euclid-ndk 0.2.0

package/dist/credentials.js

@@ -0,0 +1,135 @@
+/**
+ * The `~/.euclid/credentials` file, shared with euclid-cli, euclid-jdk and euclid-pdk.
+ *
+ * All four clients read and write the same file, so a login from any of them is picked up by the
+ * others. That makes the field names a wire format rather than an implementation detail: the
+ * namespace key is `namespace` (not `nameSpace`), `isAdmin` travels alongside the token, and an
+ * absent namespace is written as an empty string rather than null so the CLI's string reader can
+ * take it. `baseUrl` is the one field the CLI has no equivalent for - it is what lets a cached
+ * session be recognised as belonging to the server being talked to now.
+ */
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/**
+ * Where the credentials live.
+ *
+ * Resolved per call rather than captured at import, mirroring euclid-cli's
+ * `Credentials::FilePath()`: the home directory is read when the file is actually touched, so a
+ * process that changes it is not left talking to a stale path. `EUCLID_CREDENTIALS_FILE` overrides
+ * it, which is also how a euclid-managed application is handed its own credentials.
+ */
+export function credentialsPath() {
+    return process.env["EUCLID_CREDENTIALS_FILE"] || join(homedir(), ".euclid", "credentials");
+}
+/** The cached credentials, or null when there is no readable, well-formed file. */
+export async function load() {
+    let document;
+    try {
+        document = JSON.parse(await readFile(credentialsPath(), "utf8"));
+    }
+    catch {
+        // No file, no permission, or not JSON. All three mean the same thing to a caller: there is
+        // nothing cached to reuse, so log in.
+        return null;
+    }
+    if (document === null || typeof document !== "object" || Array.isArray(document))
+        return null;
+    return fromJson(document);
+}
+/** Writes the credentials, readable by their owner alone. */
+export async function save(credentials) {
+    const path = credentialsPath();
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(toJson(credentials)), "utf8");
+    try {
+        await chmod(path, 0o600);
+    }
+    catch {
+        // Not every filesystem has POSIX permissions, and a credentials file that exists is better
+        // than a login that failed over its mode.
+    }
+}
+/**
+ * Patches the cached namespace in place, if what is cached belongs to `baseUrl`.
+ *
+ * Keeps the file in step when a session's namespace changes outside of a login. A no-op when
+ * nothing is cached for that server, in keeping with the best-effort nature of the cache: failing
+ * to record a namespace is not a reason to fail the call that changed it.
+ */
+export async function updateNamespace(baseUrl, namespace) {
+    const cached = await load();
+    if (cached === null || cached.baseUrl !== baseUrl)
+        return;
+    cached.namespace = namespace || "";
+    await save(cached);
+}
+/**
+ * Whether a JWT is well-formed and its `exp` is still in the future.
+ *
+ * Checked locally to avoid a round trip that would only tell us what the token already says. The
+ * signature is not verified - the client does not hold the server's secret, and a token the client
+ * forged for itself would be rejected on arrival anyway.
+ */
+export function isTokenValid(token) {
+    const parts = token.split(".");
+    if (parts.length < 2)
+        return false;
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    }
+    catch {
+        return false;
+    }
+    if (payload === null || typeof payload !== "object")
+        return false;
+    const expiry = payload.exp;
+    return typeof expiry === "number" && Date.now() / 1000 < expiry;
+}
+/** An empty set of credentials, which is what every field defaults from. */
+export function emptyCredentials() {
+    return {
+        token: "",
+        userId: "",
+        accountId: "",
+        region: "",
+        accessKeyId: "",
+        secretAccessKey: "",
+        isAdmin: false,
+        baseUrl: "",
+        namespace: "",
+        raw: {},
+    };
+}
+function fromJson(document) {
+    return {
+        token: text(document["token"]),
+        userId: text(document["userId"]),
+        accountId: text(document["accountId"]),
+        region: text(document["region"]),
+        accessKeyId: text(document["accessKeyId"]),
+        secretAccessKey: text(document["secretAccessKey"]),
+        isAdmin: document["isAdmin"] === true,
+        baseUrl: text(document["baseUrl"]),
+        namespace: text(document["namespace"]),
+        raw: document,
+    };
+}
+function toJson(credentials) {
+    return {
+        token: credentials.token,
+        userId: credentials.userId,
+        accountId: credentials.accountId,
+        region: credentials.region,
+        accessKeyId: credentials.accessKeyId,
+        secretAccessKey: credentials.secretAccessKey,
+        isAdmin: credentials.isAdmin,
+        baseUrl: credentials.baseUrl,
+        namespace: credentials.namespace,
+    };
+}
+function text(value) {
+    return typeof value === "string" ? value : "";
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiB1C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC7F,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,sCAAsC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,QAAQ,CAAC,QAAmC,CAAC,CAAC;AACvD,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,WAA8B;IACvD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,0CAA0C;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,SAAiB;IACtE,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC5B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO;IAC1D,MAAM,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,MAAM,GAAI,OAA6B,CAAC,GAAG,CAAC;IAClD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC;AAClE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,EAAE;QACb,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,QAAiC;IACjD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC1C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI;QACrC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtC,GAAG,EAAE,QAAQ;KACd,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,WAA8B;IAC5C,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,eAAe,EAAE,WAAW,CAAC,eAAe;QAC5C,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/dto/com.d.ts

@@ -0,0 +1,101 @@
+/**
+ * The shapes more than one euclid module speaks.
+ *
+ * {@link Variant} is here rather than in the module that needed it first for the same reason the
+ * server keeps it in `Euclid::Dto::COM`: a queue message attribute, a topic message attribute and a
+ * storage object attribute are the same typed value on the wire.
+ *
+ * {@link Subscription} is here for a plainer reason - ESM and ENS answer with the same four fields,
+ * because both are saying the same thing: messages from this source go to that target from now on.
+ */
+/**
+ * What a message is delivered at, and the only three values euclid accepts.
+ *
+ * Shared for the same reason {@link Variant} is: a queue message, a topic message and the `priority`
+ * system attribute of a stored object all mean the same thing by it.
+ */
+export declare const PRIORITY_LOW = "LOW";
+export declare const PRIORITY_MIDDLE = "MIDDLE";
+export declare const PRIORITY_HIGH = "HIGH";
+/**
+ * What a subscription delivers to: a queue...
+ *
+ * Shared by ESM and ENS because the server's subscription is: both name a source, a target and which
+ * of these two the target is.
+ */
+export declare const QUEUE = "SQS";
+/** ...or a topic. The two name different modules, and this is what says which. */
+export declare const TOPIC = "SNS";
+/** The type tags `Euclid::Dto::COM::Variant` round-trips a value through. */
+export declare const VARIANT_INT = "int";
+export declare const VARIANT_LONG = "long";
+export declare const VARIANT_DOUBLE = "double";
+export declare const VARIANT_FLOAT = "float";
+export declare const VARIANT_BOOL = "bool";
+export declare const VARIANT_STRING = "string";
+export declare const VARIANT_BINARY = "binary";
+/**
+ * A typed value: what it is, and what it holds.
+ *
+ * The tag is what makes the round trip lossless. JSON has one number type and euclid's server has
+ * several, so an attribute stored as a `long` would come back as a `double` - or an `int`, depending
+ * on the reader - if the type travelled only in the shape of the value.
+ *
+ * `binary` is base64 on the wire and a {@link Buffer} here; {@link toVariant} decodes it and
+ * {@link variantToJson} encodes it again, so a caller never sees the encoding.
+ */
+export interface Variant {
+    type: string;
+    value: unknown;
+}
+/** What {@link variantOf} takes: a plain value to be tagged, or a variant that already is. */
+export type VariantInput = Variant | string | number | boolean | Uint8Array;
+/**
+ * A variant from a plain JavaScript value, tagged with the type euclid stores it under.
+ *
+ * A whole number becomes a `long` rather than an `int` because JavaScript has one number type and
+ * the 64-bit tag is the one that holds all of the integers it can represent exactly; anything else
+ * numeric becomes a `double` for the same reason.
+ *
+ * A {@link Variant} is returned as it is, so a caller may mix the two spellings in the same
+ * attribute map - and reach for the explicit one exactly when it wants a tag other than the obvious
+ * one.
+ *
+ * @throws {TypeError} for a value with no euclid variant type, which a variant spelled out by hand
+ *   is the way past.
+ */
+export declare function variantOf(value: VariantInput): Variant;
+/** This variant as the server reads it, with a `binary` value encoded as base64. */
+export declare function variantToJson(variant: Variant): Record<string, unknown>;
+/** One variant as the server sent it. An unreadable one reads as an empty string value. */
+export declare function toVariant(document: unknown): Variant;
+/** An object of variants keyed by name, empty when absent. */
+export declare function toVariantMap(document: unknown): Record<string, Variant>;
+/** An attribute map as the server reads it, taking plain values or variants. */
+export declare function variantMapToJson(attributes: Record<string, VariantInput> | undefined): Record<string, Record<string, unknown>>;
+/**
+ * A standing instruction to deliver what arrives at a source onward to a target.
+ *
+ * One shape for both modules that have them: a bucket's events going to a queue (ESM) and a topic's
+ * messages going to a queue (ENS) differ in what is delivered, not in how the instruction is
+ * described. `type` is {@link QUEUE} or {@link TOPIC}, and `ern` is the subscription's own - which is
+ * what removing it takes.
+ */
+export interface Subscription {
+    ern: string;
+    sourceErn: string;
+    type: string;
+    targetErn: string;
+    created: string;
+    modified: string;
+}
+/** A new subscription, as the `subscribe` actions answer with it: the same, minus the timestamps. */
+export interface SubscribeResult {
+    ern: string;
+    sourceErn: string;
+    type: string;
+    targetErn: string;
+}
+export declare function toSubscription(document: unknown): Subscription;
+export declare function toSubscribeResult(document: unknown): SubscribeResult;
+//# sourceMappingURL=com.d.ts.map

package/dist/dto/com.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"com.d.ts","sourceRoot":"","sources":["../../src/dto/com.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,QAAQ,CAAC;AAClC,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,KAAK,QAAQ,CAAC;AAC3B,kFAAkF;AAClF,eAAO,MAAM,KAAK,QAAQ,CAAC;AAE3B,6EAA6E;AAC7E,eAAO,MAAM,WAAW,QAAQ,CAAC;AACjC,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,eAAO,MAAM,aAAa,UAAU,CAAC;AACrC,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAWtD;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKvE;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAYpD;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvE;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,SAAS,GACnD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAKzC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qGAAqG;AACrG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,YAAY,CAS9D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,eAAe,CAOpE"}

package/dist/dto/com.js

@@ -0,0 +1,132 @@
+/**
+ * The shapes more than one euclid module speaks.
+ *
+ * {@link Variant} is here rather than in the module that needed it first for the same reason the
+ * server keeps it in `Euclid::Dto::COM`: a queue message attribute, a topic message attribute and a
+ * storage object attribute are the same typed value on the wire.
+ *
+ * {@link Subscription} is here for a plainer reason - ESM and ENS answer with the same four fields,
+ * because both are saying the same thing: messages from this source go to that target from now on.
+ */
+import { object, text } from "./json.js";
+/**
+ * What a message is delivered at, and the only three values euclid accepts.
+ *
+ * Shared for the same reason {@link Variant} is: a queue message, a topic message and the `priority`
+ * system attribute of a stored object all mean the same thing by it.
+ */
+export const PRIORITY_LOW = "LOW";
+export const PRIORITY_MIDDLE = "MIDDLE";
+export const PRIORITY_HIGH = "HIGH";
+/**
+ * What a subscription delivers to: a queue...
+ *
+ * Shared by ESM and ENS because the server's subscription is: both name a source, a target and which
+ * of these two the target is.
+ */
+export const QUEUE = "SQS";
+/** ...or a topic. The two name different modules, and this is what says which. */
+export const TOPIC = "SNS";
+/** The type tags `Euclid::Dto::COM::Variant` round-trips a value through. */
+export const VARIANT_INT = "int";
+export const VARIANT_LONG = "long";
+export const VARIANT_DOUBLE = "double";
+export const VARIANT_FLOAT = "float";
+export const VARIANT_BOOL = "bool";
+export const VARIANT_STRING = "string";
+export const VARIANT_BINARY = "binary";
+/**
+ * A variant from a plain JavaScript value, tagged with the type euclid stores it under.
+ *
+ * A whole number becomes a `long` rather than an `int` because JavaScript has one number type and
+ * the 64-bit tag is the one that holds all of the integers it can represent exactly; anything else
+ * numeric becomes a `double` for the same reason.
+ *
+ * A {@link Variant} is returned as it is, so a caller may mix the two spellings in the same
+ * attribute map - and reach for the explicit one exactly when it wants a tag other than the obvious
+ * one.
+ *
+ * @throws {TypeError} for a value with no euclid variant type, which a variant spelled out by hand
+ *   is the way past.
+ */
+export function variantOf(value) {
+    if (isVariant(value))
+        return value;
+    if (typeof value === "boolean")
+        return { type: VARIANT_BOOL, value };
+    if (typeof value === "number") {
+        return { type: Number.isInteger(value) ? VARIANT_LONG : VARIANT_DOUBLE, value };
+    }
+    if (typeof value === "string")
+        return { type: VARIANT_STRING, value };
+    if (value instanceof Uint8Array)
+        return { type: VARIANT_BINARY, value: Buffer.from(value) };
+    throw new TypeError(`a ${typeof value} has no euclid variant type - pass a Variant with the tag it should carry`);
+}
+/** This variant as the server reads it, with a `binary` value encoded as base64. */
+export function variantToJson(variant) {
+    if (variant.type === VARIANT_BINARY && variant.value instanceof Uint8Array) {
+        return { type: variant.type, value: Buffer.from(variant.value).toString("base64") };
+    }
+    return { type: variant.type, value: variant.value };
+}
+/** One variant as the server sent it. An unreadable one reads as an empty string value. */
+export function toVariant(document) {
+    if (document === null || typeof document !== "object" || Array.isArray(document)) {
+        return { type: VARIANT_STRING, value: "" };
+    }
+    const type = text(document, "type");
+    const value = document["value"];
+    if (type === VARIANT_BINARY && typeof value === "string") {
+        // Handed back as the text it arrived as rather than throwing: a caller that can make sense of it
+        // is better served than one that gets an exception instead of the object the attribute hung off.
+        return { type, value: isBase64(value) ? Buffer.from(value, "base64") : value };
+    }
+    return { type, value };
+}
+/** An object of variants keyed by name, empty when absent. */
+export function toVariantMap(document) {
+    return Object.fromEntries(Object.entries(object(document)).map(([name, value]) => [name, toVariant(value)]));
+}
+/** An attribute map as the server reads it, taking plain values or variants. */
+export function variantMapToJson(attributes) {
+    if (attributes === undefined)
+        return {};
+    return Object.fromEntries(Object.entries(attributes).map(([name, value]) => [name, variantToJson(variantOf(value))]));
+}
+export function toSubscription(document) {
+    return {
+        ern: text(document, "ern"),
+        sourceErn: text(document, "sourceErn"),
+        type: text(document, "type"),
+        targetErn: text(document, "targetErn"),
+        created: text(document, "created"),
+        modified: text(document, "modified"),
+    };
+}
+export function toSubscribeResult(document) {
+    return {
+        ern: text(document, "ern"),
+        sourceErn: text(document, "sourceErn"),
+        type: text(document, "type"),
+        targetErn: text(document, "targetErn"),
+    };
+}
+/** Whether this is already a variant rather than a value to be tagged as one. */
+function isVariant(value) {
+    return (value !== null &&
+        typeof value === "object" &&
+        !(value instanceof Uint8Array) &&
+        typeof value.type === "string" &&
+        "value" in value);
+}
+/**
+ * Whether a string is base64 at all.
+ *
+ * Checked rather than trusted because node's decoder silently drops what it cannot read, which would
+ * turn a `binary` attribute that arrived mangled into a shorter buffer that looks fine.
+ */
+function isBase64(value) {
+    return value.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(value);
+}
+//# sourceMappingURL=com.js.map

package/dist/dto/com.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"com.js","sourceRoot":"","sources":["../../src/dto/com.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC;AAC3B,kFAAkF;AAClF,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC;AAE3B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAoBvC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,KAAmB;IAC3C,IAAI,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACtE,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5F,MAAM,IAAI,SAAS,CACjB,KAAK,OAAO,KAAK,2EAA2E,CAC7F,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,KAAK,YAAY,UAAU,EAAE,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,QAAiB;IACzC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAI,QAAoC,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,cAAc,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,iGAAiG;QACjG,iGAAiG;QACjG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,QAAiB;IAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAC9B,UAAoD;IAEpD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC;AA2BD,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;QAC9B,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACtD,OAAO,IAAI,KAAK,CACjB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC"}

package/dist/dto/eag.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The shapes EAG sends back.
+ *
+ * Parsed the same defensive way as every other module's. One thing is not just parsed but gathered: a
+ * listener's certificate arrives flat, as a dozen `certificate*` fields alongside the listener's own, and
+ * {@link toListener} collects them into a {@link ListenerCertificate} - or into null, when the server said
+ * it found none.
+ */
+import { type Page } from "./eam.js";
+/**
+ * One published path: what the gateway answers for, and where it sends it.
+ *
+ * A route goes to an application euclid runs or to a euclid module, never to both and never to neither, so
+ * a non-empty `moduleTarget` is exactly what says this is a module route. An empty `methods` means every
+ * method.
+ */
+export interface Route {
+    routeId: string;
+    ern: string;
+    accountId: string;
+    region: string;
+    namespace: string;
+    path: string;
+    applicationId: string;
+    moduleTarget: string;
+    moduleAction: string;
+    methods: string[];
+    /**
+     * `NONE`, `EUCLID` or `BASIC` - what a caller has to present before anything is forwarded. See
+     * {@link import("../modules/eag.js")}.
+     */
+    authentication: string;
+    /**
+     * Whether the gateway is serving this path at all - see
+     * {@link import("../modules/eag.js").EuclidEag.setRouteActive}.
+     */
+    active: boolean;
+    created: string;
+    modified: string;
+}
+/**
+ * The certificate an HTTPS listener is actually serving.
+ *
+ * `generated` is whether euclid minted it itself because the listener needed something to start with.
+ * Callers reject a self-signed certificate until they are given it, so which of the two this is decides
+ * whether the port works for anybody who has not been told about it.
+ */
+export interface ListenerCertificate {
+    ern: string;
+    subject: string;
+    issuer: string;
+    serialNumber: string;
+    fingerprint: string;
+    subjectAltNames: string[];
+    generated: boolean;
+    notBefore: string;
+    notAfter: string;
+    /** Whether `notAfter` is already in the past, as the server judged it against its own clock. */
+    expired: boolean;
+}
+/**
+ * One port the gateway was configured to answer on, and what it speaks.
+ *
+ * `certificateName` is the certificate this listener serves, which is the conventional one for its
+ * namespace when the configuration named none; `certificateConfigured` is what the configuration actually
+ * wrote, so "this listener names its certificate" and "this listener takes the conventional one" can be
+ * told apart - the second is a non-empty `certificateConfigured`.
+ */
+export interface Listener {
+    namespace: string;
+    port: number;
+    /** `http` or `https`. */
+    protocol: string;
+    /**
+     * Whether the gateway's ports are bound at all - the same answer for every listener, since it is a
+     * property of the proxy rather than of one port.
+     */
+    serving: boolean;
+    certificateName: string;
+    certificateConfigured: string;
+    /** Null for a plain HTTP listener, and for an HTTPS one whose certificate the server did not find. */
+    certificate: ListenerCertificate | null;
+}
+/**
+ * What the gateway was configured to serve, and whether it is serving it.
+ *
+ * A listener whose port was taken, or whose certificate could not be loaded, is still in `items` - it is
+ * the one somebody is looking for - and `serving` is what says whether anything is actually bound.
+ */
+export interface ListListenersResult extends Page<Listener> {
+    serving: boolean;
+}
+export declare function toRoute(document: unknown): Route;
+/**
+ * The certificate a listener entry describes, or null when it describes none.
+ *
+ * A plain HTTP listener has no certificate to be missing, and an HTTPS one whose certificate is absent is
+ * what a port that never came up looks like - neither is a certificate this can describe, and the server
+ * says which by `certificateFound`.
+ */
+export declare function toListenerCertificate(document: unknown): ListenerCertificate | null;
+export declare function toListener(document: unknown): Listener;
+export declare function toListListenersResult(document: unknown): ListListenersResult;
+//# sourceMappingURL=eag.d.ts.map

package/dist/dto/eag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eag.d.ts","sourceRoot":"","sources":["../../src/dto/eag.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC;AAGrC;;;;;;GAMG;AACH,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACzC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,QAAQ,CAAC;IACzD,OAAO,EAAE,OAAO,CAAC;CAClB;AAID,wBAAgB,OAAO,CAAC,QAAQ,EAAE,OAAO,GAAG,KAAK,CAkBhD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAcnF;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAUtD;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,mBAAmB,CAI5E"}

package/dist/dto/eag.js

@@ -0,0 +1,70 @@
+/**
+ * The shapes EAG sends back.
+ *
+ * Parsed the same defensive way as every other module's. One thing is not just parsed but gathered: a
+ * listener's certificate arrives flat, as a dozen `certificate*` fields alongside the listener's own, and
+ * {@link toListener} collects them into a {@link ListenerCertificate} - or into null, when the server said
+ * it found none.
+ */
+import {} from "./eam.js";
+import { documents, flag, number, strings, text } from "./json.js";
+// -- parsers ---------------------------------------------------------------------------------------
+export function toRoute(document) {
+    return {
+        routeId: text(document, "routeId"),
+        ern: text(document, "ern"),
+        accountId: text(document, "accountId"),
+        region: text(document, "region"),
+        namespace: text(document, "namespace"),
+        path: text(document, "path"),
+        applicationId: text(document, "applicationId"),
+        moduleTarget: text(document, "moduleTarget"),
+        moduleAction: text(document, "moduleAction"),
+        methods: strings(document, "methods"),
+        authentication: text(document, "authentication"),
+        // Absent means serving, which is the server's default for a stored route.
+        active: flag(document, "active", true),
+        created: text(document, "created"),
+        modified: text(document, "modified"),
+    };
+}
+/**
+ * The certificate a listener entry describes, or null when it describes none.
+ *
+ * A plain HTTP listener has no certificate to be missing, and an HTTPS one whose certificate is absent is
+ * what a port that never came up looks like - neither is a certificate this can describe, and the server
+ * says which by `certificateFound`.
+ */
+export function toListenerCertificate(document) {
+    if (!flag(document, "certificateFound"))
+        return null;
+    return {
+        ern: text(document, "certificateErn"),
+        subject: text(document, "certificateSubject"),
+        issuer: text(document, "certificateIssuer"),
+        serialNumber: text(document, "certificateSerialNumber"),
+        fingerprint: text(document, "certificateFingerprint"),
+        subjectAltNames: strings(document, "certificateSubjectAltNames"),
+        generated: flag(document, "certificateGenerated"),
+        notBefore: text(document, "certificateNotBefore"),
+        notAfter: text(document, "certificateNotAfter"),
+        expired: flag(document, "certificateExpired"),
+    };
+}
+export function toListener(document) {
+    return {
+        namespace: text(document, "namespace"),
+        port: number(document, "port"),
+        protocol: text(document, "protocol"),
+        serving: flag(document, "serving"),
+        certificateName: text(document, "certificate"),
+        certificateConfigured: text(document, "certificateConfigured"),
+        certificate: toListenerCertificate(document),
+    };
+}
+export function toListListenersResult(document) {
+    const items = documents(document, "listeners").map(toListener);
+    // The server sends a total; falling back to what arrived keeps a sparse answer self-consistent.
+    return { total: number(document, "total") || items.length, items, serving: flag(document, "serving") };
+}
+//# sourceMappingURL=eag.js.map

package/dist/dto/eag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eag.js","sourceRoot":"","sources":["../../src/dto/eag.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAa,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyFnE,qGAAqG;AAErG,MAAM,UAAU,OAAO,CAAC,QAAiB;IACvC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QACtC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;QAC9C,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;QAC5C,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;QACrC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAChD,0EAA0E;QAC1E,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QACrC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAC7C,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC;QAC3C,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC;QACvD,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC;QACrD,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,4BAA4B,CAAC;QAChE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QACjD,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QACjD,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC/C,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAiB;IAC1C,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;QACpC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QAClC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC9C,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAC9D,WAAW,EAAE,qBAAqB,CAAC,QAAQ,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/D,gGAAgG;IAChG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;AACzG,CAAC"}