hecks 3.5.0 → 3.7.0

data/lib/hecks/projections/deploy/shared_database_instance/templates/rds.yaml.tmpl

@@ -0,0 +1,180 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >
+  The shared RDS Postgres instance @@STACK@@, on which several sites each keep their own database and
+  login role. Private subnets only; each site's box stack admits itself on 5432, so nothing else can reach
+  it. The master password is managed by RDS in Secrets Manager ({username, password}); only the operator
+  who runs a site's provision-database.sh reads it, and no box does.
+
+Parameters:
+  VpcId:
+    Type: AWS::EC2::VPC::Id
+  BastionSecurityGroupId:
+    Type: String
+    Default: ""
+    Description: >
+      A security group allowed to reach the instance on 5432, for the bastion that provision-database.sh and
+      restore-to-rds.sh tunnel through. Blank admits nothing but the sites' boxes.
+  PrivateSubnetIds:
+    Type: List<AWS::EC2::Subnet::Id>
+    Description: At least two subnets in different availability zones (an RDS subnet group needs them).
+  InstanceClass:
+    Type: String
+    Default: @@DB_CLASS@@
+  AllocatedStorageGb:
+    Type: Number
+    Default: @@STORAGE_GB@@
+  EngineVersion:
+    Type: String
+    Default: "@@ENGINE_VERSION@@"
+    Description: A major version ("16") lets RDS pick its current minor release.
+  BackupRetentionDays:
+    Type: Number
+    Default: @@BACKUP_DAYS@@
+  ExistingAlertTopicArn:
+    Type: String
+    Default: ""
+    Description: An SNS topic that already has subscribers. Blank creates a new topic.
+  AlertEmail:
+    Type: String
+    Default: ""
+    Description: Subscribed to a new topic (AWS sends one confirmation link). Ignored when ExistingAlertTopicArn is set.
+  Rehearsal:
+    Type: String
+    Default: "false"
+    AllowedValues: ["true", "false"]
+    Description: >
+      true is a throwaway copy (no deletion protection, no final snapshot). false is the real
+      database: deletion protection on and a snapshot taken on delete.
+
+Conditions:
+  NewTopic: !Equals [!Ref ExistingAlertTopicArn, ""]
+  NewTopicWithEmail: !And [!Condition NewTopic, !Not [!Equals [!Ref AlertEmail, ""]]]
+  IsRehearsal: !Equals [!Ref Rehearsal, "true"]
+  HasBastion: !Not [!Equals [!Ref BastionSecurityGroupId, ""]]
+
+Resources:
+  # No inline rules: every site's box stack adds its own ingress rule to this group, and CloudFormation can
+  # revoke an externally added rule when it updates an inline list. The bastion's rule is its own resource.
+  DbSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: @@STACK@@ RDS, 5432 from each site's box (their stacks add the rules) and a bastion if given
+      VpcId: !Ref VpcId
+
+  BastionIngress:
+    Type: AWS::EC2::SecurityGroupIngress
+    Condition: HasBastion
+    Properties:
+      GroupId: !Ref DbSecurityGroup
+      IpProtocol: tcp
+      FromPort: 5432
+      ToPort: 5432
+      SourceSecurityGroupId: !Ref BastionSecurityGroupId
+      Description: Bastion for provision-database.sh and restore-to-rds.sh
+
+  DbSubnetGroup:
+    Type: AWS::RDS::DBSubnetGroup
+    Properties:
+      DBSubnetGroupDescription: @@STACK@@ RDS subnets
+      SubnetIds: !Ref PrivateSubnetIds
+
+  Database:
+    Type: AWS::RDS::DBInstance
+    DeletionPolicy: !If [IsRehearsal, Delete, Snapshot]
+    UpdateReplacePolicy: !If [IsRehearsal, Delete, Snapshot]
+    Properties:
+      Engine: postgres
+      EngineVersion: !Ref EngineVersion
+      DBInstanceClass: !Ref InstanceClass
+      AllocatedStorage: !Ref AllocatedStorageGb
+      StorageType: gp3
+      StorageEncrypted: true
+      MasterUsername: postgres
+      ManageMasterUserPassword: true
+      DBSubnetGroupName: !Ref DbSubnetGroup
+      VPCSecurityGroups: [!Ref DbSecurityGroup]
+      PubliclyAccessible: false
+      MultiAZ: false
+      BackupRetentionPeriod: !Ref BackupRetentionDays
+      DeletionProtection: !If [IsRehearsal, false, true]
+      AutoMinorVersionUpgrade: true
+      CopyTagsToSnapshot: true
+      Tags:
+        - Key: Name
+          Value: @@STACK@@-rds
+
+  AlertTopic:
+    Type: AWS::SNS::Topic
+    Condition: NewTopic
+    Properties:
+      DisplayName: @@STACK@@-alerts
+
+  AlertSubscription:
+    Type: AWS::SNS::Subscription
+    Condition: NewTopicWithEmail
+    Properties:
+      TopicArn: !Ref AlertTopic
+      Protocol: email
+      Endpoint: !Ref AlertEmail
+
+  # Every site's journal only grows, and RDS stops accepting writes when storage is full.
+  StorageLowAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: RDS free storage under 3 GB
+      Namespace: AWS/RDS
+      MetricName: FreeStorageSpace
+      Dimensions: [{ Name: DBInstanceIdentifier, Value: !Ref Database }]
+      Statistic: Minimum
+      Period: 300
+      EvaluationPeriods: 3
+      Threshold: 3221225472
+      ComparisonOperator: LessThanThreshold
+      TreatMissingData: breaching
+      AlarmActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+      OKActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+
+  CpuHighAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: "RDS CPU above 80% for 15 minutes (a burstable class may be out of credits)"
+      Namespace: AWS/RDS
+      MetricName: CPUUtilization
+      Dimensions: [{ Name: DBInstanceIdentifier, Value: !Ref Database }]
+      Statistic: Average
+      Period: 300
+      EvaluationPeriods: 3
+      Threshold: 80
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+      OKActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+
+  MemoryLowAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: RDS freeable memory under 100 MB for 15 minutes
+      Namespace: AWS/RDS
+      MetricName: FreeableMemory
+      Dimensions: [{ Name: DBInstanceIdentifier, Value: !Ref Database }]
+      Statistic: Minimum
+      Period: 300
+      EvaluationPeriods: 3
+      Threshold: 104857600
+      ComparisonOperator: LessThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+      OKActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+
+Outputs:
+  AlertTopicArn:
+    Description: Pass as AlertTopicArn to the box stack.
+    Value: !If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]
+  DbEndpoint:
+    Value: !GetAtt Database.Endpoint.Address
+  DbSecretArn:
+    Description: RDS-managed master secret ({username, password}).
+    Value: !GetAtt Database.MasterUserSecret.SecretArn
+  DbSecurityGroupId:
+    Description: Pass as DbSecurityGroupId to the box stack.
+    Value: !Ref DbSecurityGroup

data/lib/hecks/projections/deploy/shared_database_instance.rb

@@ -0,0 +1,106 @@
+require "json"
+require_relative "../../projector"
+require_relative "box/settings"
+
+module Hecks
+  module Projections
+    module Deploy
+      # The shared database target for `deployed_to("AwsSharedDatabase")`: one RDS Postgres instance
+      # that several sites each keep a database on (ADR 0092). It renders the instance's stack
+      # (`rds.yaml`), a `Makefile` that deploys it, and a README. A site's own world says
+      # `shared_database "<this stack>"`, and its box generates the provisioning of its database.
+      #
+      # The stack's name is the world's `stack_name` exactly, with no prefix or suffix, because
+      # every site names it by that string.
+      module SharedDatabaseInstance
+        extend Projector::Target
+
+        projects_as :aws_shared_database, needs_world: true, emits: :files
+
+        TEMPLATE_DIR = File.join(__dir__, "shared_database_instance", "templates").freeze
+
+        # What the world leaves out resolves to these.
+        DEFAULTS = { database_class: "db.t4g.small", storage_gb: 30, engine_version: "16", backup_days: 7 }.freeze
+
+        # The checked settings the templates are filled from.
+        Plan = Struct.new(:stack, :database_class, :storage_gb, :engine_version, :backup_days, keyword_init: true)
+
+        module_function
+
+        # @param bluebook [Bluebook::Behaviour::Chapter] the domain's own booted chapter
+        # @param options [Hash] generation options; same shape as `Box.call`'s
+        # @return [Hash{String => String}] the generated file contents, keyed by filename
+        # @raise [ArgumentError] if the domain's deploy settings are invalid
+        def call(bluebook:, options: {})
+          world, _domain, world_file = options.values_at(:world, :domain_dir, :world_file)
+          settings = world.for_verb("deployed_to")
+          target = declare(world.domain, settings, world_file)
+          render_all(resolve(settings, target))
+        end
+
+        # Validates the target through the Deploy bluebook's own `SharedDatabaseTarget.Declare`.
+        #
+        # @return [Object] the declared target aggregate
+        # @raise [ArgumentError] when the bluebook refuses a value
+        def declare(domain, settings, world_file)
+          dispatcher = Hecks.boot(File.expand_path("../../deploy", __dir__))
+          dispatcher.dispatch("Deploy::SharedDatabaseTarget.Declare", with: declare_arguments(domain, settings)).instance
+        rescue *Hecks::Runtime::DOMAIN_REFUSALS => e
+          raise ArgumentError, "#{world_file}'s deployed_to(\"AwsSharedDatabase\") is invalid: #{e.message}"
+        end
+
+        # @return [Hash{Symbol => Hash}] the `Declare` arguments, each `{ value: }`
+        def declare_arguments(domain, settings)
+          {
+            domain: { value: domain }, region: { value: settings[:region] },
+            database_class: { value: settings.fetch(:database_class, DEFAULTS[:database_class]) },
+            storage_gb: { value: settings.fetch(:storage_gb, DEFAULTS[:storage_gb]) }
+          }
+        end
+
+        # @param settings [Hash{Symbol => Object}] the world's `AwsSharedDatabase` settings
+        # @param target [Object] the declared target, whose class and storage `Declare` has checked
+        # @return [Plan] the checked settings
+        # @raise [ArgumentError] when the stack name is missing or a setting is malformed
+        def resolve(settings, target)
+          Plan.new(stack: read_stack(settings), database_class: target.state[:database_class].value,
+                   storage_gb: target.state[:storage_gb].value, engine_version: read_engine(settings),
+                   backup_days: Box::Settings.integer(:backup_days, settings.fetch(:backup_days, DEFAULTS[:backup_days]), 1, 35))
+        end
+
+        # @return [String] the stack's name, which every site's `shared_database` repeats
+        def read_stack(settings)
+          stack = settings.fetch(:stack_name) do
+            raise ArgumentError, "stack_name: the shared instance's stack, which every site names in shared_database"
+          end
+          Box::Settings.check(:stack_name, stack, Box::Settings::NAME)
+        end
+
+        # @return [String] the Postgres major (or major.minor) version
+        def read_engine(settings)
+          Box::Settings.check(:engine_version, settings.fetch(:engine_version, DEFAULTS[:engine_version]).to_s,
+                              Box::Settings::ENGINE)
+        end
+
+        # @param plan [Plan] the checked settings
+        # @return [Hash{String => String}] every generated file
+        def render_all(plan)
+          values = { "STACK" => plan.stack, "DB_CLASS" => plan.database_class, "DATABASE_CLASS" => plan.database_class,
+                     "STORAGE_GB" => plan.storage_gb.to_s, "ENGINE_VERSION" => plan.engine_version,
+                     "BACKUP_DAYS" => plan.backup_days.to_s }
+          { "rds.yaml" => template("rds.yaml.tmpl", values), "Makefile" => template("Makefile.tmpl", values),
+            "README.md" => template("README.md.tmpl", values) }
+        end
+
+        # Fills `@@NAME@@` markers.
+        #
+        # @param file [String] the template's name in `TEMPLATE_DIR`
+        # @param values [Hash{String => String}] marker name => text
+        # @return [String] the rendered file
+        def template(file, values)
+          values.reduce(File.read(File.join(TEMPLATE_DIR, file))) { |text, (marker, value)| text.gsub("@@#{marker}@@", value) }
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/smoke.rb

@@ -55,19 +55,24 @@ module Hecks
         end
 
         def resolve(deploy_settings)
+          require_settings!(deploy_settings)
+          picked = PATTERNS.keys.to_h { |name| [name, deploy_settings.fetch(setting_key(name), DEFAULTS[name])] }
+          PATTERNS.each { |name, pattern| check_value!(name, picked[name], pattern) }
+          picked
+        end
+
+        def require_settings!(deploy_settings)
           missing = REQUIRED.reject { |name| deploy_settings[setting_key(name)] }
-          unless missing.empty?
-            raise ArgumentError, "smoke true needs #{missing.map { |name| setting_key(name) }.join(', ')} " \
-                                 "in the deployed_to block; the workflow cannot be rendered without them"
-          end
+          return if missing.empty?
 
-          picked = PATTERNS.keys.to_h { |name| [name, deploy_settings.fetch(setting_key(name), DEFAULTS[name])] }
-          PATTERNS.each do |name, pattern|
-            next if picked[name].nil? || picked[name].to_s.match?(pattern)
+          raise ArgumentError, "smoke true needs #{missing.map { |name| setting_key(name) }.join(", ")} " \
+                               "in the deployed_to block; the workflow cannot be rendered without them"
+        end
 
-            raise ArgumentError, "#{setting_key(name)} #{picked[name].inspect} is not a value the smoke workflow can carry"
-          end
-          picked
+        def check_value!(name, value, pattern)
+          return if value.nil? || value.to_s.match?(pattern)
+
+          raise ArgumentError, "#{setting_key(name)} #{value.inspect} is not a value the smoke workflow can carry"
         end
 
         # The region has no `smoke_` prefix; every other setting does.

data/lib/hecks/projections/deploy/template_diff/comparer.rb

@@ -1,3 +1,6 @@
+require_relative "normalizer"
+require_relative "value_diff"
+
 module Hecks
   module Projections
     module Deploy
@@ -14,13 +17,15 @@ module Hecks
           end
 
           ENTITY_SECTIONS = %w[Parameters Resources Outputs Conditions Mappings].freeze
-          IDENTITY_KEYS = %w[Name Id Key PolicyName PathPattern HeaderName ContainerName Sid Field].freeze
-          ORDERED_BY = %w[PathPattern].freeze
 
           # Diffs each entity section by name, with other top-level keys grouped under "Template".
+          #
+          # @param before [Hash] the template before, as loaded
+          # @param after [Hash] the template after, as loaded
+          # @return [Hash{String => SectionDiff, Array<Change>}] one diff per section present
           def compare(before, after)
-            before = normalize(before)
-            after = normalize(after)
+            before = Normalizer.normalize(before)
+            after = Normalizer.normalize(after)
             diff = ENTITY_SECTIONS.each_with_object({}) do |section, sections|
               next unless before.key?(section) || after.key?(section)
 
@@ -30,54 +35,21 @@ module Hecks
             diff
           end
 
-          def normalize(value)
-            case value
-            when Hash then normalize_hash(value)
-            when Array then value.map { |item| normalize(item) }
-            else value
-            end
-          end
-          private_class_method :normalize
-
-          def normalize_hash(hash)
-            result = hash.to_h { |key, item| [key, key == "DependsOn" ? depends_on(item) : normalize(item)] }
-            substitution?(result) ? simplify_sub(result) : result
-          end
-          private_class_method :normalize_hash
-
-          def depends_on(value)
-            Array(value).map(&:to_s).sort
-          end
-          private_class_method :depends_on
-
-          def substitution?(hash)
-            hash.size == 1 && hash["Fn::Sub"].is_a?(String)
-          end
-          private_class_method :substitution?
-
-          # `!Sub "${Name}"` is `!Ref Name`, `!Sub "${A.B}"` is `!GetAtt A.B`, and a `!Sub` with no
-          # variable is the plain string.
-          def simplify_sub(hash)
-            text = hash["Fn::Sub"]
-            return text unless text.include?("${")
-
-            match = text.match(/\A\$\{([^}!]+)\}\z/)
-            return hash unless match
-
-            name = match[1]
-            name.include?(".") && !name.start_with?("AWS::") ? { "Fn::GetAtt" => name.split(".", 2) } : { "Ref" => name }
-          end
-          private_class_method :simplify_sub
-
           def section_diff(section, before, after)
             SectionDiff.new(
-              added:   (after.keys - before.keys).sort.map { |name| [name, type_of(section, after[name])] },
-              removed: (before.keys - after.keys).sort.map { |name| [name, type_of(section, before[name])] },
+              added:   listed(section, after, before),
+              removed: listed(section, before, after),
               changed: (before.keys & after.keys).sort.filter_map { |name| entity_diff(section, name, before[name], after[name]) }
             )
           end
           private_class_method :section_diff
 
+          # The `[name, type]` of each entity in `side` that `other` lacks.
+          def listed(section, side, other)
+            (side.keys - other.keys).sort.map { |name| [name, type_of(section, side[name])] }
+          end
+          private_class_method :listed
+
           def type_of(section, entity)
             entity.is_a?(Hash) && %w[Resources Parameters].include?(section) ? entity["Type"] : nil
           end
@@ -87,7 +59,7 @@ module Hecks
             return nil if before == after
 
             changes = []
-            diff_values("", before, after, changes)
+            ValueDiff.diff_values("", before, after, changes)
             return nil if changes.empty?
 
             replaced = section == "Resources" && before.is_a?(Hash) && after.is_a?(Hash) && before["Type"] != after["Type"]
@@ -98,110 +70,12 @@ module Hecks
           def template_changes(before, after)
             changes = []
             others = (before.keys | after.keys) - ENTITY_SECTIONS
-            others.sort.each { |key| diff_values(key, before[key], after[key], changes) unless before[key] == after[key] }
+            others.sort.each do |key|
+              ValueDiff.diff_values(key, before[key], after[key], changes) unless before[key] == after[key]
+            end
             changes
           end
           private_class_method :template_changes
-
-          def diff_values(path, before, after, changes)
-            return if before == after
-
-            if before.is_a?(Hash) && after.is_a?(Hash)
-              diff_hashes(path, before, after, changes)
-            elsif before.is_a?(Array) && after.is_a?(Array)
-              diff_arrays(path, before, after, changes)
-            else
-              changes << Change.new(path: path, kind: :changed, before: before, after: after, cosmetic: same_text?(before, after))
-            end
-          end
-          private_class_method :diff_values
-
-          def diff_hashes(path, before, after, changes)
-            (before.keys | after.keys).sort.each do |key|
-              child = path.empty? ? key : "#{path}.#{key}"
-              if !after.key?(key)
-                changes << Change.new(path: child, kind: :removed, before: before[key])
-              elsif !before.key?(key)
-                changes << Change.new(path: child, kind: :added, after: after[key])
-              else
-                diff_values(child, before[key], after[key], changes)
-              end
-            end
-          end
-          private_class_method :diff_hashes
-
-          def diff_arrays(path, before, after, changes)
-            key = identity_key(before, after)
-            return diff_keyed(path, key, before, after, changes) if key
-            if before.sort_by(&:to_s) == after.sort_by(&:to_s)
-              return changes << Change.new(path: path, kind: :reordered, before: before, after: after,
-                                           cosmetic: true)
-            end
-
-            (0...[before.size, after.size].max).each do |index|
-              child = "#{path}[#{index}]"
-              if index >= after.size then changes << Change.new(path: child, kind: :removed, before: before[index])
-              elsif index >= before.size then changes << Change.new(path: child, kind: :added, after: after[index])
-              else diff_values(child, before[index], after[index], changes)
-              end
-            end
-          end
-          private_class_method :diff_arrays
-
-          def diff_keyed(path, key, before, after, changes)
-            left = before.to_h { |item| [item[key].to_s, item] }
-            right = after.to_h { |item| [item[key].to_s, item] }
-            (left.keys | right.keys).each do |name|
-              child = "#{path}[#{key}=#{name}]"
-              if !right.key?(name) then changes << Change.new(path: child, kind: :removed, before: left[name])
-              elsif !left.key?(name) then changes << Change.new(path: child, kind: :added, after: right[name])
-              else diff_values(child, left[name], right[name], changes)
-              end
-            end
-            check_order(path, key, left.keys, right.keys, changes)
-          end
-          private_class_method :diff_keyed
-
-          def check_order(path, key, left, right, changes)
-            return unless ORDERED_BY.include?(key)
-
-            common = left & right
-            return if left.select { |name| common.include?(name) } == right.select { |name| common.include?(name) }
-
-            changes << Change.new(path: path, kind: :reordered, before: left, after: right, cosmetic: false)
-          end
-          private_class_method :check_order
-
-          # A list of mappings is matched by a field only when every entry in both lists has it and
-          # no two entries share its value, so a match is never ambiguous.
-          def identity_key(before, after)
-            lists = [before, after]
-            return nil if lists.any? { |list| list.empty? || !list.all?(Hash) }
-
-            IDENTITY_KEYS.find do |key|
-              lists.all? do |list|
-                list.all? { |item| scalar?(item[key]) } && list.map do |item|
-                  item[key].to_s
-                end.uniq.size == list.size
-              end
-            end
-          end
-          private_class_method :identity_key
-
-          def scalar?(value)
-            value.is_a?(String) || value.is_a?(Integer)
-          end
-          private_class_method :scalar?
-
-          def same_text?(before, after)
-            scalars = [before, after].all? do |value|
-              [String, Integer, Float, TrueClass, FalseClass].any? do |type|
-                value.is_a?(type)
-              end
-            end
-            scalars && before.to_s == after.to_s
-          end
-          private_class_method :same_text?
         end
       end
     end

data/lib/hecks/projections/deploy/template_diff/normalizer.rb

@@ -0,0 +1,60 @@
+module Hecks
+  module Projections
+    module Deploy
+      module TemplateDiff
+        # Rewrites a loaded CloudFormation template into one canonical spelling so two templates
+        # that say the same thing compare equal: `DependsOn` sorted, and a `!Sub` of a single
+        # variable written as the `!Ref` or `!GetAtt` it stands for.
+        module Normalizer
+          module_function
+
+          # @param value [Object] a loaded template, or any node inside one
+          # @return [Object] the same shape with every node in its canonical spelling
+          def normalize(value)
+            case value
+            when Hash then normalize_hash(value)
+            when Array then value.map { |item| normalize(item) }
+            else value
+            end
+          end
+
+          def normalize_hash(hash)
+            result = hash.to_h { |key, item| [key, key == "DependsOn" ? depends_on(item) : normalize(item)] }
+            substitution?(result) ? simplify_sub(result) : result
+          end
+          private_class_method :normalize_hash
+
+          def depends_on(value)
+            Array(value).map(&:to_s).sort
+          end
+          private_class_method :depends_on
+
+          def substitution?(hash)
+            hash.size == 1 && hash["Fn::Sub"].is_a?(String)
+          end
+          private_class_method :substitution?
+
+          # `!Sub "${Name}"` is `!Ref Name`, `!Sub "${A.B}"` is `!GetAtt A.B`, and a `!Sub` with no
+          # variable is the plain string.
+          def simplify_sub(hash)
+            text = hash["Fn::Sub"]
+            return text unless text.include?("${")
+
+            match = text.match(/\A\$\{([^}!]+)\}\z/)
+            return hash unless match
+
+            intrinsic_for(match[1])
+          end
+          private_class_method :simplify_sub
+
+          def intrinsic_for(name)
+            return { "Ref" => name } unless name.include?(".") && !name.start_with?("AWS::")
+
+            { "Fn::GetAtt" => name.split(".", 2) }
+          end
+          private_class_method :intrinsic_for
+        end
+      end
+    end
+  end
+end