Migrate server-side ES domain to packages (#136297)

* create es types package

* start moving client types to @kbn/core-elasticsearch-server

* move ElasticsearchClientConfig to package

* start adapting usages

* start fixing imports

* fix more imports

* just a bit more

* move service types

* [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix'

* fix more internal types

* move retry call cluster helpers outside of client package

* move client code and mocks to packages

* fix imports

* adapt external usages

* adapt more external usages

* adapt more external usages 2

* fix mocked module

* create empty domain packages

* more external usages fix

* move ALL the things (again)

* mock external import fix

* fix tests, add test dependencies

* fix some internal usages

* fix more internal usages

* [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix'

* fix cli_setup usage

* desperate times force desperate decisions

* fix misc stuff

* update snapshots (?!)

* fix mocked package

* self review

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

package.json

@@ -169,6 +169,12 @@
     "@kbn/core-doc-links-server": "link:bazel-bin/packages/core/doc-links/core-doc-links-server",
     "@kbn/core-doc-links-server-internal": "link:bazel-bin/packages/core/doc-links/core-doc-links-server-internal",
     "@kbn/core-doc-links-server-mocks": "link:bazel-bin/packages/core/doc-links/core-doc-links-server-mocks",
+    "@kbn/core-elasticsearch-client-server": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-client-server",
+    "@kbn/core-elasticsearch-client-server-internal": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-client-server-internal",
+    "@kbn/core-elasticsearch-client-server-mocks": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-client-server-mocks",
+    "@kbn/core-elasticsearch-server": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-server",
+    "@kbn/core-elasticsearch-server-internal": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-server-internal",
+    "@kbn/core-elasticsearch-server-mocks": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-server-mocks",
     "@kbn/core-environment-server-internal": "link:bazel-bin/packages/core/environment/core-environment-server-internal",
     "@kbn/core-environment-server-mocks": "link:bazel-bin/packages/core/environment/core-environment-server-mocks",
     "@kbn/core-execution-context-browser": "link:bazel-bin/packages/core/execution-context/core-execution-context-browser",
@@ -757,6 +763,12 @@
     "@types/kbn__core-doc-links-server": "link:bazel-bin/packages/core/doc-links/core-doc-links-server/npm_module_types",
     "@types/kbn__core-doc-links-server-internal": "link:bazel-bin/packages/core/doc-links/core-doc-links-server-internal/npm_module_types",
     "@types/kbn__core-doc-links-server-mocks": "link:bazel-bin/packages/core/doc-links/core-doc-links-server-mocks/npm_module_types",
+    "@types/kbn__core-elasticsearch-client-server": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-client-server/npm_module_types",
+    "@types/kbn__core-elasticsearch-client-server-internal": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-client-server-internal/npm_module_types",
+    "@types/kbn__core-elasticsearch-client-server-mocks": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-client-server-mocks/npm_module_types",
+    "@types/kbn__core-elasticsearch-server": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-server/npm_module_types",
+    "@types/kbn__core-elasticsearch-server-internal": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-server-internal/npm_module_types",
+    "@types/kbn__core-elasticsearch-server-mocks": "link:bazel-bin/packages/core/elasticsearch/core-elasticsearch-server-mocks/npm_module_types",
     "@types/kbn__core-environment-server-internal": "link:bazel-bin/packages/core/environment/core-environment-server-internal/npm_module_types",
     "@types/kbn__core-environment-server-mocks": "link:bazel-bin/packages/core/environment/core-environment-server-mocks/npm_module_types",
     "@types/kbn__core-execution-context-browser": "link:bazel-bin/packages/core/execution-context/core-execution-context-browser/npm_module_types",

packages/BUILD.bazel

@@ -37,6 +37,11 @@ filegroup(
     "//packages/core/doc-links/core-doc-links-server-internal:build",
     "//packages/core/doc-links/core-doc-links-server-mocks:build",
     "//packages/core/doc-links/core-doc-links-server:build",
+    "//packages/core/elasticsearch/core-elasticsearch-client-server-internal:build",
+    "//packages/core/elasticsearch/core-elasticsearch-client-server-mocks:build",
+    "//packages/core/elasticsearch/core-elasticsearch-server-internal:build",
+    "//packages/core/elasticsearch/core-elasticsearch-server-mocks:build",
+    "//packages/core/elasticsearch/core-elasticsearch-server:build",
     "//packages/core/environment/core-environment-server-internal:build",
     "//packages/core/environment/core-environment-server-mocks:build",
     "//packages/core/execution-context/core-execution-context-browser-internal:build",
@@ -248,6 +253,11 @@ filegroup(
     "//packages/core/doc-links/core-doc-links-server-internal:build_types",
     "//packages/core/doc-links/core-doc-links-server-mocks:build_types",
     "//packages/core/doc-links/core-doc-links-server:build_types",
+    "//packages/core/elasticsearch/core-elasticsearch-client-server-internal:build_types",
+    "//packages/core/elasticsearch/core-elasticsearch-client-server-mocks:build_types",
+    "//packages/core/elasticsearch/core-elasticsearch-server-internal:build_types",
+    "//packages/core/elasticsearch/core-elasticsearch-server-mocks:build_types",
+    "//packages/core/elasticsearch/core-elasticsearch-server:build_types",
     "//packages/core/environment/core-environment-server-internal:build_types",
     "//packages/core/environment/core-environment-server-mocks:build_types",
     "//packages/core/execution-context/core-execution-context-browser-internal:build_types",

packages/core/base/core-base-common/BUILD.bazel

@@ -26,11 +26,13 @@ NPM_MODULE_EXTRA_FILES = [
 ]
 
 RUNTIME_DEPS = [
+  "//packages/kbn-std",
 ]
 
 TYPES_DEPS = [
   "@npm//@types/node",
   "@npm//@types/jest",
+  "//packages/kbn-std:npm_module_types",
   "//packages/kbn-config:npm_module_types",
 ]
 

packages/core/base/core-base-common/src/index.ts

@@ -9,3 +9,5 @@
 export type { PluginOpaqueId, PluginName, DiscoveredPlugin } from './plugins';
 export { PluginType } from './plugins';
 export { EUI_STYLES_GLOBAL } from './eui';
+export { ServiceStatusLevels } from './service_status';
+export type { ServiceStatus, ServiceStatusLevel } from './service_status';

packages/core/base/core-base-common/src/service_status.ts

@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { deepFreeze } from '@kbn/std';
+
+/**
+ * The current status of a service at a point in time.
+ *
+ * @typeParam Meta - JSON-serializable object. Plugins should export this type to allow other plugins to read the `meta`
+ *                   field in a type-safe way.
+ * @public
+ */
+export interface ServiceStatus<Meta extends Record<string, any> | unknown = unknown> {
+  /**
+   * The current availability level of the service.
+   */
+  level: ServiceStatusLevel;
+  /**
+   * A high-level summary of the service status.
+   */
+  summary: string;
+  /**
+   * A more detailed description of the service status.
+   */
+  detail?: string;
+  /**
+   * A URL to open in a new tab about how to resolve or troubleshoot the problem.
+   */
+  documentationUrl?: string;
+  /**
+   * Any JSON-serializable data to be included in the HTTP API response. Useful for providing more fine-grained,
+   * machine-readable information about the service status. May include status information for underlying features.
+   */
+  meta?: Meta;
+}
+
+/**
+ * The current "level" of availability of a service.
+ *
+ * @remarks
+ * The values implement `valueOf` to allow for easy comparisons between status levels with <, >, etc. Higher values
+ * represent higher severities. Note that the default `Array.prototype.sort` implementation does not correctly sort
+ * these values.
+ *
+ * A snapshot serializer is available in `src/core/server/test_utils` to ease testing of these values with Jest.
+ *
+ * @public
+ */
+export const ServiceStatusLevels = deepFreeze({
+  /**
+   * Everything is working!
+   */
+  available: {
+    toString: () => 'available',
+    valueOf: () => 0,
+    toJSON() {
+      return this.toString();
+    },
+  },
+  /**
+   * Some features may not be working.
+   */
+  degraded: {
+    toString: () => 'degraded',
+    valueOf: () => 1,
+    toJSON() {
+      return this.toString();
+    },
+  },
+  /**
+   * The service is unavailable, but other functions that do not depend on this service should work.
+   */
+  unavailable: {
+    toString: () => 'unavailable',
+    valueOf: () => 2,
+    toJSON() {
+      return this.toString();
+    },
+  },
+  /**
+   * Block all user functions and display the status page, reserved for Core services only.
+   */
+  critical: {
+    toString: () => 'critical',
+    valueOf: () => 3,
+    toJSON() {
+      return this.toString();
+    },
+  },
+});
+
+/**
+ * A convenience type that represents the union of each value in {@link ServiceStatusLevels}.
+ * @public
+ */
+export type ServiceStatusLevel = typeof ServiceStatusLevels[keyof typeof ServiceStatusLevels];

packages/core/elasticsearch/core-elasticsearch-client-server-internal/BUILD.bazel

@@ -0,0 +1,116 @@
+load("@npm//@bazel/typescript:index.bzl", "ts_config")
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler", "pkg_npm", "pkg_npm_types", "ts_project")
+
+PKG_DIRNAME = "core-elasticsearch-client-server-internal"
+PKG_REQUIRE_NAME = "@kbn/core-elasticsearch-client-server-internal"
+
+SOURCE_FILES = glob(
+  [
+    "src/**/*.ts",
+  ],
+  exclude = [
+    "**/*.test.*",
+    "**/*.stories.*",
+  ],
+)
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+]
+
+RUNTIME_DEPS = [
+  "@npm//moment",
+  "@npm//@elastic/elasticsearch",
+  "@npm//@elastic/numeral",
+  "//packages/kbn-std",
+  "//packages/kbn-es-errors",
+  "//packages/core/http/core-http-router-server-internal",
+  ### test dependencies
+  "//packages/core/logging/core-logging-server-mocks",
+  "//packages/core/http/core-http-server-mocks",
+]
+
+TYPES_DEPS = [
+  "@npm//@types/node",
+  "@npm//@types/jest",
+  "@npm//moment",
+  "@npm//@elastic/elasticsearch",
+  "@npm//@elastic/numeral",
+  "//packages/kbn-utility-types:npm_module_types",
+  "//packages/kbn-std:npm_module_types",
+  "//packages/kbn-es-errors:npm_module_types",
+  "//packages/kbn-logging:npm_module_types",
+  "//packages/core/http/core-http-server:npm_module_types",
+  "//packages/core/http/core-http-router-server-internal:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-server:npm_module_types",
+]
+
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
+
+ts_config(
+  name = "tsconfig",
+  src = "tsconfig.json",
+  deps = [
+    "//:tsconfig.base.json",
+    "//:tsconfig.bazel.json",
+  ],
+)
+
+ts_project(
+  name = "tsc_types",
+  args = ['--pretty'],
+  srcs = SRCS,
+  deps = TYPES_DEPS,
+  declaration = True,
+  declaration_map = True,
+  emit_declaration_only = True,
+  out_dir = "target_types",
+  root_dir = "src",
+  tsconfig = ":tsconfig",
+)
+
+js_library(
+  name = PKG_DIRNAME,
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = RUNTIME_DEPS + [":target_node"],
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  deps = [":" + PKG_DIRNAME],
+)
+
+filegroup(
+  name = "build",
+  srcs = [":npm_module"],
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm_types(
+  name = "npm_module_types",
+  srcs = SRCS,
+  deps = [":tsc_types"],
+  package_name = PKG_REQUIRE_NAME,
+  tsconfig = ":tsconfig",
+  visibility = ["//visibility:public"],
+)
+
+filegroup(
+  name = "build_types",
+  srcs = [":npm_module_types"],
+  visibility = ["//visibility:public"],
+)

packages/core/elasticsearch/core-elasticsearch-client-server-internal/README.md

@@ -0,0 +1,3 @@
+# @kbn/core-elasticsearch-client-server-internal
+
+This package contains the internal implementation for Core's server-side elasticsearch client.

packages/core/elasticsearch/core-elasticsearch-client-server-internal/jest.config.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/core/elasticsearch/core-elasticsearch-client-server-internal'],
+};

packages/core/elasticsearch/core-elasticsearch-client-server-internal/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@kbn/core-elasticsearch-client-server-internal",
+  "private": true,
+  "version": "1.0.0",
+  "main": "./target_node/index.js",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/client_config.test.ts

@@ -7,8 +7,9 @@
  */
 
 import { duration } from 'moment';
-import { ElasticsearchClientConfig, parseClientOptions } from './client_config';
-import { DEFAULT_HEADERS } from '../default_headers';
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
+import { parseClientOptions } from './client_config';
+import { DEFAULT_HEADERS } from './headers';
 
 const createConfig = (
   parts: Partial<ElasticsearchClientConfig> = {}

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/client_config.ts

@@ -10,35 +10,8 @@ import { ConnectionOptions as TlsConnectionOptions } from 'tls';
 import { URL } from 'url';
 import { Duration } from 'moment';
 import type { ClientOptions } from '@elastic/elasticsearch/lib/client';
-import { ElasticsearchConfig } from '../elasticsearch_config';
-import { DEFAULT_HEADERS } from '../default_headers';
-
-/**
- * Configuration options to be used to create a {@link IClusterClient | cluster client} using the
- * {@link ElasticsearchServiceStart.createClient | createClient API}
- *
- * @public
- */
-export type ElasticsearchClientConfig = Pick<
-  ElasticsearchConfig,
-  | 'customHeaders'
-  | 'maxSockets'
-  | 'compression'
-  | 'sniffOnStart'
-  | 'sniffOnConnectionFault'
-  | 'requestHeadersWhitelist'
-  | 'sniffInterval'
-  | 'hosts'
-  | 'username'
-  | 'password'
-  | 'serviceAccountToken'
-> & {
-  pingTimeout?: ElasticsearchConfig['pingTimeout'] | ClientOptions['pingTimeout'];
-  requestTimeout?: ElasticsearchConfig['requestTimeout'] | ClientOptions['requestTimeout'];
-  ssl?: Partial<ElasticsearchConfig['ssl']>;
-  keepAlive?: boolean;
-  caFingerprint?: ClientOptions['caFingerprint'];
-};
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
+import { DEFAULT_HEADERS } from './headers';
 
 /**
  * Parse the client options from given client config and `scoped` flag.

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/cluster_client.test.ts

@@ -11,12 +11,12 @@ import {
   createTransportMock,
   createInternalErrorHandlerMock,
 } from './cluster_client.test.mocks';
+import type { Client } from '@elastic/elasticsearch';
 import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
 import { httpServerMock, httpServiceMock } from '@kbn/core-http-server-mocks';
-import { elasticsearchClientMock } from './mocks';
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
 import { ClusterClient } from './cluster_client';
-import { ElasticsearchClientConfig } from './client_config';
-import { DEFAULT_HEADERS } from '../default_headers';
+import { DEFAULT_HEADERS } from './headers';
 
 const createConfig = (
   parts: Partial<ElasticsearchClientConfig> = {}
@@ -34,18 +34,21 @@ const createConfig = (
   };
 };
 
+const createClient = () =>
+  ({ close: jest.fn(), child: jest.fn() } as unknown as jest.Mocked<Client>);
+
 describe('ClusterClient', () => {
   let logger: ReturnType<typeof loggingSystemMock.createLogger>;
   let authHeaders: ReturnType<typeof httpServiceMock.createAuthHeaderStorage>;
-  let internalClient: ReturnType<typeof elasticsearchClientMock.createInternalClient>;
-  let scopedClient: ReturnType<typeof elasticsearchClientMock.createInternalClient>;
+  let internalClient: jest.Mocked<Client>;
+  let scopedClient: jest.Mocked<Client>;
 
   const mockTransport = { mockTransport: true };
 
   beforeEach(() => {
     logger = loggingSystemMock.createLogger();
-    internalClient = elasticsearchClientMock.createInternalClient();
-    scopedClient = elasticsearchClientMock.createInternalClient();
+    internalClient = createClient();
+    scopedClient = createClient();
 
     authHeaders = httpServiceMock.createAuthHeaderStorage();
     authHeaders.get.mockImplementation(() => ({

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/cluster_client.ts

@@ -15,52 +15,20 @@ import {
   isKibanaRequest,
   isRealRequest,
 } from '@kbn/core-http-router-server-internal';
-import { ScopeableRequest } from '../types';
-import { ElasticsearchClient } from './types';
-import { configureClient } from './configure_client';
-import { ElasticsearchClientConfig } from './client_config';
-import { ScopedClusterClient, IScopedClusterClient } from './scoped_cluster_client';
-import { DEFAULT_HEADERS } from '../default_headers';
-import {
+import type {
+  ScopeableRequest,
   UnauthorizedErrorHandler,
-  createInternalErrorHandler,
-  InternalUnauthorizedErrorHandler,
-} from './retry_unauthorized';
+  ICustomClusterClient,
+} from '@kbn/core-elasticsearch-server';
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
+import { configureClient } from './configure_client';
+import { ScopedClusterClient } from './scoped_cluster_client';
+import { DEFAULT_HEADERS } from './headers';
+import { createInternalErrorHandler, InternalUnauthorizedErrorHandler } from './retry_unauthorized';
 import { createTransport } from './create_transport';
 
 const noop = () => undefined;
 
-/**
- * Represents an Elasticsearch cluster API client created by the platform.
- * It allows to call API on behalf of the internal Kibana user and
- * the actual user that is derived from the request headers (via `asScoped(...)`).
- *
- * @public
- **/
-export interface IClusterClient {
-  /**
-   * A {@link ElasticsearchClient | client} to be used to query the ES cluster on behalf of the Kibana internal user
-   */
-  readonly asInternalUser: ElasticsearchClient;
-  /**
-   * Creates a {@link IScopedClusterClient | scoped cluster client} bound to given {@link ScopeableRequest | request}
-   */
-  asScoped: (request: ScopeableRequest) => IScopedClusterClient;
-}
-
-/**
- * See {@link IClusterClient}
- *
- * @public
- */
-export interface ICustomClusterClient extends IClusterClient {
-  /**
-   * Closes the cluster client. After that client cannot be used and one should
-   * create a new client instance to be able to interact with Elasticsearch API.
-   */
-  close: () => Promise<void>;
-}
-
 /** @internal **/
 export class ClusterClient implements ICustomClusterClient {
   private readonly config: ElasticsearchClientConfig;

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/configure_client.test.ts

@@ -18,7 +18,7 @@ import {
 } from './configure_client.test.mocks';
 import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
 import { ClusterConnectionPool } from '@elastic/elasticsearch';
-import type { ElasticsearchClientConfig } from './client_config';
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
 import { configureClient } from './configure_client';
 import { instrumentEsQueryAndDeprecationLogger } from './log_query_and_deprecation';
 

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/configure_client.ts

@@ -8,7 +8,8 @@
 
 import { Client, HttpConnection, ClusterConnectionPool } from '@elastic/elasticsearch';
 import type { Logger } from '@kbn/logging';
-import { parseClientOptions, ElasticsearchClientConfig } from './client_config';
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
+import { parseClientOptions } from './client_config';
 import { instrumentEsQueryAndDeprecationLogger } from './log_query_and_deprecation';
 import { createTransport } from './create_transport';
 

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/create_transport.ts

@@ -7,13 +7,13 @@
  */
 
 import type { IncomingHttpHeaders } from 'http';
-import type {
-  TransportRequestParams,
-  TransportRequestOptions,
-  TransportResult,
-} from '@elastic/transport';
-import type { TransportOptions } from '@elastic/transport/lib/Transport';
-import { Transport } from '@elastic/elasticsearch';
+import {
+  Transport,
+  type TransportOptions,
+  type TransportRequestParams,
+  type TransportRequestOptions,
+  type TransportResult,
+} from '@elastic/elasticsearch';
 import { isUnauthorizedError } from '@kbn/es-errors';
 import { InternalUnauthorizedErrorHandler, isRetryResult } from './retry_unauthorized';
 

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.test.ts

@@ -5,6 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
 import { type DiagnosticResult, type ConnectionRequestParams } from '@elastic/elasticsearch';
 import { getEcsResponseLog } from './get_ecs_response_log';
 

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.ts

@@ -5,6 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
 import { type IncomingHttpHeaders } from 'http';
 import { type DiagnosticResult } from '@elastic/elasticsearch';
 import { type LogMeta } from '@kbn/logging';

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/headers.ts

@@ -8,22 +8,26 @@
 
 import { deepFreeze } from '@kbn/std';
 
+/**
+ * @internal
+ */
+export const PRODUCT_RESPONSE_HEADER = 'x-elastic-product';
+
+/**
+ * @internal
+ */
 export const PRODUCT_ORIGIN_HEADER = 'x-elastic-product-origin';
 
+/**
+ * @internal
+ */
 export const RESERVED_HEADERS = deepFreeze([PRODUCT_ORIGIN_HEADER]);
 
+/**
+ * @internal
+ */
 export const DEFAULT_HEADERS = deepFreeze({
   // Elasticsearch uses this to identify when a request is coming from Kibana, to allow Kibana to
   // access system indices using the standard ES APIs.
   [PRODUCT_ORIGIN_HEADER]: 'kibana',
 });
-
-export const getReservedHeaders = (headerNames: string[]): string[] => {
-  const reservedHeaders = [];
-  for (const headerName of headerNames) {
-    if (RESERVED_HEADERS.includes(headerName.toLowerCase())) {
-      reservedHeaders.push(headerName);
-    }
-  }
-  return reservedHeaders;
-};

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/index.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { ScopedClusterClient } from './scoped_cluster_client';
+export { ClusterClient } from './cluster_client';
+export { configureClient } from './configure_client';
+export { getRequestDebugMeta, getErrorMessage } from './log_query_and_deprecation';
+export {
+  PRODUCT_RESPONSE_HEADER,
+  DEFAULT_HEADERS,
+  PRODUCT_ORIGIN_HEADER,
+  RESERVED_HEADERS,
+} from './headers';

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/log_query_and_deprecation.ts

@@ -5,6 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
 import type { IncomingHttpHeaders } from 'http';
 import { Buffer } from 'buffer';
 import { stringify } from 'querystring';

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/retry_unauthorized.ts

@@ -8,71 +8,16 @@
 
 import { MaybePromise } from '@kbn/utility-types';
 import { UnauthorizedError } from '@kbn/es-errors';
-import type { AuthHeaders, KibanaRequest, SetAuthHeaders } from '@kbn/core-http-server';
+import type { SetAuthHeaders } from '@kbn/core-http-server';
 import { isRealRequest } from '@kbn/core-http-router-server-internal';
-import { ScopeableRequest } from '../types';
-
-/**
- * @public
- */
-export interface UnauthorizedErrorHandlerOptions {
-  error: UnauthorizedError;
-  request: KibanaRequest;
-}
-
-/**
- * @public
- */
-export interface UnauthorizedErrorHandlerResultRetryParams {
-  authHeaders: AuthHeaders;
-}
-
-/**
- * @public
- */
-export interface UnauthorizedErrorHandlerRetryResult
-  extends UnauthorizedErrorHandlerResultRetryParams {
-  type: 'retry';
-}
-
-/**
- * @public
- */
-export interface UnauthorizedErrorHandlerNotHandledResult {
-  type: 'notHandled';
-}
-
-/**
- * @public
- */
-export type UnauthorizedErrorHandlerResult =
-  | UnauthorizedErrorHandlerRetryResult
-  | UnauthorizedErrorHandlerNotHandledResult;
-
-/**
- * Toolkit passed to a {@link UnauthorizedErrorHandler} used to generate responses from the handler
- * @public
- */
-export interface UnauthorizedErrorHandlerToolkit {
-  /**
-   * The handler cannot handle the error, or was not able to authenticate.
-   */
-  notHandled: () => UnauthorizedErrorHandlerNotHandledResult;
-  /**
-   * The handler was able to authenticate. Will retry the failed request with new auth headers
-   */
-  retry: (params: UnauthorizedErrorHandlerResultRetryParams) => UnauthorizedErrorHandlerRetryResult;
-}
-
-/**
- * A handler used to handle unauthorized error returned by elasticsearch
- *
- * @public
- */
-export type UnauthorizedErrorHandler = (
-  options: UnauthorizedErrorHandlerOptions,
-  toolkit: UnauthorizedErrorHandlerToolkit
-) => MaybePromise<UnauthorizedErrorHandlerResult>;
+import type {
+  ScopeableRequest,
+  UnauthorizedErrorHandler,
+  UnauthorizedErrorHandlerResult,
+  UnauthorizedErrorHandlerToolkit,
+  UnauthorizedErrorHandlerRetryResult,
+  UnauthorizedErrorHandlerNotHandledResult,
+} from '@kbn/core-elasticsearch-server';
 
 /** @internal */
 export type InternalUnauthorizedErrorHandler = (

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/scoped_cluster_client.test.ts

@@ -6,13 +6,15 @@
  * Side Public License, v 1.
  */
 
-import { elasticsearchClientMock } from './mocks';
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import { ScopedClusterClient } from './scoped_cluster_client';
 
+const createEsClient = () => ({} as unknown as ElasticsearchClient);
+
 describe('ScopedClusterClient', () => {
   it('uses the internal client passed in the constructor', () => {
-    const internalClient = elasticsearchClientMock.createElasticsearchClient();
-    const scopedClient = elasticsearchClientMock.createElasticsearchClient();
+    const internalClient = createEsClient();
+    const scopedClient = createEsClient();
 
     const scopedClusterClient = new ScopedClusterClient(internalClient, scopedClient);
 
@@ -20,8 +22,8 @@ describe('ScopedClusterClient', () => {
   });
 
   it('uses the scoped client passed in the constructor', () => {
-    const internalClient = elasticsearchClientMock.createElasticsearchClient();
-    const scopedClient = elasticsearchClientMock.createElasticsearchClient();
+    const internalClient = createEsClient();
+    const scopedClient = createEsClient();
 
     const scopedClusterClient = new ScopedClusterClient(internalClient, scopedClient);
 

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/scoped_cluster_client.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { ElasticsearchClient, IScopedClusterClient } from '@kbn/core-elasticsearch-server';
+
+/** @internal **/
+export class ScopedClusterClient implements IScopedClusterClient {
+  constructor(
+    public readonly asInternalUser: ElasticsearchClient,
+    public readonly asCurrentUser: ElasticsearchClient
+  ) {}
+}

packages/core/elasticsearch/core-elasticsearch-client-server-internal/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "extends": "../../../../tsconfig.bazel.json",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "outDir": "target_types",
+    "rootDir": "src",
+    "stripInternal": false,
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "src/**/*"
+  ]
+}

packages/core/elasticsearch/core-elasticsearch-client-server-mocks/BUILD.bazel

@@ -0,0 +1,102 @@
+load("@npm//@bazel/typescript:index.bzl", "ts_config")
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler", "pkg_npm", "pkg_npm_types", "ts_project")
+
+PKG_DIRNAME = "core-elasticsearch-client-server-mocks"
+PKG_REQUIRE_NAME = "@kbn/core-elasticsearch-client-server-mocks"
+
+SOURCE_FILES = glob(
+  [
+    "src/**/*.ts",
+  ],
+  exclude = [
+    "**/*.test.*",
+    "**/*.stories.*",
+  ],
+)
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+]
+
+RUNTIME_DEPS = [
+  "//packages/core/elasticsearch/core-elasticsearch-client-server-internal",
+]
+
+TYPES_DEPS = [
+  "@npm//@types/node",
+  "@npm//@types/jest",
+  "@npm//@elastic/elasticsearch",
+  "//packages/kbn-utility-types:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-server:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-client-server-internal:npm_module_types",
+]
+
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
+
+ts_config(
+  name = "tsconfig",
+  src = "tsconfig.json",
+  deps = [
+    "//:tsconfig.base.json",
+    "//:tsconfig.bazel.json",
+  ],
+)
+
+ts_project(
+  name = "tsc_types",
+  args = ['--pretty'],
+  srcs = SRCS,
+  deps = TYPES_DEPS,
+  declaration = True,
+  declaration_map = True,
+  emit_declaration_only = True,
+  out_dir = "target_types",
+  root_dir = "src",
+  tsconfig = ":tsconfig",
+)
+
+js_library(
+  name = PKG_DIRNAME,
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = RUNTIME_DEPS + [":target_node"],
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  deps = [":" + PKG_DIRNAME],
+)
+
+filegroup(
+  name = "build",
+  srcs = [":npm_module"],
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm_types(
+  name = "npm_module_types",
+  srcs = SRCS,
+  deps = [":tsc_types"],
+  package_name = PKG_REQUIRE_NAME,
+  tsconfig = ":tsconfig",
+  visibility = ["//visibility:public"],
+)
+
+filegroup(
+  name = "build_types",
+  srcs = [":npm_module_types"],
+  visibility = ["//visibility:public"],
+)

packages/core/elasticsearch/core-elasticsearch-client-server-mocks/README.md

@@ -0,0 +1,3 @@
+# @kbn/core-elasticsearch-client-server-mocks
+
+This package contains the mocks for the server-side elasticsearch client.

packages/core/elasticsearch/core-elasticsearch-client-server-mocks/jest.config.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/core/elasticsearch/core-elasticsearch-client-server-mocks'],
+};

packages/core/elasticsearch/core-elasticsearch-client-server-mocks/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@kbn/core-elasticsearch-client-server-mocks",
+  "private": true,
+  "version": "1.0.0",
+  "main": "./target_node/index.js",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}

packages/core/elasticsearch/core-elasticsearch-client-server-mocks/src/index.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { elasticsearchClientMock } from './mocks';
+export type {
+  ClientApiMockInstance,
+  ClusterClientMock,
+  ScopedClusterClientMock,
+  CustomClusterClientMock,
+  DeeplyMockedApi,
+  ElasticsearchClientMock,
+} from './mocks';

packages/core/elasticsearch/core-elasticsearch-client-server-mocks/src/mocks.ts

@@ -6,12 +6,10 @@
  * Side Public License, v 1.
  */
 
-import type { Client } from '@elastic/elasticsearch';
-import type { TransportResult, TransportRequestOptions } from '@elastic/elasticsearch';
+import type { Client, TransportResult, TransportRequestOptions } from '@elastic/elasticsearch';
 import type { PublicKeys } from '@kbn/utility-types';
-import { ElasticsearchClient } from './types';
-import { ICustomClusterClient } from './cluster_client';
-import { PRODUCT_RESPONSE_HEADER } from '../supported_server_response_check';
+import type { ElasticsearchClient, ICustomClusterClient } from '@kbn/core-elasticsearch-server';
+import { PRODUCT_RESPONSE_HEADER } from '@kbn/core-elasticsearch-client-server-internal';
 
 const omittedProps = [
   'diagnostic',

packages/core/elasticsearch/core-elasticsearch-client-server-mocks/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "extends": "../../../../tsconfig.bazel.json",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "outDir": "target_types",
+    "rootDir": "src",
+    "stripInternal": false,
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "src/**/*"
+  ]
+}

packages/core/elasticsearch/core-elasticsearch-server-internal/BUILD.bazel

@@ -0,0 +1,132 @@
+load("@npm//@bazel/typescript:index.bzl", "ts_config")
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler", "pkg_npm", "pkg_npm_types", "ts_project")
+
+PKG_DIRNAME = "core-elasticsearch-server-internal"
+PKG_REQUIRE_NAME = "@kbn/core-elasticsearch-server-internal"
+
+SOURCE_FILES = glob(
+  [
+    "src/**/*.ts",
+  ],
+  exclude = [
+    "**/*.test.*",
+    "**/*.stories.*",
+  ],
+)
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+]
+
+RUNTIME_DEPS = [
+  "@npm//rxjs",
+  "@npm//semver",
+  "@npm//moment",
+  "@npm//@elastic/elasticsearch",
+  "//packages/kbn-std",
+  "//packages/kbn-i18n",
+  "//packages/kbn-crypto",
+  "//packages/kbn-config-schema",
+  "//packages/core/elasticsearch/core-elasticsearch-client-server-internal",
+  ### test dependencies
+  "//packages/kbn-config-mocks",
+  "//packages/core/logging/core-logging-server-mocks",
+  "//packages/core/analytics/core-analytics-server-mocks",
+  "//packages/core/execution-context/core-execution-context-server-mocks",
+  "//packages/core/http/core-http-server-mocks",
+  "//packages/core/elasticsearch/core-elasticsearch-client-server-mocks",
+  "//packages/core/config/core-config-server-internal",
+]
+
+TYPES_DEPS = [
+  "@npm//@types/node",
+  "@npm//@types/jest",
+  "@npm//rxjs",
+  "@npm//@types/semver",
+  "@npm//moment",
+  "@npm//@elastic/elasticsearch",
+  "//packages/kbn-utility-types:npm_module_types",
+  "//packages/kbn-std:npm_module_types",
+  "//packages/kbn-logging:npm_module_types",
+  "//packages/kbn-i18n:npm_module_types",
+  "//packages/kbn-crypto:npm_module_types",
+  "//packages/kbn-config-schema:npm_module_types",
+  "//packages/core/base/core-base-common:npm_module_types",
+  "//packages/core/base/core-base-server-internal:npm_module_types",
+  "//packages/core/analytics/core-analytics-server:npm_module_types",
+  "//packages/core/http/core-http-server:npm_module_types",
+  "//packages/core/http/core-http-server-internal:npm_module_types",
+  "//packages/core/execution-context/core-execution-context-server-internal:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-server:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-client-server-internal:npm_module_types",
+]
+
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
+
+ts_config(
+  name = "tsconfig",
+  src = "tsconfig.json",
+  deps = [
+    "//:tsconfig.base.json",
+    "//:tsconfig.bazel.json",
+  ],
+)
+
+ts_project(
+  name = "tsc_types",
+  args = ['--pretty'],
+  srcs = SRCS,
+  deps = TYPES_DEPS,
+  declaration = True,
+  declaration_map = True,
+  emit_declaration_only = True,
+  out_dir = "target_types",
+  root_dir = "src",
+  tsconfig = ":tsconfig",
+)
+
+js_library(
+  name = PKG_DIRNAME,
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = RUNTIME_DEPS + [":target_node"],
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  deps = [":" + PKG_DIRNAME],
+)
+
+filegroup(
+  name = "build",
+  srcs = [":npm_module"],
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm_types(
+  name = "npm_module_types",
+  srcs = SRCS,
+  deps = [":tsc_types"],
+  package_name = PKG_REQUIRE_NAME,
+  tsconfig = ":tsconfig",
+  visibility = ["//visibility:public"],
+)
+
+filegroup(
+  name = "build_types",
+  srcs = [":npm_module_types"],
+  visibility = ["//visibility:public"],
+)

packages/core/elasticsearch/core-elasticsearch-server-internal/README.md

@@ -0,0 +1,3 @@
+# @kbn/core-elasticsearch-server-internal
+
+This package contains the internal types and implementation for Core's server-side elasticsearch service.

packages/core/elasticsearch/core-elasticsearch-server-internal/jest.config.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/core/elasticsearch/core-elasticsearch-server-internal'],
+};

packages/core/elasticsearch/core-elasticsearch-server-internal/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@kbn/core-elasticsearch-server-internal",
+  "private": true,
+  "version": "1.0.0",
+  "main": "./target_node/index.js",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}

packages/core/elasticsearch/core-elasticsearch-server-internal/src/default_headers.test.ts

@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { getReservedHeaders, PRODUCT_ORIGIN_HEADER } from './default_headers';
+import { PRODUCT_ORIGIN_HEADER } from '@kbn/core-elasticsearch-client-server-internal';
+import { getReservedHeaders } from './default_headers';
 
 describe('getReservedHeaders', () => {
   it('returns the list of reserved headers contained in a list', () => {

packages/core/elasticsearch/core-elasticsearch-server-internal/src/default_headers.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { RESERVED_HEADERS } from '@kbn/core-elasticsearch-client-server-internal';
+
+export const getReservedHeaders = (headerNames: string[]): string[] => {
+  const reservedHeaders = [];
+  for (const headerName of headerNames) {
+    if (RESERVED_HEADERS.includes(headerName.toLowerCase())) {
+      reservedHeaders.push(headerName);
+    }
+  }
+  return reservedHeaders;
+};

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_config.ts

@@ -12,7 +12,8 @@ import { i18n } from '@kbn/i18n';
 import { Duration } from 'moment';
 import { readFileSync } from 'fs';
 import type { ServiceConfigDescriptor } from '@kbn/core-base-server-internal';
-import { ConfigDeprecationProvider } from '..';
+import type { ConfigDeprecationProvider } from '@kbn/config';
+import type { IElasticsearchConfig, ElasticsearchSslConfig } from '@kbn/core-elasticsearch-server';
 import { getReservedHeaders } from './default_headers';
 
 const hostURISchema = schema.uri({ scheme: ['http', 'https'] });
@@ -20,7 +21,6 @@ const hostURISchema = schema.uri({ scheme: ['http', 'https'] });
 export const DEFAULT_API_VERSION = 'master';
 
 export type ElasticsearchConfigType = TypeOf<typeof configSchema>;
-type SslConfigSchema = ElasticsearchConfigType['ssl'];
 
 /**
  * Validation schema for elasticsearch service config. It can be reused when plugins allow users
@@ -270,9 +270,9 @@ export const config: ServiceConfigDescriptor<ElasticsearchConfigType> = {
 
 /**
  * Wrapper of config schema.
- * @public
+ * @internal
  */
-export class ElasticsearchConfig {
+export class ElasticsearchConfig implements IElasticsearchConfig {
   /**
    * @internal
    * Only valid in dev mode. Skip the valid connection check during startup. The connection check allows
@@ -381,10 +381,7 @@ export class ElasticsearchConfig {
    * are required when `xpack.ssl.verification_mode` in Elasticsearch is set to
    * either `certificate` or `full`.
    */
-  public readonly ssl: Pick<
-    SslConfigSchema,
-    Exclude<keyof SslConfigSchema, 'certificateAuthorities' | 'keystore' | 'truststore'>
-  > & { certificateAuthorities?: string[] };
+  public readonly ssl: ElasticsearchSslConfig;
 
   /**
    * Header names and values to send to Elasticsearch with every request. These

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_route_handler_context.ts

@@ -7,17 +7,12 @@
  */
 
 import type { KibanaRequest } from '@kbn/core-http-server';
-import type { IScopedClusterClient } from './client';
+import type {
+  IScopedClusterClient,
+  ElasticsearchRequestHandlerContext,
+} from '@kbn/core-elasticsearch-server';
 import type { InternalElasticsearchServiceStart } from './types';
 
-/**
- * Core's `elasticsearch` request handler context.
- * @public
- */
-export interface ElasticsearchRequestHandlerContext {
-  client: IScopedClusterClient;
-}
-
 /**
  * The {@link UiSettingsRequestHandlerContext} implementation.
  * @internal

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_service.test.mocks.ts

@@ -7,7 +7,9 @@
  */
 
 export const MockClusterClient = jest.fn();
-jest.mock('./client/cluster_client', () => ({ ClusterClient: MockClusterClient }));
+jest.mock('@kbn/core-elasticsearch-client-server-internal', () => ({
+  ClusterClient: MockClusterClient,
+}));
 
 export const isScriptingEnabledMock = jest.fn();
 jest.doMock('./is_scripting_enabled', () => ({

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_service.test.ts

@@ -16,9 +16,6 @@ jest.mock('./version_check/ensure_es_version', () => ({
   pollEsNodesVersion: jest.fn(),
 }));
 
-// Mocking the module to disable caching for tests
-jest.mock('../ui_settings/cache');
-
 import { MockClusterClient, isScriptingEnabledMock } from './elasticsearch_service.test.mocks';
 
 import type { NodesVersionCompatibility } from './version_check/ensure_es_version';
@@ -32,9 +29,9 @@ import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
 import { analyticsServiceMock } from '@kbn/core-analytics-server-mocks';
 import { executionContextServiceMock } from '@kbn/core-execution-context-server-mocks';
 import { httpServiceMock } from '@kbn/core-http-server-mocks';
+import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
 import { configSchema, ElasticsearchConfig } from './elasticsearch_config';
 import { ElasticsearchService, SetupDeps } from './elasticsearch_service';
-import { elasticsearchClientMock } from './client/mocks';
 import { duration } from 'moment';
 import { isValidConnection as isValidConnectionMock } from './is_valid_connection';
 import { pollEsNodesVersion as pollEsNodesVersionMocked } from './version_check/ensure_es_version';

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_service.ts

@@ -18,9 +18,13 @@ import type {
 } from '@kbn/core-execution-context-server-internal';
 import type { IAuthHeadersStorage } from '@kbn/core-http-server';
 import type { InternalHttpServiceSetup } from '@kbn/core-http-server-internal';
+import type {
+  UnauthorizedErrorHandler,
+  ElasticsearchClientConfig,
+} from '@kbn/core-elasticsearch-server';
+import { ClusterClient } from '@kbn/core-elasticsearch-client-server-internal';
 
 import { registerAnalyticsContextProvider } from './register_analytics_context_provider';
-import { ClusterClient, ElasticsearchClientConfig } from './client';
 import { ElasticsearchConfig, ElasticsearchConfigType } from './elasticsearch_config';
 import {
   InternalElasticsearchServicePreboot,
@@ -32,7 +36,6 @@ import { pollEsNodesVersion } from './version_check/ensure_es_version';
 import { calculateStatus$ } from './status';
 import { isValidConnection } from './is_valid_connection';
 import { isInlineScriptingEnabled } from './is_scripting_enabled';
-import type { UnauthorizedErrorHandler } from './client/retry_unauthorized';
 import { mergeConfig } from './merge_config';
 import { getClusterInfo$ } from './get_cluster_info';
 

packages/core/elasticsearch/core-elasticsearch-server-internal/src/get_cluster_info.test.ts

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { elasticsearchClientMock } from './client/mocks';
+import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
 import { firstValueFrom } from 'rxjs';
 import { getClusterInfo$ } from './get_cluster_info';
 

packages/core/elasticsearch/core-elasticsearch-server-internal/src/get_cluster_info.ts

@@ -8,7 +8,7 @@
 
 import type { Observable } from 'rxjs';
 import { defer, map, retry, shareReplay } from 'rxjs';
-import type { ElasticsearchClient } from './client';
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 
 /** @private */
 export interface ClusterInfo {

packages/core/elasticsearch/core-elasticsearch-server-internal/src/index.ts

@@ -7,45 +7,25 @@
  */
 
 export { ElasticsearchService } from './elasticsearch_service';
-export { config, configSchema } from './elasticsearch_config';
-export { ElasticsearchConfig } from './elasticsearch_config';
+export { config, configSchema, ElasticsearchConfig } from './elasticsearch_config';
+export type { ElasticsearchConfigType } from './elasticsearch_config';
 export type {
   NodesVersionCompatibility,
   PollEsNodesVersionOptions,
+  NodesInfo,
+  NodeInfo,
 } from './version_check/ensure_es_version';
 export type {
-  ElasticsearchServicePreboot,
-  ElasticsearchServiceSetup,
-  ElasticsearchServiceStart,
   ElasticsearchStatusMeta,
   InternalElasticsearchServicePreboot,
   InternalElasticsearchServiceSetup,
   InternalElasticsearchServiceStart,
-  FakeRequest,
-  ScopeableRequest,
-  ElasticsearchConfigPreboot,
 } from './types';
-export type {
-  IClusterClient,
-  ICustomClusterClient,
-  ElasticsearchClientConfig,
-  ElasticsearchClient,
-  IScopedClusterClient,
-  // unauthorized error handler
-  UnauthorizedErrorHandlerOptions,
-  UnauthorizedErrorHandlerResultRetryParams,
-  UnauthorizedErrorHandlerRetryResult,
-  UnauthorizedErrorHandlerNotHandledResult,
-  UnauthorizedErrorHandlerResult,
-  UnauthorizedErrorHandlerToolkit,
-  UnauthorizedErrorHandler,
-} from './client';
-export { getRequestDebugMeta, getErrorMessage } from './client';
 export { pollEsNodesVersion } from './version_check/ensure_es_version';
 export {
   isSupportedEsServer,
   isNotFoundFromUnsupportedServer,
-  PRODUCT_RESPONSE_HEADER,
 } from './supported_server_response_check';
 export { CoreElasticsearchRouteHandlerContext } from './elasticsearch_route_handler_context';
-export type { ElasticsearchRequestHandlerContext } from './elasticsearch_route_handler_context';
+export { retryCallCluster, migrationRetryCallCluster } from './retry_call_cluster';
+export { isInlineScriptingEnabled } from './is_scripting_enabled';

packages/core/elasticsearch/core-elasticsearch-server-internal/src/is_scripting_enabled.test.ts

@@ -7,14 +7,14 @@
  */
 
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
-import { elasticsearchServiceMock } from './elasticsearch_service.mock';
+import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
 import { isInlineScriptingEnabled } from './is_scripting_enabled';
 
 describe('isInlineScriptingEnabled', () => {
-  let client: ReturnType<typeof elasticsearchServiceMock.createElasticsearchClient>;
+  let client: ReturnType<typeof elasticsearchClientMock.createElasticsearchClient>;
 
   beforeEach(() => {
-    client = elasticsearchServiceMock.createElasticsearchClient();
+    client = elasticsearchClientMock.createElasticsearchClient();
   });
 
   const mockSettingsValue = (settings: estypes.ClusterGetSettingsResponse) => {

packages/core/elasticsearch/core-elasticsearch-server-internal/src/is_scripting_enabled.ts

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { ElasticsearchClient } from './client';
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 
 const scriptAllowedTypesKey = 'script.allowed_types';
 

packages/core/elasticsearch/core-elasticsearch-server-internal/src/merge_config.test.ts

@@ -6,8 +6,8 @@
  * Side Public License, v 1.
  */
 
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
 import { mergeConfig } from './merge_config';
-import type { ElasticsearchClientConfig } from './client';
 import { configSchema, ElasticsearchConfig } from './elasticsearch_config';
 
 const partialToConfig = (parts: Partial<ElasticsearchClientConfig>): ElasticsearchClientConfig => {

packages/core/elasticsearch/core-elasticsearch-server-internal/src/merge_config.ts

@@ -8,7 +8,7 @@
 
 import { merge } from '@kbn/std';
 import { Writable } from '@kbn/utility-types';
-import type { ElasticsearchClientConfig } from './client';
+import type { ElasticsearchClientConfig } from '@kbn/core-elasticsearch-server';
 
 type WritableConfig = Writable<ElasticsearchClientConfig>;
 

packages/core/elasticsearch/core-elasticsearch-server-internal/src/retry_call_cluster.test.ts

@@ -8,7 +8,7 @@
 
 import { errors } from '@elastic/elasticsearch';
 import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
-import { elasticsearchClientMock } from './mocks';
+import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
 import { retryCallCluster, migrationRetryCallCluster } from './retry_call_cluster';
 
 const dummyBody: any = { foo: 'bar' };

packages/core/elasticsearch/core-elasticsearch-server-internal/src/status.test.ts

@@ -9,11 +9,15 @@
 import { take } from 'rxjs/operators';
 import { Subject, of } from 'rxjs';
 
+import { ServiceStatusLevels, ServiceStatusLevel, ServiceStatus } from '@kbn/core-base-common';
 import { calculateStatus$ } from './status';
-import { ServiceStatusLevels, ServiceStatus } from '../status';
-import { ServiceStatusLevelSnapshotSerializer } from '../status/test_utils';
 import { NodesVersionCompatibility } from './version_check/ensure_es_version';
 
+const ServiceStatusLevelSnapshotSerializer: jest.SnapshotSerializerPlugin = {
+  test: (val: any) => Object.values(ServiceStatusLevels).includes(val),
+  serialize: (val: ServiceStatusLevel) => val.toString(),
+};
+
 expect.addSnapshotSerializer(ServiceStatusLevelSnapshotSerializer);
 
 const nodeInfo = {

packages/core/elasticsearch/core-elasticsearch-server-internal/src/status.ts

@@ -8,8 +8,7 @@
 
 import { Observable, merge, of } from 'rxjs';
 import { map } from 'rxjs/operators';
-
-import { ServiceStatus, ServiceStatusLevels } from '../status';
+import { ServiceStatus, ServiceStatusLevels } from '@kbn/core-base-common';
 import { ElasticsearchStatusMeta } from './types';
 import { NodesVersionCompatibility } from './version_check/ensure_es_version';
 

packages/core/elasticsearch/core-elasticsearch-server-internal/src/supported_server_response_check.ts

@@ -5,7 +5,9 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-export const PRODUCT_RESPONSE_HEADER = 'x-elastic-product';
+
+import { PRODUCT_RESPONSE_HEADER } from '@kbn/core-elasticsearch-client-server-internal';
+
 /**
  * Response headers check to determine if the response is from Elasticsearch
  * @param headers Response headers

packages/core/elasticsearch/core-elasticsearch-server-internal/src/types.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { Observable } from 'rxjs';
+import type {
+  ElasticsearchServicePreboot,
+  ElasticsearchServiceStart,
+  ElasticsearchServiceSetup,
+} from '@kbn/core-elasticsearch-server';
+import type { ServiceStatus } from '@kbn/core-base-common';
+import type { NodesVersionCompatibility, NodeInfo } from './version_check/ensure_es_version';
+import type { ClusterInfo } from './get_cluster_info';
+
+/** @internal */
+export type InternalElasticsearchServicePreboot = ElasticsearchServicePreboot;
+
+/** @internal */
+export interface InternalElasticsearchServiceSetup extends ElasticsearchServiceSetup {
+  clusterInfo$: Observable<ClusterInfo>;
+  esNodesCompatibility$: Observable<NodesVersionCompatibility>;
+  status$: Observable<ServiceStatus<ElasticsearchStatusMeta>>;
+}
+
+/**
+ * @internal
+ */
+export type InternalElasticsearchServiceStart = ElasticsearchServiceStart;
+
+/** @internal */
+export interface ElasticsearchStatusMeta {
+  warningNodes: NodeInfo[];
+  incompatibleNodes: NodeInfo[];
+  nodesInfoRequestError?: Error;
+}

packages/core/elasticsearch/core-elasticsearch-server-internal/src/version_check/ensure_es_version.test.ts

@@ -8,7 +8,7 @@
 
 import { mapNodesVersionCompatibility, pollEsNodesVersion, NodesInfo } from './ensure_es_version';
 import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
-import { elasticsearchClientMock } from '../client/mocks';
+import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
 import { take, delay } from 'rxjs/operators';
 import { TestScheduler } from 'rxjs/testing';
 import { of } from 'rxjs';

packages/core/elasticsearch/core-elasticsearch-server-internal/src/version_check/ensure_es_version.ts

@@ -14,11 +14,11 @@
 import { timer, of, from, Observable } from 'rxjs';
 import { map, distinctUntilChanged, catchError, exhaustMap } from 'rxjs/operators';
 import type { Logger } from '@kbn/logging';
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import {
   esVersionCompatibleWithKibana,
   esVersionEqualsKibana,
 } from './es_kibana_version_compatability';
-import type { ElasticsearchClient } from '../client';
 
 /** @public */
 export interface PollEsNodesVersionOptions {
@@ -29,7 +29,8 @@ export interface PollEsNodesVersionOptions {
   esVersionCheckInterval: number;
 }
 
-interface NodeInfo {
+/** @public */
+export interface NodeInfo {
   version: string;
   ip: string;
   http?: {

packages/core/elasticsearch/core-elasticsearch-server-internal/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "extends": "../../../../tsconfig.bazel.json",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "outDir": "target_types",
+    "rootDir": "src",
+    "stripInternal": false,
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "src/**/*"
+  ]
+}

packages/core/elasticsearch/core-elasticsearch-server-mocks/BUILD.bazel

@@ -0,0 +1,105 @@
+load("@npm//@bazel/typescript:index.bzl", "ts_config")
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler", "pkg_npm", "pkg_npm_types", "ts_project")
+
+PKG_DIRNAME = "core-elasticsearch-server-mocks"
+PKG_REQUIRE_NAME = "@kbn/core-elasticsearch-server-mocks"
+
+SOURCE_FILES = glob(
+  [
+    "src/**/*.ts",
+  ],
+  exclude = [
+    "**/*.test.*",
+    "**/*.stories.*",
+  ],
+)
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+]
+
+RUNTIME_DEPS = [
+  "@npm//rxjs",
+  "//packages/core/elasticsearch/core-elasticsearch-client-server-mocks",
+]
+
+TYPES_DEPS = [
+  "@npm//@types/node",
+  "@npm//@types/jest",
+  "@npm//rxjs",
+  "//packages/kbn-utility-types:npm_module_types",
+  "//packages/core/base/core-base-common:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-server:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-client-server-mocks:npm_module_types",
+  "//packages/core/elasticsearch/core-elasticsearch-server-internal:npm_module_types",
+]
+
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
+
+ts_config(
+  name = "tsconfig",
+  src = "tsconfig.json",
+  deps = [
+    "//:tsconfig.base.json",
+    "//:tsconfig.bazel.json",
+  ],
+)
+
+ts_project(
+  name = "tsc_types",
+  args = ['--pretty'],
+  srcs = SRCS,
+  deps = TYPES_DEPS,
+  declaration = True,
+  declaration_map = True,
+  emit_declaration_only = True,
+  out_dir = "target_types",
+  root_dir = "src",
+  tsconfig = ":tsconfig",
+)
+
+js_library(
+  name = PKG_DIRNAME,
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = RUNTIME_DEPS + [":target_node"],
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  deps = [":" + PKG_DIRNAME],
+)
+
+filegroup(
+  name = "build",
+  srcs = [":npm_module"],
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm_types(
+  name = "npm_module_types",
+  srcs = SRCS,
+  deps = [":tsc_types"],
+  package_name = PKG_REQUIRE_NAME,
+  tsconfig = ":tsconfig",
+  visibility = ["//visibility:public"],
+)
+
+filegroup(
+  name = "build_types",
+  srcs = [":npm_module_types"],
+  visibility = ["//visibility:public"],
+)

packages/core/elasticsearch/core-elasticsearch-server-mocks/README.md

@@ -0,0 +1,3 @@
+# @kbn/core-elasticsearch-server-mocks
+
+This package contains the mocks for Core's server-side elasticsearch service.

packages/core/elasticsearch/core-elasticsearch-server-mocks/jest.config.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/core/elasticsearch/core-elasticsearch-server-mocks'],
+};

packages/core/elasticsearch/core-elasticsearch-server-mocks/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@kbn/core-elasticsearch-server-mocks",
+  "private": true,
+  "version": "1.0.0",
+  "main": "./target_node/index.js",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}

packages/core/elasticsearch/core-elasticsearch-server-mocks/src/elasticsearch_service.mock.ts

@@ -11,21 +11,23 @@ import type { PublicMethodsOf } from '@kbn/utility-types';
 
 import {
   elasticsearchClientMock,
-  ClusterClientMock,
-  CustomClusterClientMock,
-} from './client/mocks';
-import { ElasticsearchClientConfig } from './client';
-import { ElasticsearchConfig } from './elasticsearch_config';
-import { ElasticsearchService } from './elasticsearch_service';
-import {
-  InternalElasticsearchServiceSetup,
+  type ClusterClientMock,
+  type CustomClusterClientMock,
+} from '@kbn/core-elasticsearch-client-server-mocks';
+import type {
+  ElasticsearchClientConfig,
   ElasticsearchServiceSetup,
-  ElasticsearchStatusMeta,
   ElasticsearchServicePreboot,
-} from './types';
-import { NodesVersionCompatibility } from './version_check/ensure_es_version';
-import { ServiceStatus, ServiceStatusLevels } from '../status';
-import type { ClusterInfo } from './get_cluster_info';
+} from '@kbn/core-elasticsearch-server';
+import type {
+  ElasticsearchConfig,
+  ElasticsearchService,
+  InternalElasticsearchServiceSetup,
+  ElasticsearchStatusMeta,
+  NodesVersionCompatibility,
+  ClusterInfo,
+} from '@kbn/core-elasticsearch-server-internal';
+import { type ServiceStatus, ServiceStatusLevels } from '@kbn/core-base-common';
 
 type MockedElasticSearchServicePreboot = jest.Mocked<ElasticsearchServicePreboot>;
 

packages/core/elasticsearch/core-elasticsearch-server-mocks/src/index.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { elasticsearchServiceMock } from './elasticsearch_service.mock';
+export type {
+  MockedElasticSearchServiceSetup,
+  MockedElasticSearchServiceStart,
+} from './elasticsearch_service.mock';

packages/core/elasticsearch/core-elasticsearch-server-mocks/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "extends": "../../../../tsconfig.bazel.json",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "outDir": "target_types",
+    "rootDir": "src",
+    "stripInternal": false,
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "src/**/*"
+  ]
+}

packages/core/elasticsearch/core-elasticsearch-server/BUILD.bazel

@@ -0,0 +1,102 @@
+load("@npm//@bazel/typescript:index.bzl", "ts_config")
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler", "pkg_npm", "pkg_npm_types", "ts_project")
+
+PKG_DIRNAME = "core-elasticsearch-server"
+PKG_REQUIRE_NAME = "@kbn/core-elasticsearch-server"
+
+SOURCE_FILES = glob(
+  [
+    "src/**/*.ts",
+  ],
+  exclude = [
+    "**/*.test.*",
+    "**/*.stories.*",
+  ],
+)
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+]
+
+RUNTIME_DEPS = [
+]
+
+TYPES_DEPS = [
+  "@npm//@types/node",
+  "@npm//@types/jest",
+  "@npm//moment",
+  "@npm//@elastic/elasticsearch",
+  "//packages/kbn-utility-types:npm_module_types",
+  "//packages/kbn-es-errors:npm_module_types",
+  "//packages/core/http/core-http-server:npm_module_types",
+]
+
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
+
+ts_config(
+  name = "tsconfig",
+  src = "tsconfig.json",
+  deps = [
+    "//:tsconfig.base.json",
+    "//:tsconfig.bazel.json",
+  ],
+)
+
+ts_project(
+  name = "tsc_types",
+  args = ['--pretty'],
+  srcs = SRCS,
+  deps = TYPES_DEPS,
+  declaration = True,
+  declaration_map = True,
+  emit_declaration_only = True,
+  out_dir = "target_types",
+  root_dir = "src",
+  tsconfig = ":tsconfig",
+)
+
+js_library(
+  name = PKG_DIRNAME,
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = RUNTIME_DEPS + [":target_node"],
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  deps = [":" + PKG_DIRNAME],
+)
+
+filegroup(
+  name = "build",
+  srcs = [":npm_module"],
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm_types(
+  name = "npm_module_types",
+  srcs = SRCS,
+  deps = [":tsc_types"],
+  package_name = PKG_REQUIRE_NAME,
+  tsconfig = ":tsconfig",
+  visibility = ["//visibility:public"],
+)
+
+filegroup(
+  name = "build_types",
+  srcs = [":npm_module_types"],
+  visibility = ["//visibility:public"],
+)

packages/core/elasticsearch/core-elasticsearch-server/README.md

@@ -0,0 +1,3 @@
+# @kbn/core-elasticsearch-server
+
+This package contains the public type for Core's server-side `elasticsearch` domain.

packages/core/elasticsearch/core-elasticsearch-server/jest.config.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/packages/core/elasticsearch/core-elasticsearch-server'],
+};

packages/core/elasticsearch/core-elasticsearch-server/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@kbn/core-elasticsearch-server",
+  "private": true,
+  "version": "1.0.0",
+  "main": "./target_node/index.js",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}

packages/core/elasticsearch/core-elasticsearch-server/src/client/client_config.ts

@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { Duration } from 'moment';
+
+/**
+ * Configuration options to be used to create a {@link IClusterClient | cluster client}
+ *
+ * @public
+ */
+export interface ElasticsearchClientConfig {
+  customHeaders: Record<string, string>;
+  requestHeadersWhitelist: string[];
+  maxSockets: number;
+  compression: boolean;
+  sniffOnStart: boolean;
+  sniffOnConnectionFault: boolean;
+  sniffInterval: false | Duration;
+  username?: string;
+  password?: string;
+  serviceAccountToken?: string;
+  hosts: string[];
+  keepAlive?: boolean;
+  pingTimeout?: Duration | number;
+  requestTimeout?: Duration | number;
+  caFingerprint?: string;
+  ssl?: ElasticsearchClientSslConfig;
+}
+
+/**
+ * @public
+ */
+export interface ElasticsearchClientSslConfig {
+  verificationMode?: 'none' | 'certificate' | 'full';
+  certificate?: string;
+  certificateAuthorities?: string[];
+  key?: string;
+  keyPassphrase?: string;
+  alwaysPresentCertificate?: boolean;
+}

packages/core/elasticsearch/core-elasticsearch-server/src/client/cluster_client.ts

@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { ElasticsearchClient } from './client';
+import { ScopeableRequest } from './scopeable_request';
+import { IScopedClusterClient } from './scoped_cluster_client';
+
+/**
+ * Represents an Elasticsearch cluster API client created by the platform.
+ * It allows to call API on behalf of the internal Kibana user and
+ * the actual user that is derived from the request headers (via `asScoped(...)`).
+ *
+ * @public
+ **/
+export interface IClusterClient {
+  /**
+   * A {@link ElasticsearchClient | client} to be used to query the ES cluster on behalf of the Kibana internal user
+   */
+  readonly asInternalUser: ElasticsearchClient;
+  /**
+   * Creates a {@link IScopedClusterClient | scoped cluster client} bound to given {@link ScopeableRequest | request}
+   */
+  asScoped: (request: ScopeableRequest) => IScopedClusterClient;
+}
+
+/**
+ * See {@link IClusterClient}
+ *
+ * @public
+ */
+export interface ICustomClusterClient extends IClusterClient {
+  /**
+   * Closes the cluster client. After that client cannot be used and one should
+   * create a new client instance to be able to interact with Elasticsearch API.
+   */
+  close: () => Promise<void>;
+}

packages/core/elasticsearch/core-elasticsearch-server/src/client/index.ts

@@ -6,21 +6,17 @@
  * Side Public License, v 1.
  */
 
-export type { ElasticsearchClient } from './types';
-export { ScopedClusterClient } from './scoped_cluster_client';
-export type { IScopedClusterClient } from './scoped_cluster_client';
-export type { ElasticsearchClientConfig } from './client_config';
-export { ClusterClient } from './cluster_client';
+export type { ElasticsearchClient } from './client';
 export type { IClusterClient, ICustomClusterClient } from './cluster_client';
-export { configureClient } from './configure_client';
-export { getRequestDebugMeta, getErrorMessage } from './log_query_and_deprecation';
-export { retryCallCluster, migrationRetryCallCluster } from './retry_call_cluster';
+export type { ScopeableRequest, FakeRequest } from './scopeable_request';
+export type { IScopedClusterClient } from './scoped_cluster_client';
 export type {
+  UnauthorizedErrorHandler,
   UnauthorizedErrorHandlerOptions,
+  UnauthorizedErrorHandlerResult,
   UnauthorizedErrorHandlerResultRetryParams,
+  UnauthorizedErrorHandlerToolkit,
   UnauthorizedErrorHandlerRetryResult,
   UnauthorizedErrorHandlerNotHandledResult,
-  UnauthorizedErrorHandlerResult,
-  UnauthorizedErrorHandlerToolkit,
-  UnauthorizedErrorHandler,
-} from './retry_unauthorized';
+} from './unauthorized_error_handler';
+export type { ElasticsearchClientConfig, ElasticsearchClientSslConfig } from './client_config';

packages/core/elasticsearch/core-elasticsearch-server/src/client/scopeable_request.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { Headers, KibanaRequest } from '@kbn/core-http-server';
+
+/**
+ * Fake request object created manually by Kibana plugins.
+ * @public
+ */
+export interface FakeRequest {
+  /** Headers used for authentication against Elasticsearch */
+  headers: Headers;
+}
+
+/**
+ A user credentials container.
+ * It accommodates the necessary auth credentials to impersonate the current user.
+ *
+ * @public
+ * See {@link KibanaRequest}.
+ */
+export type ScopeableRequest = KibanaRequest | FakeRequest;

packages/core/elasticsearch/core-elasticsearch-server/src/client/scoped_cluster_client.ts

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { ElasticsearchClient } from './types';
+import { ElasticsearchClient } from './client';
 
 /**
  * Serves the same purpose as the normal {@link IClusterClient | cluster client} but exposes
@@ -28,11 +28,3 @@ export interface IScopedClusterClient {
    */
   readonly asCurrentUser: ElasticsearchClient;
 }
-
-/** @internal **/
-export class ScopedClusterClient implements IScopedClusterClient {
-  constructor(
-    public readonly asInternalUser: ElasticsearchClient,
-    public readonly asCurrentUser: ElasticsearchClient
-  ) {}
-}

packages/core/elasticsearch/core-elasticsearch-server/src/client/unauthorized_error_handler.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { MaybePromise } from '@kbn/utility-types';
+import type { UnauthorizedError } from '@kbn/es-errors';
+import type { AuthHeaders, KibanaRequest } from '@kbn/core-http-server';
+
+/**
+ * @public
+ */
+export interface UnauthorizedErrorHandlerOptions {
+  error: UnauthorizedError;
+  request: KibanaRequest;
+}
+
+/**
+ * @public
+ */
+export interface UnauthorizedErrorHandlerResultRetryParams {
+  authHeaders: AuthHeaders;
+}
+
+/**
+ * @public
+ */
+export interface UnauthorizedErrorHandlerRetryResult
+  extends UnauthorizedErrorHandlerResultRetryParams {
+  type: 'retry';
+}
+
+/**
+ * @public
+ */
+export interface UnauthorizedErrorHandlerNotHandledResult {
+  type: 'notHandled';
+}
+
+/**
+ * @public
+ */
+export type UnauthorizedErrorHandlerResult =
+  | UnauthorizedErrorHandlerRetryResult
+  | UnauthorizedErrorHandlerNotHandledResult;
+
+/**
+ * Toolkit passed to a {@link UnauthorizedErrorHandler} used to generate responses from the handler
+ * @public
+ */
+export interface UnauthorizedErrorHandlerToolkit {
+  /**
+   * The handler cannot handle the error, or was not able to authenticate.
+   */
+  notHandled: () => UnauthorizedErrorHandlerNotHandledResult;
+  /**
+   * The handler was able to authenticate. Will retry the failed request with new auth headers
+   */
+  retry: (params: UnauthorizedErrorHandlerResultRetryParams) => UnauthorizedErrorHandlerRetryResult;
+}
+
+/**
+ * A handler used to handle unauthorized error returned by elasticsearch
+ *
+ * @public
+ */
+export type UnauthorizedErrorHandler = (
+  options: UnauthorizedErrorHandlerOptions,
+  toolkit: UnauthorizedErrorHandlerToolkit
+) => MaybePromise<UnauthorizedErrorHandlerResult>;

packages/core/elasticsearch/core-elasticsearch-server/src/contracts.ts

@@ -7,13 +7,13 @@
  */
 
 import { Observable } from 'rxjs';
-import type { Headers, KibanaRequest } from '@kbn/core-http-server';
-import { ElasticsearchConfig } from './elasticsearch_config';
-import { IClusterClient, ICustomClusterClient, ElasticsearchClientConfig } from './client';
-import { NodesVersionCompatibility } from './version_check/ensure_es_version';
-import { ServiceStatus } from '../status';
-import type { UnauthorizedErrorHandler } from './client/retry_unauthorized';
-import { ClusterInfo } from './get_cluster_info';
+import type {
+  IClusterClient,
+  ICustomClusterClient,
+  ElasticsearchClientConfig,
+  UnauthorizedErrorHandler,
+} from './client';
+import { IElasticsearchConfig } from './elasticsearch_config';
 
 /**
  * @public
@@ -88,20 +88,10 @@ export interface ElasticsearchServiceSetup {
      *
      * @deprecated Can be removed when https://github.com/elastic/kibana/issues/119862 is done.
      */
-    readonly config$: Observable<ElasticsearchConfig>;
+    readonly config$: Observable<IElasticsearchConfig>;
   };
 }
 
-/** @internal */
-export type InternalElasticsearchServicePreboot = ElasticsearchServicePreboot;
-
-/** @internal */
-export interface InternalElasticsearchServiceSetup extends ElasticsearchServiceSetup {
-  clusterInfo$: Observable<ClusterInfo>;
-  esNodesCompatibility$: Observable<NodesVersionCompatibility>;
-  status$: Observable<ServiceStatus<ElasticsearchStatusMeta>>;
-}
-
 /**
  * @public
  */
@@ -138,36 +128,6 @@ export interface ElasticsearchServiceStart {
   ) => ICustomClusterClient;
 }
 
-/**
- * @internal
- */
-export type InternalElasticsearchServiceStart = ElasticsearchServiceStart;
-
-/** @public */
-export interface ElasticsearchStatusMeta {
-  warningNodes: NodesVersionCompatibility['warningNodes'];
-  incompatibleNodes: NodesVersionCompatibility['incompatibleNodes'];
-  nodesInfoRequestError?: NodesVersionCompatibility['nodesInfoRequestError'];
-}
-
-/**
- * Fake request object created manually by Kibana plugins.
- * @public
- */
-export interface FakeRequest {
-  /** Headers used for authentication against Elasticsearch */
-  headers: Headers;
-}
-
-/**
- A user credentials container.
- * It accommodates the necessary auth credentials to impersonate the current user.
- *
- * @public
- * See {@link KibanaRequest}.
- */
-export type ScopeableRequest = KibanaRequest | FakeRequest;
-
 /**
  * A limited set of Elasticsearch configuration entries exposed to the `preboot` plugins at `setup`.
  *

packages/core/elasticsearch/core-elasticsearch-server/src/elasticsearch_config.ts

@@ -0,0 +1,144 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { Duration } from 'moment';
+
+/**
+ * @public
+ */
+export interface IElasticsearchConfig {
+  /**
+   * The interval between health check requests Kibana sends to the Elasticsearch.
+   */
+  readonly healthCheckDelay: Duration;
+
+  /**
+   * Whether to allow kibana to connect to a non-compatible elasticsearch node.
+   */
+  readonly ignoreVersionMismatch: boolean;
+
+  /**
+   * Version of the Elasticsearch (6.7, 7.1 or `master`) client will be connecting to.
+   */
+  readonly apiVersion: string;
+
+  /**
+   * The maximum number of sockets that can be used for communications with elasticsearch.
+   */
+  readonly maxSockets: number;
+
+  /**
+   * Whether to use compression for communications with elasticsearch.
+   */
+  readonly compression: boolean;
+
+  /**
+   * Hosts that the client will connect to. If sniffing is enabled, this list will
+   * be used as seeds to discover the rest of your cluster.
+   */
+  readonly hosts: string[];
+
+  /**
+   * List of Kibana client-side headers to send to Elasticsearch when request
+   * scoped cluster client is used. If this is an empty array then *no* client-side
+   * will be sent.
+   */
+  readonly requestHeadersWhitelist: string[];
+
+  /**
+   * Timeout after which PING HTTP request will be aborted and retried.
+   */
+  readonly pingTimeout: Duration;
+
+  /**
+   * Timeout after which HTTP request will be aborted and retried.
+   */
+  readonly requestTimeout: Duration;
+
+  /**
+   * Timeout for Elasticsearch to wait for responses from shards. Set to 0 to disable.
+   */
+  readonly shardTimeout: Duration;
+
+  /**
+   * Specifies whether the client should attempt to detect the rest of the cluster
+   * when it is first instantiated.
+   */
+  readonly sniffOnStart: boolean;
+
+  /**
+   * Interval to perform a sniff operation and make sure the list of nodes is complete.
+   * If `false` then sniffing is disabled.
+   */
+  readonly sniffInterval: false | Duration;
+
+  /**
+   * Specifies whether the client should immediately sniff for a more current list
+   * of nodes when a connection dies.
+   */
+  readonly sniffOnConnectionFault: boolean;
+
+  /**
+   * If Elasticsearch is protected with basic authentication, this setting provides
+   * the username that the Kibana server uses to perform its administrative functions.
+   * Cannot be used in conjunction with serviceAccountToken.
+   */
+  readonly username?: string;
+
+  /**
+   * If Elasticsearch is protected with basic authentication, this setting provides
+   * the password that the Kibana server uses to perform its administrative functions.
+   */
+  readonly password?: string;
+
+  /**
+   * If Elasticsearch security features are enabled, this setting provides the service account
+   * token that the Kibana server users to perform its administrative functions.
+   *
+   * This is an alternative to specifying a username and password.
+   */
+  readonly serviceAccountToken?: string;
+
+  /**
+   * Header names and values to send to Elasticsearch with every request. These
+   * headers cannot be overwritten by client-side headers and aren't affected by
+   * `requestHeadersWhitelist` configuration.
+   */
+  readonly customHeaders: Record<string, string>;
+
+  /**
+   * @internal
+   * Only valid in dev mode. Skip the valid connection check during startup. The connection check allows
+   * Kibana to ensure that the Elasticsearch connection is valid before allowing
+   * any other services to be set up.
+   *
+   * @remarks
+   * You should disable this check at your own risk: Other services in Kibana
+   * may fail if this step is not completed.
+   */
+  readonly skipStartupConnectionCheck: boolean;
+
+  /**
+   * Set of settings configure SSL connection between Kibana and Elasticsearch that
+   * are required when `xpack.ssl.verification_mode` in Elasticsearch is set to
+   * either `certificate` or `full`.
+   */
+  readonly ssl: ElasticsearchSslConfig;
+}
+
+/**
+ * @public
+ */
+export interface ElasticsearchSslConfig {
+  verificationMode: 'none' | 'certificate' | 'full';
+  certificate?: string;
+  certificateAuthorities?: string[];
+  key?: string;
+  keyPassphrase?: string;
+  alwaysPresentCertificate: boolean;
+}

packages/core/elasticsearch/core-elasticsearch-server/src/index.ts

@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export type {
+  ElasticsearchClient,
+  IScopedClusterClient,
+  IClusterClient,
+  ICustomClusterClient,
+  ScopeableRequest,
+  UnauthorizedErrorHandlerResult,
+  UnauthorizedErrorHandler,
+  UnauthorizedErrorHandlerRetryResult,
+  UnauthorizedErrorHandlerToolkit,
+  UnauthorizedErrorHandlerResultRetryParams,
+  UnauthorizedErrorHandlerNotHandledResult,
+  UnauthorizedErrorHandlerOptions,
+  FakeRequest,
+  ElasticsearchClientSslConfig,
+  ElasticsearchClientConfig,
+} from './client';
+
+export type {
+  ElasticsearchConfigPreboot,
+  ElasticsearchServicePreboot,
+  ElasticsearchServiceStart,
+  ElasticsearchServiceSetup,
+} from './contracts';
+export type { IElasticsearchConfig, ElasticsearchSslConfig } from './elasticsearch_config';
+export type { ElasticsearchRequestHandlerContext } from './request_handler_context';

packages/core/elasticsearch/core-elasticsearch-server/src/request_handler_context.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { IScopedClusterClient } from './client';
+
+/**
+ * Core's `elasticsearch` request handler context.
+ * @public
+ */
+export interface ElasticsearchRequestHandlerContext {
+  client: IScopedClusterClient;
+}

packages/core/elasticsearch/core-elasticsearch-server/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "extends": "../../../../tsconfig.bazel.json",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "outDir": "target_types",
+    "rootDir": "src",
+    "stripInternal": false,
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "src/**/*"
+  ]
+}

src/cli_setup/utils.ts

@@ -13,8 +13,8 @@ import { merge } from 'lodash';
 import { kibanaPackageJson } from '@kbn/utils';
 
 import { Logger } from '@kbn/core/server';
-import { ClusterClient } from '@kbn/core/server/elasticsearch/client';
-import { configSchema } from '@kbn/core/server/elasticsearch';
+import { ClusterClient } from '@kbn/core-elasticsearch-client-server-internal';
+import { configSchema } from '@kbn/core-elasticsearch-server-internal';
 import { ElasticsearchService } from '@kbn/interactive-setup-plugin/server/elasticsearch_service';
 import { KibanaConfigWriter } from '@kbn/interactive-setup-plugin/server/kibana_config_writer';
 import type { EnrollmentToken } from '@kbn/interactive-setup-plugin/common';

src/core/server/core_route_handler_context.ts

@@ -7,15 +7,13 @@
  */
 
 import type { KibanaRequest } from '@kbn/core-http-server';
+import type { ElasticsearchRequestHandlerContext } from '@kbn/core-elasticsearch-server';
+import { CoreElasticsearchRouteHandlerContext } from '@kbn/core-elasticsearch-server-internal';
 import type { InternalCoreStart } from './internal_types';
 import {
   CoreSavedObjectsRouteHandlerContext,
   SavedObjectsRequestHandlerContext,
 } from './saved_objects';
-import {
-  CoreElasticsearchRouteHandlerContext,
-  ElasticsearchRequestHandlerContext,
-} from './elasticsearch';
 import { CoreUiSettingsRouteHandlerContext, UiSettingsRequestHandlerContext } from './ui_settings';
 import {
   CoreDeprecationsRouteHandlerContext,