euclid-ndk 0.2.0

package/dist/modules/eap.d.ts

@@ -0,0 +1,204 @@
+/**
+ * EAP - euclid's application platform: what euclid runs, from what, and as whom.
+ *
+ * One object, {@link EuclidEap}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const eap = session.eap();
+ *
+ * await eap.createApplication("order-service", RUNTIME_JAVA, "artifacts", "order-service-1.4.0.jar", {
+ *   queues: ["orders"],
+ * });
+ * await eap.startApplication("order-service");
+ * ```
+ *
+ * An application is deployed from an artifact already in a bucket - ESM puts it there, and EAP names it.
+ * The deployment says which buckets and queues it may reach, and euclid grants those to the identity it
+ * runs as: a technical principal it creates for the application unless one is named, with no password, no
+ * login and one access key. Nothing an application leaks is then a person's credential.
+ *
+ * Two names for the same things, and the asymmetry is the server's: a deployment names a `bucket` and an
+ * `artifact`, and the application that comes back describes a `bucketErn` and an `artifactKey`. Likewise
+ * the `buckets` and `queues` it is granted come back resolved into `resources`.
+ *
+ * Every action here is administrator-only, server-side. {@link EuclidSession.isAdmin} says whether the
+ * logged-in user is one, though the server enforces it regardless.
+ */
+import { type Application, type LogLevelResult } from "../dto/eap.js";
+import { ModuleClient } from "./base.js";
+import type { EuclidSession } from "./eam.js";
+export declare const TARGET = "eap";
+/**
+ * What an artifact is handed to. Matched exactly, in upper case, and anything else is refused with
+ * HTTP 400 - a runtime is a category rather than a version, so a JDK 17 and a JDK 25 application are both
+ * {@link RUNTIME_JAVA} and it is the command or the PATH that decides which one runs.
+ */
+export declare const RUNTIME_JAVA = "JAVA";
+export declare const RUNTIME_PYTHON = "PYTHON";
+export declare const RUNTIME_NODEJS = "NODEJS";
+/** Anything already executable, which is where C++ and Rust applications land. */
+export declare const RUNTIME_BINARY = "BINARY";
+/**
+ * The levels {@link EuclidEap.setLogLevel} accepts. An unrecognised one is refused rather than defaulted:
+ * "warnign" quietly meaning "info" is an application logging more than somebody asked for, and quietly
+ * meaning "off" is silence nobody asked for at all.
+ */
+export declare const LOG_TRACE = "trace";
+export declare const LOG_DEBUG = "debug";
+export declare const LOG_INFO = "info";
+export declare const LOG_WARNING = "warning";
+export declare const LOG_ERROR = "error";
+export declare const LOG_FATAL = "fatal";
+export declare const LOG_OFF = "off";
+/** What an application's `desiredState` and `state` read as. */
+export declare const STATE_RUNNING = "RUNNING";
+export declare const STATE_STOPPED = "STOPPED";
+/** What a pool is sized at unless the deployment says otherwise. */
+export declare const DEFAULT_MIN_INSTANCES = 1;
+export declare const DEFAULT_MAX_INSTANCES = 1;
+/** How long an instance has to become ready before the manager gives up on it, in milliseconds. */
+export declare const DEFAULT_READY_TIMEOUT_MS = 30000;
+/** Everything a deployment says beyond what it runs and where the artifact is. */
+export interface CreateApplicationOptions {
+    /**
+     * What to record as the deployed version. Left empty, the server reads it out of the artifact's name,
+     * and refuses the deployment if it cannot.
+     */
+    version?: string;
+    /**
+     * What to run, when the runtime's own interpreter is not it. Empty means the runtime decides, resolved
+     * through PATH.
+     */
+    command?: string;
+    /** What follows the command. */
+    arguments?: readonly string[];
+    /** The environment the process is given. */
+    environment?: Record<string, string>;
+    /**
+     * The buckets this application may reach, by name; euclid resolves them and grants them to the identity
+     * it runs as.
+     */
+    buckets?: readonly string[];
+    /** Likewise for queues. */
+    queues?: readonly string[];
+    /**
+     * An existing user to run as. Left empty, euclid creates a technical principal for the application -
+     * which is the better answer, and why this is not required.
+     */
+    user?: string;
+    /** The smallest the pool goes; at least 1. */
+    minInstances?: number;
+    /** The largest it goes; never below `minInstances`. */
+    maxInstances?: number;
+    /** How long an instance has to become ready; at least 1000. */
+    readyTimeoutMs?: number;
+}
+/**
+ * What an update changes - and only what it names.
+ *
+ * The distinction the server draws is between a field being sent and not being sent, rather than between
+ * its values: leaving `command` out leaves the stored command alone, while passing `""` clears it and
+ * hands the artifact back to the runtime's own interpreter.
+ *
+ * `buckets` and `queues` are re-resolved together whenever either is named, so naming one and not the
+ * other revokes what the other used to grant. Pass both, or neither.
+ */
+export interface UpdateApplicationChanges {
+    runtime?: string;
+    artifact?: string;
+    version?: string;
+    command?: string;
+    arguments?: readonly string[];
+    environment?: Record<string, string>;
+    buckets?: readonly string[];
+    queues?: readonly string[];
+    minInstances?: number;
+    maxInstances?: number;
+    readyTimeoutMs?: number;
+    namespace?: string;
+}
+/**
+ * EAP's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.eap} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export declare class EuclidEap extends ModuleClient {
+    #private;
+    constructor(session: EuclidSession);
+    /**
+     * Deploys an application, stopped, and answers with it as it was stored.
+     *
+     * Nothing runs yet: a new application's desired state is `STOPPED`, so {@link startApplication} is what
+     * puts it in service. Refused with HTTP 409 if the ID is taken, and with 404 if the bucket, the
+     * artifact, a named resource or a named user is not there - a deployment pointing at nothing would
+     * otherwise become an application that fails to start for a reason nobody can see.
+     *
+     * @param applicationId aoolication ID
+     * @param runtime {@link RUNTIME_JAVA}, {@link RUNTIME_PYTHON}, {@link RUNTIME_NODEJS} or
+     *   {@link RUNTIME_BINARY}.
+     * @param bucket the name of the bucket holding the artifact - a name, not an ERN.
+     * @param artifact the artifact's object key within that bucket.
+     * @param options call options
+     */
+    createApplication(applicationId: string, runtime: string, bucket: string, artifact: string, options?: CreateApplicationOptions): Promise<Application>;
+    /**
+     * Changes a deployed application. Only what `changes` names changes - see
+     * {@link UpdateApplicationChanges}, which is where the rules about that live.
+     *
+     * Changing the artifact is a change of what will run next; {@link redeployApplication} is what a new
+     * build of the same application usually wants.
+     */
+    updateApplication(applicationId: string, changes?: UpdateApplicationChanges): Promise<Application>;
+    /**
+     * Points an application at a new build of itself.
+     *
+     * The artifact defaults to the one already deployed - which is what a rebuilt artifact stored under the
+     * same key wants - and the version to whatever the artifact's name says. A redeploy that would change
+     * neither the version nor the checksum is refused with HTTP 409: it would restart the instances for
+     * nothing, and usually means the new artifact never reached the bucket.
+     */
+    redeployApplication(applicationId: string, artifact?: string, version?: string): Promise<Application>;
+    /** Removes an application. Stop it first - this does not. */
+    deleteApplication(applicationId: string): Promise<void>;
+    /**
+     * Asks for an application to run, and answers with it as it stands.
+     *
+     * Asking is all this does: the desired state changes here and the manager acts on it, so the application
+     * in the answer is usually still `STOPPED` - it says what was asked for, not what has happened yet.
+     */
+    startApplication(applicationId: string): Promise<Application>;
+    /** Asks for an application to stop, and answers with it as it stands. */
+    stopApplication(applicationId: string): Promise<Application>;
+    /**
+     * The applications whose ID starts with a prefix; an empty prefix lists them all.
+     *
+     * A list rather than a page: EAP answers with every match at once, since an installation has tens of
+     * applications rather than thousands.
+     */
+    listApplications(prefix?: string): Promise<Application[]>;
+    /** One application, by its ID, with the instances that are answering for it. */
+    getApplication(applicationId: string): Promise<Application>;
+    /**
+     * Sets what one application logs at, without restarting or redeploying it.
+     *
+     * @param applicationId application ID
+     * @param level {@link LOG_TRACE}, {@link LOG_DEBUG}, {@link LOG_INFO}, {@link LOG_WARNING},
+     *   {@link LOG_ERROR}, {@link LOG_FATAL} or {@link LOG_OFF}. An empty one takes the setting back - see
+     *   {@link resetLogLevel}, which says that in a word.
+     */
+    setLogLevel(applicationId: string, level: string): Promise<LogLevelResult>;
+    /**
+     * Puts an application back under the installation's own logging configuration.
+     *
+     * Which is not the same as setting it to whatever that configuration says: this removes the override, so
+     * the application follows the configuration as it changes from here on.
+     */
+    resetLogLevel(applicationId: string): Promise<LogLevelResult>;
+    /**
+     * EAP's own metrics, as the server collects them. Answered unparsed - the shape belongs to the
+     * monitoring module rather than to EAP.
+     */
+    metrics(): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=eap.d.ts.map

package/dist/modules/eap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eap.d.ts","sourceRoot":"","sources":["../../src/modules/eap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,eAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,kFAAkF;AAClF,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,QAAQ,SAAS,CAAC;AAC/B,eAAO,MAAM,WAAW,YAAY,CAAC;AACrC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,OAAO,QAAQ,CAAC;AAE7B,gEAAgE;AAChE,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,2BAA2B;IAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,YAAY;;gBAC7B,OAAO,EAAE,aAAa;IAMlC;;;;;;;;;;;;;;OAcG;IACG,iBAAiB,CACrB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,WAAW,CAAC;IAmBvB;;;;;;OAMG;IACG,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAG,OAAO,CAAC,WAAW,CAAC;IAS5G;;;;;;;OAOG;IACG,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,SAAK,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAOnG,6DAA6D;IACvD,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7D;;;;;OAKG;IACG,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAInE,yEAAyE;IACnE,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIlE;;;;;OAKG;IACG,gBAAgB,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAM3D,gFAAgF;IAC1E,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAMjE;;;;;;;OAOG;IACG,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAIhF;;;;;OAKG;IACG,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAMnE;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAQlD"}

package/dist/modules/eap.js

@@ -0,0 +1,218 @@
+/**
+ * EAP - euclid's application platform: what euclid runs, from what, and as whom.
+ *
+ * One object, {@link EuclidEap}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const eap = session.eap();
+ *
+ * await eap.createApplication("order-service", RUNTIME_JAVA, "artifacts", "order-service-1.4.0.jar", {
+ *   queues: ["orders"],
+ * });
+ * await eap.startApplication("order-service");
+ * ```
+ *
+ * An application is deployed from an artifact already in a bucket - ESM puts it there, and EAP names it.
+ * The deployment says which buckets and queues it may reach, and euclid grants those to the identity it
+ * runs as: a technical principal it creates for the application unless one is named, with no password, no
+ * login and one access key. Nothing an application leaks is then a person's credential.
+ *
+ * Two names for the same things, and the asymmetry is the server's: a deployment names a `bucket` and an
+ * `artifact`, and the application that comes back describes a `bucketErn` and an `artifactKey`. Likewise
+ * the `buckets` and `queues` it is granted come back resolved into `resources`.
+ *
+ * Every action here is administrator-only, server-side. {@link EuclidSession.isAdmin} says whether the
+ * logged-in user is one, though the server enforces it regardless.
+ */
+import { toApplication, toLogLevelResult, } from "../dto/eap.js";
+import { ModuleClient } from "./base.js";
+export const TARGET = "eap";
+/**
+ * What an artifact is handed to. Matched exactly, in upper case, and anything else is refused with
+ * HTTP 400 - a runtime is a category rather than a version, so a JDK 17 and a JDK 25 application are both
+ * {@link RUNTIME_JAVA} and it is the command or the PATH that decides which one runs.
+ */
+export const RUNTIME_JAVA = "JAVA";
+export const RUNTIME_PYTHON = "PYTHON";
+export const RUNTIME_NODEJS = "NODEJS";
+/** Anything already executable, which is where C++ and Rust applications land. */
+export const RUNTIME_BINARY = "BINARY";
+/**
+ * The levels {@link EuclidEap.setLogLevel} accepts. An unrecognised one is refused rather than defaulted:
+ * "warnign" quietly meaning "info" is an application logging more than somebody asked for, and quietly
+ * meaning "off" is silence nobody asked for at all.
+ */
+export const LOG_TRACE = "trace";
+export const LOG_DEBUG = "debug";
+export const LOG_INFO = "info";
+export const LOG_WARNING = "warning";
+export const LOG_ERROR = "error";
+export const LOG_FATAL = "fatal";
+export const LOG_OFF = "off";
+/** What an application's `desiredState` and `state` read as. */
+export const STATE_RUNNING = "RUNNING";
+export const STATE_STOPPED = "STOPPED";
+/** What a pool is sized at unless the deployment says otherwise. */
+export const DEFAULT_MIN_INSTANCES = 1;
+export const DEFAULT_MAX_INSTANCES = 1;
+/** How long an instance has to become ready before the manager gives up on it, in milliseconds. */
+export const DEFAULT_READY_TIMEOUT_MS = 30_000;
+/** The fields an update sends when - and only when - it was given them. */
+const UPDATABLE = [
+    "runtime",
+    "artifact",
+    "version",
+    "command",
+    "arguments",
+    "environment",
+    "buckets",
+    "queues",
+    "minInstances",
+    "maxInstances",
+    "readyTimeoutMs",
+    "namespace",
+];
+/**
+ * EAP's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.eap} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export class EuclidEap extends ModuleClient {
+    constructor(session) {
+        super(session, { target: TARGET });
+    }
+    // -- deploying -------------------------------------------------------------------------------
+    /**
+     * Deploys an application, stopped, and answers with it as it was stored.
+     *
+     * Nothing runs yet: a new application's desired state is `STOPPED`, so {@link startApplication} is what
+     * puts it in service. Refused with HTTP 409 if the ID is taken, and with 404 if the bucket, the
+     * artifact, a named resource or a named user is not there - a deployment pointing at nothing would
+     * otherwise become an application that fails to start for a reason nobody can see.
+     *
+     * @param applicationId aoolication ID
+     * @param runtime {@link RUNTIME_JAVA}, {@link RUNTIME_PYTHON}, {@link RUNTIME_NODEJS} or
+     *   {@link RUNTIME_BINARY}.
+     * @param bucket the name of the bucket holding the artifact - a name, not an ERN.
+     * @param artifact the artifact's object key within that bucket.
+     * @param options call options
+     */
+    async createApplication(applicationId, runtime, bucket, artifact, options = {}) {
+        return this.#application("create-application", {
+            applicationId,
+            runtime,
+            bucket,
+            artifact,
+            version: options.version ?? "",
+            command: options.command ?? "",
+            arguments: [...(options.arguments ?? [])],
+            environment: { ...options.environment },
+            buckets: [...(options.buckets ?? [])],
+            queues: [...(options.queues ?? [])],
+            user: options.user ?? "",
+            minInstances: options.minInstances ?? DEFAULT_MIN_INSTANCES,
+            maxInstances: options.maxInstances ?? DEFAULT_MAX_INSTANCES,
+            readyTimeoutMs: options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
+        });
+    }
+    /**
+     * Changes a deployed application. Only what `changes` names changes - see
+     * {@link UpdateApplicationChanges}, which is where the rules about that live.
+     *
+     * Changing the artifact is a change of what will run next; {@link redeployApplication} is what a new
+     * build of the same application usually wants.
+     */
+    async updateApplication(applicationId, changes = {}) {
+        const payload = { applicationId };
+        for (const field of UPDATABLE) {
+            const value = changes[field];
+            if (value !== undefined)
+                payload[field] = value;
+        }
+        return this.#application("update-application", payload);
+    }
+    /**
+     * Points an application at a new build of itself.
+     *
+     * The artifact defaults to the one already deployed - which is what a rebuilt artifact stored under the
+     * same key wants - and the version to whatever the artifact's name says. A redeploy that would change
+     * neither the version nor the checksum is refused with HTTP 409: it would restart the instances for
+     * nothing, and usually means the new artifact never reached the bucket.
+     */
+    async redeployApplication(applicationId, artifact = "", version = "") {
+        const payload = { applicationId };
+        if (artifact)
+            payload["artifact"] = artifact;
+        if (version)
+            payload["version"] = version;
+        return this.#application("redeploy-application", payload);
+    }
+    /** Removes an application. Stop it first - this does not. */
+    async deleteApplication(applicationId) {
+        await this.call("delete-application", { applicationId });
+    }
+    // -- running ---------------------------------------------------------------------------------
+    /**
+     * Asks for an application to run, and answers with it as it stands.
+     *
+     * Asking is all this does: the desired state changes here and the manager acts on it, so the application
+     * in the answer is usually still `STOPPED` - it says what was asked for, not what has happened yet.
+     */
+    async startApplication(applicationId) {
+        return this.#application("start-application", { applicationId });
+    }
+    /** Asks for an application to stop, and answers with it as it stands. */
+    async stopApplication(applicationId) {
+        return this.#application("stop-application", { applicationId });
+    }
+    /**
+     * The applications whose ID starts with a prefix; an empty prefix lists them all.
+     *
+     * A list rather than a page: EAP answers with every match at once, since an installation has tens of
+     * applications rather than thousands.
+     */
+    async listApplications(prefix = "") {
+        const response = await this.call("list-applications", { prefix });
+        const applications = response["applications"];
+        return Array.isArray(applications) ? applications.map(toApplication) : [];
+    }
+    /** One application, by its ID, with the instances that are answering for it. */
+    async getApplication(applicationId) {
+        return this.#application("get-application", { applicationId });
+    }
+    // -- logging ---------------------------------------------------------------------------------
+    /**
+     * Sets what one application logs at, without restarting or redeploying it.
+     *
+     * @param applicationId application ID
+     * @param level {@link LOG_TRACE}, {@link LOG_DEBUG}, {@link LOG_INFO}, {@link LOG_WARNING},
+     *   {@link LOG_ERROR}, {@link LOG_FATAL} or {@link LOG_OFF}. An empty one takes the setting back - see
+     *   {@link resetLogLevel}, which says that in a word.
+     */
+    async setLogLevel(applicationId, level) {
+        return toLogLevelResult(await this.call("set-log-level", { applicationId, level }));
+    }
+    /**
+     * Puts an application back under the installation's own logging configuration.
+     *
+     * Which is not the same as setting it to whatever that configuration says: this removes the override, so
+     * the application follows the configuration as it changes from here on.
+     */
+    async resetLogLevel(applicationId) {
+        return this.setLogLevel(applicationId, "");
+    }
+    // -- monitoring ------------------------------------------------------------------------------
+    /**
+     * EAP's own metrics, as the server collects them. Answered unparsed - the shape belongs to the
+     * monitoring module rather than to EAP.
+     */
+    async metrics() {
+        return this.call("get-metrics");
+    }
+    /** The actions that answer with one application, which is most of them. */
+    async #application(action, payload) {
+        return toApplication(await this.call(action, payload));
+    }
+}
+//# sourceMappingURL=eap.js.map

package/dist/modules/eap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eap.js","sourceRoot":"","sources":["../../src/modules/eap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,GAGjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC/B,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AACrC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,CAAC;AAE7B,gEAAgE;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AA+D/C,2EAA2E;AAC3E,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,SAAS;IACT,QAAQ;IACR,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,WAAW;CACmD,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,OAAO,SAAU,SAAQ,YAAY;IACzC,YAAY,OAAsB;QAChC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,iBAAiB,CACrB,aAAqB,EACrB,OAAe,EACf,MAAc,EACd,QAAgB,EAChB,UAAoC,EAAE;QAEtC,OAAO,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE;YAC7C,aAAa;YACb,OAAO;YACP,MAAM;YACN,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACzC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE;YACvC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,qBAAqB;YAC3D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,wBAAwB;SACnE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,aAAqB,EAAE,UAAoC,EAAE;QACnF,MAAM,OAAO,GAA4B,EAAE,aAAa,EAAE,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CAAC,aAAqB,EAAE,QAAQ,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;QAC1E,MAAM,OAAO,GAA4B,EAAE,aAAa,EAAE,CAAC;QAC3D,IAAI,QAAQ;YAAE,OAAO,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QAC1C,OAAO,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,+FAA+F;IAE/F;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,aAAqB;QAC1C,OAAO,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,cAAc,CAAC,aAAqB;QACxC,OAAO,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,+FAA+F;IAE/F;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,KAAa;QACpD,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,aAAqB;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,+FAA+F;IAE/F;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,OAAgC;QACjE,OAAO,aAAa,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/modules/ekm.d.ts

@@ -0,0 +1,182 @@
+/**
+ * EKM - euclid's key management module: encryption keys, and the certificates a deployment serves.
+ *
+ * One object, {@link EuclidEkm}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const ekm = session.ekm();
+ * const key = await ekm.createKey({ description: "customer exports" });
+ *
+ * const sealed = await ekm.encrypt(key.name, "account 4711");
+ * const plain = await ekm.decrypt(key.name, sealed);
+ * ```
+ *
+ * Key material never leaves the server: {@link EuclidEkm.encrypt} and {@link EuclidEkm.decrypt} send the
+ * bytes to the key rather than fetching the key to the bytes. That is what makes a key deletable as a
+ * unit - and what makes deleting one final, since nothing anywhere else has a copy.
+ *
+ * A key is named two ways, and they are not interchangeable. `name` is the ID the server minted and is
+ * what encrypts, decrypts and is deleted; the ERN is what revokes, describes and tags. Both are on every
+ * {@link import("../dto/ekm.js").Key} a listing returns.
+ *
+ * `encrypt` and `decrypt` carry raw bytes rather than JSON, and present the session's bearer token for
+ * the same reason ESM's transfer actions do - see {@link ModuleClient}.
+ */
+import { type Page } from "../dto/eam.js";
+import { type Certificate, type CreateKeyResult, type DeleteCertificateResult, type DeleteKeyResult, type Key, type KeyDescriptionResult, type RevokeKeyResult } from "../dto/ekm.js";
+import { ModuleClient, type Bytes, type ListOptions } from "./base.js";
+import type { EuclidSession } from "./eam.js";
+export declare const TARGET = "ekm";
+/** The only algorithm the server generates so far; anything else is refused with HTTP 400. */
+export declare const AES = "AES";
+/**
+ * The key length this SDK asks for when the caller does not say. 128 is the other one the server
+ * accepts, and what euclid-jdk's no-argument `createKey()` mints; 256 is what euclid itself creates when
+ * a bucket asks to be encrypted, which is the better default to inherit.
+ */
+export declare const DEFAULT_KEY_LENGTH = 256;
+/**
+ * How long a key scheduled for deletion stays alive by default, in days. The server's own default when
+ * the field is left out, restated here because it is the one number in this module that decides whether
+ * a mistake can be caught.
+ */
+export declare const DEFAULT_PENDING_WINDOW_DAYS = 7;
+/** The actions that carry raw bytes rather than JSON. */
+export declare const BYTE_ACTIONS: string[];
+/** What a key is created as, and what it says it is for. */
+export interface CreateKeyOptions {
+    /** {@link AES}; the server generates nothing else so far. */
+    algorithm?: string;
+    /** 128 or 256 bits. */
+    length?: number;
+    /** What the key is for. Free text, never interpreted - and worth supplying; see {@link EuclidEkm.createKey}. */
+    description?: string;
+}
+/** What a generated certificate is valid for, and for how long. */
+export interface CreateCertificateOptions {
+    /**
+     * The certificate's common name. Defaults to the name it is stored under: for a listener certificate
+     * those are usually the same word, and a certificate with an empty subject is refused by everything
+     * that reads it.
+     */
+    commonName?: string;
+    /** The other names it should be valid for. */
+    subjectAltNames?: Iterable<string>;
+    /** How long it is valid, in days, or left out for the server's default of 825. */
+    validDays?: number;
+    /** The RSA key length, or left out for the server's default of 2048. */
+    keyBits?: number;
+    description?: string;
+}
+/**
+ * EKM's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.ekm} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export declare class EuclidEkm extends ModuleClient {
+    #private;
+    constructor(session: EuclidSession);
+    /**
+     * Creates a key, and answers with the ID the server minted for it.
+     *
+     * The description is worth supplying. A key is identified by that generated ID, which says nothing
+     * about what the key protects, and a key outlives the reason it was made - so months later this is the
+     * only thing that answers whether it can be deleted, and deleting one is not a mistake that can be
+     * undone.
+     */
+    createKey(options?: CreateKeyOptions): Promise<CreateKeyResult>;
+    /** One page of keys, and how many exist in total. Never their material. */
+    listKeys(options?: ListOptions): Promise<Page<Key>>;
+    /**
+     * Schedules a key for deletion, and answers with the date it goes for good.
+     *
+     * Scheduled rather than immediate, because this is the one action here that cannot be undone by any
+     * other: everything the key encrypted - a bucket's objects, a secret's value - becomes unreadable when
+     * the date passes, and the window is the only chance anybody gets to notice. A key inside its window
+     * still decrypts.
+     *
+     * Takes the key's ID rather than its ERN, as {@link encrypt} does.
+     */
+    deleteKey(keyId: string, pendingWindowInDays?: number): Promise<DeleteKeyResult>;
+    /**
+     * Stops a key encrypting anything further, without touching what it already wrote.
+     *
+     * The difference from {@link deleteKey} is that nothing becomes unreadable: a revoked key still
+     * decrypts, so this is what to reach for when a key should no longer be used but the data under it is
+     * still wanted.
+     *
+     * Takes the key's ERN rather than its ID.
+     */
+    revokeKey(ern: string): Promise<RevokeKeyResult>;
+    /**
+     * Changes what a key says it is for.
+     *
+     * Only the description changes: the material, algorithm, length, status and any scheduled deletion are
+     * untouched, so describing a key neither prolongs nor shortens its life. An empty string clears the
+     * description rather than leaving it alone - otherwise there would be no way to remove one.
+     *
+     * Takes the key's ERN rather than its ID.
+     */
+    setKeyDescription(ern: string, description: string): Promise<KeyDescriptionResult>;
+    /**
+     * Tags a key. The tag is upserted, so one already there has its value replaced - EKM has no separate
+     * set-key-tag action to distinguish the two.
+     */
+    addKeyTag(ern: string, key: string, value: string): Promise<void>;
+    /** Removes a tag from a key. */
+    deleteKeyTag(ern: string, key: string): Promise<void>;
+    /**
+     * Encrypts bytes with a key the server holds, and answers with `IV || ciphertext || tag`.
+     *
+     * Those are the exact bytes {@link decrypt} takes back; nothing here needs to be unpacked or
+     * re-assembled. Only a key whose status is `AVAILABLE` encrypts - a revoked one, or one scheduled for
+     * deletion, is refused with HTTP 403.
+     *
+     * Takes the key's ID - the `name` {@link createKey} answered with - rather than its ERN.
+     */
+    encrypt(keyId: string, plaintext: Bytes): Promise<Buffer>;
+    /**
+     * Decrypts what {@link encrypt} produced.
+     *
+     * Works for a revoked key and for one scheduled for deletion, right up until its deletion date passes -
+     * which is the whole difference between revoking a key and deleting it.
+     */
+    decrypt(keyId: string, ciphertext: Buffer | Uint8Array): Promise<Buffer>;
+    /**
+     * Stores a certificate somebody else issued, together with the private key that proves it.
+     *
+     * Both halves are required and the server checks them against each other: a certificate stored with a
+     * key that is not its own is accepted silently by every step after this one and only shows itself as a
+     * handshake that fails for every caller. A mismatch is HTTP 400 here instead.
+     *
+     * The private key stays with EKM. It goes in and is never handed back - no action returns one.
+     */
+    importCertificate(name: string, certificatePem: string, privateKeyPem: string, description?: string): Promise<Certificate>;
+    /**
+     * Generates a self-signed certificate, for an installation that has to serve HTTPS before anybody has
+     * bought it a real one.
+     *
+     * Nobody has vouched for the result - {@link import("../dto/ekm.js").Certificate.generated} says so,
+     * and a client still has to be told to trust it.
+     */
+    createCertificate(name: string, options?: CreateCertificateOptions): Promise<Certificate>;
+    /** One stored certificate, by name. The PEM comes back; the private key does not. */
+    getCertificate(name: string): Promise<Certificate>;
+    /** One page of certificates, and how many exist in total. */
+    listCertificates(options?: ListOptions): Promise<Page<Certificate>>;
+    /**
+     * Deletes a certificate, outright and with no grace period.
+     *
+     * Unlike {@link deleteKey} this needs none: nothing becomes unreadable, because a certificate is
+     * public. A listener already serving it keeps the copy it loaded until it is restarted, which is what
+     * makes this recoverable - import a replacement under the same name.
+     */
+    deleteCertificate(name: string): Promise<DeleteCertificateResult>;
+    /**
+     * EKM's own metrics, as the server collects them. Answered unparsed - the shape belongs to the
+     * monitoring module rather than to EKM.
+     */
+    metrics(): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=ekm.d.ts.map

package/dist/modules/ekm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ekm.d.ts","sourceRoot":"","sources":["../../src/modules/ekm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAU,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,GAAG,EACR,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAe,YAAY,EAAE,KAAK,KAAK,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,eAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,8FAA8F;AAC9F,eAAO,MAAM,GAAG,QAAQ,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,YAAY,UAAyB,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gHAAgH;IAChH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,YAAY;;gBAC7B,OAAO,EAAE,aAAa;IAMlC;;;;;;;OAOG;IACG,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IAUzE,2EAA2E;IACrE,QAAQ,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAI7D;;;;;;;;;OASG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,mBAAmB,SAA8B,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3G;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAItD;;;;;;;;OAQG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAIxF;;;OAGG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE,gCAAgC;IAC1B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3D;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAI/D;;;;;OAKG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB9E;;;;;;;;OAQG;IACG,iBAAiB,CACrB,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,aAAa,EAAE,MAAM,EACrB,WAAW,SAAK,GACf,OAAO,CAAC,WAAW,CAAC;IASvB;;;;;;OAMG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAG,OAAO,CAAC,WAAW,CAAC;IAanG,qFAAqF;IAC/E,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD,6DAA6D;IACvD,gBAAgB,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAK7E;;;;;;OAMG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAYvE;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAGlD"}