euclid-ndk 0.2.0

package/dist/modules/ekm.js

@@ -0,0 +1,228 @@
+/**
+ * EKM - euclid's key management module: encryption keys, and the certificates a deployment serves.
+ *
+ * One object, {@link EuclidEkm}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const ekm = session.ekm();
+ * const key = await ekm.createKey({ description: "customer exports" });
+ *
+ * const sealed = await ekm.encrypt(key.name, "account 4711");
+ * const plain = await ekm.decrypt(key.name, sealed);
+ * ```
+ *
+ * Key material never leaves the server: {@link EuclidEkm.encrypt} and {@link EuclidEkm.decrypt} send the
+ * bytes to the key rather than fetching the key to the bytes. That is what makes a key deletable as a
+ * unit - and what makes deleting one final, since nothing anywhere else has a copy.
+ *
+ * A key is named two ways, and they are not interchangeable. `name` is the ID the server minted and is
+ * what encrypts, decrypts and is deleted; the ERN is what revokes, describes and tags. Both are on every
+ * {@link import("../dto/ekm.js").Key} a listing returns.
+ *
+ * `encrypt` and `decrypt` carry raw bytes rather than JSON, and present the session's bearer token for
+ * the same reason ESM's transfer actions do - see {@link ModuleClient}.
+ */
+import { toPage } from "../dto/eam.js";
+import { toCertificate, toCreateKeyResult, toDeleteCertificateResult, toDeleteKeyResult, toKey, toKeyDescriptionResult, toRevokeKeyResult, } from "../dto/ekm.js";
+import { EuclidServiceError } from "../errors.js";
+import { listPayload, ModuleClient } from "./base.js";
+export const TARGET = "ekm";
+/** The only algorithm the server generates so far; anything else is refused with HTTP 400. */
+export const AES = "AES";
+/**
+ * The key length this SDK asks for when the caller does not say. 128 is the other one the server
+ * accepts, and what euclid-jdk's no-argument `createKey()` mints; 256 is what euclid itself creates when
+ * a bucket asks to be encrypted, which is the better default to inherit.
+ */
+export const DEFAULT_KEY_LENGTH = 256;
+/**
+ * How long a key scheduled for deletion stays alive by default, in days. The server's own default when
+ * the field is left out, restated here because it is the one number in this module that decides whether
+ * a mistake can be caught.
+ */
+export const DEFAULT_PENDING_WINDOW_DAYS = 7;
+/** The actions that carry raw bytes rather than JSON. */
+export const BYTE_ACTIONS = ["encrypt", "decrypt"];
+/**
+ * EKM's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.ekm} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export class EuclidEkm extends ModuleClient {
+    constructor(session) {
+        super(session, { target: TARGET, byteActions: BYTE_ACTIONS });
+    }
+    // -- keys ------------------------------------------------------------------------------------
+    /**
+     * Creates a key, and answers with the ID the server minted for it.
+     *
+     * The description is worth supplying. A key is identified by that generated ID, which says nothing
+     * about what the key protects, and a key outlives the reason it was made - so months later this is the
+     * only thing that answers whether it can be deleted, and deleting one is not a mistake that can be
+     * undone.
+     */
+    async createKey(options = {}) {
+        return toCreateKeyResult(await this.call("create-key", {
+            algorithm: options.algorithm ?? AES,
+            length: options.length ?? DEFAULT_KEY_LENGTH,
+            description: options.description ?? "",
+        }));
+    }
+    /** One page of keys, and how many exist in total. Never their material. */
+    async listKeys(options = {}) {
+        return toPage(await this.call("list-keys", listPayload(options, "name")), "keys", toKey);
+    }
+    /**
+     * Schedules a key for deletion, and answers with the date it goes for good.
+     *
+     * Scheduled rather than immediate, because this is the one action here that cannot be undone by any
+     * other: everything the key encrypted - a bucket's objects, a secret's value - becomes unreadable when
+     * the date passes, and the window is the only chance anybody gets to notice. A key inside its window
+     * still decrypts.
+     *
+     * Takes the key's ID rather than its ERN, as {@link encrypt} does.
+     */
+    async deleteKey(keyId, pendingWindowInDays = DEFAULT_PENDING_WINDOW_DAYS) {
+        return toDeleteKeyResult(await this.call("delete-key", { keyId, pendingWindowInDays }));
+    }
+    /**
+     * Stops a key encrypting anything further, without touching what it already wrote.
+     *
+     * The difference from {@link deleteKey} is that nothing becomes unreadable: a revoked key still
+     * decrypts, so this is what to reach for when a key should no longer be used but the data under it is
+     * still wanted.
+     *
+     * Takes the key's ERN rather than its ID.
+     */
+    async revokeKey(ern) {
+        return toRevokeKeyResult(await this.call("revoke-key", { ern }));
+    }
+    /**
+     * Changes what a key says it is for.
+     *
+     * Only the description changes: the material, algorithm, length, status and any scheduled deletion are
+     * untouched, so describing a key neither prolongs nor shortens its life. An empty string clears the
+     * description rather than leaving it alone - otherwise there would be no way to remove one.
+     *
+     * Takes the key's ERN rather than its ID.
+     */
+    async setKeyDescription(ern, description) {
+        return toKeyDescriptionResult(await this.call("set-key-description", { ern, description }));
+    }
+    /**
+     * Tags a key. The tag is upserted, so one already there has its value replaced - EKM has no separate
+     * set-key-tag action to distinguish the two.
+     */
+    async addKeyTag(ern, key, value) {
+        await this.call("add-key-tag", { ern, key, value });
+    }
+    /** Removes a tag from a key. */
+    async deleteKeyTag(ern, key) {
+        await this.call("delete-key-tag", { ern, key });
+    }
+    // -- using a key -----------------------------------------------------------------------------
+    /**
+     * Encrypts bytes with a key the server holds, and answers with `IV || ciphertext || tag`.
+     *
+     * Those are the exact bytes {@link decrypt} takes back; nothing here needs to be unpacked or
+     * re-assembled. Only a key whose status is `AVAILABLE` encrypts - a revoked one, or one scheduled for
+     * deletion, is refused with HTTP 403.
+     *
+     * Takes the key's ID - the `name` {@link createKey} answered with - rather than its ERN.
+     */
+    async encrypt(keyId, plaintext) {
+        return this.#transform("encrypt", keyId, plaintext);
+    }
+    /**
+     * Decrypts what {@link encrypt} produced.
+     *
+     * Works for a revoked key and for one scheduled for deletion, right up until its deletion date passes -
+     * which is the whole difference between revoking a key and deleting it.
+     */
+    async decrypt(keyId, ciphertext) {
+        return this.#transform("decrypt", keyId, ciphertext);
+    }
+    /**
+     * encrypt and decrypt differ only in direction: both send opaque bytes, name their key in a header, and
+     * answer with opaque bytes.
+     */
+    async #transform(action, keyId, data) {
+        const response = await this.postBytes(action, data, { "x-euclid-key-id": keyId });
+        if (!response.ok)
+            throw new EuclidServiceError(TARGET, action, response.status, response.text);
+        return response.content;
+    }
+    // -- certificates ----------------------------------------------------------------------------
+    /**
+     * Stores a certificate somebody else issued, together with the private key that proves it.
+     *
+     * Both halves are required and the server checks them against each other: a certificate stored with a
+     * key that is not its own is accepted silently by every step after this one and only shows itself as a
+     * handshake that fails for every caller. A mismatch is HTTP 400 here instead.
+     *
+     * The private key stays with EKM. It goes in and is never handed back - no action returns one.
+     */
+    async importCertificate(name, certificatePem, privateKeyPem, description = "") {
+        return this.#certificate("import-certificate", {
+            name,
+            description,
+            certificate: certificatePem,
+            privateKey: privateKeyPem,
+        });
+    }
+    /**
+     * Generates a self-signed certificate, for an installation that has to serve HTTPS before anybody has
+     * bought it a real one.
+     *
+     * Nobody has vouched for the result - {@link import("../dto/ekm.js").Certificate.generated} says so,
+     * and a client still has to be told to trust it.
+     */
+    async createCertificate(name, options = {}) {
+        const payload = {
+            name,
+            description: options.description ?? "",
+            commonName: options.commonName ?? "",
+            subjectAltNames: [...(options.subjectAltNames ?? [])],
+        };
+        // Left out rather than sent as zero, so the server's own defaults - 825 days, 2048 bits - apply.
+        if (options.validDays)
+            payload["validDays"] = options.validDays;
+        if (options.keyBits)
+            payload["keyBits"] = options.keyBits;
+        return this.#certificate("create-certificate", payload);
+    }
+    /** One stored certificate, by name. The PEM comes back; the private key does not. */
+    async getCertificate(name) {
+        return this.#certificate("get-certificate", { name });
+    }
+    /** One page of certificates, and how many exist in total. */
+    async listCertificates(options = {}) {
+        const response = await this.call("list-certificates", listPayload(options, "name"));
+        return toPage(response, "certificates", toCertificate);
+    }
+    /**
+     * Deletes a certificate, outright and with no grace period.
+     *
+     * Unlike {@link deleteKey} this needs none: nothing becomes unreadable, because a certificate is
+     * public. A listener already serving it keeps the copy it loaded until it is restarted, which is what
+     * makes this recoverable - import a replacement under the same name.
+     */
+    async deleteCertificate(name) {
+        return toDeleteCertificateResult(await this.call("delete-certificate", { name }));
+    }
+    /** The three actions that answer with one certificate, wrapped in a `certificate` field. */
+    async #certificate(action, payload) {
+        const response = await this.call(action, payload);
+        return toCertificate(response["certificate"]);
+    }
+    // -- monitoring ------------------------------------------------------------------------------
+    /**
+     * EKM's own metrics, as the server collects them. Answered unparsed - the shape belongs to the
+     * monitoring module rather than to EKM.
+     */
+    async metrics() {
+        return this.call("get-metrics");
+    }
+}
+//# sourceMappingURL=ekm.js.map

package/dist/modules/ekm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ekm.js","sourceRoot":"","sources":["../../src/modules/ekm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,EAAa,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,EACL,sBAAsB,EACtB,iBAAiB,GAQlB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAgC,MAAM,WAAW,CAAC;AAGpF,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC;AAE5B,8FAA8F;AAC9F,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;AAEzB;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AA6BnD;;;;;GAKG;AACH,MAAM,OAAO,SAAU,SAAQ,YAAY;IACzC,YAAY,OAAsB;QAChC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,+FAA+F;IAE/F;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CAAC,UAA4B,EAAE;QAC5C,OAAO,iBAAiB,CACtB,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,GAAG;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,kBAAkB;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,QAAQ,CAAC,UAAuB,EAAE;QACtC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,mBAAmB,GAAG,2BAA2B;QAC9E,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,WAAmB;QACtD,OAAO,sBAAsB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,GAAW;QACzC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,SAAgB;QAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,UAA+B;QAC1D,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,IAAW;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/F,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CACrB,IAAY,EACZ,cAAsB,EACtB,aAAqB,EACrB,WAAW,GAAG,EAAE;QAEhB,OAAO,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE;YAC7C,IAAI;YACJ,WAAW;YACX,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,UAAoC,EAAE;QAC1E,MAAM,OAAO,GAA4B;YACvC,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;YACpC,eAAe,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;SACtD,CAAC;QACF,iGAAiG;QACjG,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAChE,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,gBAAgB,CAAC,UAAuB,EAAE;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAClC,OAAO,yBAAyB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,OAAgC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,+FAA+F;IAE/F;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/modules/ekv.d.ts

@@ -0,0 +1,189 @@
+/**
+ * EKV - euclid's key-value store: tables of items, read by key rather than searched.
+ *
+ * One object, {@link EuclidEkv}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const ekv = session.ekv();
+ * await ekv.createTable("sessions", "userId", { sortKey: "startedAt", sortKeyType: KEY_NUMBER });
+ *
+ * await ekv.putItem("sessions", { userId: "jens", startedAt: 1757462400, host: "laptop" });
+ * const recent = await ekv.query("sessions", "jens", { sortOperator: SORT_GE, sortValue: 1757462400 });
+ * ```
+ *
+ * A table is keyed on one attribute, or on two: a partition key that identifies an item, and optionally a
+ * sort key that orders the items sharing a partition key - which is what makes a partition readable as a
+ * range. The key attributes have declared types, and those are what make a range mean what it should: a
+ * {@link KEY_NUMBER} sort key orders 2, 9, 10, 100 rather than putting "10" before "9". They cannot be
+ * changed after the table is created.
+ *
+ * An item's other attributes are free-form documents - scalars, arrays, nested objects - and are not
+ * declared anywhere. They are also not typed the way a queue message's attributes are: EKV stores what JSON
+ * can express, so nothing here takes a {@link import("../dto/com.js").Variant}.
+ */
+import { type Page } from "../dto/eam.js";
+import { type Item, type QueryResult, type ScanResult, type TableDescription } from "../dto/ekv.js";
+import { ModuleClient, type ListOptions } from "./base.js";
+import type { EuclidSession } from "./eam.js";
+export declare const TARGET = "ekv";
+/**
+ * The types a key attribute can have. A table's keys are the only attributes with a declared type, and the
+ * type is what a comparison is made under.
+ */
+export declare const KEY_STRING = "string";
+export declare const KEY_NUMBER = "number";
+export declare const KEY_BINARY = "binary";
+/**
+ * How {@link EuclidEkv.query} narrows by sort key. The default takes the whole partition; the rest need a
+ * table that declares a sort key, and asking one that does not is refused with HTTP 400.
+ */
+export declare const WHOLE_PARTITION = "";
+export declare const SORT_EQ = "eq";
+export declare const SORT_LT = "lt";
+export declare const SORT_LE = "le";
+export declare const SORT_GT = "gt";
+export declare const SORT_GE = "ge";
+/** Takes a lower and an upper bound, both inclusive - see {@link EuclidEkv.query}. */
+export declare const SORT_BETWEEN = "between";
+/**
+ * The one operator that is not a comparison, and so the one that applies to a string sort key only: a prefix
+ * of a number or of a blob is not a thing.
+ */
+export declare const SORT_BEGINS_WITH = "begins-with";
+/** What a table is keyed on, beyond the partition key every table has. */
+export interface CreateTableOptions {
+    /** {@link KEY_STRING}, {@link KEY_NUMBER} or {@link KEY_BINARY}. */
+    partitionKeyType?: string;
+    /**
+     * The attribute items sharing a partition key are ordered by, which is what makes a partition readable as
+     * a range. Left empty, the table has none and {@link EuclidEkv.query} can only take whole partitions.
+     */
+    sortKey?: string;
+    /** The sort key's type, which decides what its ordering means. */
+    sortKeyType?: string;
+}
+/** How a query narrows a partition, and in what order and quantity it reads it. */
+export interface QueryOptions {
+    /**
+     * {@link SORT_EQ}, {@link SORT_LT}, {@link SORT_LE}, {@link SORT_GT}, {@link SORT_GE},
+     * {@link SORT_BETWEEN} or {@link SORT_BEGINS_WITH}, or {@link WHOLE_PARTITION} for all of it.
+     */
+    sortOperator?: string;
+    /** What to compare the sort key against - the lower bound for {@link SORT_BETWEEN}. */
+    sortValue?: unknown;
+    /** The upper bound, for {@link SORT_BETWEEN} only. */
+    sortUpper?: unknown;
+    /**
+     * Whether to read in ascending sort-key order. Always sent, because the server reads an absent flag as
+     * descending rather than as "unspecified".
+     */
+    forward?: boolean;
+    /** The most items to return; 0 means no limit. */
+    pageSize?: number;
+    /** The zero-based page, applied when `pageSize` is set. */
+    pageIndex?: number;
+}
+/** How much of a table a scan reads at a time. */
+export interface ScanOptions {
+    pageSize?: number;
+    pageIndex?: number;
+}
+/**
+ * EKV's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.ekv} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export declare class EuclidEkv extends ModuleClient {
+    constructor(session: EuclidSession);
+    /**
+     * Creates a table, and answers with it as it was created - with an item count of zero.
+     *
+     * Refused with HTTP 409 if a table of that name already exists, and with HTTP 400 if a key attribute is
+     * empty, starts with `$`, contains `.`, or if the sort key names the same attribute as the partition key.
+     *
+     * @param name name of the table
+     * @param partitionKey the attribute every item is identified by.
+     * @param options table options
+     */
+    createTable(name: string, partitionKey: string, options?: CreateTableOptions): Promise<TableDescription>;
+    /**
+     * A table's key, and how many items it holds.
+     *
+     * The count is counted rather than looked up, so this is not free on a large table.
+     */
+    describeTable(name: string): Promise<TableDescription>;
+    /** One page of tables, each described as {@link describeTable} would describe it. */
+    listTables(options?: ListOptions): Promise<Page<TableDescription>>;
+    /**
+     * Deletes a table and every item in it, and answers with how many items went with it.
+     *
+     * There is no confirmation and nothing is kept.
+     */
+    deleteTable(name: string): Promise<number>;
+    /**
+     * Writes an item, replacing whatever was stored under its key.
+     *
+     * It replaces rather than merges: an item written with two attributes has two attributes afterwards,
+     * whatever it had before. So changing one field means reading the item, changing it and writing the whole
+     * thing back - which is why {@link import("../dto/ekv.js").Item} keeps the server's timestamps out of its
+     * attributes, where they would otherwise be written back as two attributes of the caller's own.
+     *
+     * The item has to carry the table's key attributes with the types the table declared for them, and no
+     * attribute name may be empty, start with `$` or contain `.`.
+     */
+    putItem(table: string, item: Record<string, unknown>): Promise<Item>;
+    /**
+     * Reads one item by its key.
+     *
+     * The key names the table's key attributes and only those - the partition key alone where the table has no
+     * sort key, both where it has one.
+     *
+     * An item that is not there is HTTP 404, and so a {@link EuclidServiceError} rather than an empty item:
+     * "there is no such item" and "here is an item with nothing in it" are different, and a caller should not
+     * have to tell them apart. Where a miss is an ordinary outcome, use {@link findItem}.
+     */
+    getItem(table: string, key: Record<string, unknown>): Promise<Item>;
+    /**
+     * The same read as {@link getItem}, answering null rather than throwing when there is no such item.
+     *
+     * Only a 404 becomes null. A refusal, a malformed key or a table that does not exist still throws, because
+     * none of those mean "not there".
+     */
+    findItem(table: string, key: Record<string, unknown>): Promise<Item | null>;
+    /**
+     * Removes one item by its key, and says whether there was one to remove.
+     *
+     * False rather than an error for a key that names nothing: deleting what is not there has already achieved
+     * what the caller asked for.
+     */
+    deleteItem(table: string, key: Record<string, unknown>): Promise<boolean>;
+    /**
+     * Reads the items of one partition, in sort-key order.
+     *
+     * This is the lookup EKV is for: it addresses a partition by key rather than reading the table. Narrowing
+     * by sort key needs a table that declares one, and asking one that does not for anything but
+     * {@link WHOLE_PARTITION} is refused with HTTP 400.
+     *
+     * @param table name of the table
+     * @param partitionKey the partition key's value, of the type the table declared for it.
+     * @param options table options
+     * @throws {Error} if {@link SORT_BETWEEN} was asked for without both bounds, which the server refuses
+     *   anyway - this just says so before the round trip.
+     */
+    query(table: string, partitionKey: unknown, options?: QueryOptions): Promise<QueryResult>;
+    /**
+     * Reads a table's items without regard to their key.
+     *
+     * This reads the table rather than an index: fine for a small table or an export, the wrong tool for a
+     * lookup - {@link query} is that. A `pageSize` of 0 means no limit, so a scan of a large table with no
+     * paging brings all of it back.
+     */
+    scan(table: string, options?: ScanOptions): Promise<ScanResult>;
+    /**
+     * EKV's own metrics, as the server collects them. Answered unparsed - the shape belongs to the monitoring
+     * module rather than to EKV.
+     */
+    metrics(): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=ekv.d.ts.map

package/dist/modules/ekv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ekv.d.ts","sourceRoot":"","sources":["../../src/modules/ekv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAU,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAKL,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAe,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,eAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;GAGG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,OAAO,OAAO,CAAC;AAC5B,eAAO,MAAM,OAAO,OAAO,CAAC;AAC5B,eAAO,MAAM,OAAO,OAAO,CAAC;AAC5B,eAAO,MAAM,OAAO,OAAO,CAAC;AAC5B,eAAO,MAAM,OAAO,OAAO,CAAC;AAC5B,sFAAsF;AACtF,eAAO,MAAM,YAAY,YAAY,CAAC;AACtC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAK9C,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,YAAY;gBAC7B,OAAO,EAAE,aAAa;IAMlC;;;;;;;;;OASG;IACG,WAAW,CACf,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAY5B;;;;OAIG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI5D,qFAAqF;IAC/E,UAAU,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAK5E;;;;OAIG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMhD;;;;;;;;;;OAUG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E;;;;;;;;;OASG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzE;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IASjF;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAO/E;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAsBnG;;;;;;OAMG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAOzE;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAGlD"}

package/dist/modules/ekv.js

@@ -0,0 +1,212 @@
+/**
+ * EKV - euclid's key-value store: tables of items, read by key rather than searched.
+ *
+ * One object, {@link EuclidEkv}, built from a session that has already logged in:
+ *
+ * ```ts
+ * const ekv = session.ekv();
+ * await ekv.createTable("sessions", "userId", { sortKey: "startedAt", sortKeyType: KEY_NUMBER });
+ *
+ * await ekv.putItem("sessions", { userId: "jens", startedAt: 1757462400, host: "laptop" });
+ * const recent = await ekv.query("sessions", "jens", { sortOperator: SORT_GE, sortValue: 1757462400 });
+ * ```
+ *
+ * A table is keyed on one attribute, or on two: a partition key that identifies an item, and optionally a
+ * sort key that orders the items sharing a partition key - which is what makes a partition readable as a
+ * range. The key attributes have declared types, and those are what make a range mean what it should: a
+ * {@link KEY_NUMBER} sort key orders 2, 9, 10, 100 rather than putting "10" before "9". They cannot be
+ * changed after the table is created.
+ *
+ * An item's other attributes are free-form documents - scalars, arrays, nested objects - and are not
+ * declared anywhere. They are also not typed the way a queue message's attributes are: EKV stores what JSON
+ * can express, so nothing here takes a {@link import("../dto/com.js").Variant}.
+ */
+import { toPage } from "../dto/eam.js";
+import { toItem, toQueryResult, toScanResult, toTableDescription, } from "../dto/ekv.js";
+import { EuclidServiceError } from "../errors.js";
+import { listPayload, ModuleClient } from "./base.js";
+export const TARGET = "ekv";
+/**
+ * The types a key attribute can have. A table's keys are the only attributes with a declared type, and the
+ * type is what a comparison is made under.
+ */
+export const KEY_STRING = "string";
+export const KEY_NUMBER = "number";
+export const KEY_BINARY = "binary";
+/**
+ * How {@link EuclidEkv.query} narrows by sort key. The default takes the whole partition; the rest need a
+ * table that declares a sort key, and asking one that does not is refused with HTTP 400.
+ */
+export const WHOLE_PARTITION = "";
+export const SORT_EQ = "eq";
+export const SORT_LT = "lt";
+export const SORT_LE = "le";
+export const SORT_GT = "gt";
+export const SORT_GE = "ge";
+/** Takes a lower and an upper bound, both inclusive - see {@link EuclidEkv.query}. */
+export const SORT_BETWEEN = "between";
+/**
+ * The one operator that is not a comparison, and so the one that applies to a string sort key only: a prefix
+ * of a number or of a blob is not a thing.
+ */
+export const SORT_BEGINS_WITH = "begins-with";
+/** HTTP 404, which is how a read says the item is not there - see {@link EuclidEkv.findItem}. */
+const NOT_FOUND = 404;
+/**
+ * EKV's operations, on the credentials of the session that created it.
+ *
+ * Built by {@link EuclidSession.ekv} rather than directly, so that it shares that session's identity,
+ * namespace and connection settings - and follows them as they change.
+ */
+export class EuclidEkv extends ModuleClient {
+    constructor(session) {
+        super(session, { target: TARGET });
+    }
+    // -- tables ----------------------------------------------------------------------------------
+    /**
+     * Creates a table, and answers with it as it was created - with an item count of zero.
+     *
+     * Refused with HTTP 409 if a table of that name already exists, and with HTTP 400 if a key attribute is
+     * empty, starts with `$`, contains `.`, or if the sort key names the same attribute as the partition key.
+     *
+     * @param name name of the table
+     * @param partitionKey the attribute every item is identified by.
+     * @param options table options
+     */
+    async createTable(name, partitionKey, options = {}) {
+        return toTableDescription(await this.call("create-table", {
+            name,
+            partitionKey,
+            partitionKeyType: options.partitionKeyType ?? KEY_STRING,
+            sortKey: options.sortKey ?? "",
+            sortKeyType: options.sortKeyType ?? KEY_STRING,
+        }));
+    }
+    /**
+     * A table's key, and how many items it holds.
+     *
+     * The count is counted rather than looked up, so this is not free on a large table.
+     */
+    async describeTable(name) {
+        return toTableDescription(await this.call("describe-table", { name }));
+    }
+    /** One page of tables, each described as {@link describeTable} would describe it. */
+    async listTables(options = {}) {
+        const response = await this.call("list-tables", listPayload(options, "name"));
+        return toPage(response, "tables", toTableDescription);
+    }
+    /**
+     * Deletes a table and every item in it, and answers with how many items went with it.
+     *
+     * There is no confirmation and nothing is kept.
+     */
+    async deleteTable(name) {
+        return this.numberOf("delete-table", { name }, "deletedItems");
+    }
+    // -- items -----------------------------------------------------------------------------------
+    /**
+     * Writes an item, replacing whatever was stored under its key.
+     *
+     * It replaces rather than merges: an item written with two attributes has two attributes afterwards,
+     * whatever it had before. So changing one field means reading the item, changing it and writing the whole
+     * thing back - which is why {@link import("../dto/ekv.js").Item} keeps the server's timestamps out of its
+     * attributes, where they would otherwise be written back as two attributes of the caller's own.
+     *
+     * The item has to carry the table's key attributes with the types the table declared for them, and no
+     * attribute name may be empty, start with `$` or contain `.`.
+     */
+    async putItem(table, item) {
+        return toItem(await this.call("put-item", { table, item }));
+    }
+    /**
+     * Reads one item by its key.
+     *
+     * The key names the table's key attributes and only those - the partition key alone where the table has no
+     * sort key, both where it has one.
+     *
+     * An item that is not there is HTTP 404, and so a {@link EuclidServiceError} rather than an empty item:
+     * "there is no such item" and "here is an item with nothing in it" are different, and a caller should not
+     * have to tell them apart. Where a miss is an ordinary outcome, use {@link findItem}.
+     */
+    async getItem(table, key) {
+        return toItem(await this.call("get-item", { table, key }));
+    }
+    /**
+     * The same read as {@link getItem}, answering null rather than throwing when there is no such item.
+     *
+     * Only a 404 becomes null. A refusal, a malformed key or a table that does not exist still throws, because
+     * none of those mean "not there".
+     */
+    async findItem(table, key) {
+        try {
+            return await this.getItem(table, key);
+        }
+        catch (error) {
+            if (error instanceof EuclidServiceError && error.status === NOT_FOUND)
+                return null;
+            throw error;
+        }
+    }
+    /**
+     * Removes one item by its key, and says whether there was one to remove.
+     *
+     * False rather than an error for a key that names nothing: deleting what is not there has already achieved
+     * what the caller asked for.
+     */
+    async deleteItem(table, key) {
+        const response = await this.call("delete-item", { table, key });
+        return response["deleted"] === true;
+    }
+    // -- reading many ----------------------------------------------------------------------------
+    /**
+     * Reads the items of one partition, in sort-key order.
+     *
+     * This is the lookup EKV is for: it addresses a partition by key rather than reading the table. Narrowing
+     * by sort key needs a table that declares one, and asking one that does not for anything but
+     * {@link WHOLE_PARTITION} is refused with HTTP 400.
+     *
+     * @param table name of the table
+     * @param partitionKey the partition key's value, of the type the table declared for it.
+     * @param options table options
+     * @throws {Error} if {@link SORT_BETWEEN} was asked for without both bounds, which the server refuses
+     *   anyway - this just says so before the round trip.
+     */
+    async query(table, partitionKey, options = {}) {
+        const sortOperator = options.sortOperator ?? WHOLE_PARTITION;
+        if (sortOperator === SORT_BETWEEN && (options.sortValue === undefined || options.sortUpper === undefined)) {
+            throw new Error("between needs both a sortValue and a sortUpper");
+        }
+        // Null rather than absent for the two bounds: JSON.stringify drops an undefined field altogether, and
+        // the server reads the pair as sent rather than as defaulted.
+        return toQueryResult(await this.call("query", {
+            table,
+            partitionKey,
+            sortOperator,
+            sortValue: options.sortValue ?? null,
+            sortUpper: options.sortUpper ?? null,
+            forward: options.forward ?? true,
+            pageSize: options.pageSize ?? 0,
+            pageIndex: options.pageIndex ?? 0,
+        }));
+    }
+    /**
+     * Reads a table's items without regard to their key.
+     *
+     * This reads the table rather than an index: fine for a small table or an export, the wrong tool for a
+     * lookup - {@link query} is that. A `pageSize` of 0 means no limit, so a scan of a large table with no
+     * paging brings all of it back.
+     */
+    async scan(table, options = {}) {
+        const payload = { table, pageSize: options.pageSize ?? 0, pageIndex: options.pageIndex ?? 0 };
+        return toScanResult(await this.call("scan", payload));
+    }
+    // -- monitoring ------------------------------------------------------------------------------
+    /**
+     * EKV's own metrics, as the server collects them. Answered unparsed - the shape belongs to the monitoring
+     * module rather than to EKV.
+     */
+    async metrics() {
+        return this.call("get-metrics");
+    }
+}
+//# sourceMappingURL=ekv.js.map

package/dist/modules/ekv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ekv.js","sourceRoot":"","sources":["../../src/modules/ekv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,EAAa,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,MAAM,EACN,aAAa,EACb,YAAY,EACZ,kBAAkB,GAKnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,WAAW,CAAC;AAGxE,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AACnC,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AACnC,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAEnC;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,sFAAsF;AACtF,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AACtC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,iGAAiG;AACjG,MAAM,SAAS,GAAG,GAAG,CAAC;AA2CtB;;;;;GAKG;AACH,MAAM,OAAO,SAAU,SAAQ,YAAY;IACzC,YAAY,OAAsB;QAChC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW,CACf,IAAY,EACZ,YAAoB,EACpB,UAA8B,EAAE;QAEhC,OAAO,kBAAkB,CACvB,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAC9B,IAAI;YACJ,YAAY;YACZ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,UAAU;YACxD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,UAAU;SAC/C,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,kBAAkB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,UAAU,CAAC,UAAuB,EAAE;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;IACjE,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,IAA6B;QACxD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,GAA4B;QACvD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,GAA4B;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,GAA4B;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,+FAA+F;IAE/F;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,YAAqB,EAAE,UAAwB,EAAE;QAC1E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,eAAe,CAAC;QAC7D,IAAI,YAAY,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,sGAAsG;QACtG,8DAA8D;QAC9D,OAAO,aAAa,CAClB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACvB,KAAK;YACL,YAAY;YACZ,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;SAClC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,UAAuB,EAAE;QACjD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QAC9F,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,+FAA+F;IAE/F;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;CACF"}