euclid-ndk 0.2.0

package/dist/modules/base.d.ts

@@ -0,0 +1,121 @@
+/**
+ * What every module client has in common.
+ *
+ * euclid speaks one request shape, so most of a module client is the same client over and over: post
+ * JSON to `/`, name the module in `x-euclid-target` and the operation in `x-euclid-action`,
+ * authenticate the way the session that created it authenticates, and turn a non-2xx into a
+ * {@link EuclidServiceError}. That part lives here; what is left in {@link import("./esm.js")} - and
+ * in the module clients that follow it - is the operations themselves.
+ *
+ * Subclassing this is also how an application reaches a module this SDK has not wrapped: give the
+ * subclass a target and call {@link ModuleClient.call}.
+ */
+import type { EuclidHttpClient, Response } from "../http/client.js";
+import type { EuclidSession } from "./eam.js";
+/**
+ * What an action whose body is bytes will take.
+ *
+ * A string is sent as its UTF-8 bytes, which is then exactly what the server stored or encrypted;
+ * anything that matters about the encoding is the caller's to decide before calling.
+ */
+export type Bytes = Buffer | Uint8Array | string;
+/** How a listing is paged and ordered. Every field has a server-side default. */
+export interface PageOptions {
+    pageSize?: number;
+    pageIndex?: number;
+    sortColumn?: string;
+    sortDirection?: string;
+}
+/**
+ * How a listing is paged, ordered and narrowed.
+ *
+ * Most listings take a prefix; the ones that page messages do not, and take {@link PageOptions}
+ * instead - the server has nothing to match a message against.
+ */
+export interface ListOptions extends PageOptions {
+    prefix?: string;
+}
+/** What a {@link ModuleClient} needs beyond the session: which module it is, and how it behaves. */
+export interface ModuleClientOptions {
+    /** The module this client talks to - what travels in `x-euclid-target`. */
+    target: string;
+    /**
+     * The actions of this module that carry raw bytes rather than JSON, and so present the session's
+     * bearer token rather than a signature - see {@link ModuleClient.authHeaders}.
+     */
+    byteActions?: Iterable<string>;
+    /** Headers every request of this client carries on top of the session's own. */
+    headers?: Record<string, string>;
+    /**
+     * A connection to share rather than open. Only for a second view of the same module, where two
+     * clients that differ by a header have no reason to differ by a socket.
+     */
+    client?: EuclidHttpClient;
+}
+/**
+ * One euclid module, on the credentials of the session that created it.
+ *
+ * Holds the session rather than a copy of what it knew at the time, so the client follows it: a
+ * {@link EuclidSession.changeNamespace} between two calls scopes the second one, and a token the
+ * session refreshes is the token the next request carries.
+ */
+export declare abstract class ModuleClient {
+    #private;
+    /** The module this client talks to - what travels in `x-euclid-target`. */
+    readonly target: string;
+    /** The session this client authenticates as. */
+    protected readonly session: EuclidSession;
+    /**
+     * The connection this client sends on.
+     *
+     * Visible to a subclass because a second view of the same module shares it - see
+     * {@link import("./eqs.js").EuclidEqs.asInternal}, where two clients that differ by a header have no
+     * reason to differ by a socket.
+     */
+    protected readonly client: EuclidHttpClient;
+    protected constructor(session: EuclidSession, options: ModuleClientOptions);
+    /** Releases the connection this client was holding. Closing the session calls it. */
+    close(): void;
+    /**
+     * Sends any action of this module, for one this SDK does not wrap yet.
+     *
+     * Public on purpose: a server that gains an action should be reachable without waiting for a
+     * release here.
+     */
+    call(action: string, payload?: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
+    /** Who is asking, what they are scoped to, and whatever this client adds to that. */
+    routingHeaders(): Record<string, string>;
+    /** One action, sent. The raw response, for a caller that reads a status this does not. */
+    protected post(action: string, payload?: Record<string, unknown>, headers?: Record<string, string>, timeoutMs?: number): Promise<Response>;
+    /**
+     * One of the actions whose body is bytes rather than JSON, described by its headers instead.
+     *
+     * The content type is the only routing header that changes, and neither signing scheme covers it -
+     * both sign a fixed list of headers, which is what lets this differ without the signature having to
+     * know.
+     */
+    protected postBytes(action: string, data: Bytes, headers?: Record<string, string>, timeoutMs?: number): Promise<Response>;
+    /**
+     * How this request authenticates - and what it is rebuilt with when the server says the credentials
+     * had expired.
+     *
+     * A byte-carrying action presents the session's bearer token rather than a signature, which is what
+     * euclid-cli and euclid-jdk do for the same actions, so all of them write an object the same way. A
+     * session that {@link EuclidSession.alwaysSigns} signs them anyway: it asked not to be handed a token
+     * silently, and a signature over raw bytes is exact here in a way it is not in every language.
+     */
+    protected authHeaders(action: string, body: Buffer): Record<string, string>;
+    /** The response body as an object, or the server's own reason for refusing. */
+    protected result(action: string, response: Response): Record<string, unknown>;
+    /** An action whose answer is one string - an ERN, mostly. */
+    protected textOf(action: string, payload: Record<string, unknown>, field: string): Promise<string>;
+    /** An action whose answer is one number - a size, a count. */
+    protected numberOf(action: string, payload: Record<string, unknown>, field: string): Promise<number>;
+}
+/** A listing's paging and ordering, with the server's defaults filled in where the caller said nothing. */
+export declare function pagePayload(options: PageOptions, defaultSortColumn: string): Record<string, unknown>;
+/** The same, for the listings that also narrow by prefix. */
+export declare function listPayload(options: ListOptions, defaultSortColumn: string): Record<string, unknown>;
+/** One request body's bytes, whichever of the three spellings a caller reached for. */
+export declare function bytesOf(data: Bytes): Buffer;
+//# sourceMappingURL=base.d.ts.map

package/dist/modules/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/modules/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,8BAAsB,YAAY;;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,gDAAgD;IAChD,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAE1C;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAK5C,SAAS,aAAa,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB;IAW1E,qFAAqF;IACrF,KAAK,IAAI,IAAI;IAMb;;;;;OAKG;IACG,IAAI,CACR,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACrC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAInC,qFAAqF;IACrF,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIxC,0FAA0F;cAC1E,IAAI,CAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACrC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC;IAMpB;;;;;;OAMG;cACa,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,KAAK,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC;IAWpB;;;;;;;;OAQG;IACH,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAK3E,+EAA+E;IAC/E,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAU7E,6DAA6D;cAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxG,8DAA8D;cAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAI3G;AAED,2GAA2G;AAC3G,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOpG;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEpG;AAED,uFAAuF;AACvF,wBAAgB,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAG3C"}

package/dist/modules/base.js

@@ -0,0 +1,142 @@
+/**
+ * What every module client has in common.
+ *
+ * euclid speaks one request shape, so most of a module client is the same client over and over: post
+ * JSON to `/`, name the module in `x-euclid-target` and the operation in `x-euclid-action`,
+ * authenticate the way the session that created it authenticates, and turn a non-2xx into a
+ * {@link EuclidServiceError}. That part lives here; what is left in {@link import("./esm.js")} - and
+ * in the module clients that follow it - is the operations themselves.
+ *
+ * Subclassing this is also how an application reaches a module this SDK has not wrapped: give the
+ * subclass a target and call {@link ModuleClient.call}.
+ */
+import { EuclidServiceError } from "../errors.js";
+/**
+ * One euclid module, on the credentials of the session that created it.
+ *
+ * Holds the session rather than a copy of what it knew at the time, so the client follows it: a
+ * {@link EuclidSession.changeNamespace} between two calls scopes the second one, and a token the
+ * session refreshes is the token the next request carries.
+ */
+export class ModuleClient {
+    /** The module this client talks to - what travels in `x-euclid-target`. */
+    target;
+    /** The session this client authenticates as. */
+    session;
+    /**
+     * The connection this client sends on.
+     *
+     * Visible to a subclass because a second view of the same module shares it - see
+     * {@link import("./eqs.js").EuclidEqs.asInternal}, where two clients that differ by a header have no
+     * reason to differ by a socket.
+     */
+    client;
+    #byteActions;
+    #headers;
+    constructor(session, options) {
+        if (!options.target)
+            throw new Error("a module client must name its target, e.g. target: 'esm'");
+        this.target = options.target;
+        this.session = session;
+        this.#byteActions = new Set(options.byteActions ?? []);
+        this.#headers = { ...options.headers };
+        // Its own connection, and its own header factory: a request of this module whose credentials
+        // expired in flight has to be rebuilt as a request of *this* module rather than of EAM.
+        this.client = options.client ?? session.newClient((action, body) => this.authHeaders(action, body));
+    }
+    /** Releases the connection this client was holding. Closing the session calls it. */
+    close() {
+        this.client.close();
+    }
+    // -- transport -------------------------------------------------------------------------------
+    /**
+     * Sends any action of this module, for one this SDK does not wrap yet.
+     *
+     * Public on purpose: a server that gains an action should be reachable without waiting for a
+     * release here.
+     */
+    async call(action, payload = {}, timeoutMs) {
+        return this.result(action, await this.post(action, payload, {}, timeoutMs));
+    }
+    /** Who is asking, what they are scoped to, and whatever this client adds to that. */
+    routingHeaders() {
+        return { ...this.session.routingHeaders(), ...this.#headers };
+    }
+    /** One action, sent. The raw response, for a caller that reads a status this does not. */
+    async post(action, payload = {}, headers = {}, timeoutMs) {
+        const body = Buffer.from(JSON.stringify(payload), "utf8");
+        const sent = { ...this.routingHeaders(), ...headers, ...this.authHeaders(action, body) };
+        return this.client.post(`${this.session.baseUrl}/`, body, this.target, action, sent, timeoutMs);
+    }
+    /**
+     * One of the actions whose body is bytes rather than JSON, described by its headers instead.
+     *
+     * The content type is the only routing header that changes, and neither signing scheme covers it -
+     * both sign a fixed list of headers, which is what lets this differ without the signature having to
+     * know.
+     */
+    async postBytes(action, data, headers = {}, timeoutMs) {
+        const bytes = bytesOf(data);
+        const sent = {
+            ...this.routingHeaders(),
+            "content-type": "application/octet-stream",
+            ...headers,
+            ...this.authHeaders(action, bytes),
+        };
+        return this.client.post(`${this.session.baseUrl}/`, bytes, this.target, action, sent, timeoutMs);
+    }
+    /**
+     * How this request authenticates - and what it is rebuilt with when the server says the credentials
+     * had expired.
+     *
+     * A byte-carrying action presents the session's bearer token rather than a signature, which is what
+     * euclid-cli and euclid-jdk do for the same actions, so all of them write an object the same way. A
+     * session that {@link EuclidSession.alwaysSigns} signs them anyway: it asked not to be handed a token
+     * silently, and a signature over raw bytes is exact here in a way it is not in every language.
+     */
+    authHeaders(action, body) {
+        if (this.#byteActions.has(action) && !this.session.alwaysSigns)
+            return this.session.bearerHeaders();
+        return this.session.authHeaders(this.target, action, body);
+    }
+    /** The response body as an object, or the server's own reason for refusing. */
+    result(action, response) {
+        if (!response.ok)
+            throw new EuclidServiceError(this.target, action, response.status, response.text);
+        const parsed = response.json();
+        return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : { result: parsed };
+    }
+    // -- reading answers -------------------------------------------------------------------------
+    /** An action whose answer is one string - an ERN, mostly. */
+    async textOf(action, payload, field) {
+        const value = (await this.call(action, payload))[field];
+        return typeof value === "string" ? value : "";
+    }
+    /** An action whose answer is one number - a size, a count. */
+    async numberOf(action, payload, field) {
+        const value = (await this.call(action, payload))[field];
+        return typeof value === "number" && Number.isFinite(value) ? value : 0;
+    }
+}
+/** A listing's paging and ordering, with the server's defaults filled in where the caller said nothing. */
+export function pagePayload(options, defaultSortColumn) {
+    return {
+        pageSize: options.pageSize ?? 10,
+        pageIndex: options.pageIndex ?? 0,
+        sortColumn: options.sortColumn ?? defaultSortColumn,
+        sortDirection: options.sortDirection ?? "asc",
+    };
+}
+/** The same, for the listings that also narrow by prefix. */
+export function listPayload(options, defaultSortColumn) {
+    return { prefix: options.prefix ?? "", ...pagePayload(options, defaultSortColumn) };
+}
+/** One request body's bytes, whichever of the three spellings a caller reached for. */
+export function bytesOf(data) {
+    if (typeof data === "string")
+        return Buffer.from(data, "utf8");
+    return Buffer.isBuffer(data) ? data : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+}
+//# sourceMappingURL=base.js.map

package/dist/modules/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/modules/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA+ClD;;;;;;GAMG;AACH,MAAM,OAAgB,YAAY;IAChC,2EAA2E;IAClE,MAAM,CAAS;IAExB,gDAAgD;IAC7B,OAAO,CAAgB;IAE1C;;;;;;OAMG;IACgB,MAAM,CAAmB;IAEnC,YAAY,CAAsB;IAClC,QAAQ,CAAyB;IAE1C,YAAsB,OAAsB,EAAE,OAA4B;QACxE,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACvC,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,qFAAqF;IACrF,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,+FAA+F;IAE/F;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CACR,MAAc,EACd,UAAmC,EAAE,EACrC,SAAkB;QAElB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,qFAAqF;IACrF,cAAc;QACZ,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,0FAA0F;IAChF,KAAK,CAAC,IAAI,CAClB,MAAc,EACd,UAAmC,EAAE,EACrC,UAAkC,EAAE,EACpC,SAAkB;QAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,SAAS,CACvB,MAAc,EACd,IAAW,EACX,UAAkC,EAAE,EACpC,SAAkB;QAElB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG;YACX,GAAG,IAAI,CAAC,cAAc,EAAE;YACxB,cAAc,EAAE,0BAA0B;YAC1C,GAAG,OAAO;YACV,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;SACnC,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACnG,CAAC;IAED;;;;;;;;OAQG;IACO,WAAW,CAAC,MAAc,EAAE,IAAY;QAChD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACpG,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,+EAA+E;IACrE,MAAM,CAAC,MAAc,EAAE,QAAkB;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,+FAA+F;IAE/F,6DAA6D;IACnD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAgC,EAAE,KAAa;QACpF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,8DAA8D;IACpD,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAgC,EAAE,KAAa;QACtF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;CACF;AAED,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,OAAoB,EAAE,iBAAyB;IACzE,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;QACjC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB;QACnD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK;KAC9C,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,OAAoB,EAAE,iBAAyB;IACzE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,IAAW;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACnG,CAAC"}

package/dist/modules/eag.d.ts

@@ -0,0 +1,166 @@
+/**
+ * EAG - euclid's API gateway: the paths it publishes, and the ports it publishes them on.
+ *
+ * One object, {@link EuclidEag}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const eag = session.eag();
+ *
+ * await eag.createRoute("orders", "/api/orders", { applicationId: "order-service" });
+ * await eag.createModuleRoute("login", "/euclid/login", "eam", "login");
+ * ```
+ *
+ * A route publishes a path prefix and says where everything beneath it goes: to an application euclid runs,
+ * or to one action of a euclid module. It is one or the other, never both and never neither - those are
+ * reached in entirely different ways, and a route that named both would leave which one wins up to the
+ * proxy.
+ *
+ * Module routes are the way in for something outside euclid that needs euclid itself - a browser that has to
+ * log in before it can call anything. Without one, a front end would talk to the API gateway for the
+ * application and to euclid's own gateway for its credentials: two ports, two origins, and CORS between
+ * them.
+ *
+ * Every action here is administrator-only, server-side. {@link EuclidSession.isAdmin} says whether the
+ * logged-in user is one, though the server enforces it regardless.
+ */
+import { type ListListenersResult, type Route } from "../dto/eag.js";
+import { ModuleClient } from "./base.js";
+import type { EuclidSession } from "./eam.js";
+export declare const TARGET = "eag";
+/** Proxied as it arrives: whatever the application requires, it enforces itself. */
+export declare const ROUTE_AUTH_NONE = "NONE";
+/**
+ * A euclid credential is required and verified before anything is forwarded - whatever euclid's own gateway
+ * accepts, which is a bearer token, an RFC 9421 signature or SigV4.
+ */
+export declare const ROUTE_AUTH_EUCLID = "EUCLID";
+/**
+ * HTTP Basic against a euclid user's password, for the callers a euclid credential does not suit: a browser,
+ * which prompts when it is answered with `WWW-Authenticate`, and a script with nothing but curl.
+ */
+export declare const ROUTE_AUTH_BASIC = "BASIC";
+/** What a listener speaks, as {@link import("../dto/eag.js").Listener} reports it. */
+export declare const PROTOCOL_HTTP = "http";
+export declare const PROTOCOL_HTTPS = "https";
+/** Where a route sends what it carries, and on what terms. */
+export interface CreateRouteOptions {
+    /** The application requests are sent to, which has to exist already. */
+    applicationId?: string;
+    /**
+     * The euclid module to reach instead, e.g. `"eam"` - see {@link EuclidEag.createModuleRoute}, which is
+     * this with the pair spelled out.
+     */
+    moduleTarget?: string;
+    /** The one action that module answers for on this route. */
+    moduleAction?: string;
+    /** The HTTP methods this route answers for; none means every method. */
+    methods?: Iterable<string>;
+    /** {@link ROUTE_AUTH_NONE}, {@link ROUTE_AUTH_EUCLID} or {@link ROUTE_AUTH_BASIC}. */
+    authentication?: string;
+    /** Whether the gateway serves it from the start. */
+    active?: boolean;
+    /**
+     * The namespace requests carried by this route act in. Left empty, the session's own - which is almost
+     * always what is meant, and nameable because it is not always: a route published for one namespace should
+     * not act in another just because an administrator of the first happened to configure it.
+     */
+    namespace?: string;
+    /** Likewise, defaulting to the session's. */
+    region?: string;
+}
+/** The same, minus the pair {@link EuclidEag.createModuleRoute} supplies itself. */
+export type CreateModuleRouteOptions = Omit<CreateRouteOptions, "applicationId" | "moduleTarget" | "moduleAction">;
+/**
+ * What an update changes - and only what it names.
+ *
+ * The distinction the server draws is between a field being sent and not being sent, rather than between its
+ * values, so leaving `path` out leaves the stored path alone. Moving a route to an application clears its
+ * module target and the other way round, since leaving both set would make which one wins depend on the
+ * proxy.
+ */
+export interface UpdateRouteChanges {
+    path?: string;
+    applicationId?: string;
+    moduleTarget?: string;
+    moduleAction?: string;
+    methods?: Iterable<string>;
+    authentication?: string;
+    active?: boolean;
+    namespace?: string;
+    region?: string;
+}
+/**
+ * EAG's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.eag} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export declare class EuclidEag extends ModuleClient {
+    constructor(session: EuclidSession);
+    /**
+     * Publishes a path, and sends everything beneath it to an application or to a module.
+     *
+     * Refused with HTTP 409 if the route ID is taken, or if another route already answers for this path and
+     * one of these methods. An application that does not exist is refused with 404 rather than becoming a
+     * route that answers 503 for every request - which looks like an application that is down rather than one
+     * that was never deployed.
+     *
+     * @param routeId the name to manage this route under, unique across the installation.
+     * @param path the path prefix to publish, which has to start with `/`.
+     * @param options request options
+     * @throws {Error} if neither an application nor a module was named, or both were. The server refuses that
+     *   too; this just says so before the round trip.
+     */
+    createRoute(routeId: string, path: string, options?: CreateRouteOptions): Promise<Route>;
+    /**
+     * Publishes a path that reaches one action of a euclid module rather than an application.
+     *
+     * The same call as {@link createRoute} with the module pair required rather than optional, because that
+     * pair is what makes a module route: a target with no action gives the gateway nothing to dispatch on, and
+     * would answer 400 for every request the route ever carries.
+     */
+    createModuleRoute(routeId: string, path: string, moduleTarget: string, moduleAction: string, options?: CreateModuleRouteOptions): Promise<Route>;
+    /**
+     * Changes a route that already exists. Only what `changes` names changes - see
+     * {@link UpdateRouteChanges}.
+     */
+    updateRoute(routeId: string, changes?: UpdateRouteChanges): Promise<Route>;
+    /**
+     * Takes a route out of service, or puts it back, without changing anything else about it.
+     *
+     * This is how something stops being exposed in a hurry: the route stays exactly as it was and comes back
+     * the same when it is reactivated, which deleting and recreating it would not guarantee.
+     */
+    setRouteActive(routeId: string, active: boolean): Promise<Route>;
+    /**
+     * The routes whose path starts with a prefix - what somebody asking "what is published under `/api`"
+     * wants. An empty prefix lists them all.
+     *
+     * The prefix filters on the path rather than on the route ID, and is matched literally rather than as a
+     * pattern, so `/api/v1.0` does not also match `/api/v1X0`.
+     */
+    listRoutes(pathPrefix?: string): Promise<Route[]>;
+    /** One route, by its ID. */
+    getRoute(routeId: string): Promise<Route>;
+    /**
+     * Deletes a route, which stops the gateway serving its path.
+     *
+     * Deleting is not how something is taken out of service temporarily - see {@link setRouteActive}, which
+     * leaves the route as it was so it returns exactly the same.
+     */
+    deleteRoute(routeId: string): Promise<void>;
+    /**
+     * The ports the gateway was configured to answer on, and whether it is answering.
+     *
+     * A listener whose port was taken, or whose certificate could not be loaded, is still listed - it is the
+     * one somebody is looking for - and `serving` is what says whether anything is bound. For an HTTPS
+     * listener the certificate comes with it, including whether euclid minted it itself.
+     */
+    listListeners(): Promise<ListListenersResult>;
+    /**
+     * EAG's own metrics, as the server collects them. Answered unparsed - the shape belongs to the monitoring
+     * module rather than to EAG.
+     */
+    metrics(): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=eag.d.ts.map

package/dist/modules/eag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eag.d.ts","sourceRoot":"","sources":["../../src/modules/eag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,KAAK,EACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,eAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,oFAAoF;AACpF,eAAO,MAAM,eAAe,SAAS,CAAC;AACtC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,sFAAsF;AACtF,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,kBAAkB,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC,CAAC;AAEnH;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,YAAY;gBAC7B,OAAO,EAAE,aAAa;IAMlC;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC;IA6BlG;;;;;;OAMG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,KAAK,CAAC;IAIjB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC;IAUpF;;;;;OAKG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAItE;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,SAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAMnD,4BAA4B;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAI/C;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD;;;;;;OAMG;IACG,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAMnD;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAGlD"}

package/dist/modules/eag.js

@@ -0,0 +1,189 @@
+/**
+ * EAG - euclid's API gateway: the paths it publishes, and the ports it publishes them on.
+ *
+ * One object, {@link EuclidEag}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const eag = session.eag();
+ *
+ * await eag.createRoute("orders", "/api/orders", { applicationId: "order-service" });
+ * await eag.createModuleRoute("login", "/euclid/login", "eam", "login");
+ * ```
+ *
+ * A route publishes a path prefix and says where everything beneath it goes: to an application euclid runs,
+ * or to one action of a euclid module. It is one or the other, never both and never neither - those are
+ * reached in entirely different ways, and a route that named both would leave which one wins up to the
+ * proxy.
+ *
+ * Module routes are the way in for something outside euclid that needs euclid itself - a browser that has to
+ * log in before it can call anything. Without one, a front end would talk to the API gateway for the
+ * application and to euclid's own gateway for its credentials: two ports, two origins, and CORS between
+ * them.
+ *
+ * Every action here is administrator-only, server-side. {@link EuclidSession.isAdmin} says whether the
+ * logged-in user is one, though the server enforces it regardless.
+ */
+import { toListListenersResult, toRoute, } from "../dto/eag.js";
+import { ModuleClient } from "./base.js";
+export const TARGET = "eag";
+/** Proxied as it arrives: whatever the application requires, it enforces itself. */
+export const ROUTE_AUTH_NONE = "NONE";
+/**
+ * A euclid credential is required and verified before anything is forwarded - whatever euclid's own gateway
+ * accepts, which is a bearer token, an RFC 9421 signature or SigV4.
+ */
+export const ROUTE_AUTH_EUCLID = "EUCLID";
+/**
+ * HTTP Basic against a euclid user's password, for the callers a euclid credential does not suit: a browser,
+ * which prompts when it is answered with `WWW-Authenticate`, and a script with nothing but curl.
+ */
+export const ROUTE_AUTH_BASIC = "BASIC";
+/** What a listener speaks, as {@link import("../dto/eag.js").Listener} reports it. */
+export const PROTOCOL_HTTP = "http";
+export const PROTOCOL_HTTPS = "https";
+/** The fields an update sends when - and only when - it was given them. */
+const UPDATABLE = [
+    "path",
+    "applicationId",
+    "moduleTarget",
+    "moduleAction",
+    "methods",
+    "authentication",
+    "active",
+    "namespace",
+    "region",
+];
+/**
+ * EAG's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.eag} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export class EuclidEag extends ModuleClient {
+    constructor(session) {
+        super(session, { target: TARGET });
+    }
+    // -- routes ----------------------------------------------------------------------------------
+    /**
+     * Publishes a path, and sends everything beneath it to an application or to a module.
+     *
+     * Refused with HTTP 409 if the route ID is taken, or if another route already answers for this path and
+     * one of these methods. An application that does not exist is refused with 404 rather than becoming a
+     * route that answers 503 for every request - which looks like an application that is down rather than one
+     * that was never deployed.
+     *
+     * @param routeId the name to manage this route under, unique across the installation.
+     * @param path the path prefix to publish, which has to start with `/`.
+     * @param options request options
+     * @throws {Error} if neither an application nor a module was named, or both were. The server refuses that
+     *   too; this just says so before the round trip.
+     */
+    async createRoute(routeId, path, options = {}) {
+        const applicationId = options.applicationId ?? "";
+        const moduleTarget = options.moduleTarget ?? "";
+        if (Boolean(applicationId) === Boolean(moduleTarget)) {
+            throw new Error("name either an applicationId or a moduleTarget, not both and not neither");
+        }
+        if (moduleTarget && !options.moduleAction) {
+            throw new Error("moduleAction is required when a moduleTarget is named");
+        }
+        const payload = {
+            routeId,
+            path,
+            methods: [...(options.methods ?? [])],
+            authentication: options.authentication ?? ROUTE_AUTH_NONE,
+            active: options.active ?? true,
+        };
+        // Only when the caller named one: the server reads an empty string as the empty namespace rather than
+        // as "unspecified", so sending one would scope the route to nothing.
+        if (applicationId)
+            payload["applicationId"] = applicationId;
+        if (moduleTarget) {
+            payload["moduleTarget"] = moduleTarget;
+            payload["moduleAction"] = options.moduleAction;
+        }
+        if (options.namespace)
+            payload["namespace"] = options.namespace;
+        if (options.region)
+            payload["region"] = options.region;
+        return toRoute(await this.call("create-route", payload));
+    }
+    /**
+     * Publishes a path that reaches one action of a euclid module rather than an application.
+     *
+     * The same call as {@link createRoute} with the module pair required rather than optional, because that
+     * pair is what makes a module route: a target with no action gives the gateway nothing to dispatch on, and
+     * would answer 400 for every request the route ever carries.
+     */
+    async createModuleRoute(routeId, path, moduleTarget, moduleAction, options = {}) {
+        return this.createRoute(routeId, path, { ...options, moduleTarget, moduleAction });
+    }
+    /**
+     * Changes a route that already exists. Only what `changes` names changes - see
+     * {@link UpdateRouteChanges}.
+     */
+    async updateRoute(routeId, changes = {}) {
+        const payload = { routeId };
+        for (const field of UPDATABLE) {
+            const value = changes[field];
+            if (value === undefined)
+                continue;
+            payload[field] = field === "methods" ? [...value] : value;
+        }
+        return toRoute(await this.call("update-route", payload));
+    }
+    /**
+     * Takes a route out of service, or puts it back, without changing anything else about it.
+     *
+     * This is how something stops being exposed in a hurry: the route stays exactly as it was and comes back
+     * the same when it is reactivated, which deleting and recreating it would not guarantee.
+     */
+    async setRouteActive(routeId, active) {
+        return this.updateRoute(routeId, { active });
+    }
+    /**
+     * The routes whose path starts with a prefix - what somebody asking "what is published under `/api`"
+     * wants. An empty prefix lists them all.
+     *
+     * The prefix filters on the path rather than on the route ID, and is matched literally rather than as a
+     * pattern, so `/api/v1.0` does not also match `/api/v1X0`.
+     */
+    async listRoutes(pathPrefix = "") {
+        const response = await this.call("list-routes", { prefix: pathPrefix });
+        const routes = response["routes"];
+        return Array.isArray(routes) ? routes.map(toRoute) : [];
+    }
+    /** One route, by its ID. */
+    async getRoute(routeId) {
+        return toRoute(await this.call("get-route", { routeId }));
+    }
+    /**
+     * Deletes a route, which stops the gateway serving its path.
+     *
+     * Deleting is not how something is taken out of service temporarily - see {@link setRouteActive}, which
+     * leaves the route as it was so it returns exactly the same.
+     */
+    async deleteRoute(routeId) {
+        await this.call("delete-route", { routeId });
+    }
+    // -- listeners -------------------------------------------------------------------------------
+    /**
+     * The ports the gateway was configured to answer on, and whether it is answering.
+     *
+     * A listener whose port was taken, or whose certificate could not be loaded, is still listed - it is the
+     * one somebody is looking for - and `serving` is what says whether anything is bound. For an HTTPS
+     * listener the certificate comes with it, including whether euclid minted it itself.
+     */
+    async listListeners() {
+        return toListListenersResult(await this.call("list-listeners"));
+    }
+    // -- monitoring ------------------------------------------------------------------------------
+    /**
+     * EAG's own metrics, as the server collects them. Answered unparsed - the shape belongs to the monitoring
+     * module rather than to EAG.
+     */
+    async metrics() {
+        return this.call("get-metrics");
+    }
+}
+//# sourceMappingURL=eag.js.map

package/dist/modules/eag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eag.js","sourceRoot":"","sources":["../../src/modules/eag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,qBAAqB,EACrB,OAAO,GAGR,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC;AAE5B,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAC1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAExC,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAoDtC,2EAA2E;AAC3E,MAAM,SAAS,GAAG;IAChB,MAAM;IACN,eAAe;IACf,cAAc;IACd,cAAc;IACd,SAAS;IACT,gBAAgB;IAChB,QAAQ;IACR,WAAW;IACX,QAAQ;CACgD,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,OAAO,SAAU,SAAQ,YAAY;IACzC,YAAY,OAAsB;QAChC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,IAAY,EAAE,UAA8B,EAAE;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GAA4B;YACvC,OAAO;YACP,IAAI;YACJ,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,eAAe;YACzD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;SAC/B,CAAC;QACF,sGAAsG;QACtG,qEAAqE;QACrE,IAAI,aAAa;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;YACvC,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QACvD,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAe,EACf,IAAY,EACZ,YAAoB,EACpB,YAAoB,EACpB,UAAoC,EAAE;QAEtC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,UAA8B,EAAE;QACjE,MAAM,OAAO,GAA4B,EAAE,OAAO,EAAE,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAI,KAA0B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClF,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,MAAe;QACnD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,UAAU,GAAG,EAAE;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,+FAA+F;IAE/F;;;;;;OAMG;IACH,KAAK,CAAC,aAAa;QACjB,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAE/F;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;CACF"}