@xeonr/telemetry 0.0.0-stage → 0.1.0

package/dist/keys.js

@@ -0,0 +1,90 @@
+// Code generated by scripts/gen-keys.mjs from keys.json. DO NOT EDIT.
+// Vocabulary version 1.
+export const VOCABULARY_VERSION = 1;
+/** Subject is the verified principal's full URN (urn:xeonr:auth:uid:user:88, a service account, a client, an API key's owner or the key itself). Never a bare id. */
+export const KeySubject = "xeonr.subject";
+export const FieldSubject = "subject";
+/** SubjectKind is derived from Subject's URN prefix (SubjectKind func): user, service_account, client, api_key, team; anonymous for an unauthenticated request, system for a job with no caller, unknown for a URN with no recognised prefix. */
+export const KeySubjectKind = "xeonr.subject.kind";
+export const FieldSubjectKind = "subject_kind";
+/** OrgID is the auth organisation id (Principal.OrganisationID). Not Lantern's org.id resource attribute. */
+export const KeyOrgID = "xeonr.org.id";
+export const FieldOrgID = "org_id";
+/** ClientID is the OAuth client the token was issued to. */
+export const KeyClientID = "xeonr.client.id";
+export const FieldClientID = "client_id";
+/** ApplicationID is the auth application the token was minted for. */
+export const KeyApplicationID = "xeonr.application.id";
+export const FieldApplicationID = "application_id";
+/** DelegatorApp is the product acting for the user on an RFC 8693 exchanged token; empty unless delegated. */
+export const KeyDelegatorApp = "xeonr.delegator.app";
+export const FieldDelegatorApp = "delegator_app";
+/** APIKeyID is the API key's URN when a key authenticated the request. */
+export const KeyAPIKeyID = "xeonr.api_key.id";
+export const FieldAPIKeyID = "api_key_id";
+/** AuthMethod is how the caller authenticated: bearer, cookie, api_key, or none. */
+export const KeyAuthMethod = "xeonr.auth.method";
+export const FieldAuthMethod = "auth_method";
+/** OriginSubject is the subject at the entry of the trace. It survives a service-account hop through baggage from trusted in-cluster peers. */
+export const KeyOriginSubject = "xeonr.origin.subject";
+export const FieldOriginSubject = "origin_subject";
+/** OriginService is the service.name of the trace's entry service. */
+export const KeyOriginService = "xeonr.origin.service";
+export const FieldOriginService = "origin_service";
+/** TeamURN is the team the request acts on (resource ownership), set by the handler with SetTeam. Never the caller's membership list. */
+export const KeyTeamURN = "xeonr.team.urn";
+export const FieldTeamURN = "team_urn";
+/** ResourceType is the kind of the request's target, set with SetResource. */
+export const KeyResourceType = "xeonr.resource.type";
+export const FieldResourceType = "resource_type";
+/** ResourceID is the target's id, set with SetResource. */
+export const KeyResourceID = "xeonr.resource.id";
+export const FieldResourceID = "resource_id";
+/** ResourceURN is the target's URN, set with SetResource. */
+export const KeyResourceURN = "xeonr.resource.urn";
+export const FieldResourceURN = "resource_urn";
+/** Scopes are the token's scopes. They go on the RPC server span only: Attributes and Fields leave them out. */
+export const KeyScopes = "xeonr.scopes";
+/** JobName is the background job's name (trail.outbox.flush), set by StartJob. */
+export const KeyJobName = "xeonr.job.name";
+export const FieldJobName = "job";
+/** JobRunID identifies one run of the job, set by StartJob. */
+export const KeyJobRunID = "xeonr.job.run_id";
+export const FieldJobRunID = "job_run_id";
+/** JobTrigger is what started the job (cron, queue, request), set by StartJob's Trigger option. */
+export const KeyJobTrigger = "xeonr.job.trigger";
+export const FieldJobTrigger = "job_trigger";
+/** the Connect procedure of the request a log line belongs to */
+export const FieldProcedure = "procedure";
+/** the Connect code of a finished RPC */
+export const FieldStatus = "status";
+/** how long the RPC or job took, in milliseconds */
+export const FieldDurationMS = "duration_ms";
+/** the resolved client address (connectmw.ClientIPResolver) */
+export const FieldIP = "ip";
+/** true on a span whose request or job panicked */
+export const KeyPanic = "xeonr.panic";
+/** The §4.2 table in order. */
+export const IDENTITY_KEYS = [
+    { "field": "Subject", "prop": "subject", "span": "xeonr.subject", "log": "subject" },
+    { "field": "SubjectKind", "prop": "subjectKind", "span": "xeonr.subject.kind", "log": "subject_kind" },
+    { "field": "OrgID", "prop": "orgId", "span": "xeonr.org.id", "log": "org_id", "baggage": true },
+    { "field": "ClientID", "prop": "clientId", "span": "xeonr.client.id", "log": "client_id" },
+    { "field": "ApplicationID", "prop": "applicationId", "span": "xeonr.application.id", "log": "application_id" },
+    { "field": "DelegatorApp", "prop": "delegatorApp", "span": "xeonr.delegator.app", "log": "delegator_app" },
+    { "field": "APIKeyID", "prop": "apiKeyId", "span": "xeonr.api_key.id", "log": "api_key_id" },
+    { "field": "AuthMethod", "prop": "authMethod", "span": "xeonr.auth.method", "log": "auth_method" },
+    { "field": "OriginSubject", "prop": "originSubject", "span": "xeonr.origin.subject", "log": "origin_subject", "baggage": true },
+    { "field": "OriginService", "prop": "originService", "span": "xeonr.origin.service", "log": "origin_service", "baggage": true },
+    { "field": "TeamURN", "prop": "teamUrn", "span": "xeonr.team.urn", "log": "team_urn" },
+    { "field": "ResourceType", "prop": "resourceType", "span": "xeonr.resource.type", "log": "resource_type" },
+    { "field": "ResourceID", "prop": "resourceId", "span": "xeonr.resource.id", "log": "resource_id" },
+    { "field": "ResourceURN", "prop": "resourceUrn", "span": "xeonr.resource.urn", "log": "resource_urn" },
+    { "field": "Scopes", "prop": "scopes", "span": "xeonr.scopes", "rpcServerSpanOnly": true },
+    { "field": "JobName", "prop": "jobName", "span": "xeonr.job.name", "log": "job" },
+    { "field": "JobRunID", "prop": "jobRunId", "span": "xeonr.job.run_id", "log": "job_run_id" },
+    { "field": "JobTrigger", "prop": "jobTrigger", "span": "xeonr.job.trigger", "log": "job_trigger" },
+];
+/** The baggage members, in table order: nothing else ever travels as baggage. */
+export const BAGGAGE_KEYS = ["xeonr.org.id", "xeonr.origin.subject", "xeonr.origin.service"];
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,wBAAwB;AAYxB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,qKAAqK;AACrK,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAC;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AACtC,iPAAiP;AACjP,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAC/C,6GAA6G;AAC7G,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC;AACvC,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AACnC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AACzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AACnD,8GAA8G;AAC9G,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,+IAA+I;AAC/I,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AACnD,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AACnD,yIAAyI;AACzI,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AACvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAC/C,gHAAgH;AAChH,MAAM,CAAC,MAAM,SAAS,GAAG,cAAc,CAAC;AACxC,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAClC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAC1C,yCAAyC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AACpC,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAEtC,+BAA+B;AAC/B,MAAM,CAAC,MAAM,aAAa,GAA2B;IACpD,EAAC,OAAO,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,EAAC,MAAM,EAAC,eAAe,EAAC,KAAK,EAAC,SAAS,EAAC;IAC3E,EAAC,OAAO,EAAC,aAAa,EAAC,MAAM,EAAC,aAAa,EAAC,MAAM,EAAC,oBAAoB,EAAC,KAAK,EAAC,cAAc,EAAC;IAC7F,EAAC,OAAO,EAAC,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,EAAC,cAAc,EAAC,KAAK,EAAC,QAAQ,EAAC,SAAS,EAAC,IAAI,EAAC;IACpF,EAAC,OAAO,EAAC,UAAU,EAAC,MAAM,EAAC,UAAU,EAAC,MAAM,EAAC,iBAAiB,EAAC,KAAK,EAAC,WAAW,EAAC;IACjF,EAAC,OAAO,EAAC,eAAe,EAAC,MAAM,EAAC,eAAe,EAAC,MAAM,EAAC,sBAAsB,EAAC,KAAK,EAAC,gBAAgB,EAAC;IACrG,EAAC,OAAO,EAAC,cAAc,EAAC,MAAM,EAAC,cAAc,EAAC,MAAM,EAAC,qBAAqB,EAAC,KAAK,EAAC,eAAe,EAAC;IACjG,EAAC,OAAO,EAAC,UAAU,EAAC,MAAM,EAAC,UAAU,EAAC,MAAM,EAAC,kBAAkB,EAAC,KAAK,EAAC,YAAY,EAAC;IACnF,EAAC,OAAO,EAAC,YAAY,EAAC,MAAM,EAAC,YAAY,EAAC,MAAM,EAAC,mBAAmB,EAAC,KAAK,EAAC,aAAa,EAAC;IACzF,EAAC,OAAO,EAAC,eAAe,EAAC,MAAM,EAAC,eAAe,EAAC,MAAM,EAAC,sBAAsB,EAAC,KAAK,EAAC,gBAAgB,EAAC,SAAS,EAAC,IAAI,EAAC;IACpH,EAAC,OAAO,EAAC,eAAe,EAAC,MAAM,EAAC,eAAe,EAAC,MAAM,EAAC,sBAAsB,EAAC,KAAK,EAAC,gBAAgB,EAAC,SAAS,EAAC,IAAI,EAAC;IACpH,EAAC,OAAO,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,EAAC,MAAM,EAAC,gBAAgB,EAAC,KAAK,EAAC,UAAU,EAAC;IAC7E,EAAC,OAAO,EAAC,cAAc,EAAC,MAAM,EAAC,cAAc,EAAC,MAAM,EAAC,qBAAqB,EAAC,KAAK,EAAC,eAAe,EAAC;IACjG,EAAC,OAAO,EAAC,YAAY,EAAC,MAAM,EAAC,YAAY,EAAC,MAAM,EAAC,mBAAmB,EAAC,KAAK,EAAC,aAAa,EAAC;IACzF,EAAC,OAAO,EAAC,aAAa,EAAC,MAAM,EAAC,aAAa,EAAC,MAAM,EAAC,oBAAoB,EAAC,KAAK,EAAC,cAAc,EAAC;IAC7F,EAAC,OAAO,EAAC,QAAQ,EAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,EAAC,cAAc,EAAC,mBAAmB,EAAC,IAAI,EAAC;IACjF,EAAC,OAAO,EAAC,SAAS,EAAC,MAAM,EAAC,SAAS,EAAC,MAAM,EAAC,gBAAgB,EAAC,KAAK,EAAC,KAAK,EAAC;IACxE,EAAC,OAAO,EAAC,UAAU,EAAC,MAAM,EAAC,UAAU,EAAC,MAAM,EAAC,kBAAkB,EAAC,KAAK,EAAC,YAAY,EAAC;IACnF,EAAC,OAAO,EAAC,YAAY,EAAC,MAAM,EAAC,YAAY,EAAC,MAAM,EAAC,mBAAmB,EAAC,KAAK,EAAC,aAAa,EAAC;CACzF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAsB,CAAC,cAAc,EAAC,sBAAsB,EAAC,sBAAsB,CAAC,CAAC"}

package/dist/keys.json

@@ -0,0 +1,127 @@
+{
+  "$comment": "The fleet's identity vocabulary (observability plan §4.2). telemetry/keys_gen.go is generated from this file (go generate ./telemetry); @xeonr/telemetry (Node) compares its own constants against it. One key per concept: the log field is the span key without `xeonr.`, dots as underscores, except where the table names a shorter field. Keys are dots only and never collide with Lantern's direct-column aliases or resource namespaces.",
+  "version": 1,
+  "identity": [
+    {
+      "field": "Subject",
+      "span": "xeonr.subject",
+      "log": "subject",
+      "doc": "Subject is the verified principal's full URN (urn:xeonr:auth:uid:user:88, a service account, a client, an API key's owner or the key itself). Never a bare id."
+    },
+    {
+      "field": "SubjectKind",
+      "span": "xeonr.subject.kind",
+      "log": "subject_kind",
+      "values": ["user", "service_account", "client", "api_key", "team", "anonymous", "system", "unknown"],
+      "doc": "SubjectKind is derived from Subject's URN prefix (SubjectKind func): user, service_account, client, api_key, team; anonymous for an unauthenticated request, system for a job with no caller, unknown for a URN with no recognised prefix."
+    },
+    {
+      "field": "OrgID",
+      "span": "xeonr.org.id",
+      "log": "org_id",
+      "baggage": true,
+      "doc": "OrgID is the auth organisation id (Principal.OrganisationID). Not Lantern's org.id resource attribute."
+    },
+    {
+      "field": "ClientID",
+      "span": "xeonr.client.id",
+      "log": "client_id",
+      "doc": "ClientID is the OAuth client the token was issued to."
+    },
+    {
+      "field": "ApplicationID",
+      "span": "xeonr.application.id",
+      "log": "application_id",
+      "doc": "ApplicationID is the auth application the token was minted for."
+    },
+    {
+      "field": "DelegatorApp",
+      "span": "xeonr.delegator.app",
+      "log": "delegator_app",
+      "doc": "DelegatorApp is the product acting for the user on an RFC 8693 exchanged token; empty unless delegated."
+    },
+    {
+      "field": "APIKeyID",
+      "span": "xeonr.api_key.id",
+      "log": "api_key_id",
+      "doc": "APIKeyID is the API key's URN when a key authenticated the request."
+    },
+    {
+      "field": "AuthMethod",
+      "span": "xeonr.auth.method",
+      "log": "auth_method",
+      "values": ["bearer", "cookie", "api_key", "none"],
+      "doc": "AuthMethod is how the caller authenticated: bearer, cookie, api_key, or none."
+    },
+    {
+      "field": "OriginSubject",
+      "span": "xeonr.origin.subject",
+      "log": "origin_subject",
+      "baggage": true,
+      "doc": "OriginSubject is the subject at the entry of the trace. It survives a service-account hop through baggage from trusted in-cluster peers."
+    },
+    {
+      "field": "OriginService",
+      "span": "xeonr.origin.service",
+      "log": "origin_service",
+      "baggage": true,
+      "doc": "OriginService is the service.name of the trace's entry service."
+    },
+    {
+      "field": "TeamURN",
+      "span": "xeonr.team.urn",
+      "log": "team_urn",
+      "doc": "TeamURN is the team the request acts on (resource ownership), set by the handler with SetTeam. Never the caller's membership list."
+    },
+    {
+      "field": "ResourceType",
+      "span": "xeonr.resource.type",
+      "log": "resource_type",
+      "doc": "ResourceType is the kind of the request's target, set with SetResource."
+    },
+    {
+      "field": "ResourceID",
+      "span": "xeonr.resource.id",
+      "log": "resource_id",
+      "doc": "ResourceID is the target's id, set with SetResource."
+    },
+    {
+      "field": "ResourceURN",
+      "span": "xeonr.resource.urn",
+      "log": "resource_urn",
+      "doc": "ResourceURN is the target's URN, set with SetResource."
+    },
+    {
+      "field": "Scopes",
+      "span": "xeonr.scopes",
+      "type": "[]string",
+      "rpc_server_span_only": true,
+      "doc": "Scopes are the token's scopes. They go on the RPC server span only: Attributes and Fields leave them out."
+    },
+    {
+      "field": "JobName",
+      "span": "xeonr.job.name",
+      "log": "job",
+      "doc": "JobName is the background job's name (trail.outbox.flush), set by StartJob."
+    },
+    {
+      "field": "JobRunID",
+      "span": "xeonr.job.run_id",
+      "log": "job_run_id",
+      "doc": "JobRunID identifies one run of the job, set by StartJob."
+    },
+    {
+      "field": "JobTrigger",
+      "span": "xeonr.job.trigger",
+      "log": "job_trigger",
+      "doc": "JobTrigger is what started the job (cron, queue, request), set by StartJob's Trigger option."
+    }
+  ],
+  "other": [
+    {"name": "Procedure", "log": "procedure", "doc": "the Connect procedure of the request a log line belongs to"},
+    {"name": "Status", "log": "status", "doc": "the Connect code of a finished RPC"},
+    {"name": "DurationMS", "log": "duration_ms", "doc": "how long the RPC or job took, in milliseconds"},
+    {"name": "IP", "log": "ip", "doc": "the resolved client address (connectmw.ClientIPResolver)"},
+    {"name": "Panic", "span": "xeonr.panic", "doc": "true on a span whose request or job panicked"}
+  ]
+}

package/dist/log.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `@xeonr/telemetry/log`: the service's pino logger (obs.node-telemetry,
+ * observability plan §5.6/§6), the Node counterpart of logrus with
+ * go-platform's telemetry.LogrusHook:
+ *
+ * - JSON on stdout only, `level`/`time`/`msg` as logrus writes them, `time`
+ *   in RFC 3339;
+ * - `trace_id`, `span_id`, `trace_flags`, every §4.2 field of the request's
+ *   identity, `procedure` and `ip`, from the active context. A field the call
+ *   passes itself wins;
+ * - credentials redacted by key, error texts sanitised;
+ * - an Error line inside a recording span is mirrored as a span event, so the
+ *   error's text reaches the trace although logs are never shipped.
+ */
+import { type Context } from "@opentelemetry/api";
+import pino, { type Logger, type LoggerOptions } from "pino";
+export type { Logger } from "pino";
+/** Keys whose values are never logged, at the top level and one level down. */
+export declare const REDACT_KEYS: string[];
+/** The fields the active context adds to a line. */
+export declare function contextFields(ctx?: Context): Record<string, string>;
+/** pino options for the fleet's line shape. Exposed for a service that needs its own destination in tests. */
+export declare function loggerOptions(opts?: {
+    level?: string;
+    redact?: string[];
+}): LoggerOptions;
+/** An error as a log field: its type, sanitised message, stack and code. Never an upstream body. */
+export declare function serializeError(err: unknown): Record<string, unknown>;
+/** Makes a logger with the fleet's line shape on stdout. Most services use `logger`. */
+export declare function createLogger(opts?: {
+    level?: string;
+    redact?: string[];
+    destination?: pino.DestinationStream;
+}): Logger;
+/** The process's logger. */
+export declare const logger: Logger;
+/**
+ * The logger bound to a context other than the active one, as
+ * `log.WithContext(ctx)`: for a line about a request or job written from a
+ * callback that runs outside it.
+ */
+export declare function withContext(ctx: Context, l?: Logger): Logger;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,IAAI,EAAE,EAAE,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,MAAM,CAAC;AAK7D,YAAY,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,+EAA+E;AAC/E,eAAO,MAAM,WAAW,UAgBvB,CAAC;AAIF,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,GAAG,GAAE,OAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAerF;AAED,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,aAAa,CAsB7F;AASD,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUpE;AAaD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAA;CAAO,GAAG,MAAM,CAE3H;AAED,4BAA4B;AAC5B,eAAO,MAAM,MAAM,EAAE,MAAuB,CAAC;AAE7C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,GAAE,MAAe,GAAG,MAAM,CAQpE"}

package/dist/log.js

@@ -0,0 +1,139 @@
+/**
+ * `@xeonr/telemetry/log`: the service's pino logger (obs.node-telemetry,
+ * observability plan §5.6/§6), the Node counterpart of logrus with
+ * go-platform's telemetry.LogrusHook:
+ *
+ * - JSON on stdout only, `level`/`time`/`msg` as logrus writes them, `time`
+ *   in RFC 3339;
+ * - `trace_id`, `span_id`, `trace_flags`, every §4.2 field of the request's
+ *   identity, `procedure` and `ip`, from the active context. A field the call
+ *   passes itself wins;
+ * - credentials redacted by key, error texts sanitised;
+ * - an Error line inside a recording span is mirrored as a span event, so the
+ *   error's text reaches the trace although logs are never shipped.
+ */
+import { context, trace } from "@opentelemetry/api";
+import pino, {} from "pino";
+import { fields, stateFrom } from "./identity.js";
+import { FieldIP, FieldProcedure } from "./keys.js";
+import { sanitize, sanitizeError } from "./sanitize.js";
+/** Keys whose values are never logged, at the top level and one level down. */
+export const REDACT_KEYS = [
+    "authorization",
+    "cookie",
+    "set-cookie",
+    "password",
+    "passwd",
+    "secret",
+    "token",
+    "accessToken",
+    "refreshToken",
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "client_secret",
+    "apiKey",
+    "api_key",
+];
+const ERROR_LEVEL = 50;
+/** The fields the active context adds to a line. */
+export function contextFields(ctx = context.active()) {
+    const out = {};
+    const sc = trace.getSpanContext(ctx);
+    if (sc && trace.isSpanContextValid(sc)) {
+        out.trace_id = sc.traceId;
+        out.span_id = sc.spanId;
+        out.trace_flags = sc.traceFlags.toString(16).padStart(2, "0");
+    }
+    const s = stateFrom(ctx);
+    if (s) {
+        Object.assign(out, fields(s.identity()));
+        if (s.procedure)
+            out[FieldProcedure] = s.procedure;
+        if (s.ip)
+            out[FieldIP] = s.ip;
+    }
+    return out;
+}
+/** pino options for the fleet's line shape. Exposed for a service that needs its own destination in tests. */
+export function loggerOptions(opts = {}) {
+    const keys = [...REDACT_KEYS, ...(opts.redact ?? [])];
+    return {
+        level: opts.level ?? process.env.LOG_LEVEL?.trim().toLowerCase() ?? "info",
+        base: null,
+        messageKey: "msg",
+        errorKey: "error",
+        timestamp: () => `,"time":"${new Date().toISOString()}"`,
+        formatters: { level: (label) => ({ level: label }) },
+        mixin: () => contextFields(),
+        redact: { paths: keys.flatMap((k) => [`["${k}"]`, `*["${k}"]`]), censor: "[REDACTED]" },
+        serializers: {
+            error: errorField,
+            err: errorField,
+        },
+        hooks: {
+            logMethod(args, method, level) {
+                if (level >= ERROR_LEVEL)
+                    mirrorToSpan(args);
+                return method.apply(this, args);
+            },
+        },
+    };
+}
+/** An `error` / `err` field: an Error is serialised, a string sanitised, anything else left alone. */
+function errorField(v) {
+    if (v instanceof Error)
+        return serializeError(v);
+    if (typeof v === "string")
+        return sanitize(v);
+    return v;
+}
+/** An error as a log field: its type, sanitised message, stack and code. Never an upstream body. */
+export function serializeError(err) {
+    const { type, message } = sanitizeError(err);
+    const out = { type, message };
+    if (err instanceof Error) {
+        // The frames only: the first line repeats the (unsanitised) message.
+        if (err.stack)
+            out.stack = err.stack.split("\n").slice(1).join("\n").trim();
+        const code = err.code;
+        if (typeof code === "string" || typeof code === "number")
+            out.code = code;
+    }
+    return out;
+}
+function mirrorToSpan(args) {
+    const span = trace.getActiveSpan();
+    if (!span?.isRecording())
+        return;
+    const [first, second] = args;
+    const msg = typeof first === "string" ? first : typeof second === "string" ? second : "";
+    const attrs = { "log.severity": "error", "log.message": sanitize(msg) };
+    const err = first instanceof Error ? first : first?.error ?? first?.err;
+    if (err !== undefined)
+        attrs["exception.message"] = sanitizeError(err).message;
+    span.addEvent("log", attrs);
+}
+/** Makes a logger with the fleet's line shape on stdout. Most services use `logger`. */
+export function createLogger(opts = {}) {
+    return pino(loggerOptions(opts), opts.destination ?? pino.destination({ dest: 1, sync: true }));
+}
+/** The process's logger. */
+export const logger = createLogger();
+/**
+ * The logger bound to a context other than the active one, as
+ * `log.WithContext(ctx)`: for a line about a request or job written from a
+ * callback that runs outside it.
+ */
+export function withContext(ctx, l = logger) {
+    return new Proxy(l, {
+        get(target, prop, receiver) {
+            const v = Reflect.get(target, prop, receiver);
+            if (typeof v !== "function" || !LEVELS.has(prop))
+                return v;
+            return (...args) => context.with(ctx, () => v.apply(target, args));
+        },
+    });
+}
+const LEVELS = new Set(["trace", "debug", "info", "warn", "error", "fatal"]);
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAgB,MAAM,oBAAoB,CAAC;AAClE,OAAO,IAAI,EAAE,EAAmC,MAAM,MAAM,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAIxD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG;IAC1B,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,UAAU;IACV,eAAe;IACf,QAAQ;IACR,SAAS;CACT,CAAC;AAEF,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,MAAe,OAAO,CAAC,MAAM,EAAE;IAC5D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,EAAE,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC;QAC1B,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC;QACxB,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC;QACP,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,SAAS;YAAE,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,OAA8C,EAAE;IAC7E,MAAM,IAAI,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO;QACN,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,MAAM;QAC1E,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG;QACxD,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;QACpD,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;QAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE;QACvF,WAAW,EAAE;YACZ,KAAK,EAAE,UAAU;YACjB,GAAG,EAAE,UAAU;SACf;QACD,KAAK,EAAE;YACN,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK;gBAC5B,IAAI,KAAK,IAAI,WAAW;oBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;SACD;KACD,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAS,UAAU,CAAC,CAAU;IAC7B,IAAI,CAAC,YAAY,KAAK;QAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC;AACV,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,cAAc,CAAC,GAAY;IAC1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA4B,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QAC1B,qEAAqE;QACrE,IAAI,GAAG,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,IAAe;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE;QAAE,OAAO;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,KAAK,GAA2B,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IAChG,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAwD,EAAE,KAAK,IAAK,KAAuC,EAAE,GAAG,CAAC;IAC/J,IAAI,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,OAAoF,EAAE;IAClH,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,4BAA4B;AAC5B,MAAM,CAAC,MAAM,MAAM,GAAW,YAAY,EAAE,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAY,MAAM;IAC3D,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACzB,MAAM,CAAC,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAE,CAAkC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjH,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC"}

package/dist/processor.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The span processors `init` installs, in order:
+ *
+ * 1. IdentitySpanProcessor stamps the request's identity on every span
+ *    started under it (go-platform's telemetry.SpanProcessor).
+ * 2. SanitizeSpanProcessor strips queries and credentials from URL attributes
+ *    and names client spans `HTTP <METHOD> <peer>` (§4.3).
+ * 3. The processors a service adds at run time (`addSpanProcessor`), e.g. the
+ *    upl-im pipeline's own trace store.
+ * 4. The OTLP batch processor, behind ExportGuard.
+ */
+import { type Context } from "@opentelemetry/api";
+import type { ReadableSpan, Span, SpanProcessor } from "@opentelemetry/sdk-trace";
+/** `peer.service` (go-platform's KeyPeerService). */
+export declare const KEY_PEER_SERVICE = "peer.service";
+/** Runs `fn` with `peer` named on every HTTP client span it starts: `peer.service`, and the span name `HTTP GET <peer>`. */
+export declare function withPeer<T>(peer: string, fn: () => T, ctx?: Context): T;
+/** @internal */
+export declare function peerFrom(ctx: Context): string | undefined;
+export declare class IdentitySpanProcessor implements SpanProcessor {
+    onStart(span: Span, parent: Context): void;
+    onEnd(): void;
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+export declare class SanitizeSpanProcessor implements SpanProcessor {
+    onStart(span: Span, parent: Context): void;
+    onEnd(): void;
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+/** Processors added after boot. A span sees the processors that were there when it started. */
+export declare class DynamicSpanProcessor implements SpanProcessor {
+    #private;
+    add(p: SpanProcessor): void;
+    onStart(span: Span, parent: Context): void;
+    onEnd(span: ReadableSpan): void;
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+export declare const METRIC_ROOTLESS_CLIENT_SPANS = "xeonr_telemetry_rootless_client_spans_total";
+/** The event attribute that keeps a span event out of the OTLP export. */
+export declare const KEY_LOCAL_EVENT = "xeonr.local";
+/**
+ * Attributes for a span event that only the service's own processors may see
+ * (`addSpanProcessor`), never the collector: payloads a product shows its own
+ * users (the upl-im pipeline's run traces), which §4.2 forbids in Lantern.
+ *
+ * ```ts
+ * span.addEvent("rpc.request", localEvent({ payload }));
+ * ```
+ */
+export declare function localEvent<T extends Record<string, unknown>>(attrs: T): T & {
+    [KEY_LOCAL_EVENT]: true;
+};
+/**
+ * Sits in front of the OTLP batch processor:
+ *
+ * - Keeps a client or producer span that has no parent out of the export
+ *   (obs.rooted-spans: a database, cache or client span is never a trace
+ *   root). Such a span means the work ran on a context with no span: a loop
+ *   or callback not under `startJob`. The instrumentations that can refuse
+ *   those spans already do (`requireParentSpan`); this catches the rest
+ *   (mysql2, aws-sdk). Each one dropped is counted in
+ *   xeonr_telemetry_rootless_client_spans_total{scope}, so the gap stays visible.
+ * - Drops `localEvent` events from what is exported.
+ */
+export declare class ExportGuard implements SpanProcessor {
+    #private;
+    constructor(inner: SpanProcessor);
+    onStart(span: Span, parent: Context): void;
+    onEnd(span: ReadableSpan): void;
+    forceFlush(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=processor.d.ts.map

package/dist/processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"processor.d.ts","sourceRoot":"","sources":["../src/processor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAgD,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOlF,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,4HAA4H;AAC5H,wBAAgB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,GAAE,OAA0B,GAAG,CAAC,CAEzF;AAED,gBAAgB;AAChB,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED,qBAAa,qBAAsB,YAAW,aAAa;IAC1D,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAI1C,KAAK,IAAI,IAAI;IACb,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAG3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGzB;AAMD,qBAAa,qBAAsB,YAAW,aAAa;IAC1D,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAmB1C,KAAK,IAAI,IAAI;IACb,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAG3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGzB;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,YAAW,aAAa;;IAIzD,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI;IAG3B,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAM1C,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAGzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAG3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B;AAED,eAAO,MAAM,4BAA4B,gDAAgD,CAAC;AAE1F,0EAA0E;AAC1E,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG;IAAE,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAEvG;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAY,YAAW,aAAa;;gBAEpC,KAAK,EAAE,aAAa;IAGhC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAG1C,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAe/B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAG3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGzB"}