@intentius/chant-lexicon-terraform 0.102.0 → 0.104.0

package/dist/rules/tf045.ts

@@ -0,0 +1,47 @@
+/**
+ * TF045: no Terragrunt config sets `terragrunt_version_constraint`.
+ *
+ * The attribute makes Terragrunt refuse to run on a release outside the range.
+ * Without it each machine and each CI image runs whatever Terragrunt it
+ * installed, and a behaviour change between releases reaches a plan with no
+ * diff. It is usually set once, in the root config every unit includes.
+ *
+ * The rule looks at the whole set of configs in the scan and reports once. It
+ * reports only when the set holds a config that includes no other file (the
+ * root config, or a self-contained unit) and none of the configs sets the
+ * attribute. A set made only of units that include a parent it did not read,
+ * such as one unit directory passed alone, is not determined: the parent may
+ * set it. The finding is anchored on `root.hcl` when the set has one.
+ *
+ * Off by default: the `report-only` tier keeps it out of the `recommended`
+ * preset, since many repos pin Terragrunt in the toolchain (`.tool-versions`,
+ * a CI image) rather than in config.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_CONFIG_TYPE } from "../../hcl/parse";
+import { terragruntEntities } from "./terragrunt";
+
+export const tf045: PostSynthCheck = {
+  id: "TF045",
+  description: "No Terragrunt config sets terragrunt_version_constraint",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const configs = terragruntEntities(ctx.entities, TERRAGRUNT_CONFIG_TYPE);
+    if (configs.some((c) => c.body.terragrunt_version_constraint !== undefined)) return [];
+    const tops = configs.filter((c) => Array.isArray(c.body.includes) && c.body.includes.length === 0);
+    if (tops.length === 0) return [];
+    const anchor = [...tops].sort((a, b) => Number(b.file === "root.hcl") - Number(a.file === "root.hcl") || a.key.localeCompare(b.key))[0];
+    return [
+      {
+        checkId: "TF045",
+        severity: "warning",
+        message:
+          `No Terragrunt config sets \`terragrunt_version_constraint\` (${anchor.file} is the top config read). ` +
+          'Set it once in the root config, for example `terragrunt_version_constraint = ">= 1.1.0"`, so every machine runs a release the repo was tested with.',
+        entity: anchor.key,
+        lexicon: "terraform",
+      },
+    ];
+  },
+};

package/dist/terragrunt/affected.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Affected Terragrunt units for a git range (#3415): what Terragrunt's own
+ * git filter selects, plus three cases it misses, each unit with its reasons.
+ *
+ * Terragrunt's `[base...head]` filter is the starting point, so the selection
+ * matches what `run --all` with that filter would run. Terragrunt 1.1.6 and
+ * 1.2.0-rc1 both miss these (observed on `../__fixtures__/terragrunt/affected`):
+ *
+ * - `module-file`: a file under a unit's local module directory that is not a
+ *   configuration file, such as one the module reads with `file()`. A unit's
+ *   module directory is where the `.tf` and `.tofu` files in its `reading`
+ *   list live, so an interpolated `terraform.source` resolves the way
+ *   Terragrunt resolved it. A file Terragrunt lists in `reading` is its own
+ *   to track and is not counted here.
+ * - `module-call`: a file under a local module that the unit's module calls,
+ *   followed through modules that call modules with the same reader
+ *   `../changed-roots.ts` uses for plain roots.
+ * - `stack-template`: a file under a stack's local unit template selects the
+ *   units generated from it. A stack template (a `stack` block) selects every
+ *   unit generated under it.
+ *
+ * Dependents of the selected units are the caller's to add (`terragruntDependents`).
+ */
+import { type TerragruntFindOptions, type TerragruntUnit } from "./units.js";
+import { type TerragruntRunOptions } from "./run.js";
+/** Why a unit is affected. */
+export type TerragruntAffectedKind = 
+/** Terragrunt's git filter selected it. */
+"terragrunt"
+/** Terragrunt's git filter selected it and it is gone at head: Terragrunt plans its destroy from the base checkout. */
+ | "removed"
+/** A changed file under the unit's module directory that Terragrunt does not track. */
+ | "module-file"
+/** A changed file under a local module the unit's module calls. */
+ | "module-call"
+/** A changed file under the stack template the unit is generated from. */
+ | "stack-template";
+export interface TerragruntAffectedReason {
+    kind: TerragruntAffectedKind;
+    /** The changed files behind this reason, sorted. Empty when Terragrunt selected the unit for files chant cannot attribute. */
+    files: string[];
+    /** The module directory or template directory the files sit under. Unset for `terragrunt` and `removed`. */
+    via?: string;
+}
+export interface TerragruntAffectedUnit {
+    /** The unit's path, as discovery reports it. */
+    path: string;
+    /** Terragrunt's reason first, then the supplements in the order of {@link TerragruntAffectedKind}. */
+    reasons: TerragruntAffectedReason[];
+}
+export interface TerragruntAffected {
+    /** The affected units, sorted by path. */
+    units: TerragruntAffectedUnit[];
+    /** What the selection could not do, one line each: a unit Terragrunt selected that discovery left out, a generated unit not generated yet. */
+    notes: string[];
+}
+export interface TerragruntAffectedInput {
+    /** The project directory. Unit paths, `reading` entries and changed files are relative to it. */
+    dir: string;
+    /** The project's units at head, from discovery, with stacks generated. */
+    units: readonly TerragruntUnit[];
+    /** Unit paths Terragrunt's own `[base...head]` filter selected. */
+    terragruntSelected: readonly string[];
+    /** Files the range changed, relative to `dir`, `/`-separated, as `git diff --name-only --relative` prints them. */
+    changedFiles: readonly string[];
+}
+/** Arguments to `terragrunt find` for the units Terragrunt's git filter selects between `base` and `head`. */
+export declare function terragruntAffectedFindArgs(options: {
+    base: string;
+    head?: string;
+} & TerragruntFindOptions): string[];
+/** Arguments to `git` for the files the range changed, relative to the project directory. */
+export declare function terragruntAffectedDiffArgs(options: {
+    base: string;
+    head?: string;
+}): string[];
+/** The unit's local module directories: where the `.tf` and `.tofu` files Terragrunt reports it reading live, outside the unit's own directory. */
+export declare function terragruntModuleDirs(unit: TerragruntUnit): string[];
+/** A `unit` or `stack` block of a `terragrunt.stack.hcl`, as far as affected selection needs it. */
+export interface TerragruntStackBlock {
+    type: "unit" | "stack";
+    name: string;
+    /** The template directory, relative to the project, for a local source; unset for a remote one. */
+    template?: string;
+    /** Where the block generates, relative to the project. */
+    generated: string;
+}
+/**
+ * The `unit` and `stack` blocks of a stack file at `stackFile` (relative to
+ * `dir`). Sources that are relative paths or start with `${get_terragrunt_dir()}`
+ * are local; anything else (git, registry, other functions) is left without a
+ * template, since its version lives in the stack file and a change to it is
+ * Terragrunt's to see.
+ */
+export declare function readTerragruntStackFile(dir: string, stackFile: string, text: string): TerragruntStackBlock[];
+/** Every `terragrunt.stack.hcl` under `dir`, generated ones included, relative to `dir`. */
+export declare function findTerragruntStackFiles(dir: string): string[];
+/**
+ * The affected units: what Terragrunt selected, each with the changed files
+ * that explain it, plus the three supplements. A unit Terragrunt selected
+ * that discovery does not list is `removed` when its `terragrunt.hcl` is gone,
+ * and otherwise left out with a note (discovery excluded it).
+ */
+export declare function terragruntAffected(input: TerragruntAffectedInput): TerragruntAffected;
+/** One line per reason, for a report or a job log. */
+export declare function describeTerragruntAffectedReason(reason: TerragruntAffectedReason): string;
+export interface FindTerragruntAffectedOptions extends TerragruntRunOptions, TerragruntFindOptions {
+    /** The range's base commit or ref (`origin/main`). */
+    base: string;
+    /** The range's head. Default `HEAD`. */
+    head?: string;
+    /** The project's units at head; discovered when unset. Stacks must be generated before discovery. */
+    units?: readonly TerragruntUnit[];
+    /** The `git` executable. Default `git` on PATH. */
+    git?: string;
+}
+/** Run git and Terragrunt's git filter in `dir` and return the affected units with their reasons. */
+export declare function findTerragruntAffected(options: FindTerragruntAffectedOptions): Promise<TerragruntAffected>;
+//# sourceMappingURL=affected.d.ts.map

package/dist/terragrunt/affected.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"affected.d.ts","sourceRoot":"","sources":["../../src/terragrunt/affected.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAqE,KAAK,qBAAqB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7I,OAAO,EAAmE,KAAK,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAGnH,8BAA8B;AAC9B,MAAM,MAAM,sBAAsB;AAChC,2CAA2C;AACzC,YAAY;AACd,uHAAuH;GACrH,SAAS;AACX,uFAAuF;GACrF,aAAa;AACf,mEAAmE;GACjE,aAAa;AACf,0EAA0E;GACxE,gBAAgB,CAAC;AAErB,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,8HAA8H;IAC9H,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4GAA4G;IAC5G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,8IAA8I;IAC9I,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,mEAAmE;IACnE,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,mHAAmH;IACnH,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAQD,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,GAAG,MAAM,EAAE,CAYrH;AAED,6FAA6F;AAC7F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE7F;AAED,mJAAmJ;AACnJ,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAOnE;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAoB5G;AAkCD,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB9D;AAQD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CA6ErF;AAED,sDAAsD;AACtD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAczF;AAED,MAAM,WAAW,6BAA8B,SAAQ,oBAAoB,EAAE,qBAAqB;IAChG,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuBhH"}

package/dist/terragrunt/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Terragrunt units as roots (#3414). `./units`, `./wave` and `./mocks` are pure and
+ * bundle without TypeScript; `./run` spawns `terragrunt`. `./affected` picks
+ * the units a git range touches (#3415).
+ */
+export * from "./units.js";
+export * from "./wave.js";
+export * from "./mocks.js";
+export * from "./run.js";
+export * from "./affected.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/terragrunt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/terragrunt/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC"}

package/dist/terragrunt/mocks.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Mock outputs in Terragrunt waves (#3416): which plans of a wave would read
+ * a dependency's `mock_outputs`, and the provisional mark a preview carries.
+ *
+ * A plan built on `mock_outputs` looks like a real one: Terragrunt says so in
+ * one log line only, and the plan JSON holds the mock values as if they were
+ * the upstream's (observed on 1.1.6). Gruntwork closed mocks in saved plans
+ * as won't-fix (gruntwork-io/terragrunt#2178). So a wave is checked before it
+ * is planned, and a wave that would read a mock is refused: it is not gated,
+ * and the refusal names the upstream that must apply first.
+ *
+ * The rules follow Terragrunt's own (`pkg/config/dependency.go` at v1.1.6,
+ * `getTerragruntOutputIfAppliedElseConfiguredDefault` and
+ * `shouldReturnMockOutputs`). For one `dependency` block, read at `plan`:
+ *
+ * - `enabled = false` or `skip_outputs = true`: Terragrunt never reads the
+ *   upstream, so with `mock_outputs` set the unit always reads the mock.
+ * - The upstream has no outputs (`output -json` prints `{}`, as it does for
+ *   a unit never applied): Terragrunt returns `mock_outputs` when they are
+ *   set and allowed for `plan`, and fails otherwise. Either way the wave
+ *   cannot plan on real values yet.
+ * - The upstream has outputs and the block sets a merge strategy
+ *   (`mock_outputs_merge_strategy_with_state`, or the older
+ *   `mock_outputs_merge_with_state = true`): every mock key the real outputs
+ *   lack is filled from the mock. That is a partial mock, and it counts.
+ *
+ * The blocks come from `terragrunt render --json`, so includes, locals and
+ * expressions in `config_path` are Terragrunt's to evaluate, not chant's.
+ *
+ * A provisional plan is the other side: a dependent planned at PR time
+ * (`dependents: plan`), before its upstream applied. It may read mocks. Its
+ * change-set members carry `provisional: true`, which keeps it out of the
+ * change-set digest, out of any wave's set digest and out of every group of
+ * real plans, and its saved plans are never applied.
+ *
+ * Pure: nothing here spawns or reads files. `./run.ts` runs the commands.
+ */
+import type { ChangeSetPart } from "@intentius/chant/change-set";
+/** One `dependency` block as `terragrunt render --json` prints it. */
+export interface RenderedDependency {
+    /** The block's label. */
+    name: string;
+    /** The upstream unit, relative to where Terragrunt runs, with `/` separators. */
+    upstream: string;
+    /** `mock_outputs`, when set. */
+    mockOutputs?: Record<string, unknown>;
+    /** `mock_outputs_allowed_terraform_commands`, when set. Unset or empty allows every command. */
+    mockAllowed?: string[];
+    /** `no_merge`, `shallow`, `deep_map_only` or `deep`, from either merge attribute. Unset is `no_merge`. */
+    mergeStrategy?: string;
+    /** `skip_outputs = true`. */
+    skipOutputs?: boolean;
+    /** `enabled = false`. */
+    disabled?: boolean;
+}
+/**
+ * The upstream a `config_path` names, relative to where Terragrunt runs. A
+ * relative path is taken from the unit's directory. An absolute one is made
+ * relative to the first of `dirs` it sits under (a directory and its real
+ * path, when a symlink leads to it), and kept absolute when it sits under
+ * none. A path to the upstream's `terragrunt.hcl` names its directory.
+ */
+export declare function upstreamOfConfigPath(unit: string, configPath: string, dirs: string | readonly string[]): string;
+/**
+ * The `dependency` blocks of one unit, from `terragrunt render --json` run
+ * in it. `unit` is the unit's path relative to where Terragrunt runs (`dirs`).
+ * Throws when the output is not the rendered config.
+ */
+export declare function parseRenderedDependencies(unit: string, output: string | unknown, dirs: string | readonly string[]): RenderedDependency[];
+/**
+ * The outputs `output -json` prints, by name, with their values. Undefined
+ * when the text holds no JSON object.
+ */
+export declare function parseTerragruntOutputs(output: string): Record<string, unknown> | undefined;
+/** Arguments to `terragrunt` that print one unit's outputs as JSON. */
+export declare function terragruntOutputArgs(unit: string): string[];
+/** Arguments to `terragrunt` that print one unit's evaluated configuration as JSON. */
+export declare function terragruntRenderArgs(unit: string): string[];
+/** Why one dependency of a wave's unit would read `mock_outputs`. */
+export type TerragruntMockReason = 
+/** The upstream has no outputs: never applied, or applied with none. */
+"no-outputs"
+/** A merge strategy fills keys the upstream's outputs lack from the mock. */
+ | "partial"
+/** `skip_outputs = true` with `mock_outputs` set: the mock is always read. */
+ | "skip-outputs"
+/** `enabled = false` with `mock_outputs` set: the mock is always read. */
+ | "disabled";
+/** One dependency of a wave's unit that would plan on mock values. */
+export interface TerragruntMockRead {
+    /** The wave's unit. */
+    unit: string;
+    /** The `dependency` block's label. */
+    dependency: string;
+    /** The upstream unit it names. */
+    upstream: string;
+    reason: TerragruntMockReason;
+    /** For `partial`: the mock keys the upstream's outputs lack, as dotted paths. */
+    keys?: string[];
+}
+export interface TerragruntMockReadsInput {
+    /** Each wave unit's `dependency` blocks, by unit. */
+    dependencies: ReadonlyMap<string, readonly RenderedDependency[]>;
+    /**
+     * Each upstream's outputs, by unit path. `{}` for an upstream with none;
+     * a missing entry is read as none.
+     */
+    outputs: ReadonlyMap<string, Record<string, unknown>>;
+}
+/**
+ * Every dependency of the wave's units that would read `mock_outputs` at
+ * plan, sorted by unit and dependency. Empty when the wave plans on real
+ * outputs only.
+ *
+ * An upstream with no outputs is listed whether or not the block sets
+ * mocks: without them Terragrunt fails the plan, and with them it plans on
+ * fake values. Both mean the upstream must apply first.
+ */
+export declare function terragruntMockReads(input: TerragruntMockReadsInput): TerragruntMockRead[];
+/** The upstreams a wave's `dependency` blocks read outputs from, sorted. */
+export declare function terragruntOutputUpstreams(dependencies: ReadonlyMap<string, readonly RenderedDependency[]>): string[];
+/** The refusal for a wave whose plans would read mocks: each unit, the upstream, and what must happen first. */
+export declare function describeMockRefusal(reads: readonly TerragruntMockRead[]): string;
+/**
+ * The units a plan log says read mocks, with the upstream each read,
+ * relative to where Terragrunt ran (`dirs`, as for
+ * {@link upstreamOfConfigPath}). This is the check after the fact: the check
+ * before planning ({@link terragruntMockReads}) is what refuses a wave, and
+ * this catches an upstream whose state went away in between.
+ */
+export declare function terragruntMockWarnings(log: string, dirs: string | readonly string[]): Array<{
+    unit: string;
+    upstream: string;
+}>;
+/**
+ * The parts with each member whose unit the plan log says read mocks turned
+ * into a failed member, so a mock plan never reaches a gate.
+ */
+export declare function failMockedParts(parts: readonly ChangeSetPart[], mocked: ReadonlyArray<{
+    unit: string;
+    upstream: string;
+}>): ChangeSetPart[];
+/** The parts of a provisional plan: each member marked, so no digest or group of real plans takes it. */
+export declare function markProvisional(parts: readonly ChangeSetPart[]): ChangeSetPart[];
+/** The file a provisional plan leaves in its work directory, so its saved plans are never applied. */
+export declare const PROVISIONAL_MARKER = "PROVISIONAL";
+//# sourceMappingURL=mocks.d.ts.map

package/dist/terragrunt/mocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mocks.d.ts","sourceRoot":"","sources":["../../src/terragrunt/mocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,0GAA0G;IAC1G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,CAU/G;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,kBAAkB,EAAE,CA4BxI;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAY1F;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED,qEAAqE;AACrE,MAAM,MAAM,oBAAoB;AAC9B,wEAAwE;AACtE,YAAY;AACd,6EAA6E;GAC3E,SAAS;AACX,8EAA8E;GAC5E,cAAc;AAChB,0EAA0E;GACxE,UAAU,CAAC;AAEf,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAeD,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAAC;IACjE;;;OAGG;IACH,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,EAAE,CAqBzF;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,GAAG,MAAM,EAAE,CAIpH;AAgBD,gHAAgH;AAChH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,CAMhF;AAUD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAY/H;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAgB3I;AAED,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAEhF;AAED,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,gBAAgB,CAAC"}

package/dist/terragrunt/run.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The Terragrunt runner (#3414): discovery and one wave, run against a real
+ * `terragrunt`. The pure halves are `./units.ts` and `./wave.ts`.
+ *
+ * Every call takes an injectable `exec`, so tests stub the process and the
+ * acceptance test runs the real binary.
+ */
+import type { ChangeSetPart, ChangeSetPlanner } from "@intentius/chant/change-set";
+import { type TerragruntFindOptions, type TerragruntUnit } from "./units.js";
+import { type TerragruntMockRead } from "./mocks.js";
+import { type TerragruntUnitResult } from "./wave.js";
+export interface ExecResult {
+    /** The exit code; null when the process did not exit on its own. */
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}
+/** Runs `file args` in `cwd` with `env` added to the process environment. Never throws on a non-zero exit. */
+export type TerragruntExec = (file: string, args: readonly string[], options: {
+    cwd: string;
+    env: Record<string, string>;
+}) => Promise<ExecResult>;
+export declare const defaultTerragruntExec: TerragruntExec;
+export interface TerragruntRunOptions {
+    /** The project directory Terragrunt runs in. Unit paths are relative to it. */
+    dir: string;
+    /** The `terragrunt` executable. Default `terragrunt` on PATH. */
+    terragrunt?: string;
+    /** The project's `binary`: what Terragrunt calls, via `TG_TF_PATH`. Unset leaves Terragrunt's own choice. */
+    binary?: string;
+    exec?: TerragruntExec;
+}
+/** Thrown when `terragrunt` is missing, too old or fails. */
+export declare class TerragruntError extends Error {
+    constructor(message: string);
+}
+/** Refuse a Terragrunt older than 1.1. Returns the version line. */
+export declare function checkTerragruntVersion(options: TerragruntRunOptions): Promise<string>;
+export interface TerragruntDiscovery {
+    units: TerragruntUnit[];
+    /** Units whose own configuration names a `terraform_binary` that `TG_TF_PATH` overrides. */
+    warnings: string[];
+}
+/**
+ * The project's units, from `terragrunt find`, with catalog templates and the
+ * module cache left out and `.terragrunt-filters` honoured.
+ */
+export declare function discoverTerragruntUnits(options: TerragruntRunOptions & TerragruntFindOptions): Promise<TerragruntDiscovery>;
+/**
+ * A warning per unit whose `terragrunt.hcl`, or a file it includes, sets
+ * `terraform_binary` to something other than `binary`. `TG_TF_PATH` wins over
+ * it (observed on 1.1.6), so the unit runs `binary`, not what it names.
+ */
+export declare function terraformBinaryWarnings(dir: string, units: readonly TerragruntUnit[], binary: string): string[];
+/** The planner a wave's plans come from: the project's binary, else Terragrunt's default of tofu. */
+export declare function terragruntPlanner(binary: string | undefined): ChangeSetPlanner;
+export interface TerragruntWaveRunInput extends TerragruntRunOptions {
+    units: readonly string[];
+    /** A directory for this wave's plans, plan JSON and reports. Plan and apply of one wave share it. */
+    workDir: string;
+    destroy?: boolean;
+    parallelism?: number;
+    /**
+     * Plan a preview of units whose upstream has not applied (`dependents:
+     * plan` at PR time, #3416). It skips the mock check, so it may read
+     * `mock_outputs`; its members are marked provisional, and its saved plans
+     * are never applied. Unset, a wave that would read a mock is refused.
+     */
+    provisional?: boolean;
+}
+/**
+ * Thrown when a wave's plans would read `mock_outputs` (#3416). Nothing in
+ * the wave was planned, so there is nothing to gate. `reads` names each unit,
+ * dependency and upstream.
+ */
+export declare class TerragruntMockRefusal extends TerragruntError {
+    readonly reads: TerragruntMockRead[];
+    constructor(reads: TerragruntMockRead[]);
+}
+export interface TerragruntMockCheckInput extends TerragruntRunOptions {
+    units: readonly string[];
+    /** How many `render` and `output` calls run at once. Default 8. */
+    parallelism?: number;
+}
+/**
+ * Which dependencies of the wave's units would read `mock_outputs` at plan,
+ * asked of Terragrunt: `render --json` in each unit for its evaluated
+ * `dependency` blocks, then `output -json` in each upstream they read. Empty
+ * when the wave would plan on real outputs only. Throws when Terragrunt
+ * cannot render a unit or read an upstream's outputs, since then nobody
+ * knows what the plan would read. A unit with no `terragrunt.hcl` in `dir`
+ * (removed by the change, so planned as a destroy) is not rendered.
+ */
+export declare function checkTerragruntWaveMocks(input: TerragruntMockCheckInput): Promise<TerragruntMockRead[]>;
+export interface TerragruntWavePlan {
+    /** The change-set parts, one per unit. Marked provisional for a provisional plan. */
+    parts: ChangeSetPart[];
+    /** Whether this was a provisional plan. */
+    provisional: boolean;
+    results: TerragruntUnitResult[];
+    /** Terragrunt's exit code. */
+    code: number | null;
+    /** Terragrunt's stderr, for the job log. */
+    log: string;
+}
+/**
+ * Plan one wave with one `terragrunt run --all`, and read each unit's plan
+ * JSON and run-report row.
+ *
+ * Unless the plan is provisional, the wave is first checked for mock reads
+ * ({@link checkTerragruntWaveMocks}) and refused with a
+ * {@link TerragruntMockRefusal} when any dependency would read
+ * `mock_outputs`; nothing is planned then. A unit the plan log still shows
+ * reading a mock (its upstream's state went away in between) becomes a
+ * failed member.
+ */
+export declare function planTerragruntWave(input: TerragruntWaveRunInput): Promise<TerragruntWavePlan>;
+export interface TerragruntWaveApply {
+    results: TerragruntUnitResult[];
+    code: number | null;
+    log: string;
+}
+/**
+ * Apply one planned wave from its saved plans, with the same filters. Refuses
+ * before running anything when a unit of the wave has no saved plan, since
+ * Terragrunt would plan it afresh and apply a plan nobody saw, and when the
+ * plans are provisional.
+ */
+export declare function applyTerragruntWave(input: TerragruntWaveRunInput): Promise<TerragruntWaveApply>;
+//# sourceMappingURL=run.d.ts.map

package/dist/terragrunt/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/terragrunt/run.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAaL,KAAK,kBAAkB,EACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,QAAQ,CAAC;AAEhB,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8GAA8G;AAC9G,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAEnJ,eAAO,MAAM,qBAAqB,EAAE,cAWhC,CAAC;AAEL,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED,6DAA6D;AAC7D,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,oEAAoE;AACpE,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3F;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAajI;AAID;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB/G;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAE9E;AAED,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,qGAAqG;IACrG,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;IAC5C,QAAQ,CAAC,KAAK,EAAE,kBAAkB,EAAE;IAAhD,YAAqB,KAAK,EAAE,kBAAkB,EAAE,EAG/C;CACF;AA2BD,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiC7G;AAED,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2CAA2C;IAC3C,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,8BAA8B;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0CnG;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6BrG"}

package/dist/terragrunt/units.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Terragrunt units as roots (#3414): what a unit is, how discovery finds the
+ * units, and how the unit graph orders them into waves.
+ *
+ * A Terragrunt unit is a root: its own state, plan file and plan digest. The
+ * units and their edges come from `terragrunt find --json --dag
+ * --dependencies`, run by Terragrunt itself, so chant never evaluates
+ * Terragrunt's HCL to learn the graph. Directories that group units (implicit
+ * stacks) are labels: a unit's stack is its parent directory.
+ *
+ * This module runs nothing and imports only chant's `gated-waves` subpath, so
+ * terragucci can bundle it without TypeScript (#3421). `./run.ts` spawns.
+ */
+import type { WaveNode } from "@intentius/chant/gated-waves";
+/** The oldest Terragrunt this runner drives: `run --all`, `find --dag` and `--filter` as 1.1 ships them. */
+export declare const TERRAGRUNT_MIN_VERSION = "1.1.0";
+/**
+ * Filters every discovery adds: catalog unit templates, which parse only
+ * inside a stack, and Terragrunt's module cache. A project's own `exclude`
+ * globs are added after these.
+ */
+export declare const TERRAGRUNT_DISCOVERY_EXCLUDES: readonly string[];
+/** One unit as `find --json --dag --dependencies --include --reading` reports it. */
+export interface TerragruntUnit {
+    /** The unit's directory, relative to where discovery ran, with `/` separators. Also its change-set member name. */
+    path: string;
+    /** Units this one must follow, from `dependency` and `dependencies` blocks alike. */
+    dependencies: string[];
+    /** Included files by include name, relative to where discovery ran. */
+    include?: Record<string, string>;
+    /** Files Terragrunt reports the unit reading. */
+    reading?: string[];
+}
+/** A Terragrunt version string, parsed. */
+export interface TerragruntVersion {
+    major: number;
+    minor: number;
+    patch: number;
+    /** `rc1` in `1.2.0-rc1`. */
+    pre?: string;
+    raw: string;
+}
+/** Read `terragrunt --version` output (`terragrunt version v1.1.6`). Undefined when no version is in it. */
+export declare function parseTerragruntVersion(output: string): TerragruntVersion | undefined;
+/**
+ * Why this Terragrunt cannot run units, or undefined when it can. A release
+ * candidate of 1.1.0 or later counts as that release line.
+ */
+export declare function terragruntVersionProblem(output: string): string | undefined;
+/** A path filter that selects exactly one unit. Braced so a path with glob characters stays a path. */
+export declare function unitPathFilter(path: string): string;
+/** A filter that drops everything under `glob`, relative to where discovery runs. */
+export declare function excludeFilter(glob: string): string;
+export interface TerragruntFindOptions {
+    /** Globs to leave out beside {@link TERRAGRUNT_DISCOVERY_EXCLUDES}, relative to the project directory. */
+    exclude?: readonly string[];
+}
+/**
+ * Arguments to `terragrunt` for discovery. `.terragrunt-filters` is read, as
+ * Terragrunt reads it by default; the excludes narrow what it selects.
+ */
+export declare function terragruntFindArgs(options?: TerragruntFindOptions): string[];
+/**
+ * The units in `find --json` output, in the order Terragrunt printed them
+ * (its DAG order under `--dag`). Stacks and anything else that is not a unit
+ * are left out. Throws when the output is not a JSON array.
+ */
+export declare function parseTerragruntFind(output: string | unknown): TerragruntUnit[];
+/** A unit's implicit stack: its parent directory, or `.` for a unit at the top. */
+export declare function stackOfUnit(path: string): string;
+/** Whether `path` matches `glob` (`*` within a segment, `**` across segments, `?` one character). */
+export declare function matchesUnitGlob(path: string, glob: string): boolean;
+/** The units, as the nodes gated waves (#3049) and a fan-out (#2417) layer. */
+export declare function terragruntWaveNodes(units: readonly TerragruntUnit[]): WaveNode[];
+export interface TerragruntWavesOptions {
+    /** Unit globs that form wave 1 (`live/dev/**`). A glob matching no unit in the set adds nothing. */
+    canary?: readonly string[];
+}
+/** Thrown when units cannot be cut into waves. The message names the units. */
+export declare class TerragruntWaveError extends Error {
+    constructor(message: string);
+}
+/**
+ * Cut units into waves by Terragrunt's unit graph: each unit after every unit
+ * it depends on. A dependency outside `units` holds nothing back; it is not
+ * part of this change. Each wave is sorted by path.
+ *
+ * Canaries go first, layered among themselves, so a canary that reads
+ * another canary still waits for it to apply. A canary that depends on a unit
+ * of the set that is not a canary is refused: it would apply before what it
+ * reads.
+ */
+export declare function terragruntWaves(units: readonly TerragruntUnit[], options?: TerragruntWavesOptions): string[][];
+/**
+ * Every unit that depends on one of `changed`, directly or through other
+ * units, not counting `changed` itself. Sorted by path.
+ *
+ * `find` reports `dependency` and ordering-only `dependencies` edges as one
+ * list, so this follows both. A caller that follows `dependency` edges only
+ * passes `edges` built from the units' own blocks.
+ */
+export declare function terragruntDependents(units: readonly TerragruntUnit[], changed: readonly string[], edges?: (unit: TerragruntUnit) => readonly string[]): string[];
+//# sourceMappingURL=units.d.ts.map

package/dist/terragrunt/units.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"units.d.ts","sourceRoot":"","sources":["../../src/terragrunt/units.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,4GAA4G;AAC5G,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAA8C,CAAC;AAE1G,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,mHAAmH;IACnH,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4GAA4G;AAC5G,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAIpF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM3E;AAED,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,MAAM,WAAW,qBAAqB;IACpC,0GAA0G;IAC1G,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAYhF;AAMD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,cAAc,EAAE,CAkB9E;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAmBnE;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,QAAQ,EAAE,CAEhF;AAED,MAAM,WAAW,sBAAsB;IACrC,oGAAoG;IACpG,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,GAAE,sBAA2B,GAAG,MAAM,EAAE,EAAE,CAmBlH;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,GAAE,CAAC,IAAI,EAAE,cAAc,KAAK,SAAS,MAAM,EAA0B,GACzE,MAAM,EAAE,CAeV"}