euclid-ndk 0.2.0

package/dist/http/client.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The connection to a euclid server.
+ *
+ * euclid speaks one request shape: `POST /` with a JSON body, the module named in
+ * `x-euclid-target` and the operation in `x-euclid-action`. Everything else - which module, which
+ * action, who is asking - travels in headers, which is why the signing schemes cover the headers
+ * they do. This client knows that shape and nothing about any particular module.
+ *
+ * Built on node's own `http`/`https` rather than a third-party client so that installing this SDK
+ * does not drag a dependency tree into an application that only wanted to call euclid.
+ */
+/**
+ * Where euclid installs the certificate its gateway presents. Applied only when the file is there,
+ * so this is a no-op on a machine with no euclid deployment, and the same default euclid-cli uses.
+ */
+export declare const DEFAULT_CA_CERT_PATH = "/etc/euclid/euclid_cert.crt";
+/** How long to wait for a response, in milliseconds, unless a call overrides it. */
+export declare const DEFAULT_TIMEOUT_MS = 10000;
+/** One HTTP response, with the body already read. */
+export declare class Response {
+    readonly status: number;
+    readonly reason: string;
+    readonly headers: Record<string, string>;
+    readonly content: Buffer;
+    constructor(status: number, reason: string, headers: Record<string, string>, content: Buffer);
+    /** Whether the server answered 2xx. */
+    get ok(): boolean;
+    /** The body decoded as UTF-8. */
+    get text(): string;
+    /** The body parsed as JSON. An empty body reads as an empty object. */
+    json(): unknown;
+}
+/** How a request's authentication headers are rebuilt when the first attempt is refused. */
+export type HeaderFactory = (action: string, body: Buffer) => Record<string, string>;
+export interface HttpClientOptions {
+    /**
+     * A PEM CA certificate to trust *alongside* the system trust store, for reaching a euclid server
+     * that presents its own certificate. Null uses only the system store. Mirrors euclid-cli's
+     * `--ca-cert`.
+     */
+    caCertPath?: string | null;
+    /** How long to wait for a response, in milliseconds, unless a call overrides it. */
+    timeoutMs?: number;
+    /**
+     * Whether to verify the server certificate at all. Turning it off is for a development server
+     * with a certificate nothing vouches for, and for nothing else.
+     */
+    verify?: boolean;
+}
+/**
+ * Sends euclid's action requests over a connection it keeps open.
+ *
+ * One keep-alive agent rather than a connection per call: a fresh connection per action would pay
+ * for a TLS handshake every time, and node's agent already serialises what has to be serialised.
+ *
+ * Two retries are built in, and both are deliberately narrow:
+ *
+ * - A connection closed while it sat idle - by the server's timeout, a proxy, a load balancer - is
+ *   not visible until the next write, and surfaces as a failure with no response at all. That is
+ *   retried once on a fresh connection. It is not quite the same as knowing the request was never
+ *   processed, so this trades a possible repeat for the far commoner case of a socket that was
+ *   already gone.
+ * - A 401 whose body says the credentials had expired is retried once with rebuilt headers, if
+ *   {@link EuclidHttpClient.headerFactory} was given one and it produces different headers. A wrong
+ *   password or a missing permission is answered once, as before; and a token nobody has refreshed
+ *   comes back identical, so there is nothing to retry with.
+ */
+export declare class EuclidHttpClient {
+    #private;
+    readonly caCertPath: string | null;
+    constructor(options?: HttpClientOptions);
+    /**
+     * Registers how to rebuild the authentication headers for an `(action, body)` pair.
+     *
+     * Without one, a request whose credentials expired between the header being built and the server
+     * reading it fails like any other error - which for a long-lived application is a business
+     * operation lost to a token that a second attempt would have carried correctly.
+     */
+    headerFactory(factory: HeaderFactory | null): this;
+    /**
+     * Sends one euclid action request.
+     *
+     * @param url the full URL to post to, normally the server's base URL plus `/`.
+     * @param body the JSON request body.
+     * @param target the module to route to, e.g. `"eam"`.
+     * @param action the operation, e.g. `"list-users"`.
+     * @param headers authentication and routing headers, as a module client builds them.
+     * @param timeoutMs overrides this client's timeout, for the actions a server answers slowly on
+     *   purpose - a long poll is told how many seconds to hold the request open, and a caller
+     *   unwilling to wait that long would abandon a request still being served.
+     */
+    post(url: string, body: Buffer | string, target: string, action: string, headers?: Record<string, string>, timeoutMs?: number): Promise<Response>;
+    /** Releases the connections this client was holding. */
+    close(): void;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/http/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,qDAAqD;AACrD,qBAAa,QAAQ;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM;IAO5F,uCAAuC;IACvC,IAAI,EAAE,IAAI,OAAO,CAEhB;IAED,iCAAiC;IACjC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,uEAAuE;IACvE,IAAI,IAAI,OAAO;CAGhB;AAED,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAErF,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAgB;;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBASvB,OAAO,GAAE,iBAAsB;IAM3C;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI;IAKlD;;;;;;;;;;;OAWG;IACG,IAAI,CACR,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC;IAWpB,wDAAwD;IACxD,KAAK,IAAI,IAAI;CA2Id"}

package/dist/http/client.js

@@ -0,0 +1,258 @@
+/**
+ * The connection to a euclid server.
+ *
+ * euclid speaks one request shape: `POST /` with a JSON body, the module named in
+ * `x-euclid-target` and the operation in `x-euclid-action`. Everything else - which module, which
+ * action, who is asking - travels in headers, which is why the signing schemes cover the headers
+ * they do. This client knows that shape and nothing about any particular module.
+ *
+ * Built on node's own `http`/`https` rather than a third-party client so that installing this SDK
+ * does not drag a dependency tree into an application that only wanted to call euclid.
+ */
+import { readFile } from "node:fs/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import { rootCertificates } from "node:tls";
+/**
+ * Where euclid installs the certificate its gateway presents. Applied only when the file is there,
+ * so this is a no-op on a machine with no euclid deployment, and the same default euclid-cli uses.
+ */
+export const DEFAULT_CA_CERT_PATH = "/etc/euclid/euclid_cert.crt";
+/** How long to wait for a response, in milliseconds, unless a call overrides it. */
+export const DEFAULT_TIMEOUT_MS = 10_000;
+/** One HTTP response, with the body already read. */
+export class Response {
+    status;
+    reason;
+    headers;
+    content;
+    constructor(status, reason, headers, content) {
+        this.status = status;
+        this.reason = reason;
+        this.headers = headers;
+        this.content = content;
+    }
+    /** Whether the server answered 2xx. */
+    get ok() {
+        return Math.floor(this.status / 100) === 2;
+    }
+    /** The body decoded as UTF-8. */
+    get text() {
+        return this.content.toString("utf8");
+    }
+    /** The body parsed as JSON. An empty body reads as an empty object. */
+    json() {
+        return this.content.toString("utf8").trim() ? JSON.parse(this.content.toString("utf8")) : {};
+    }
+}
+/**
+ * Sends euclid's action requests over a connection it keeps open.
+ *
+ * One keep-alive agent rather than a connection per call: a fresh connection per action would pay
+ * for a TLS handshake every time, and node's agent already serialises what has to be serialised.
+ *
+ * Two retries are built in, and both are deliberately narrow:
+ *
+ * - A connection closed while it sat idle - by the server's timeout, a proxy, a load balancer - is
+ *   not visible until the next write, and surfaces as a failure with no response at all. That is
+ *   retried once on a fresh connection. It is not quite the same as knowing the request was never
+ *   processed, so this trades a possible repeat for the far commoner case of a socket that was
+ *   already gone.
+ * - A 401 whose body says the credentials had expired is retried once with rebuilt headers, if
+ *   {@link EuclidHttpClient.headerFactory} was given one and it produces different headers. A wrong
+ *   password or a missing permission is answered once, as before; and a token nobody has refreshed
+ *   comes back identical, so there is nothing to retry with.
+ */
+export class EuclidHttpClient {
+    caCertPath;
+    #timeoutMs;
+    #verify;
+    #agents = new Map();
+    #headerFactory = null;
+    #ca = null;
+    #caLoaded = false;
+    constructor(options = {}) {
+        this.caCertPath = options.caCertPath ?? null;
+        this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.#verify = options.verify ?? true;
+    }
+    /**
+     * Registers how to rebuild the authentication headers for an `(action, body)` pair.
+     *
+     * Without one, a request whose credentials expired between the header being built and the server
+     * reading it fails like any other error - which for a long-lived application is a business
+     * operation lost to a token that a second attempt would have carried correctly.
+     */
+    headerFactory(factory) {
+        this.#headerFactory = factory;
+        return this;
+    }
+    /**
+     * Sends one euclid action request.
+     *
+     * @param url the full URL to post to, normally the server's base URL plus `/`.
+     * @param body the JSON request body.
+     * @param target the module to route to, e.g. `"eam"`.
+     * @param action the operation, e.g. `"list-users"`.
+     * @param headers authentication and routing headers, as a module client builds them.
+     * @param timeoutMs overrides this client's timeout, for the actions a server answers slowly on
+     *   purpose - a long poll is told how many seconds to hold the request open, and a caller
+     *   unwilling to wait that long would abandon a request still being served.
+     */
+    async post(url, body, target, action, headers = {}, timeoutMs) {
+        const payload = typeof body === "string" ? Buffer.from(body, "utf8") : body;
+        const sent = { ...headers, "x-euclid-target": target, "x-euclid-action": action };
+        const response = await this.#send(url, payload, sent, timeoutMs);
+        const refreshed = this.#refreshedHeaders(response, action, payload, sent);
+        if (refreshed === null)
+            return response;
+        return this.#send(url, payload, refreshed, timeoutMs);
+    }
+    /** Releases the connections this client was holding. */
+    close() {
+        for (const agent of this.#agents.values())
+            agent.destroy();
+        this.#agents.clear();
+    }
+    // -- internals -----------------------------------------------------------------------------
+    /**
+     * The headers to retry with, or null if this response should not be retried.
+     *
+     * Kept narrow so it never turns one real rejection into two: only 401, only when the server said
+     * the credentials had expired, and only when the rebuilt headers actually differ.
+     */
+    #refreshedHeaders(response, action, body, headers) {
+        if (this.#headerFactory === null || response.status !== 401)
+            return null;
+        if (!response.text.toLowerCase().includes("expired"))
+            return null;
+        const refreshed = { ...headers, ...this.#headerFactory(action, body) };
+        return sameHeaders(refreshed, headers) ? null : refreshed;
+    }
+    async #send(url, body, headers, timeoutMs) {
+        try {
+            return await this.#exchange(url, body, headers, timeoutMs);
+        }
+        catch (error) {
+            // No response at all came back, which is what a connection closed while it was idle looks
+            // like from here. One more attempt, on a socket that is definitely new.
+            if (!isRetryable(error))
+                throw error;
+            this.#dropAgent(url);
+            return this.#exchange(url, body, headers, timeoutMs);
+        }
+    }
+    async #exchange(url, body, headers, timeoutMs) {
+        const target = new URL(url);
+        const secure = target.protocol === "https:";
+        const agent = await this.#agentFor(url, secure);
+        const effectiveTimeout = timeoutMs ?? this.#timeoutMs;
+        const options = {
+            method: "POST",
+            host: target.hostname,
+            port: target.port || (secure ? 443 : 80),
+            path: `${target.pathname}${target.search}`,
+            // Host is the client's to set: it is a signed header, and letting node compose it would put
+            // a different spelling on the wire than the one the signature covers.
+            headers: { ...headers, "content-length": String(body.length) },
+            agent,
+            timeout: effectiveTimeout,
+        };
+        if (secure && !this.#verify)
+            options.rejectUnauthorized = false;
+        return new Promise((resolve, reject) => {
+            const request = (secure ? https : http).request(options, (message) => {
+                const chunks = [];
+                message.on("data", (chunk) => chunks.push(chunk));
+                message.on("end", () => {
+                    const responseHeaders = {};
+                    for (const [name, value] of Object.entries(message.headers)) {
+                        if (value !== undefined)
+                            responseHeaders[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
+                    }
+                    resolve(new Response(message.statusCode ?? 0, message.statusMessage ?? "", responseHeaders, Buffer.concat(chunks)));
+                });
+                message.on("error", reject);
+            });
+            request.on("timeout", () => {
+                // node does not fail a timed-out request by itself; it only tells us the socket went quiet.
+                request.destroy(new Error(`no response within ${effectiveTimeout}ms`));
+            });
+            request.on("error", reject);
+            request.end(body);
+        });
+    }
+    /**
+     * The keep-alive agent for one origin, built on first use.
+     *
+     * The CA file is read once, here, rather than per request: it is the same file every time, and a
+     * client that read it on every call would turn one action into two system calls plus a parse.
+     */
+    async #agentFor(url, secure) {
+        const key = originOf(url);
+        const existing = this.#agents.get(key);
+        if (existing)
+            return existing;
+        let agent;
+        if (secure) {
+            const ca = await this.#caCertificate();
+            // Added to the system trust store rather than replacing it, so a certificate is accepted if
+            // either root set vouches for it - the same union euclid-cli builds with
+            // set_default_verify_paths() followed by load_verify_file(). Node replaces the store when
+            // "ca" is given, so the union has to be spelled out.
+            agent = new https.Agent({ keepAlive: true, ...(ca ? { ca: [...rootCertificates, ca] } : {}) });
+        }
+        else {
+            agent = new http.Agent({ keepAlive: true });
+        }
+        this.#agents.set(key, agent);
+        return agent;
+    }
+    async #caCertificate() {
+        if (this.#caLoaded)
+            return this.#ca;
+        this.#caLoaded = true;
+        if (this.caCertPath) {
+            try {
+                this.#ca = await readFile(this.caCertPath, "utf8");
+            }
+            catch {
+                // Absent is the ordinary case on a machine with no euclid deployment - see
+                // DEFAULT_CA_CERT_PATH - and unreadable is the same thing as far as trust goes.
+                this.#ca = null;
+            }
+        }
+        return this.#ca;
+    }
+    #dropAgent(url) {
+        const key = originOf(url);
+        const agent = this.#agents.get(key);
+        if (agent) {
+            agent.destroy();
+            this.#agents.delete(key);
+        }
+    }
+}
+function originOf(url) {
+    const target = new URL(url);
+    return `${target.protocol}//${target.host}`;
+}
+function sameHeaders(left, right) {
+    const leftKeys = Object.keys(left);
+    if (leftKeys.length !== Object.keys(right).length)
+        return false;
+    return leftKeys.every((key) => left[key] === right[key]);
+}
+/**
+ * Failures that mean nothing came back. A reset, a broken pipe, or a socket that hung up where the
+ * status line should have been is a dead cached socket, and a fresh one usually answers. A refused
+ * connection is not in here: that one means the server is not listening, and a second attempt a
+ * microsecond later would tell the caller the same thing more slowly.
+ */
+function isRetryable(error) {
+    const code = error?.code;
+    if (code === "ECONNRESET" || code === "EPIPE")
+        return true;
+    return error instanceof Error && error.message.includes("socket hang up");
+}
+//# sourceMappingURL=client.js.map

package/dist/http/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,qDAAqD;AACrD,MAAM,OAAO,QAAQ;IACV,MAAM,CAAS;IACf,MAAM,CAAS;IACf,OAAO,CAAyB;IAChC,OAAO,CAAS;IAEzB,YAAY,MAAc,EAAE,MAAc,EAAE,OAA+B,EAAE,OAAe;QAC1F,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,uCAAuC;IACvC,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,iCAAiC;IACjC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,uEAAuE;IACvE,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;CACF;AAqBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,gBAAgB;IAClB,UAAU,CAAgB;IAEnC,UAAU,CAAS;IACnB,OAAO,CAAU;IACjB,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IACtD,cAAc,GAAyB,IAAI,CAAC;IAC5C,GAAG,GAAkB,IAAI,CAAC;IAC1B,SAAS,GAAG,KAAK,CAAC;IAElB,YAAY,UAA6B,EAAE;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAA6B;QACzC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,CACR,GAAW,EACX,IAAqB,EACrB,MAAc,EACd,MAAc,EACd,UAAkC,EAAE,EACpC,SAAkB;QAElB,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,MAAM,IAAI,GAA2B,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAE1G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,wDAAwD;IACxD,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,6FAA6F;IAE7F;;;;;OAKG;IACH,iBAAiB,CACf,QAAkB,EAClB,MAAc,EACd,IAAY,EACZ,OAA+B;QAE/B,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAElE,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,KAAK,CACT,GAAW,EACX,IAAY,EACZ,OAA+B,EAC/B,SAA6B;QAE7B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,wEAAwE;YACxE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,IAAY,EACZ,OAA+B,EAC/B,SAA6B;QAE7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QAEtD,MAAM,OAAO,GAAyB;YACpC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,4FAA4F;YAC5F,sEAAsE;YACtE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC9D,KAAK;YACL,OAAO,EAAE,gBAAgB;SAC1B,CAAC;QACF,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAEhE,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/C,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACnE,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACrB,MAAM,eAAe,GAA2B,EAAE,CAAC;oBACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5D,IAAI,KAAK,KAAK,SAAS;4BAAE,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;oBACjH,CAAC;oBACD,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACtH,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,4FAA4F;gBAC5F,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,sBAAsB,gBAAgB,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,MAAe;QAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,IAAI,KAA+B,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,4FAA4F;YAC5F,yEAAyE;YACzE,0FAA0F;YAC1F,qDAAqD;YACrD,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;gBAC3E,gFAAgF;gBAChF,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,IAA4B,EAAE,KAA6B;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAI,KAAkC,EAAE,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,93 @@
+/**
+ * euclid-ndk - the Node.js SDK for a euclid server.
+ *
+ * Start here:
+ *
+ * ```ts
+ * import { Euclid } from "euclid-ndk";
+ *
+ * const session = await Euclid.forServer("https://euclid.example.com").login("jens", "secret");
+ * const users = await session.listUsers({ prefix: "j", pageSize: 25 });
+ * for (const user of users.items) console.log(user.userId, user.email);
+ * session.close();
+ * ```
+ *
+ * Nine modules so far. EAM - euclid's access management module - is where a login comes from; ESM (storage),
+ * EQS (queues), ENS (notifications), EKM (keys), EKV (tables), EAP (applications), ESS (secrets) and EAG
+ * (the API gateway) are reached from the session it hands back:
+ *
+ * ```ts
+ * const bucket = await session.esm().createBucket("reports");
+ * const queue = await session.eqs().createQueue("orders");
+ * const key = await session.ekm().createKey({ description: "customer exports" });
+ * const password = await session.ess().getSecret("db-password");
+ * await session.eap().startApplication("order-service");
+ * await session.eag().createRoute("orders", "/api/orders", { applicationId: "order-service" });
+ * ```
+ *
+ * The remaining modules (EES, ETS) speak the same protocol through the same client and will follow;
+ * {@link EuclidSession.call} and
+ * {@link import("./modules/base.js").ModuleClient.call} reach any action this SDK does not name.
+ */
+import { EuclidEam, type EuclidSession } from "./modules/eam.js";
+export { RFC9421, SIGV4, SignableRequest, signingSchemeOf, type SigningScheme, rfc9421, sigv4, } from "./auth/index.js";
+export { credentialsPath, isTokenValid, type CachedCredentials, } from "./credentials.js";
+export { PRIORITY_HIGH, PRIORITY_LOW, PRIORITY_MIDDLE, QUEUE, TOPIC, VARIANT_BINARY, VARIANT_BOOL, VARIANT_DOUBLE, VARIANT_FLOAT, VARIANT_INT, VARIANT_LONG, VARIANT_STRING, toSubscribeResult, toSubscription, toVariant, toVariantMap, variantMapToJson, variantOf, variantToJson, type SubscribeResult, type Subscription, type Variant, type VariantInput, } from "./dto/com.js";
+export type { AccessKey, Account, AccountGrant, CreateAccessKeyResult, LoginResult, Metadata, Namespace, Page, User, UserGroup, } from "./dto/eam.js";
+export type { ListListenersResult, Listener, ListenerCertificate, Route, } from "./dto/eag.js";
+export type { Application, Endpoint, LogLevelResult } from "./dto/eap.js";
+export { CREATED_ATTRIBUTE, MODIFIED_ATTRIBUTE, type Item, type QueryResult, type ScanResult, type TableDescription, } from "./dto/ekv.js";
+export type { Certificate, CreateKeyResult, DeleteCertificateResult, DeleteKeyResult, Key, KeyDescriptionResult, RevokeKeyResult, } from "./dto/ekm.js";
+export type { CreateTopicResult, Topic, TopicMessage, TopicMessageAttribute, TopicMessageCount, TopicMetadata, } from "./dto/ens.js";
+export type { DeleteSecretResult, Secret, SecretValue } from "./dto/ess.js";
+export type { CreateQueueResult, Queue, QueueMessage, QueueMessageAttribute, QueueMessageCount, QueueMessageMetadata, QueueMetadata, QueueStatusResult, RedriveDlqResult, RedriveTarget, } from "./dto/eqs.js";
+export type { Bucket, BucketEvent, CreateBucketResult, CreateDownloadResult, CreateUploadResult, DeleteObjectsResult, DisableEncryptionResult, EnableEncryptionResult, EsmObject, ObjectAttribute, PurgeBucketResult, RenameBucketResult, SetBucketInternalResult, StoredObject, TouchObjectResult, } from "./dto/esm.js";
+export { EuclidAuthenticationError, EuclidError, EuclidServiceError } from "./errors.js";
+export { DEFAULT_CA_CERT_PATH, EuclidHttpClient, Response } from "./http/client.js";
+export { ModuleClient, type Bytes, type ModuleClientOptions, type PageOptions } from "./modules/base.js";
+export { AUTH_AUTO, AUTH_BEARER, AUTH_SIGNATURE, EuclidEam, EuclidSession, type AuthMode, type ListOptions, } from "./modules/eam.js";
+export { EuclidEag, PROTOCOL_HTTP, PROTOCOL_HTTPS, ROUTE_AUTH_BASIC, ROUTE_AUTH_EUCLID, ROUTE_AUTH_NONE, type CreateModuleRouteOptions, type CreateRouteOptions, type UpdateRouteChanges, } from "./modules/eag.js";
+export { DEFAULT_MAX_INSTANCES, DEFAULT_MIN_INSTANCES, DEFAULT_READY_TIMEOUT_MS, EuclidEap, LOG_DEBUG, LOG_ERROR, LOG_FATAL, LOG_INFO, LOG_OFF, LOG_TRACE, LOG_WARNING, RUNTIME_BINARY, RUNTIME_JAVA, RUNTIME_NODEJS, RUNTIME_PYTHON, STATE_RUNNING, STATE_STOPPED, type CreateApplicationOptions, type UpdateApplicationChanges, } from "./modules/eap.js";
+export { EuclidEkv, KEY_BINARY, KEY_NUMBER, KEY_STRING, SORT_BEGINS_WITH, SORT_BETWEEN, SORT_EQ, SORT_GE, SORT_GT, SORT_LE, SORT_LT, WHOLE_PARTITION, type CreateTableOptions, type QueryOptions, type ScanOptions, } from "./modules/ekv.js";
+export { AES, DEFAULT_KEY_LENGTH, DEFAULT_PENDING_WINDOW_DAYS, EuclidEkm, type CreateCertificateOptions, type CreateKeyOptions, } from "./modules/ekm.js";
+export { EuclidEns, type PublishMessageOptions, type PurgeAllTopicsOptions, } from "./modules/ens.js";
+export { DEFAULT_MAX_RETRIES, DEFAULT_VISIBILITY, EuclidEqs, type CreateQueueOptions, type ListQueuesOptions, type PurgeAllQueuesOptions, type ReceiveMessagesOptions, type SendMessageOptions, } from "./modules/eqs.js";
+export { EuclidEss, type CreateSecretOptions, type UpdateSecretChanges, } from "./modules/ess.js";
+export { DEFAULT_CONCURRENCY, DEFAULT_PART_SIZE, EuclidEsm, OBJECT_CREATED, OBJECT_DELETED, OBJECT_UPDATED, parseBucketEvent, type AttributeOptions, type DownloadOptions, type ListBucketsOptions, type ListObjectsOptions, type SubscribeOptions, type TouchObjectOptions, type UploadOptions, } from "./modules/esm.js";
+/** The version this package was published as. */
+export declare const VERSION = "0.2.0";
+/** Options {@link Euclid.login} passes through to the builder, for the case that needs no builder. */
+export interface LoginOptions {
+    email?: string;
+    namespace?: string;
+    caCertPath?: string | null;
+    verify?: boolean;
+    timeoutMs?: number;
+    signingScheme?: import("./auth/index.js").SigningScheme;
+    auth?: import("./modules/eam.js").AuthMode;
+    useCache?: boolean;
+    loginPath?: string;
+}
+/**
+ * Entry point: names a server, and hands out the module clients for it.
+ *
+ * Exists so that a caller writes the server's URL once. Only EAM is reached from here, because only
+ * EAM is reached before logging in; every other module hangs off the session that login answers with -
+ * {@link EuclidSession.esm}, {@link EuclidSession.eqs}, {@link EuclidSession.ens},
+ * {@link EuclidSession.ekm}, {@link EuclidSession.ekv}, {@link EuclidSession.eap},
+ * {@link EuclidSession.ess}, {@link EuclidSession.eag} - as in euclid-jdk and euclid-pdk.
+ */
+export declare class Euclid {
+    #private;
+    constructor(baseUrl: string);
+    /** Targets a euclid server, e.g. `https://euclid.example.com`. */
+    static forServer(baseUrl: string): Euclid;
+    get baseUrl(): string;
+    /** Starts a login against this server. */
+    access(): EuclidEam;
+    /** Alias for {@link access}, for callers who think in module names. */
+    eam(): EuclidEam;
+    /** Logs in, for the common case that needs no builder. */
+    login(username?: string, password?: string, options?: LoginOptions): Promise<EuclidSession>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,OAAO,EACP,KAAK,EACL,eAAe,EACf,eAAe,EACf,KAAK,aAAa,EAClB,OAAO,EACP,KAAK,GACN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,KAAK,EACL,KAAK,EACL,cAAc,EACd,YAAY,EACZ,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,SAAS,EACT,OAAO,EACP,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,mBAAmB,EACnB,QAAQ,EACR,mBAAmB,EACnB,KAAK,GACN,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,GAAG,EACH,oBAAoB,EACpB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,KAAK,EACL,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EACV,iBAAiB,EACjB,KAAK,EACL,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,KAAK,KAAK,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EACL,SAAS,EACT,WAAW,EACX,cAAc,EACd,SAAS,EACT,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,EACT,WAAW,EACX,cAAc,EACd,YAAY,EACZ,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,EACb,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,GAAG,EACH,kBAAkB,EAClB,2BAA2B,EAC3B,SAAS,EACT,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,SAAS,EACT,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAE1B,iDAAiD;AACjD,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,sGAAsG;AACtG,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,iBAAiB,EAAE,aAAa,CAAC;IACxD,IAAI,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,CAAC;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;;gBAGL,OAAO,EAAE,MAAM;IAK3B,kEAAkE;IAClE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIzC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,0CAA0C;IAC1C,MAAM,IAAI,SAAS;IAInB,uEAAuE;IACvE,GAAG,IAAI,SAAS;IAIhB,0DAA0D;IACpD,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;CAetG"}

package/dist/index.js

@@ -0,0 +1,110 @@
+/**
+ * euclid-ndk - the Node.js SDK for a euclid server.
+ *
+ * Start here:
+ *
+ * ```ts
+ * import { Euclid } from "euclid-ndk";
+ *
+ * const session = await Euclid.forServer("https://euclid.example.com").login("jens", "secret");
+ * const users = await session.listUsers({ prefix: "j", pageSize: 25 });
+ * for (const user of users.items) console.log(user.userId, user.email);
+ * session.close();
+ * ```
+ *
+ * Nine modules so far. EAM - euclid's access management module - is where a login comes from; ESM (storage),
+ * EQS (queues), ENS (notifications), EKM (keys), EKV (tables), EAP (applications), ESS (secrets) and EAG
+ * (the API gateway) are reached from the session it hands back:
+ *
+ * ```ts
+ * const bucket = await session.esm().createBucket("reports");
+ * const queue = await session.eqs().createQueue("orders");
+ * const key = await session.ekm().createKey({ description: "customer exports" });
+ * const password = await session.ess().getSecret("db-password");
+ * await session.eap().startApplication("order-service");
+ * await session.eag().createRoute("orders", "/api/orders", { applicationId: "order-service" });
+ * ```
+ *
+ * The remaining modules (EES, ETS) speak the same protocol through the same client and will follow;
+ * {@link EuclidSession.call} and
+ * {@link import("./modules/base.js").ModuleClient.call} reach any action this SDK does not name.
+ */
+import { EuclidEam } from "./modules/eam.js";
+export { RFC9421, SIGV4, SignableRequest, signingSchemeOf, rfc9421, sigv4, } from "./auth/index.js";
+export { credentialsPath, isTokenValid, } from "./credentials.js";
+export { PRIORITY_HIGH, PRIORITY_LOW, PRIORITY_MIDDLE, QUEUE, TOPIC, VARIANT_BINARY, VARIANT_BOOL, VARIANT_DOUBLE, VARIANT_FLOAT, VARIANT_INT, VARIANT_LONG, VARIANT_STRING, toSubscribeResult, toSubscription, toVariant, toVariantMap, variantMapToJson, variantOf, variantToJson, } from "./dto/com.js";
+export { CREATED_ATTRIBUTE, MODIFIED_ATTRIBUTE, } from "./dto/ekv.js";
+export { EuclidAuthenticationError, EuclidError, EuclidServiceError } from "./errors.js";
+export { DEFAULT_CA_CERT_PATH, EuclidHttpClient, Response } from "./http/client.js";
+export { ModuleClient } from "./modules/base.js";
+export { AUTH_AUTO, AUTH_BEARER, AUTH_SIGNATURE, EuclidEam, EuclidSession, } from "./modules/eam.js";
+export { EuclidEag, PROTOCOL_HTTP, PROTOCOL_HTTPS, ROUTE_AUTH_BASIC, ROUTE_AUTH_EUCLID, ROUTE_AUTH_NONE, } from "./modules/eag.js";
+export { DEFAULT_MAX_INSTANCES, DEFAULT_MIN_INSTANCES, DEFAULT_READY_TIMEOUT_MS, EuclidEap, LOG_DEBUG, LOG_ERROR, LOG_FATAL, LOG_INFO, LOG_OFF, LOG_TRACE, LOG_WARNING, RUNTIME_BINARY, RUNTIME_JAVA, RUNTIME_NODEJS, RUNTIME_PYTHON, STATE_RUNNING, STATE_STOPPED, } from "./modules/eap.js";
+export { EuclidEkv, KEY_BINARY, KEY_NUMBER, KEY_STRING, SORT_BEGINS_WITH, SORT_BETWEEN, SORT_EQ, SORT_GE, SORT_GT, SORT_LE, SORT_LT, WHOLE_PARTITION, } from "./modules/ekv.js";
+export { AES, DEFAULT_KEY_LENGTH, DEFAULT_PENDING_WINDOW_DAYS, EuclidEkm, } from "./modules/ekm.js";
+export { EuclidEns, } from "./modules/ens.js";
+export { DEFAULT_MAX_RETRIES, DEFAULT_VISIBILITY, EuclidEqs, } from "./modules/eqs.js";
+export { EuclidEss, } from "./modules/ess.js";
+export { DEFAULT_CONCURRENCY, DEFAULT_PART_SIZE, EuclidEsm, OBJECT_CREATED, OBJECT_DELETED, OBJECT_UPDATED, parseBucketEvent, } from "./modules/esm.js";
+/** The version this package was published as. */
+export const VERSION = "0.2.0";
+/**
+ * Entry point: names a server, and hands out the module clients for it.
+ *
+ * Exists so that a caller writes the server's URL once. Only EAM is reached from here, because only
+ * EAM is reached before logging in; every other module hangs off the session that login answers with -
+ * {@link EuclidSession.esm}, {@link EuclidSession.eqs}, {@link EuclidSession.ens},
+ * {@link EuclidSession.ekm}, {@link EuclidSession.ekv}, {@link EuclidSession.eap},
+ * {@link EuclidSession.ess}, {@link EuclidSession.eag} - as in euclid-jdk and euclid-pdk.
+ */
+export class Euclid {
+    #baseUrl;
+    constructor(baseUrl) {
+        if (!baseUrl)
+            throw new Error("baseUrl must not be empty");
+        this.#baseUrl = baseUrl;
+    }
+    /** Targets a euclid server, e.g. `https://euclid.example.com`. */
+    static forServer(baseUrl) {
+        return new Euclid(baseUrl);
+    }
+    get baseUrl() {
+        return this.#baseUrl;
+    }
+    /** Starts a login against this server. */
+    access() {
+        return EuclidEam.forServer(this.#baseUrl);
+    }
+    /** Alias for {@link access}, for callers who think in module names. */
+    eam() {
+        return this.access();
+    }
+    /** Logs in, for the common case that needs no builder. */
+    async login(username, password, options = {}) {
+        const builder = this.access();
+        if (username !== undefined)
+            builder.username(username);
+        if (password !== undefined)
+            builder.password(password);
+        if (options.email !== undefined)
+            builder.email(options.email);
+        if (options.namespace !== undefined)
+            builder.namespace(options.namespace);
+        if (options.caCertPath !== undefined)
+            builder.caCertPath(options.caCertPath);
+        if (options.verify !== undefined)
+            builder.verify(options.verify);
+        if (options.timeoutMs !== undefined)
+            builder.timeout(options.timeoutMs);
+        if (options.signingScheme !== undefined)
+            builder.signingScheme(options.signingScheme);
+        if (options.auth !== undefined)
+            builder.auth(options.auth);
+        if (options.useCache !== undefined)
+            builder.useCache(options.useCache);
+        if (options.loginPath !== undefined)
+            builder.loginPath(options.loginPath);
+        return builder.login();
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,OAAO,EACP,KAAK,EACL,eAAe,EACf,eAAe,EAEf,OAAO,EACP,KAAK,GACN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,YAAY,GAEb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,KAAK,EACL,KAAK,EACL,cAAc,EACd,YAAY,EACZ,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,aAAa,GAKd,MAAM,cAAc,CAAC;AAoBtB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAKnB,MAAM,cAAc,CAAC;AAgDtB,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,YAAY,EAA0D,MAAM,mBAAmB,CAAC;AACzG,OAAO,EACL,SAAS,EACT,WAAW,EACX,cAAc,EACd,SAAS,EACT,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAIhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,EACT,WAAW,EACX,cAAc,EACd,YAAY,EACZ,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,eAAe,GAIhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,GAAG,EACH,kBAAkB,EAClB,2BAA2B,EAC3B,SAAS,GAGV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,GAGV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,SAAS,GAMV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,GAGV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,GAQjB,MAAM,kBAAkB,CAAC;AAE1B,iDAAiD;AACjD,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAe/B;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACR,QAAQ,CAAS;IAE1B,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,SAAS,CAAC,OAAe;QAC9B,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,0CAA0C;IAC1C,MAAM;QACJ,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,uEAAuE;IACvE,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,KAAK,CAAC,QAAiB,EAAE,QAAiB,EAAE,UAAwB,EAAE;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CACF"}