mindoodb 0.0.53 → 0.0.55

package/dist/node/server/config.js

@@ -20,6 +20,7 @@ exports.loadConfigBackup = loadConfigBackup;
 exports.extractAllPrincipals = extractAllPrincipals;
 const fs_1 = require("fs");
 const path_1 = require("path");
+const types_1 = require("./peer/types");
 const CONFIG_BACKUP_FILENAME_RE = /^config\.(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}(?:\.\d{3})?Z)\.json$/;
 function isTenantCreationCapabilityRule(ruleKey) {
     const colonIdx = ruleKey.indexOf(":");
@@ -31,7 +32,7 @@ function isTenantCreationCapabilityRule(ruleKey) {
     // Segment-exact: tenant creation targets exactly one segment under
     // `/system/tenants/` (the tenant id, which may itself be a `*` pattern). A
     // prefix test would let a wildcard `*` principal be configured on an existing
-    // tenant's sub-resource (e.g. `.../sync-servers`), an over-grant (audit #6).
+    // tenant's sub-resource, an over-grant (audit #6).
     return method === "POST" && /^\/system\/tenants\/[^/]+\/?$/.test(pathPattern);
 }
 function isWildcardSystemAdminPrincipal(principal) {
@@ -91,10 +92,37 @@ function validateServerConfig(raw, filePath) {
     }
     const rateLimits = validateRateLimits(obj.rateLimits, filePath);
     const config = rateLimits ? { capabilities, rateLimits } : { capabilities };
+    const cluster = validateCluster(obj.cluster, filePath);
+    if (cluster) {
+        config.cluster = cluster;
+    }
     const principalCount = Object.values(capabilities).reduce((sum, arr) => sum + arr.length, 0);
     console.log(`[Config] Loaded config.json from ${filePath}: ${Object.keys(capabilities).length} capability rule(s), ${principalCount} principal entry/entries`);
     return config;
 }
+function validateCluster(raw, filePath) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath}: "cluster" must be an object`);
+    }
+    const obj = raw;
+    const cluster = {};
+    if (obj.autoSync !== undefined) {
+        if (typeof obj.autoSync !== "boolean") {
+            throw new Error(`config.json at ${filePath}: "cluster.autoSync" must be a boolean`);
+        }
+        cluster.autoSync = obj.autoSync;
+    }
+    if (obj.role !== undefined) {
+        if (!(0, types_1.isPeerRole)(obj.role)) {
+            throw new Error(`config.json at ${filePath}: "cluster.role" must be "peer", "hub" or "spoke"`);
+        }
+        cluster.role = obj.role;
+    }
+    return Object.keys(cluster).length > 0 ? cluster : undefined;
+}
 function validateRateLimits(raw, filePath) {
     if (raw === undefined) {
         return undefined;
@@ -107,7 +135,11 @@ function validateRateLimits(raw, filePath) {
     const sync = validateRateLimitConfig(obj.sync, "sync", filePath);
     const timestamps = validateTimestampRateLimitConfig(obj.timestamps, filePath);
     const global = validateRateLimitConfig(obj.global, "global", filePath);
+    const system = validateRateLimitConfig(obj.system, "system", filePath);
     const rateLimits = {};
+    if (system) {
+        rateLimits.system = system;
+    }
     if (auth) {
         rateLimits.auth = auth;
     }

package/dist/node/server/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/node/server/config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA2BH,wEAcC;AAED,wEAIC;AAED,gFAKC;AAKD,8CAKC;AAYD,4CAsBC;AAED,oDA2CC;AAuLD,oCASC;AAKD,kCAGC;AAED,wDAEC;AAcD,8CAaC;AAED,4CAmBC;AAMD,oDAiBC;AAhaD,2BAMY;AACZ,+BAA+C;AAe/C,MAAM,yBAAyB,GAC7B,oEAAoE,CAAC;AAEvE,SAAgB,8BAA8B,CAAC,OAAe;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEpD,mEAAmE;IACnE,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,OAAO,MAAM,KAAK,MAAM,IAAI,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC;AAED,SAAgB,8BAA8B,CAC5C,SAA+B;IAE/B,OAAO,SAAS,CAAC,QAAQ,KAAK,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,GAAG,CAAC;AACvE,CAAC;AAED,SAAgB,kCAAkC,CAAC,MAAoB;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CACxE,8BAA8B,CAAC,OAAO,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,OAAe,EACf,kBAA2B;IAE3B,OAAO,kBAAkB,IAAI,IAAA,WAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAC9B,OAAe,EACf,kBAA2B;IAE3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAElE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CACT,oCAAoC,UAAU,4CAA4C,CAC3F,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAY,EAAE,QAAgB;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,oCAAoC,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAA2C,EAAE,CAAC;IAEhE,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAChD,GAAG,CAAC,YAAuC,CAC5C,EAAE,CAAC;QACF,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,sCAAsC,CAC/E,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,MAAM,GAAiB,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;IAE1F,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAC9B,CAAC,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,oCAAoC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,wBAAwB,cAAc,0BAA0B,CAClJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAY,EACZ,QAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,kCAAkC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAY,EACZ,IAAY,EACZ,QAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,iBAAiB,IAAI,qBAAqB,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CACvC,GAAG,CAAC,QAAQ,EACZ,cAAc,IAAI,WAAW,EAC7B,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,uBAAuB,CAClC,GAAG,CAAC,GAAG,EACP,cAAc,IAAI,MAAM,EACxB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,gCAAgC,CACvC,GAAY,EACZ,QAAgB;IAEhB,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAA6B,EAAE,GAAG,IAAI,EAAE,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CACvC,GAAG,CAAC,QAAQ,EACZ,gCAAgC,EAChC,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAY,EACZ,SAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,MAAM,SAAS,8BAA8B,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,QAAgB;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,8BAA8B,IAAI,mCAAmC,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,qBAAqB,MAAM,cAAc,IAAI,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,2BAA2B,IAAI,uBAAuB,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAY,EACZ,OAAe,EACf,KAAa,EACb,QAAgB;IAEhB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,qBAAqB,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,2CAA2C,CAC/G,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,gDAAgD,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC;IAC3E,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,wDAAwD,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,6EAA6E,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,UAAkB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,UAAU,SAAS,OAAO,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAEzC,IAAA,iBAAY,EAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,UAAkB,EAAE,MAAoB;IAClE,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CACrB,0DAA0D,EAC1D,UAAU,CACX,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,UAAkB;IAClD,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAC;IAEhC,OAAO,IAAA,gBAAW,EAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,UAAkB;IACrE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,cAAO,EAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,MAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/node/server/config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA6BH,wEAcC;AAED,wEAIC;AAED,gFAKC;AAKD,8CAKC;AAYD,4CAsBC;AAED,oDAgDC;AAuND,oCASC;AAKD,kCAGC;AAED,wDAEC;AAcD,8CAaC;AAED,4CAmBC;AAMD,oDAiBC;AAvcD,2BAMY;AACZ,+BAA+C;AAU/C,wCAA0C;AAO1C,MAAM,yBAAyB,GAC7B,oEAAoE,CAAC;AAEvE,SAAgB,8BAA8B,CAAC,OAAe;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEpD,mEAAmE;IACnE,2EAA2E;IAC3E,8EAA8E;IAC9E,mDAAmD;IACnD,OAAO,MAAM,KAAK,MAAM,IAAI,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC;AAED,SAAgB,8BAA8B,CAC5C,SAA+B;IAE/B,OAAO,SAAS,CAAC,QAAQ,KAAK,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,GAAG,CAAC;AACvE,CAAC;AAED,SAAgB,kCAAkC,CAAC,MAAoB;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CACxE,8BAA8B,CAAC,OAAO,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,OAAe,EACf,kBAA2B;IAE3B,OAAO,kBAAkB,IAAI,IAAA,WAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAC9B,OAAe,EACf,kBAA2B;IAE3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAElE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CACT,oCAAoC,UAAU,4CAA4C,CAC3F,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAY,EAAE,QAAgB;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,oCAAoC,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAA2C,EAAE,CAAC;IAEhE,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAChD,GAAG,CAAC,YAAuC,CAC5C,EAAE,CAAC;QACF,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,sCAAsC,CAC/E,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,MAAM,GAAiB,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;IAE1F,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAC9B,CAAC,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,oCAAoC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,wBAAwB,cAAc,0BAA0B,CAClJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,QAAgB;IACrD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,+BAA+B,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,wCAAwC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,kBAAU,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,mDAAmD,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAY,EACZ,QAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,kCAAkC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,UAAU,GAAG,UAAU,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAY,EACZ,IAAY,EACZ,QAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,iBAAiB,IAAI,qBAAqB,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CACvC,GAAG,CAAC,QAAQ,EACZ,cAAc,IAAI,WAAW,EAC7B,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,uBAAuB,CAClC,GAAG,CAAC,GAAG,EACP,cAAc,IAAI,MAAM,EACxB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,gCAAgC,CACvC,GAAY,EACZ,QAAgB;IAEhB,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAA6B,EAAE,GAAG,IAAI,EAAE,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,uBAAuB,CACvC,GAAG,CAAC,QAAQ,EACZ,gCAAgC,EAChC,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAAY,EACZ,SAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,MAAM,SAAS,8BAA8B,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,QAAgB;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,8BAA8B,IAAI,mCAAmC,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,qBAAqB,MAAM,cAAc,IAAI,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,2BAA2B,IAAI,uBAAuB,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAY,EACZ,OAAe,EACf,KAAa,EACb,QAAgB;IAEhB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,qBAAqB,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,2CAA2C,CAC/G,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,gDAAgD,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC;IAC3E,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,wDAAwD,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,6EAA6E,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,UAAkB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,UAAU,SAAS,OAAO,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAEzC,IAAA,iBAAY,EAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,UAAkB,EAAE,MAAoB;IAClE,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CACrB,0DAA0D,EAC1D,UAAU,CACX,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,UAAkB;IAClD,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAC;IAEhC,OAAO,IAAA,gBAAW,EAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,UAAkB;IACrE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,cAAO,EAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,MAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/node/server/peer/ClusterAuditLog.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Append-only audit log for cluster administration.
+ *
+ * Every mutating `/system/cluster/*` call is recorded here before it runs, so
+ * "who told this node to pause replication with the archive peer, and when"
+ * survives a restart, a job eviction, and the console session that issued it.
+ * The job registry is in-memory and transient by design; this is the durable
+ * half.
+ *
+ * ## Per node, deliberately
+ *
+ * Each server writes its own log. There is no cluster-wide log, because there
+ * is no cluster-wide admin: a peer is a separately administered server that
+ * happens to trust this one for *data*, not for *administration*. A console
+ * that wants the whole picture polls each node and merges — the same fan-out
+ * model the status endpoints use.
+ *
+ * ## What is not in here
+ *
+ * No document ids, no author keys, no entry contents. An audit reader is
+ * authorized to see that an action happened, not to learn which documents
+ * moved: that would turn a read-only auditor role into a metadata oracle over
+ * data the server itself cannot decrypt. Scope stops at the tenant/database
+ * level and results are counts.
+ */
+import type { ClusterJobKind, ClusterJobScope } from "./types";
+export interface ClusterAuditRecord {
+    at: string;
+    /** System-admin principal from the JWT (`sub`), never a device key. */
+    actor: string;
+    action: ClusterJobKind | "peer-create" | "peer-update" | "peer-delete";
+    scope: ClusterJobScope;
+    /** Job this action was dispatched as, when it runs asynchronously. */
+    jobId: string | null;
+    outcome: "accepted" | "rejected";
+    /** Why a request was rejected. Absent for accepted ones. */
+    detail?: string;
+}
+export interface ClusterAuditPage {
+    records: ClusterAuditRecord[];
+    /** Pass as `before` to fetch the next (older) page; null at the end. */
+    nextCursor: string | null;
+}
+export declare class ClusterAuditLog {
+    private readonly maxBytes;
+    private readonly dir;
+    private readonly file;
+    constructor(dataDir: string, maxBytes?: number);
+    append(record: ClusterAuditRecord): void;
+    /**
+     * Read a page, newest first.
+     *
+     * `before` is an ISO timestamp from a previous page's `nextCursor`. Only the
+     * active file is read: rotated files stay on disk for offline forensics but
+     * are not served, which keeps the endpoint's cost bounded no matter how long
+     * the node has been running.
+     */
+    read(options?: {
+        limit?: number;
+        before?: string;
+    }): ClusterAuditPage;
+    private rotateIfNeeded;
+}
+//# sourceMappingURL=ClusterAuditLog.d.ts.map

package/dist/node/server/peer/ClusterAuditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterAuditLog.d.ts","sourceRoot":"","sources":["../../../../src/node/server/peer/ClusterAuditLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAK/D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,CAAC;IACvE,KAAK,EAAE,eAAe,CAAC;IACvB,sEAAsE;IACtE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;IACjC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,qBAAa,eAAe;IAMxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAG5B,OAAO,EAAE,MAAM,EACE,QAAQ,GAAE,MAA0B;IAMvD,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAaxC;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,gBAAgB;IA6BzE,OAAO,CAAC,cAAc;CAKvB"}

package/dist/node/server/peer/ClusterAuditLog.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * Append-only audit log for cluster administration.
+ *
+ * Every mutating `/system/cluster/*` call is recorded here before it runs, so
+ * "who told this node to pause replication with the archive peer, and when"
+ * survives a restart, a job eviction, and the console session that issued it.
+ * The job registry is in-memory and transient by design; this is the durable
+ * half.
+ *
+ * ## Per node, deliberately
+ *
+ * Each server writes its own log. There is no cluster-wide log, because there
+ * is no cluster-wide admin: a peer is a separately administered server that
+ * happens to trust this one for *data*, not for *administration*. A console
+ * that wants the whole picture polls each node and merges — the same fan-out
+ * model the status endpoints use.
+ *
+ * ## What is not in here
+ *
+ * No document ids, no author keys, no entry contents. An audit reader is
+ * authorized to see that an action happened, not to learn which documents
+ * moved: that would turn a read-only auditor role into a metadata oracle over
+ * data the server itself cannot decrypt. Scope stops at the tenant/database
+ * level and results are counts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterAuditLog = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/** Rotate once the active file passes this size. */
+const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
+class ClusterAuditLog {
+    constructor(dataDir, maxBytes = DEFAULT_MAX_BYTES) {
+        this.maxBytes = maxBytes;
+        this.dir = (0, path_1.join)(dataDir, "cluster");
+        this.file = (0, path_1.join)(this.dir, "audit.jsonl");
+    }
+    append(record) {
+        try {
+            if (!(0, fs_1.existsSync)(this.dir))
+                (0, fs_1.mkdirSync)(this.dir, { recursive: true });
+            this.rotateIfNeeded();
+            (0, fs_1.appendFileSync)(this.file, `${JSON.stringify(record)}\n`, "utf8");
+        }
+        catch (error) {
+            // A failing audit write must not fail the administrative action itself —
+            // an operator locked out of pausing a runaway peer because a disk is full
+            // is the worse outcome. It is loud in the log instead.
+            console.error("[ClusterAuditLog] Could not append audit record:", error);
+        }
+    }
+    /**
+     * Read a page, newest first.
+     *
+     * `before` is an ISO timestamp from a previous page's `nextCursor`. Only the
+     * active file is read: rotated files stay on disk for offline forensics but
+     * are not served, which keeps the endpoint's cost bounded no matter how long
+     * the node has been running.
+     */
+    read(options = {}) {
+        const limit = Math.min(Math.max(options.limit ?? 50, 1), 500);
+        if (!(0, fs_1.existsSync)(this.file))
+            return { records: [], nextCursor: null };
+        let lines;
+        try {
+            lines = (0, fs_1.readFileSync)(this.file, "utf8").split("\n").filter(Boolean);
+        }
+        catch (error) {
+            console.error("[ClusterAuditLog] Could not read audit log:", error);
+            return { records: [], nextCursor: null };
+        }
+        const records = [];
+        for (let i = lines.length - 1; i >= 0 && records.length < limit; i--) {
+            let record;
+            try {
+                record = JSON.parse(lines[i]);
+            }
+            catch {
+                continue;
+            }
+            if (options.before && record.at >= options.before)
+                continue;
+            records.push(record);
+        }
+        const last = records[records.length - 1];
+        const exhausted = records.length < limit;
+        return { records, nextCursor: exhausted || !last ? null : last.at };
+    }
+    rotateIfNeeded() {
+        if (!(0, fs_1.existsSync)(this.file))
+            return;
+        if ((0, fs_1.statSync)(this.file).size < this.maxBytes)
+            return;
+        (0, fs_1.renameSync)(this.file, `${this.file}.${Date.now()}`);
+    }
+}
+exports.ClusterAuditLog = ClusterAuditLog;
+//# sourceMappingURL=ClusterAuditLog.js.map

package/dist/node/server/peer/ClusterAuditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterAuditLog.js","sourceRoot":"","sources":["../../../../src/node/server/peer/ClusterAuditLog.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAEH,2BAA+F;AAC/F,+BAA4B;AAG5B,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAqB1C,MAAa,eAAe;IAI1B,YACE,OAAe,EACE,WAAmB,iBAAiB;QAApC,aAAQ,GAAR,QAAQ,CAA4B;QAErD,IAAI,CAAC,GAAG,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAA0B;QAC/B,IAAI,CAAC;YACH,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,IAAA,cAAS,EAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAA,mBAAc,EAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,uDAAuD;YACvD,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,UAA+C,EAAE;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAErE,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACrE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAuB,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;gBAAE,SAAS;YAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QACnC,IAAI,IAAA,aAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACrD,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;CACF;AAnED,0CAmEC"}

package/dist/node/server/peer/ClusterJobRunner.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Job registry for the mutating cluster actions.
+ *
+ * Every `POST /system/cluster/actions/*` returns a `jobId` immediately instead
+ * of holding the connection open. A full mirror of a large tenant can run for
+ * minutes; a console that waits for the response would either time out at some
+ * proxy or force the operator to stare at a spinner with no idea what is
+ * happening. With a job the UI gets an id in milliseconds and then polls
+ * `GET /system/cluster/jobs/:id` for typed progress.
+ *
+ * Jobs live in memory. They describe an action in flight, not a durable
+ * promise: after a restart nothing is running, so there is nothing to report,
+ * and the audit log (not this registry) is what preserves the record that the
+ * action happened.
+ */
+import { type ClusterJob, type ClusterJobKind, type ClusterJobResult, type ClusterJobScope } from "./types";
+export interface ClusterJobContext {
+    /** Report coarse progress; never pass document identity through here. */
+    progress(completed: number, total: number): void;
+}
+export type ClusterJobWork = (ctx: ClusterJobContext) => Promise<ClusterJobResult>;
+export declare class ClusterJobRunner {
+    private readonly historyLimit;
+    private readonly jobs;
+    private readonly order;
+    constructor(historyLimit?: number);
+    /**
+     * Register a job and start it. Returns as soon as the job is queued, so the
+     * caller can answer `202 Accepted` with the id.
+     */
+    start(kind: ClusterJobKind, scope: ClusterJobScope, requestedBy: string, work: ClusterJobWork): ClusterJob;
+    private run;
+    get(id: string): ClusterJob | null;
+    /** Newest first, which is the order a console wants to render. */
+    list(limit?: number): ClusterJob[];
+    /**
+     * Wait for a job to settle. Only for tests — the HTTP surface always polls,
+     * because that is the contract the console is built against.
+     */
+    waitFor(id: string, timeoutMs?: number): Promise<ClusterJob | null>;
+    private evictOverLimit;
+}
+//# sourceMappingURL=ClusterJobRunner.d.ts.map

package/dist/node/server/peer/ClusterJobRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterJobRunner.d.ts","sourceRoot":"","sources":["../../../../src/node/server/peer/ClusterJobRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAKjB,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEnF,qBAAa,gBAAgB;IAIf,OAAO,CAAC,QAAQ,CAAC,YAAY;IAHzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;gBAET,YAAY,GAAE,MAA8B;IAEzE;;;OAGG;IACH,KAAK,CACH,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,cAAc,GACnB,UAAU;YAwBC,GAAG;IAmBjB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAIlC,kEAAkE;IAClE,IAAI,CAAC,KAAK,SAAK,GAAG,UAAU,EAAE;IAO9B;;;OAGG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAWzE,OAAO,CAAC,cAAc;CAgBvB"}

package/dist/node/server/peer/ClusterJobRunner.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * Job registry for the mutating cluster actions.
+ *
+ * Every `POST /system/cluster/actions/*` returns a `jobId` immediately instead
+ * of holding the connection open. A full mirror of a large tenant can run for
+ * minutes; a console that waits for the response would either time out at some
+ * proxy or force the operator to stare at a spinner with no idea what is
+ * happening. With a job the UI gets an id in milliseconds and then polls
+ * `GET /system/cluster/jobs/:id` for typed progress.
+ *
+ * Jobs live in memory. They describe an action in flight, not a durable
+ * promise: after a restart nothing is running, so there is nothing to report,
+ * and the audit log (not this registry) is what preserves the record that the
+ * action happened.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterJobRunner = void 0;
+const crypto_1 = require("crypto");
+const types_1 = require("./types");
+/** How many finished jobs to keep for polling before evicting the oldest. */
+const DEFAULT_HISTORY_LIMIT = 200;
+class ClusterJobRunner {
+    constructor(historyLimit = DEFAULT_HISTORY_LIMIT) {
+        this.historyLimit = historyLimit;
+        this.jobs = new Map();
+        this.order = [];
+    }
+    /**
+     * Register a job and start it. Returns as soon as the job is queued, so the
+     * caller can answer `202 Accepted` with the id.
+     */
+    start(kind, scope, requestedBy, work) {
+        const job = {
+            id: (0, crypto_1.randomUUID)(),
+            kind,
+            scope,
+            state: "queued",
+            createdAt: new Date().toISOString(),
+            startedAt: null,
+            finishedAt: null,
+            progress: { total: 0, completed: 0 },
+            result: null,
+            error: null,
+            errorClass: null,
+            requestedBy,
+        };
+        this.jobs.set(job.id, job);
+        this.order.push(job.id);
+        this.evictOverLimit();
+        void this.run(job, work);
+        return job;
+    }
+    async run(job, work) {
+        job.state = "running";
+        job.startedAt = new Date().toISOString();
+        try {
+            job.result = await work({
+                progress: (completed, total) => {
+                    job.progress = { completed, total };
+                },
+            });
+            job.state = "succeeded";
+        }
+        catch (error) {
+            job.state = "failed";
+            job.error = error instanceof Error ? error.message : String(error);
+            job.errorClass = (0, types_1.classifyPeerError)(error);
+        }
+        finally {
+            job.finishedAt = new Date().toISOString();
+        }
+    }
+    get(id) {
+        return this.jobs.get(id) ?? null;
+    }
+    /** Newest first, which is the order a console wants to render. */
+    list(limit = 50) {
+        const ids = this.order.slice(-limit).reverse();
+        return ids
+            .map((id) => this.jobs.get(id))
+            .filter((job) => job !== undefined);
+    }
+    /**
+     * Wait for a job to settle. Only for tests — the HTTP surface always polls,
+     * because that is the contract the console is built against.
+     */
+    async waitFor(id, timeoutMs = 30000) {
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            const job = this.jobs.get(id);
+            if (!job)
+                return null;
+            if (job.state === "succeeded" || job.state === "failed")
+                return job;
+            if (Date.now() > deadline)
+                return job;
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+    }
+    evictOverLimit() {
+        let index = 0;
+        while (this.order.length > this.historyLimit && index < this.order.length) {
+            const id = this.order[index];
+            const job = this.jobs.get(id);
+            // Never drop a job that is still going: its id is in a caller's hands and
+            // they are polling for it. Skip past it and evict the next finished one,
+            // which keeps `order` oldest-to-newest.
+            if (job && (job.state === "queued" || job.state === "running")) {
+                index += 1;
+                continue;
+            }
+            this.order.splice(index, 1);
+            this.jobs.delete(id);
+        }
+    }
+}
+exports.ClusterJobRunner = ClusterJobRunner;
+//# sourceMappingURL=ClusterJobRunner.js.map

package/dist/node/server/peer/ClusterJobRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterJobRunner.js","sourceRoot":"","sources":["../../../../src/node/server/peer/ClusterJobRunner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,mCAAoC;AACpC,mCAMiB;AAEjB,6EAA6E;AAC7E,MAAM,qBAAqB,GAAG,GAAG,CAAC;AASlC,MAAa,gBAAgB;IAI3B,YAA6B,eAAuB,qBAAqB;QAA5C,iBAAY,GAAZ,YAAY,CAAgC;QAHxD,SAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QACrC,UAAK,GAAa,EAAE,CAAC;IAEsC,CAAC;IAE7E;;;OAGG;IACH,KAAK,CACH,IAAoB,EACpB,KAAsB,EACtB,WAAmB,EACnB,IAAoB;QAEpB,MAAM,GAAG,GAAe;YACtB,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,IAAI;YACJ,KAAK;YACL,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;YACpC,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,IAAI;YAChB,WAAW;SACZ,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAe,EAAE,IAAoB;QACrD,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;QACtB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC;gBACtB,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;oBAC7B,GAAG,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBACtC,CAAC;aACF,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC;YACrB,GAAG,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,GAAG,CAAC,UAAU,GAAG,IAAA,yBAAiB,EAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,KAAK,GAAG,EAAE;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO,GAAG;aACP,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAC9B,MAAM,CAAC,CAAC,GAAG,EAAqB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,SAAS,GAAG,KAAM;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YACpE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,OAAO,GAAG,CAAC;YACtC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,0EAA0E;YAC1E,yEAAyE;YACzE,wCAAwC;YACxC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/D,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AArGD,4CAqGC"}

package/dist/node/server/peer/ClusterManager.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Owns everything cluster-shaped on one node: the peer session authenticator,
+ * one {@link PeerReplicator} per trusted server that has a `url`, the job
+ * registry behind the mutating admin actions, and the audit log.
+ *
+ * `MindooDBServer` holds exactly one of these and routes both `/system/peer/*`
+ * (server-to-server protocol) and `/system/cluster/*` (admin surface) into it.
+ * Keeping the two prefixes on one object is fine — they never share an auth
+ * class, and the read model both need is the same in-memory replication state.
+ */
+import { StoreKind, type ContentAddressedStore } from "../../../core/types";
+import { Logger } from "../../../core/logging";
+import type { CryptoAdapter } from "../../../core/crypto/CryptoAdapter";
+import type { TrustedServer } from "../types";
+import type { SyncEventBus } from "../SyncEventBus";
+import { PeerAuthService } from "./PeerAuthService";
+import { PeerReplicator } from "./PeerReplicator";
+import { ClusterJobRunner } from "./ClusterJobRunner";
+import { ClusterAuditLog } from "./ClusterAuditLog";
+import { type ClusterJob, type ClusterJobKind, type ClusterJobScope, type ClusterStatusResponse, type ClusterTenantStatusResponse, type ClusterTopologyResponse, type PeerRole } from "./types";
+/** Result of dispatching an admin action; `accepted` discriminates the union. */
+export type ClusterActionOutcome = {
+    accepted: true;
+    job: ClusterJob;
+} | {
+    accepted: false;
+    error: string;
+};
+export interface ClusterManagerDeps {
+    cryptoAdapter: CryptoAdapter;
+    dataDir: string;
+    eventBus: SyncEventBus;
+    /** Trusted servers, re-read on every call so peer CRUD takes effect at once. */
+    listTrustedServers(): TrustedServer[];
+    /** This node's own name from `server.identity.json`, or null without identity. */
+    localServerName(): string | null;
+    /** This node's Ed25519 public key (PEM), how peers look it up. */
+    localSigningPublicKey(): string | null;
+    getSigningKey(): Promise<CryptoKey | undefined>;
+    getEncryptionKey(): Promise<CryptoKey | undefined>;
+    listTenants(): string[];
+    listDatabases(tenantId: string): string[];
+    getLocalStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ContentAddressedStore>;
+    /** This node's mesh role; `peer` unless config says hub or spoke. */
+    localRole?: PeerRole;
+    logger?: Logger;
+}
+export declare class ClusterManager {
+    private readonly deps;
+    readonly auth: PeerAuthService;
+    readonly jobs: ClusterJobRunner;
+    readonly audit: ClusterAuditLog;
+    private readonly replicators;
+    private readonly logger;
+    private started;
+    /**
+     * Tenants each peer is allowed to hear about, from the last Bloom handshake
+     * that peer performed against us.
+     *
+     * Inbound state, distinct from a replicator's own outbound intersection: this
+     * is what *they* asked about, and it exists so the peer event stream can be
+     * filtered. Without it the feed would announce every tenant we host, which
+     * would hand a peer the tenant list the Bloom exchange is designed to keep
+     * from it.
+     */
+    private readonly peerIntersections;
+    constructor(deps: ClusterManagerDeps);
+    private get localRole();
+    /**
+     * Bring the replicator set in line with `trusted-servers.json`.
+     *
+     * Called at startup and after any peer CRUD. Existing replicators are updated
+     * in place rather than recreated so their scan cursors and echo-suppression
+     * state survive an edit to, say, the attachment mode.
+     */
+    syncReplicators(): void;
+    start(): void;
+    stop(): Promise<void>;
+    get autoSyncEnabled(): boolean;
+    getReplicator(name: string): PeerReplicator | null;
+    /** Record what a peer's Bloom handshake matched; see {@link peerIntersections}. */
+    recordPeerIntersection(peerName: string, tenantIds: string[]): void;
+    /**
+     * May this peer be told that something changed in this tenant?
+     *
+     * Closed by default: a peer that has not run the Bloom handshake in this
+     * process gets nothing, rather than everything.
+     */
+    peerMaySeeTenant(peerName: string, tenantId: string): boolean;
+    topology(): ClusterTopologyResponse;
+    status(): ClusterStatusResponse;
+    tenantStatus(tenantId: string): ClusterTenantStatusResponse;
+    /**
+     * Dispatch an action as a job across the peers the scope selects.
+     *
+     * Records the request in the audit log first, with the job id, so an action
+     * that is issued is on record even if the node dies mid-run.
+     */
+    runAction(kind: ClusterJobKind, scope: ClusterJobScope, requestedBy: string): ClusterActionOutcome;
+    private targetsFor;
+    /** Record a peer CRUD change; the caller has already persisted it. */
+    auditPeerChange(action: "peer-create" | "peer-update" | "peer-delete", peerName: string, actor: string): void;
+    /**
+     * Mirrors of one tenant, for `GET /.well-known/mindoodb-cluster`.
+     *
+     * Only peers that actually hold the requested tenant are listed — a client
+     * asking about tenant A must not learn that this server also replicates
+     * tenants B and C to some other node.
+     */
+    mirrorsForTenant(tenantId: string): Array<{
+        name: string;
+        url: string;
+        role: PeerRole;
+    }>;
+}
+//# sourceMappingURL=ClusterManager.d.ts.map

package/dist/node/server/peer/ClusterManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterManager.d.ts","sourceRoot":"","sources":["../../../../src/node/server/peer/ClusterManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAoC,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAoC,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACd,MAAM,SAAS,CAAC;AAEjB,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE,GACnC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,gFAAgF;IAChF,kBAAkB,IAAI,aAAa,EAAE,CAAC;IACtC,kFAAkF;IAClF,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,kEAAkE;IAClE,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAAC;IACvC,aAAa,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAChD,gBAAgB,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACnD,WAAW,IAAI,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1C,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,qEAAqE;IACrE,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,cAAc;IAoBb,OAAO,CAAC,QAAQ,CAAC,IAAI;IAnBjC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,IAAI,mBAA0B;IACvC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,OAAO,CAAS;IACxB;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAkC;gBAEvC,IAAI,EAAE,kBAAkB;IAQrD,OAAO,KAAK,SAAS,GAEpB;IAID;;;;;;OAMG;IACH,eAAe,IAAI,IAAI;IAwCvB,KAAK,IAAI,IAAI;IAcP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAM3B,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAIlD,mFAAmF;IACnF,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAInE;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAM7D,QAAQ,IAAI,uBAAuB;IAOnC,MAAM,IAAI,qBAAqB;IAkB/B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,2BAA2B;IAa3D;;;;;OAKG;IACH,SAAS,CACP,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,MAAM,GAClB,oBAAoB;IA2EvB,OAAO,CAAC,UAAU;IAMlB,sEAAsE;IACtE,eAAe,CACb,MAAM,EAAE,aAAa,GAAG,aAAa,GAAG,aAAa,EACrD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,IAAI;IAWP;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;CAYzF"}