kuzzle 2.60.0-beta.3 → 2.60.0-beta.5

package/dist/lib/kuzzle/kuzzle.js

@@ -99,6 +99,17 @@ let _kuzzle = null;
  * not keep a failed node alive, which a bare `process.exit(1)` never did
  */
 const FAILURE_SHUTDOWN_TIMEOUT = 30000;
+/**
+ * Stops the startup sequence once a shutdown has begun (#3045): `start()`
+ * catches it and leaves the shutdown to end the process. Internal: never
+ * handed to the caller of `start()`.
+ */
+class StartupInterruptedError extends Error {
+    constructor() {
+        super("Kuzzle is shutting down");
+        this.name = "StartupInterruptedError";
+    }
+}
 Reflect.defineProperty(global, "kuzzle", {
     configurable: true,
     enumerable: false,
@@ -175,9 +186,11 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             await new cacheEngine_1.default().init();
             await new storageEngine_1.default().init();
             await new realtime_1.default().init();
+            this.stopIfShuttingDown();
             await this.internalIndex.init();
             await new security_1.default().init();
             // This will init the cluster module if enabled
+            this.stopIfShuttingDown();
             await this.initKuzzleNode();
             this.vault = vault_1.default.load(options?.vaultKey, options?.secretsFile, this.config.vault?.newAlgorithm);
             this.validation.init();
@@ -189,21 +202,25 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             // before opening connections to external users
             await this.entryPoint.init();
             await this.debugger.init();
+            this.stopIfShuttingDown();
             this.pluginsManager.application = application;
             const pluginImports = await this.pluginsManager.init(options?.plugins);
             const imports = lodash_1.default.merge({}, pluginImports, options?.import);
             // Authentification plugins must be loaded before users import to avoid
             // credentials related error which would prevent Kuzzle from starting
+            this.stopIfShuttingDown();
             await this.loadInitialState(imports, options?.support);
             await this.ask("core:security:verify");
             this.router.init();
             this.log.info("[✔] Core components loaded");
+            this.stopIfShuttingDown();
             await this.install(options?.installations);
             // `application` is the very wrapper handed to the plugins manager six
             // lines up, so reading the name back off the manager was a round trip
             // through a getter that can answer `undefined`.
             this.log.info(`[✔] Start "${application.name}" application`);
             this.openApiManager = new openapi_1.OpenApiManager(application.openApi, this.config.http.routes, this.pluginsManager.routes);
+            this.stopIfShuttingDown();
             // @deprecated
             await this.pipe("kuzzle:start");
             await this.pipe("kuzzle:state:live");
@@ -215,6 +232,9 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             this._state = kuzzleStateEnum_1.default.RUNNING;
         }
         catch (error) {
+            if (this._state === kuzzleStateEnum_1.default.SHUTTING_DOWN) {
+                return this.leaveStartupToShutdown(error);
+            }
             this.log.error(`[X] Cannot start Kuzzle ${this.version}: ${error instanceof Error ? error.message : (0, node_util_1.inspect)(error)}`);
             // A failed start cannot be retried (a second Kuzzle instance cannot be
             // built), and what it did start keeps the process alive: in production,
@@ -229,6 +249,36 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             throw error;
         }
     }
+    /**
+     * A node asked to stop while it starts must not go on taking cluster-wide
+     * locks or running the application's installations: if it is killed before
+     * its shutdown releases them, the other nodes wait for their TTL (#3045).
+     */
+    stopIfShuttingDown() {
+        if (this._state === kuzzleStateEnum_1.default.SHUTTING_DOWN) {
+            throw new StartupInterruptedError();
+        }
+    }
+    /**
+     * The shutdown began during the startup, which stopped (or failed because
+     * of it): no "Cannot start" error and no second shutdown, the one running
+     * keeps its exit code and ends the process.
+     *
+     * The returned promise never settles, as `withLock` once the process is
+     * exiting: rejecting would send the caller down its failed-start path
+     * (often a `process.exit(1)`, which would cut the shutdown short), and
+     * resolving would tell it that Kuzzle is running.
+     */
+    leaveStartupToShutdown(error) {
+        let message = "[ℹ] Startup stopped: Kuzzle is shutting down";
+        // A step that failed because of the shutdown, rather than stopped by it
+        if (!(error instanceof StartupInterruptedError)) {
+            const reason = error instanceof Error ? error.message : (0, node_util_1.inspect)(error);
+            message += ` (${reason})`;
+        }
+        this.log.info(message);
+        return new Promise(() => undefined);
+    }
     /**
      * Generates the node ID.
      *
@@ -238,6 +288,13 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         if (this.config.cluster.enabled) {
             await new cluster_1.default().init();
             this.log.info("[✔] Cluster initialized");
+            // The storage caches were loaded before the join: what a peer created
+            // in between was broadcast before this node could hear it. Read them
+            // again before the plugins' `init()` relies on them (#3044).
+            await Promise.all([
+                this.ask("core:storage:public:cache:reload"),
+                this.ask("core:storage:private:cache:reload"),
+            ]);
         }
         else {
             this.log.info("[X] Cluster disabled: single node mode.");
@@ -317,6 +374,9 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         // one must not start before they are recorded
         await (0, distributedLock_1.withLock)("backend:installations", async () => {
             for (const installation of installations) {
+                // The lock may come long after it was asked for, once the node
+                // holding it is done: by then, this one may be shutting down
+                this.stopIfShuttingDown();
                 const isAlreadyInstalled = await this.ask("core:storage:private:document:exist", "kuzzle", "installations", installation.id);
                 if (!isAlreadyInstalled) {
                     try {
@@ -508,6 +568,8 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             // cannot serialise, and the payload is built right above.
             const importPayloadHash = (0, crypto_1.sha256)((0, json_stable_stringify_1.default)(importPayload) ?? "");
             const importType = async () => {
+                // Same as for the installations: the lock may come after a SIGTERM
+                this.stopIfShuttingDown();
                 // Read the bookkeeping *after* the lock, never before: a read taken
                 // before acquiring it is not protected by it, and the holder that
                 // acted on a stale "not initialized" used to create a document the

package/dist/lib/kuzzle/vault.d.ts

@@ -1,6 +1,19 @@
 import { Vault } from "kuzzle-vault";
+/**
+ * The default secrets file, `config/secrets.enc.json` at the project root.
+ *
+ * Installed as an npm package (KaaF), Kuzzle lives under `node_modules/kuzzle`
+ * and the project root is above it: from `node_modules/kuzzle/dist/lib/kuzzle`
+ * since the build outputs to `dist/` (2.50.0), from
+ * `node_modules/kuzzle/lib/kuzzle` before. Anywhere else (a Kuzzle checkout),
+ * the file is the checkout's own `config/secrets.enc.json`.
+ *
+ * @param dirname - the directory of this module
+ */
+declare function defaultSecretsFile(dirname: string): string;
 declare function load(vaultKey?: string, secretsFile?: string, useNewAlgorithm?: boolean): Vault;
 declare const _default: {
+    defaultSecretsFile: typeof defaultSecretsFile;
     load: typeof load;
 };
 export = _default;

package/dist/lib/kuzzle/vault.js

@@ -35,15 +35,33 @@ const isEmpty_1 = __importDefault(require("lodash/isEmpty"));
 // strict while being false for every read before that first assignment
 // (TD-57, #2760).
 let ENV_VAULT_KEY;
+/**
+ * The default secrets file, `config/secrets.enc.json` at the project root.
+ *
+ * Installed as an npm package (KaaF), Kuzzle lives under `node_modules/kuzzle`
+ * and the project root is above it: from `node_modules/kuzzle/dist/lib/kuzzle`
+ * since the build outputs to `dist/` (2.50.0), from
+ * `node_modules/kuzzle/lib/kuzzle` before. Anywhere else (a Kuzzle checkout),
+ * the file is the checkout's own `config/secrets.enc.json`.
+ *
+ * @param dirname - the directory of this module
+ */
+function defaultSecretsFile(dirname) {
+    const dir = dirname.split(node_path_1.default.sep).join("/");
+    for (const installed of [
+        "/node_modules/kuzzle/dist/lib/kuzzle",
+        "/node_modules/kuzzle/lib/kuzzle",
+    ]) {
+        if (dir.endsWith(installed)) {
+            return node_path_1.default.resolve(dirname.slice(0, dirname.length - installed.length + 1), "config/secrets.enc.json");
+        }
+    }
+    return node_path_1.default.resolve(dirname, "../../config/secrets.enc.json");
+}
 function load(vaultKey, secretsFile, useNewAlgorithm = false) {
-    // Using KaaF kuzzle is an npm package and is located under node_modules folder
-    // We need to get back to root folder of the project to get the secret file
-    const defaultEncryptedSecretsFile = __dirname.endsWith("/node_modules/kuzzle/lib/kuzzle")
-        ? node_path_1.default.resolve(`${__dirname}/../../../../config/secrets.enc.json`)
-        : node_path_1.default.resolve(`${__dirname}/../../config/secrets.enc.json`);
     const encryptedSecretsFile = secretsFile ||
         process.env.KUZZLE_SECRETS_FILE ||
-        defaultEncryptedSecretsFile;
+        defaultSecretsFile(__dirname);
     let key = vaultKey;
     if ((0, isEmpty_1.default)(vaultKey) &&
         (!(0, isEmpty_1.default)(process.env.KUZZLE_VAULT_KEY) || !(0, isEmpty_1.default)(ENV_VAULT_KEY))) {
@@ -71,5 +89,5 @@ function load(vaultKey, secretsFile, useNewAlgorithm = false) {
     }
     return vault;
 }
-module.exports = { load };
+module.exports = { defaultSecretsFile, load };
 //# sourceMappingURL=vault.js.map

package/dist/lib/model/security/profile.d.ts

@@ -1,6 +1,6 @@
 import type { Policy, OptimizedPolicy, OptimizedPolicyRestrictions } from "../../types/index";
 import type { Role } from "./role";
-import type { KuzzleRequest } from "../../../index";
+import type { KuzzleRequest } from "../../api/request";
 /** @internal */
 type InternalProfilePolicy = {
     role: Role;

package/dist/lib/model/security/role.d.ts

@@ -1,5 +1,5 @@
 import type { ControllerRight, ControllerRights } from "../../types/controllers/ControllerRights";
-import type { KuzzleRequest } from "../../../index";
+import type { KuzzleRequest } from "../../api/request";
 import type { OptimizedPolicyRestrictions } from "../../types/PolicyRestrictions";
 /**
  * @class Role

package/dist/lib/model/security/user.d.ts

@@ -1,5 +1,5 @@
 import type { Profile } from "./profile";
-import type { KuzzleRequest } from "../../../index";
+import type { KuzzleRequest } from "../../api/request";
 /**
  * @class User
  */

package/dist/lib/service/storage/7/elasticsearch.d.ts

@@ -452,6 +452,24 @@ export declare class ES7 {
         mappings?: TypeMapping;
         settings?: JSONObject;
     }): Promise<null>;
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    private _updateConcurrentlyCreatedCollection;
+    /**
+     * Waits until the primary shards of a collection are active, for at most
+     * `timeout`, and rejects if they are not by then.
+     *
+     * A collection another node has just created is in the cluster state, so
+     * it exists, before its primary shard is active: until then, Elasticsearch
+     * answers 503 to any document request on it. The node that creates a
+     * collection waits for its shards (`wait_for_active_shards`); a node that
+     * finds it already there calls this instead. It answers at once when the
+     * shards are already active.
+     */
+    waitForCollectionShards(index: string, collection: string, timeout?: string): Promise<void>;
     /**
      * Retrieves settings definition for index/type
      *

package/dist/lib/service/storage/7/elasticsearch.js

@@ -89,6 +89,9 @@ const HIDDEN_COLLECTION = "_kuzzle_keep";
 // is refreshed while held, so a live holder is never overtaken; a crashed
 // one leaves it for at most `ttl` (30 s).
 const HIDDEN_COLLECTION_LOCK = { retryAttempts: Number.POSITIVE_INFINITY };
+// How long `waitForCollectionShards` lets Elasticsearch wait for a
+// collection's primary shards, which is also Elasticsearch's own default
+const COLLECTION_SHARDS_TIMEOUT = "30s";
 const ALIAS_PREFIX = "@"; // @todo next major release: Add ALIAS_PREFIX in FORBIDDEN_CHARS
 const PRIVATE_PREFIX = "%";
 const PUBLIC_PREFIX = "&";
@@ -1146,20 +1149,23 @@ class ES7 {
         this._checkDynamicProperty(mappings);
         const exists = await this.hasCollection(index, collection);
         if (exists) {
-            return this.updateCollection(index, collection, { mappings, settings });
+            return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
         }
         this._checkMappings(mappings);
+        // Copies, not in-place changes: the race branch below must hand the
+        // caller's own mappings and settings to `updateCollection`
         requestBody.mappings = {
             _meta: mappings._meta || this._config.commonMapping._meta,
             dynamic: mappings.dynamic || this._config.commonMapping.dynamic,
-            properties: lodash_1.default.merge(mappings.properties, this._config.commonMapping.properties),
+            properties: lodash_1.default.merge({}, mappings.properties, this._config.commonMapping.properties),
+        };
+        requestBody.settings = {
+            ...settings,
+            number_of_replicas: settings.number_of_replicas ||
+                this._config.defaultSettings.number_of_replicas,
+            number_of_shards: settings.number_of_shards ||
+                this._config.defaultSettings.number_of_shards,
         };
-        settings.number_of_replicas =
-            settings.number_of_replicas ||
-                this._config.defaultSettings.number_of_replicas;
-        settings.number_of_shards =
-            settings.number_of_shards ||
-                this._config.defaultSettings.number_of_shards;
         try {
             await this._client.indices.create(esRequest);
         }
@@ -1167,8 +1173,10 @@ class ES7 {
             if (lodash_1.default.get(error, "meta.body.error.type") ===
                 "resource_already_exists_exception") {
                 // race condition: the indice has been created between the "exists"
-                // check above and this "create" attempt
-                return null;
+                // check above and this "create" attempt, by a request that may not
+                // have waited for its shards yet. This request's mappings and
+                // settings must still be applied, as if it had seen it exist
+                return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
             }
             throw this._esWrapper.formatESError(error);
         }
@@ -1187,6 +1195,38 @@ class ES7 {
         }
         return null;
     }
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    async _updateConcurrentlyCreatedCollection(index, collection, mappings, settings) {
+        await this.waitForCollectionShards(index, collection);
+        return this.updateCollection(index, collection, { mappings, settings });
+    }
+    /**
+     * Waits until the primary shards of a collection are active, for at most
+     * `timeout`, and rejects if they are not by then.
+     *
+     * A collection another node has just created is in the cluster state, so
+     * it exists, before its primary shard is active: until then, Elasticsearch
+     * answers 503 to any document request on it. The node that creates a
+     * collection waits for its shards (`wait_for_active_shards`); a node that
+     * finds it already there calls this instead. It answers at once when the
+     * shards are already active.
+     */
+    async waitForCollectionShards(index, collection, timeout = COLLECTION_SHARDS_TIMEOUT) {
+        try {
+            await this._client.cluster.health({
+                index: this._getAlias(index, collection),
+                timeout,
+                wait_for_status: "yellow",
+            });
+        }
+        catch (error) {
+            throw this._esWrapper.formatESError(error);
+        }
+    }
     /**
      * Retrieves settings definition for index/type
      *

package/dist/lib/service/storage/7/esWrapper.js

@@ -35,6 +35,35 @@ const kerror = (0, kerror_1.wrap)("services", "storage");
 function isResponseError(error) {
     return Boolean(error.meta);
 }
+/**
+ * What the client puts in `message` when the response carried nothing it could
+ * read: this placeholder, or an empty string for a bodyless response.
+ */
+const CLIENT_PLACEHOLDER_MESSAGE = "Response Error";
+function isUsableMessage(message) {
+    return (typeof message === "string" &&
+        message.trim() !== "" &&
+        message !== CLIENT_PLACEHOLDER_MESSAGE);
+}
+/**
+ * A message for an error that came with none worth keeping (typically a 503
+ * with no body while shards initialize), built from what the error still
+ * carries: the client's error name, the HTTP status and the response body.
+ */
+function describeUnreadableError(error) {
+    const statusCode = error.meta?.statusCode;
+    const body = error.meta?.body;
+    const hasBody = body !== undefined && body !== null && body !== "";
+    let description = statusCode === undefined
+        ? "Elasticsearch request failed"
+        : `Elasticsearch responded ${statusCode}`;
+    description += hasBody
+        ? `: ${(0, node_util_1.inspect)(body, { breakLength: Infinity, depth: 3 })}`
+        : " (no body)";
+    return error.name && error.name !== "Error"
+        ? `${error.name}: ${description}`
+        : description;
+}
 const errorMessagesMapping = [
     {
         regex: /^\[es_rejected_execution_exception] rejected execution .*? on EsThreadPoolExecutor\[(.*?), .*$/,
@@ -258,8 +287,8 @@ class ESWrapper {
         return kerror.get("unexpected_bad_request", errorMessage);
     }
     _handleUnknownError(error, message) {
-        debug("unhandled elasticsearch error (unhandled type: %s): %o", (0, get_1.default)(error, "error.meta.statusCode", "<no status code>"), error);
-        return kerror.get("unexpected_error", message);
+        debug("unhandled elasticsearch error (unhandled type: %s): %o", (0, get_1.default)(error, "meta.statusCode", "<no status code>"), error);
+        return kerror.get("unexpected_error", isUsableMessage(message) ? message : describeUnreadableError(error));
     }
 }
 module.exports = ESWrapper;

package/dist/lib/service/storage/8/elasticsearch.d.ts

@@ -443,6 +443,24 @@ export declare class ES8 {
         mappings?: estypes.MappingTypeMapping;
         settings?: estypes.IndicesIndexSettings;
     }): Promise<null>;
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    private _updateConcurrentlyCreatedCollection;
+    /**
+     * Waits until the primary shards of a collection are active, for at most
+     * `timeout`, and rejects if they are not by then.
+     *
+     * A collection another node has just created is in the cluster state, so
+     * it exists, before its primary shard is active: until then, Elasticsearch
+     * answers 503 to any document request on it. The node that creates a
+     * collection waits for its shards (`wait_for_active_shards`); a node that
+     * finds it already there calls this instead. It answers at once when the
+     * shards are already active.
+     */
+    waitForCollectionShards(index: string, collection: string, timeout?: string): Promise<void>;
     /**
      * Retrieves settings definition for index/type
      *

package/dist/lib/service/storage/8/elasticsearch.js

@@ -89,6 +89,9 @@ const HIDDEN_COLLECTION = "_kuzzle_keep";
 // is refreshed while held, so a live holder is never overtaken; a crashed
 // one leaves it for at most `ttl` (30 s).
 const HIDDEN_COLLECTION_LOCK = { retryAttempts: Number.POSITIVE_INFINITY };
+// How long `waitForCollectionShards` lets Elasticsearch wait for a
+// collection's primary shards, which is also Elasticsearch's own default
+const COLLECTION_SHARDS_TIMEOUT = "30s";
 const ALIAS_PREFIX = "@"; // @todo next major release: Add ALIAS_PREFIX in FORBIDDEN_CHARS
 const PRIVATE_PREFIX = "%";
 const PUBLIC_PREFIX = "&";
@@ -1168,20 +1171,23 @@ class ES8 {
         this._checkDynamicProperty(mappings);
         const exists = await this.hasCollection(index, collection);
         if (exists) {
-            return this.updateCollection(index, collection, { mappings, settings });
+            return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
         }
         this._checkMappings(mappings);
+        // Copies, not in-place changes: the race branch below must hand the
+        // caller's own mappings and settings to `updateCollection`
         esRequest.mappings = {
             _meta: mappings._meta || this._config.commonMapping._meta,
             dynamic: mappings.dynamic || this._config.commonMapping.dynamic,
-            properties: lodash_1.default.merge(mappings.properties, this._config.commonMapping.properties),
+            properties: lodash_1.default.merge({}, mappings.properties, this._config.commonMapping.properties),
+        };
+        esRequest.settings = {
+            ...settings,
+            number_of_replicas: settings.number_of_replicas ||
+                this._config.defaultSettings.number_of_replicas,
+            number_of_shards: settings.number_of_shards ||
+                this._config.defaultSettings.number_of_shards,
         };
-        settings.number_of_replicas =
-            settings.number_of_replicas ||
-                this._config.defaultSettings.number_of_replicas;
-        settings.number_of_shards =
-            settings.number_of_shards ||
-                this._config.defaultSettings.number_of_shards;
         try {
             await this._client.indices.create(esRequest);
         }
@@ -1189,8 +1195,10 @@ class ES8 {
             if (lodash_1.default.get(error, "meta.body.error.type") ===
                 "resource_already_exists_exception") {
                 // race condition: the indice has been created between the "exists"
-                // check above and this "create" attempt
-                return null;
+                // check above and this "create" attempt, by a request that may not
+                // have waited for its shards yet. This request's mappings and
+                // settings must still be applied, as if it had seen it exist
+                return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
             }
             throw this._esWrapper.formatESError(error);
         }
@@ -1209,6 +1217,38 @@ class ES8 {
         }
         return null;
     }
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    async _updateConcurrentlyCreatedCollection(index, collection, mappings, settings) {
+        await this.waitForCollectionShards(index, collection);
+        return this.updateCollection(index, collection, { mappings, settings });
+    }
+    /**
+     * Waits until the primary shards of a collection are active, for at most
+     * `timeout`, and rejects if they are not by then.
+     *
+     * A collection another node has just created is in the cluster state, so
+     * it exists, before its primary shard is active: until then, Elasticsearch
+     * answers 503 to any document request on it. The node that creates a
+     * collection waits for its shards (`wait_for_active_shards`); a node that
+     * finds it already there calls this instead. It answers at once when the
+     * shards are already active.
+     */
+    async waitForCollectionShards(index, collection, timeout = COLLECTION_SHARDS_TIMEOUT) {
+        try {
+            await this._client.cluster.health({
+                index: this._getAlias(index, collection),
+                timeout,
+                wait_for_status: "yellow",
+            });
+        }
+        catch (error) {
+            throw this._esWrapper.formatESError(error);
+        }
+    }
     /**
      * Retrieves settings definition for index/type
      *

package/dist/lib/service/storage/8/esWrapper.js

@@ -35,6 +35,35 @@ const kerror = (0, kerror_1.wrap)("services", "storage");
 function isResponseError(error) {
     return Boolean(error.meta);
 }
+/**
+ * What the client puts in `message` when the response carried nothing it could
+ * read: this placeholder, or an empty string for a bodyless response.
+ */
+const CLIENT_PLACEHOLDER_MESSAGE = "Response Error";
+function isUsableMessage(message) {
+    return (typeof message === "string" &&
+        message.trim() !== "" &&
+        message !== CLIENT_PLACEHOLDER_MESSAGE);
+}
+/**
+ * A message for an error that came with none worth keeping (typically a 503
+ * with no body while shards initialize), built from what the error still
+ * carries: the client's error name, the HTTP status and the response body.
+ */
+function describeUnreadableError(error) {
+    const statusCode = error.meta?.statusCode;
+    const body = error.meta?.body;
+    const hasBody = body !== undefined && body !== null && body !== "";
+    let description = statusCode === undefined
+        ? "Elasticsearch request failed"
+        : `Elasticsearch responded ${statusCode}`;
+    description += hasBody
+        ? `: ${(0, node_util_1.inspect)(body, { breakLength: Infinity, depth: 3 })}`
+        : " (no body)";
+    return error.name && error.name !== "Error"
+        ? `${error.name}: ${description}`
+        : description;
+}
 const errorMessagesMapping = [
     {
         regex: /^\[es_rejected_execution_exception] rejected execution .*? on EsThreadPoolExecutor\[(.*?), .*$/,
@@ -258,8 +287,8 @@ class ESWrapper {
         return kerror.get("unexpected_bad_request", errorMessage);
     }
     _handleUnknownError(error, message) {
-        debug("unhandled elasticsearch error (unhandled type: %s): %o", (0, get_1.default)(error, "error.meta.statusCode", "<no status code>"), error);
-        return kerror.get("unexpected_error", message);
+        debug("unhandled elasticsearch error (unhandled type: %s): %o", (0, get_1.default)(error, "meta.statusCode", "<no status code>"), error);
+        return kerror.get("unexpected_error", isUsableMessage(message) ? message : describeUnreadableError(error));
     }
 }
 module.exports = ESWrapper;

package/dist/lib/types/config/KuzzleConfiguration.d.ts

@@ -163,6 +163,13 @@ export interface IKuzzleConfiguration {
          * Optional here for the reason given on {@link IKuzzleConfiguration.version}.
          */
         allowAllOrigins?: boolean;
+        /**
+         * Derived at startup: the deprecated configuration keys the user set
+         * (today, those of "security.jwt"), logged as a warning.
+         *
+         * Optional here for the reason given on {@link IKuzzleConfiguration.version}.
+         */
+        deprecatedSettings?: string[];
     };
     /**
      * Collection specifications to apply at startup, by index then collection.

package/dist/lib/types/config/SecurityConfiguration.d.ts

@@ -21,9 +21,10 @@ export type SecurityConfiguration = {
     /**
      * @deprecated Use `security.authToken` instead.
      *
-     * `default.config.ts` always ships it, and `authToken`'s readers fall back
-     * to it — `authToken.algorithm ?? jwt.algorithm`. Optional all the same, as
-     * v2.56.0 declared it: a required member breaks code that builds this type.
+     * Each setting the configuration sets here applies unless `authToken` sets
+     * it too (`loadConfig()` resolves both sections to the values in effect,
+     * see `authTokenSetting`). Optional all the same, as v2.56.0 declared it:
+     * a required member breaks code that builds this type.
      */
     jwt?: JSONObject;
     /**

package/dist/lib/types/controllers/ControllerDefinition.d.ts

@@ -54,8 +54,8 @@ export type ControllerDefinition = {
             handler: (request: KuzzleRequest) => Promise<any>;
             /**
              * Declare HTTP routes (optional).
-             * Http routes will be auto-generated unless at least one is provided
-             * or an empty array is provided.
+             * When omitted or empty, a default route is generated:
+             * `GET /_/<controller>/<action>`, both names in kebab-case.
              */
             http?: HttpRoute[];
         };
@@ -71,8 +71,8 @@ export type HttpRoute = {
     verb: "get" | "head" | "post" | "put" | "delete" | "patch" | "options";
     /**
      * Route path.
-     * A route starting with `/` will be prefixed by `/_` otherwise the route
-     * will be prefixed by `/_/<application-name>/`.
+     * A route starting with `/` is used as is, any other route is prefixed
+     * with `/_/`.
      */
     path: string;
     /**

package/dist/lib/types/events/EventGenericDocument.d.ts

@@ -1,6 +1,7 @@
 import type { KDocument, KDocumentContent } from "kuzzle-types";
 import type { JSONObject } from "../JSONObject";
-import type { KuzzleRequest, PipeEventHandler } from "../../../index";
+import type { KuzzleRequest } from "../../api/request";
+import type { PipeEventHandler } from "../EventHandler";
 /**
  * Events with documents only having the `_id`
  */

package/dist/lib/types/events/EventProtocol.d.ts

@@ -1,5 +1,5 @@
 import type { JSONObject } from "../JSONObject";
-import type { PipeEventHandler } from "../../../index";
+import type { PipeEventHandler } from "../EventHandler";
 import type { ClientConnection } from "../ClientConnection";
 import type { HttpMessage } from "../HttpMessage";
 export type EventHTTPBeforeParsingPayload = {

package/dist/lib/util/mutex.d.ts

@@ -86,9 +86,9 @@ export declare class Mutex {
      *
      * @return {Promise.<boolean>} True if the ressource has been unlocked before the `timeout`
      */
-    wait({ attemptDelay, timeout, }: {
-        attemptDelay?: number | undefined;
-        timeout?: number | undefined;
+    wait({ attemptDelay, timeout, }?: {
+        attemptDelay?: number;
+        timeout?: number;
     }): Promise<boolean>;
     /**
      * Frees every lock this process holds, and stops it from taking new ones.
@@ -101,7 +101,8 @@ export declare class Mutex {
      *
      * From then on, `lock()` never resolves: the process is about to exit, and
      * answering `false` would send its caller down a path meant for a lock
-     * held by another node.
+     * held by another node. And `unlock()` on a lock it already freed resolves
+     * without doing anything, since its holder may still try to give it back.
      */
     static releaseAllBeforeExit(): Promise<void>;
     get locked(): boolean;