@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/dist/drift-read.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The terraform lexicon's drift read (behold#995): `LexiconPlugin.readDrift`,
+ * which `chant lifecycle drift` calls, and which `chant workspace drift` runs
+ * in a `terraform` or `choudoufu` member's reader project. It runs the
+ * engine's own reads, one root at a time, and hands each document to the
+ * drift-record adapters in `./drift-record.ts` (#4451), so the records say
+ * exactly what those adapters say.
+ *
+ * | root | `--read` | reads | adapter |
+ * |---|---|---|---|
+ * | stock | `state` (default) | `show -json` over state | `terraformStateDriftRecords` |
+ * | stock | `plan` | `plan -input=false -lock=false -out=<tmp>`, `show -json` | `terraformPlanDriftRecords` |
+ * | live | `ownership` (default) | `choudoufu live-plan -json`, `live-ls -json` | `choudoufuLiveDriftRecords` |
+ * | live | `plan` | live-plan, then the same plan read | `choudoufuLivePlusPlanDriftRecords` |
+ * | live | `--resource <addr>` | `choudoufu live-plan -resource=<addr>` | its own stream, decoded by `decodeDriftLines` |
+ *
+ * Nothing is written in the root. `init` is never run, as on the plan read
+ * (`terraformPlanRead`): a root that was never initialised reads
+ * not-observed with the init line in the detail. A plan read that fails
+ * falls back one depth (the plan to state, live+plan to ownership) and the
+ * records carry `fellBackFrom`. A live-ls that fails is left out: it only
+ * adds what the estate holds and nothing declares.
+ *
+ * Each root's records go out as one stream: a `drift-start` whose `expected`
+ * is every address the read answered, the records, and a `drift-settle`.
+ * `node` stays null; `chant workspace drift` places each record on the
+ * member's graph. A pulumi member (`pulumiMember`) is refused: its drift is
+ * the pulumi lexicon's (chant#4453).
+ */
+import { type ReadDriftOptions, type ReadDriftResult } from "@intentius/chant/drift-record";
+/** `LexiconPlugin.readDrift` for the terraform lexicon. */
+export declare function readTerraformDrift(options: ReadDriftOptions): Promise<ReadDriftResult>;
+//# sourceMappingURL=drift-read.d.ts.map

package/dist/drift-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-read.d.ts","sourceRoot":"","sources":["../src/drift-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAUL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAkMvC,2DAA2D;AAC3D,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4C5F"}

package/dist/drift-read.js

@@ -0,0 +1,243 @@
+/**
+ * The terraform lexicon's drift read (behold#995): `LexiconPlugin.readDrift`,
+ * which `chant lifecycle drift` calls, and which `chant workspace drift` runs
+ * in a `terraform` or `choudoufu` member's reader project. It runs the
+ * engine's own reads, one root at a time, and hands each document to the
+ * drift-record adapters in `./drift-record.ts` (#4451), so the records say
+ * exactly what those adapters say.
+ *
+ * | root | `--read` | reads | adapter |
+ * |---|---|---|---|
+ * | stock | `state` (default) | `show -json` over state | `terraformStateDriftRecords` |
+ * | stock | `plan` | `plan -input=false -lock=false -out=<tmp>`, `show -json` | `terraformPlanDriftRecords` |
+ * | live | `ownership` (default) | `choudoufu live-plan -json`, `live-ls -json` | `choudoufuLiveDriftRecords` |
+ * | live | `plan` | live-plan, then the same plan read | `choudoufuLivePlusPlanDriftRecords` |
+ * | live | `--resource <addr>` | `choudoufu live-plan -resource=<addr>` | its own stream, decoded by `decodeDriftLines` |
+ *
+ * Nothing is written in the root. `init` is never run, as on the plan read
+ * (`terraformPlanRead`): a root that was never initialised reads
+ * not-observed with the init line in the detail. A plan read that fails
+ * falls back one depth (the plan to state, live+plan to ownership) and the
+ * records carry `fellBackFrom`. A live-ls that fails is left out: it only
+ * adds what the estate holds and nothing declares.
+ *
+ * Each root's records go out as one stream: a `drift-start` whose `expected`
+ * is every address the read answered, the records, and a `drift-settle`.
+ * `node` stays null; `chant workspace drift` places each record on the
+ * member's graph. A pulumi member (`pulumiMember`) is refused: its drift is
+ * the pulumi lexicon's (chant#4453).
+ */
+import { spawn } from "node:child_process";
+import { resolve } from "node:path";
+import { decodeDriftLines, driftRecord, driftRecordLine, driftSettle, driftStart, } from "@intentius/chant/drift-record";
+import { ownRoots } from "./config.js";
+import { declaredOf } from "./describe-resources.js";
+import { choudoufuLivePlusPlanDriftRecords, choudoufuLiveDriftRecords, terraformPlanDriftRecords, terraformStateDriftRecords, } from "./drift-record.js";
+import { RESOURCE_TYPE } from "./hcl/parse.js";
+import { renderTerraformRoots } from "./hcl/roots.js";
+import { readsAsCredentials } from "./live-plan-reasons.js";
+import { detectLiveEstate } from "./op/activities/live-detect.js";
+import { choudoufuLiveLs, choudoufuLivePlanDocument, rootIsInitialised, terraformBinary, terraformEnvironment, terraformInitLine, terraformPlanRead, terraformShow, } from "./op/activities/terraform.js";
+const firstLine = (err) => (err instanceof Error ? err.message : String(err)).split("\n")[0];
+/** The reads a root answers, the first its default. */
+const ROOT_READS = { stock: ["state", "plan"], live: ["ownership", "plan"] };
+/** One root's records as a stream: start, records, settle. */
+function asStream(ctx, read, records, extra = {}) {
+    const start = driftStart({
+        member: ctx.options.member,
+        engine: ctx.engine,
+        read,
+        ...extra,
+        at: ctx.options.observedAt,
+        expected: records.map((r) => r.address),
+        evidence: { tool: ctx.engine },
+    });
+    const settled = driftSettle(start, records, ctx.options.observedAt);
+    return [start, ...settled.records.map(driftRecordLine), settled.line];
+}
+/** Every declared address not-observed, for a read that could not run at all. */
+function unobservedAll(ctx, read, err, command) {
+    const detail = firstLine(err);
+    return ctx.declared.map((address) => driftRecord({
+        member: ctx.options.member,
+        engine: ctx.engine,
+        address,
+        node: null,
+        observedAt: ctx.options.observedAt,
+        read,
+        status: "not-observed",
+        unobserved: { reason: readsAsCredentials(detail) ? "no-credentials" : "read-failed", detail },
+        evidence: { tool: ctx.engine, command },
+    }));
+}
+/** A stock root's state read. Never runs init. */
+async function stateRecords(ctx, fellBackFrom) {
+    const base = { member: ctx.options.member, observedAt: ctx.options.observedAt, engine: ctx.engine, declared: ctx.declared, ...(fellBackFrom ? { fellBackFrom } : {}) };
+    const env = { ...process.env, ...terraformEnvironment(ctx.root) };
+    if (!rootIsInitialised(ctx.dir, env)) {
+        const line = terraformInitLine({
+            binary: ctx.binary,
+            dir: ctx.dir,
+            ...(ctx.root.backendConfig ? { backendConfig: ctx.root.backendConfig } : {}),
+            ...(ctx.root.backendConfigFiles ? { backendConfigFiles: ctx.root.backendConfigFiles } : {}),
+        });
+        return terraformStateDriftRecords({ ...base, failed: { reason: "read-failed", detail: `${ctx.dir} has never been initialised: run \`${line}\` first; chant never runs init on a read` } });
+    }
+    try {
+        const shown = await terraformShow(ctx.where);
+        return terraformStateDriftRecords({ ...base, state: shown.json });
+    }
+    catch (err) {
+        const detail = firstLine(err);
+        return terraformStateDriftRecords({ ...base, failed: { reason: readsAsCredentials(detail) ? "no-credentials" : "read-failed", detail } });
+    }
+}
+async function stockRoot(ctx, read) {
+    if (read === "state")
+        return asStream(ctx, "state", await stateRecords(ctx));
+    try {
+        const plan = await terraformPlanRead(ctx.where);
+        return asStream(ctx, "plan", terraformPlanDriftRecords({ member: ctx.options.member, observedAt: ctx.options.observedAt, engine: ctx.engine, plan: plan.json }));
+    }
+    catch (err) {
+        // One depth down: what the last apply recorded, said as such.
+        process.stderr.write(`terraform.roots.${ctx.name}: the plan read failed (${firstLine(err)}), so the state read answered\n`);
+        return asStream(ctx, "state", await stateRecords(ctx, "plan"), { fellBackFrom: "plan" });
+    }
+}
+async function liveOwnership(ctx, fellBackFrom) {
+    let livePlan;
+    try {
+        livePlan = (await choudoufuLivePlanDocument(ctx.where)).json;
+    }
+    catch (err) {
+        return { records: unobservedAll(ctx, "ownership", err, "choudoufu live-plan -json") };
+    }
+    let liveLs;
+    try {
+        liveLs = (await choudoufuLiveLs({ ...ctx.where, consistent: true })).json;
+    }
+    catch (err) {
+        process.stderr.write(`terraform.roots.${ctx.name}: live-ls failed (${firstLine(err)}); what the estate holds and nothing declares is left out\n`);
+    }
+    const base = { member: ctx.options.member, observedAt: ctx.options.observedAt, livePlan, ...(liveLs !== undefined ? { liveLs } : {}), ...(fellBackFrom ? { fellBackFrom } : {}) };
+    return { records: choudoufuLiveDriftRecords(base), livePlan, liveLs };
+}
+async function liveRoot(ctx, read) {
+    if (read === "ownership")
+        return asStream(ctx, "ownership", (await liveOwnership(ctx)).records);
+    const owned = await liveOwnership(ctx);
+    if (owned.livePlan === undefined)
+        return asStream(ctx, "ownership", owned.records, { fellBackFrom: "live+plan" });
+    try {
+        const plan = await terraformPlanRead(ctx.where);
+        const records = choudoufuLivePlusPlanDriftRecords({
+            member: ctx.options.member,
+            observedAt: ctx.options.observedAt,
+            livePlan: owned.livePlan,
+            plan: plan.json,
+            ...(owned.liveLs !== undefined ? { liveLs: owned.liveLs } : {}),
+        });
+        return asStream(ctx, "plan", records);
+    }
+    catch (err) {
+        process.stderr.write(`terraform.roots.${ctx.name}: the plan read failed (${firstLine(err)}), so live-plan alone answered\n`);
+        const fell = choudoufuLiveDriftRecords({
+            member: ctx.options.member,
+            observedAt: ctx.options.observedAt,
+            livePlan: owned.livePlan,
+            ...(owned.liveLs !== undefined ? { liveLs: owned.liveLs } : {}),
+            fellBackFrom: "live+plan",
+        });
+        return asStream(ctx, "ownership", fell, { fellBackFrom: "live+plan" });
+    }
+}
+/** `choudoufu live-plan -resource=<addr>`'s own stream (choudoufu#2245), decoded, with the workspace member's name on every line. */
+async function liveResource(ctx, address) {
+    // `-estate` only for a root that names its estate in chant.config and not in its HCL: choudoufu refuses the flag beside a declaration.
+    const estateFlag = ctx.root.estate !== undefined && detectLiveEstate(ctx.dir) === undefined ? [`-estate=${ctx.root.estate}`] : [];
+    const argv = ["live-plan", ...estateFlag, `-resource=${address}`];
+    const command = `${ctx.binary} ${argv.join(" ")}`;
+    const ran = await new Promise((done) => {
+        const child = spawn(ctx.binary, argv, { cwd: ctx.dir, env: { ...process.env, ...terraformEnvironment(ctx.root) }, stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (d) => (stdout += String(d)));
+        child.stderr.on("data", (d) => (stderr += String(d)));
+        child.on("error", (error) => done({ code: null, stdout, stderr, error }));
+        child.on("close", (code) => done({ code, stdout, stderr }));
+    });
+    if (ran.stderr.trim())
+        process.stderr.write(ran.stderr.endsWith("\n") ? ran.stderr : `${ran.stderr}\n`);
+    // 2 is live-plan's "changes present" under -detailed-exitcode; the stream is what answers.
+    if (ran.error === undefined && (ran.code === 0 || ran.code === 2) && ran.stdout.trim()) {
+        try {
+            return decodeDriftLines(ran.stdout).map((line) => ({ ...line, member: ctx.options.member }));
+        }
+        catch (err) {
+            return asStream(ctx, "plan", [unobservedOne(ctx, address, `${command} printed a line that is not drift: ${firstLine(err)}`, command)], { resource: address });
+        }
+    }
+    const why = ran.error?.message ?? (ran.stderr.trim().split("\n").pop() || `exit ${ran.code}`);
+    return asStream(ctx, "plan", [unobservedOne(ctx, address, `${command} failed: ${why}`, command)], { resource: address });
+}
+function unobservedOne(ctx, address, detail, command) {
+    return driftRecord({
+        member: ctx.options.member,
+        engine: "choudoufu",
+        address,
+        node: null,
+        observedAt: ctx.options.observedAt,
+        read: "plan",
+        status: "not-observed",
+        unobserved: { reason: readsAsCredentials(detail) ? "no-credentials" : "read-failed", detail },
+        evidence: { tool: "choudoufu", command },
+    });
+}
+/** `LexiconPlugin.readDrift` for the terraform lexicon. */
+export async function readTerraformDrift(options) {
+    const namespace = options.config.terraform;
+    // A `signalOnly` root (#4484) is not this project's to read.
+    const roots = Object.entries(ownRoots(namespace?.roots));
+    if (roots.length === 0)
+        return { refused: { code: "no-drift-read", message: "terraform.roots declares no root of its own" } };
+    const binary = terraformBinary(namespace);
+    const live = (root, dir) => binary === "choudoufu" && (detectLiveEstate(dir) !== undefined || root.estate !== undefined);
+    const contexts = [];
+    for (const [name, root] of roots) {
+        const dir = resolve(options.projectRoot, root.dir);
+        const rendered = await renderTerraformRoots({
+            projectRoot: options.projectRoot,
+            roots: { [name]: root },
+            binary: namespace?.binary,
+            callModuleType: namespace?.callModuleType,
+            moduleRoot: namespace?.moduleRoot,
+        });
+        const declared = [...rendered.entities.entries()]
+            .map(([key, entity]) => declaredOf(key, entity))
+            .filter((d) => d.type === RESOURCE_TYPE)
+            .map((d) => d.address);
+        const isLive = live(root, dir);
+        contexts.push({ options, name, root, binary, dir, engine: isLive ? "choudoufu" : binary === "tofu" ? "tofu" : "terraform", declared: [...new Set(declared)].sort(), where: { root: name, cwd: options.projectRoot }, live: isLive });
+    }
+    for (const ctx of contexts) {
+        const reads = ROOT_READS[ctx.live ? "live" : "stock"];
+        if (options.read !== undefined && !reads.includes(options.read)) {
+            return { refused: { code: "read-unsupported", message: `terraform.roots.${ctx.name} is a ${ctx.live ? "live (choudoufu)" : "stock"} root, which answers ${reads.join(" or ")}, not ${options.read}` } };
+        }
+        if (options.resource !== undefined && !ctx.live) {
+            return { refused: { code: "resource-unsupported", message: `terraform.roots.${ctx.name} is a stock root; one resource is read through choudoufu live-plan -resource, on a live root` } };
+        }
+    }
+    const lines = [];
+    for (const ctx of contexts) {
+        const read = options.read ?? ROOT_READS[ctx.live ? "live" : "stock"][0];
+        if (options.resource !== undefined)
+            lines.push(...(await liveResource(ctx, options.resource)));
+        else if (ctx.live)
+            lines.push(...(await liveRoot(ctx, read)));
+        else
+            lines.push(...(await stockRoot(ctx, read)));
+    }
+    return { lines };
+}

package/dist/drift-record.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Drift-record adapters for the terraform family (#4451): a stock root's
+ * state read and plan, and a choudoufu live root's `live-plan -json`,
+ * `live-ls -json` and plan, each into `@intentius/chant/drift-record`
+ * records.
+ *
+ * | source | read | status |
+ * |---|---|---|
+ * | `show -json` over state | `state` | in state: recorded. Declared and not in state: pending |
+ * | `show -json` of a saved plan | `plan` | no `resource_drift` row: in-sync. Drift update: drifted with paths. Drift delete: missing. Create with no prior row: pending. Delete with no drift: undeclared |
+ * | `live-plan -json` | `ownership` | `bound[]`: in-sync, owned by its `source`. `unowned[]` and `adoptable[]`: unclaimed. `ABSENT`: pending. Any other omission: not-observed. `foreign[]`: undeclared, foreign. `controller_held[]`: runtime |
+ * | `live-ls -json` | `ownership` | `declared: false`: undeclared. A gap no live-plan row answers: not-observed |
+ * | live-plan and a plan together | `plan` | bound with a planned update or replace: drifted with paths, the live-plan ownership kept |
+ *
+ * A state read never says in-sync or drifted: `driftRecord` refuses it.
+ *
+ * An omission keeps its token in `evidence.engineCode`, and so does the
+ * `UNOWNED` omission that has no `unowned[]` row: chant reads it as
+ * not-observed (`read-failed`), not as unclaimed, since nothing in the
+ * document says what holds the identity.
+ *
+ * ## Values
+ *
+ * Attribute values come from `./plan-observation.ts`, which already replaced
+ * every value the planner flagged, or that equals a flagged string, with
+ * `(sensitive)`. Here a `(sensitive)` side makes the attribute `sensitive:
+ * true` with neither value, and the record constructor's key-name pass runs
+ * after. `before` is what was expected and `after` what the read found, so
+ * a stock root's drift row reads state then refreshed object, and a live
+ * root's planned update reads declared then live (the plan's after, then
+ * its before).
+ *
+ * ## The import graph
+ *
+ * Like `./change-set.ts`, this imports chant's `drift-record` subpath, the
+ * plan projection and the omission table, never the lexicon's entry point
+ * or `./describe-resources.ts`, so it bundles without TypeScript, node's
+ * process modules or the lint rules (#3421).
+ */
+import { type DriftAdapterBase, type DriftRecord } from "@intentius/chant/drift-record";
+export interface TerraformStateDriftInput extends DriftAdapterBase {
+    engine?: "terraform" | "tofu";
+    /** `terraform show -json` over the root's state, parsed. Absent when the read failed. */
+    state?: unknown;
+    /**
+     * The root's declared resource blocks, by terraform address
+     * (`module.cdn.null_resource.edge`). A block with no instance in state is
+     * pending. Omit to report only what state holds.
+     */
+    declared?: readonly string[];
+    /** The read failed: every declared block is not-observed with this reason. */
+    failed?: {
+        reason: "read-failed" | "no-credentials" | "no-binding";
+        detail?: string;
+    };
+}
+/**
+ * A stock root's records from its state: every managed instance in state is
+ * recorded, every declared block with no instance there is pending, and a
+ * failed read makes every declared block not-observed. Never in-sync or
+ * drifted: state says what the last apply recorded, not what the account
+ * holds.
+ */
+export declare function terraformStateDriftRecords(input: TerraformStateDriftInput): DriftRecord[];
+export interface TerraformPlanDriftInput extends DriftAdapterBase {
+    engine?: "terraform" | "tofu";
+    /** `terraform show -json <planfile>`, parsed. */
+    plan: unknown;
+}
+/**
+ * A stock root's records from a saved plan's `show -json`, one per managed
+ * instance the plan names. A `resource_drift[]` row decides: update is
+ * drifted with its paths (before is state, after the refreshed object),
+ * delete is missing. With no drift row, a create with no prior-state row is
+ * pending, a delete or forget the configuration no longer declares is
+ * undeclared, and anything else is in-sync, since a planned change from
+ * configuration is the change set's to show and not drift.
+ */
+export declare function terraformPlanDriftRecords(input: TerraformPlanDriftInput): DriftRecord[];
+export interface ChoudoufuLivePlanDriftInput extends DriftAdapterBase {
+    /** `choudoufu live-plan -json`, parsed. */
+    livePlan: unknown;
+}
+/**
+ * A live root's records from `live-plan -json`, read `ownership`, one per
+ * address the document names.
+ *
+ * - `bound[]`: in-sync, `owned` by the row's `source`, the marker on the
+ *   object exactly when the source is `marker`.
+ * - `unowned[]`: unclaimed, `adoptable` when the row carries the adopting
+ *   tag values and `foreign` otherwise, with the estate it does carry. It
+ *   answers before the paired `UNOWNED` omission.
+ * - `adoptable[]`: unclaimed, `adoptable`, the paired omission's token kept.
+ * - an `ABSENT` omission: pending.
+ * - any other omission, `UNOWNED` with no row included: not-observed with
+ *   the reason `LIVE_PLAN_OMISSION_REASONS` gives (`VERIFIED_NOT_IMPORTABLE`
+ *   read-failed, `OUT_OF_SCOPE` filtered), a credentials failure named as
+ *   such.
+ * - `foreign[]`: undeclared, `foreign`, addressed by its identity.
+ * - `controller_held[]`: runtime, `foreign`, held by its controller,
+ *   addressed by the marker's address when it has one and its identity
+ *   otherwise.
+ */
+export declare function choudoufuLivePlanDriftRecords(input: ChoudoufuLivePlanDriftInput): DriftRecord[];
+export interface ChoudoufuLiveLsDriftInput extends DriftAdapterBase {
+    /** `choudoufu live-ls -json`, parsed. */
+    liveLs: unknown;
+    /**
+     * Addresses another read already answered (the live-plan records'), so a
+     * gap on one of them is not reported: the gap says the listing cannot
+     * reach the instance, and live-plan did.
+     */
+    answered?: Iterable<string>;
+}
+/**
+ * A live root's records from `live-ls -json`, read `ownership`. An item with
+ * `declared: false` is undeclared, addressed by its marker's address or else
+ * its identity: `owned` when its marker names this estate, held by the
+ * controller (runtime) when it has `held_by`, `foreign` when it names
+ * another estate. A declared item is live-plan's to answer and is left out.
+ * A gap is not-observed `unsupported-kind` with its rung as the token,
+ * unless `answered` holds its address.
+ */
+export declare function choudoufuLiveLsDriftRecords(input: ChoudoufuLiveLsDriftInput): DriftRecord[];
+/** live-plan's records, then live-ls's undeclared items and the gaps live-plan did not answer. */
+export declare function choudoufuLiveDriftRecords(input: DriftAdapterBase & {
+    livePlan: unknown;
+    liveLs?: unknown;
+}): DriftRecord[];
+export interface ChoudoufuLivePlusPlanDriftInput extends DriftAdapterBase {
+    /** `choudoufu live-plan -json`, parsed. */
+    livePlan: unknown;
+    /** `choudoufu show -json <planfile>` of the same root, parsed. */
+    plan: unknown;
+    /** `choudoufu live-ls -json`, parsed, when it was read too. */
+    liveLs?: unknown;
+}
+/**
+ * A live root at the plan depth. Every bound instance is read `plan`: a
+ * planned update or replace is drifted with the plan's paths, since a live
+ * root's prior state is the account itself, and anything else is in-sync.
+ * Its ownership facet is live-plan's. Every other address keeps its
+ * live-plan or live-ls record, read `ownership`, because the plan does not
+ * say who holds it.
+ */
+export declare function choudoufuLivePlusPlanDriftRecords(input: ChoudoufuLivePlusPlanDriftInput): DriftRecord[];
+//# sourceMappingURL=drift-record.d.ts.map

package/dist/drift-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-record.d.ts","sourceRoot":"","sources":["../src/drift-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAGL,KAAK,gBAAgB,EAKrB,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAiEvC,MAAM,WAAW,wBAAyB,SAAQ,gBAAgB;IAChE,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9B,yFAAyF;IACzF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,aAAa,GAAG,gBAAgB,GAAG,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,wBAAwB,GAAG,WAAW,EAAE,CA0BzF;AAID,MAAM,WAAW,uBAAwB,SAAQ,gBAAgB;IAC/D,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;IAC9B,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,uBAAuB,GAAG,WAAW,EAAE,CA0BvF;AAMD,MAAM,WAAW,2BAA4B,SAAQ,gBAAgB;IACnE,2CAA2C;IAC3C,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,2BAA2B,GAAG,WAAW,EAAE,CA2F/F;AAID,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,yCAAyC;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,yBAAyB,GAAG,WAAW,EAAE,CAmD3F;AAED,kGAAkG;AAClG,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,EAAE,CAM1H;AAID,MAAM,WAAW,+BAAgC,SAAQ,gBAAgB;IACvE,2CAA2C;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kEAAkE;IAClE,IAAI,EAAE,OAAO,CAAC;IACd,+DAA+D;IAC/D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,+BAA+B,GAAG,WAAW,EAAE,CAqBvG"}