@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/rules/tf047.ts

@@ -0,0 +1,114 @@
+/**
+ * TF047: a live root pins a registry module version the known-module catalog
+ * has no row for, or one whose row carries refusals.
+ *
+ * The catalog is choudoufu's module compatibility table, vendored in
+ * `../../module-catalog/` (chant#4560, choudoufu#2292). It has one static
+ * row per terraform-aws-modules example at one tag, measured offline in the
+ * onboarded form. A module call on a root whose binary is choudoufu (the
+ * root's `mode` is `live`) with an exact `version` is looked up there:
+ *
+ * - no row for the module, or none at the pinned version: `info`, naming the
+ *   versions the static tier did measure;
+ * - at least one example at that version refused: `warning`, with each
+ *   refusal ID, its site count, the examples that carry it and its
+ *   `live/LIMITATIONS.md` link;
+ * - every example clear: quiet.
+ *
+ * Every message names the tier. The catalog holds the static tier only, and
+ * no figure here counts a gauntlet run (choudoufu#2292 ruling: two tiers,
+ * never mixed).
+ *
+ * A stock root (`mode: "state"`) is skipped: the table measures choudoufu.
+ * A range is TF039's finding and a missing `version` TF004's, so both are
+ * skipped here. A `//subdir` source is looked up by its module repository.
+ *
+ * Off by default: `report-only` in the audit catalog, as TF039 is.
+ * terragucci turns it on and holds the product wording (terragucci#1286).
+ *
+ * Scope: root and child modules of a live root alike.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE, type BlockBody } from "../../hcl/parse";
+import { classifyModuleSource, isExactVersionConstraint } from "./module-source";
+import {
+  MODULE_CATALOG_SOURCE,
+  MODULE_COMPATIBILITY_PAGE,
+  moduleCompatibility,
+  type ModuleCompatibility,
+} from "../../module-catalog";
+
+const tierNote = (): string =>
+  `static tier of choudoufu's module table, measured ${MODULE_CATALOG_SOURCE.date} with hashicorp/aws ${MODULE_CATALOG_SOURCE.awsProvider}`;
+
+/** The TF047 message for one module call, or undefined when the call is clear. */
+export function catalogMessage(address: string, c: ModuleCompatibility): string | undefined {
+  const pin = `${c.module} ${c.version}`;
+  switch (c.status) {
+    case "clear":
+      return undefined;
+    case "unknown-module":
+      return (
+        `Module "${address}" pins ${pin}, and the ${tierNote()} has no row for this module. ` +
+        `Run \`choudoufu live-check\` on the root to see whether it plans. The table: ${MODULE_COMPATIBILITY_PAGE}`
+      );
+    case "unknown-version":
+      return (
+        `Module "${address}" pins ${pin}, and the ${tierNote()} has no row at this version. ` +
+        `It measured ${c.measuredVersions.join(", ")}. ` +
+        `Run \`choudoufu live-check\` on the root, or pin a measured version. The table: ${MODULE_COMPATIBILITY_PAGE}`
+      );
+    case "refused": {
+      const ids = c.refusals
+        .map((r) => `${r.id} (${r.sites} site${r.sites === 1 ? "" : "s"} in ${r.examples.join(", ")}; ${r.docsUrl})`)
+        .join("; ");
+      return (
+        `Module "${address}" pins ${pin}. In the ${tierNote()}, ${c.refusedExamples} of ${c.examples} ` +
+        `examples at this version are refused: ${ids}. ` +
+        "A call that uses the same features is refused the same way; `choudoufu live-check` names each site in this root."
+      );
+    }
+  }
+}
+
+export const tf047: PostSynthCheck = {
+  id: "TF047",
+  description: "Live root pins a module version the known-module catalog has no row for, or one with refusals",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [key, entity] of ctx.entities) {
+      if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity)) continue;
+      const props = entity.props as { address?: unknown; body?: unknown; mode?: unknown };
+      if (props.mode !== "live") continue;
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const source = typeof body.source === "string" ? body.source : undefined;
+      if (source === undefined || classifyModuleSource(source).kind !== "registry") continue;
+      const version = body.version;
+      if (typeof version !== "string" || !isExactVersionConstraint(version)) continue;
+
+      const compat = moduleCompatibility(source, version);
+      if (compat === undefined) continue;
+      const address = typeof props.address === "string" ? props.address : key;
+      const message = catalogMessage(address, compat);
+      if (message === undefined) continue;
+
+      diagnostics.push({
+        checkId: "TF047",
+        severity: compat.status === "refused" ? "warning" : "info",
+        message,
+        entity: key,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/skills/chant-terraform.md

@@ -33,7 +33,7 @@ export default {
 
 ## What a build produces
 
-Every block of every configured root becomes one entity, keyed `<root>/<address>`: `terraform { }` -> `Terraform::Terraform`, `provider "x" {}` -> `Terraform::Provider`, `resource "x" "y" {}` -> `Terraform::Resource`, `data "x" "y" {}` -> `Terraform::Data`, `module "x" {}` -> `Terraform::Module`, `variable "x" {}` -> `Terraform::Variable`, `output "x" {}` -> `Terraform::Output`, `locals {}` -> `Terraform::Locals`. Each carries `props.address`, `props.body` (the block, verbatim), `props.file` and `props.root`. A root whose `dir` doesn't exist, or whose HCL the parser refuses, warns and contributes no entities — the rest of the build is unaffected.
+Every block of every configured root becomes one entity, keyed `<root>/<address>`: `terraform { }` -> `Terraform::Terraform`, `provider "x" {}` -> `Terraform::Provider`, `resource "x" "y" {}` -> `Terraform::Resource`, `data "x" "y" {}` -> `Terraform::Data`, `module "x" {}` -> `Terraform::Module`, `variable "x" {}` -> `Terraform::Variable`, `output "x" {}` -> `Terraform::Output`, `locals {}` -> `Terraform::Locals`, `moved {}` -> `Terraform::Moved`, `import {}` -> `Terraform::Import`, `removed {}` -> `Terraform::Removed`, `check "x" {}` -> `Terraform::Check`. Each carries `props.address`, `props.body` (the block, verbatim), `props.file` and `props.root`. A root whose `dir` doesn't exist, or whose HCL the parser refuses, warns and contributes no entities — the rest of the build is unaffected.
 
 ## The one thing to check before anything else
 

package/dist/state/azure-blob.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The Azure Blob Storage client an azurerm backend's state uses: chant
+ * core's (#4554, `@intentius/chant/object-store`): a blob's properties and
+ * metadata, a snapshot, a block blob put, and the blob lease the backend
+ * locks a state with, signed with Shared Key, a SAS, or an Entra token for
+ * the job's OIDC identity.
+ */
+export { AZURE_AUTHORITY, AZURE_VERSION, AzureBlobClient, sharedKey, type AzureLocation, type AzureOidc, type AzureTarget, type BlobHead } from "@intentius/chant/object-store";
+//# sourceMappingURL=azure-blob.d.ts.map

package/dist/state/azure-blob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-blob.d.ts","sourceRoot":"","sources":["../../src/state/azure-blob.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/state/azure-blob.js

@@ -0,0 +1,8 @@
+/**
+ * The Azure Blob Storage client an azurerm backend's state uses: chant
+ * core's (#4554, `@intentius/chant/object-store`): a blob's properties and
+ * metadata, a snapshot, a block blob put, and the blob lease the backend
+ * locks a state with, signed with Shared Key, a SAS, or an Entra token for
+ * the job's OIDC identity.
+ */
+export { AZURE_AUTHORITY, AZURE_VERSION, AzureBlobClient, sharedKey } from "@intentius/chant/object-store";

package/dist/state/backend.d.ts

@@ -0,0 +1,158 @@
+import { type AzureOidc } from "./azure-blob.js";
+import { type GcsTarget } from "./gcs.js";
+import { type S3Target } from "./s3.js";
+/** The backend `init` recorded: its type and configuration. */
+export interface InitialisedBackend {
+    type: string;
+    config: Record<string, unknown>;
+}
+/** A state in an S3 bucket. */
+export interface S3State {
+    backend: "s3";
+    bucket: string;
+    key: string;
+    region: string;
+    endpoint?: string;
+    /** `use_lockfile = true`: the backend locks with `<key>.tflock` beside the state. */
+    lockfile: boolean;
+    target: S3Target;
+}
+/** A state in a GCS bucket: `<prefix>/<workspace>.tfstate`, locked by `<prefix>/<workspace>.tflock`. */
+export interface GcsState {
+    backend: "gcs";
+    bucket: string;
+    key: string;
+    lock: string;
+    target: GcsTarget;
+}
+/** How a request to Azure Blob Storage is authorized: an account key, a SAS, or the job's OIDC identity. */
+export type AzureAuth = {
+    accountKey: string;
+} | {
+    sas: string;
+} | {
+    oidc: AzureOidc;
+};
+/** A state blob in an Azure storage container, locked by a lease on it. */
+export interface AzureState {
+    backend: "azurerm";
+    account: string;
+    container: string;
+    key: string;
+    /** The backend snapshots the blob before each write (`snapshot = true`). */
+    snapshot: boolean;
+    /** The account's blob endpoint. */
+    endpoint: string;
+    auth: AzureAuth;
+}
+/** A local state file, its path relative to the root (or absolute). */
+export interface LocalState {
+    backend: "local";
+    path: string;
+}
+/** Why chant does not lock or write a root's state. */
+export type StateRefusalKind = "cloud" | "no-lockfile" | "backend" | "config" | "credentials" | "disagree";
+export interface StateRefusal {
+    backend: string;
+    refused: StateRefusalKind;
+    reason: string;
+}
+/** Where a root's state lives, or why chant does not lock it. */
+export type StateObject = S3State | GcsState | AzureState | LocalState | StateRefusal;
+/** A state in a bucket or a container. */
+export type StoredState = S3State | GcsState | AzureState;
+/** A state chant locks and writes. */
+export type LockableState = StoredState | LocalState;
+export declare const isRefused: (o: StateObject) => o is StateRefusal;
+/** Whether the state is in a bucket or a container: s3, gcs or azurerm. */
+export declare const isStored: (o: StateObject) => o is StoredState;
+/** The backend types whose state chant locks and writes itself, s3 only with `use_lockfile = true` (#4437). The one list (chant#4478). */
+export declare const LOCKABLE_BACKENDS: readonly string[];
+/** What a refusal says chant locks, spelled from {@link LOCKABLE_BACKENDS}. */
+export declare const LOCKS: string;
+/** The root's data dir: `TF_DATA_DIR` (relative to the root, as the binary run with `-chdir` reads it), else `.terraform`. */
+export declare function dataDir(dir: string, env?: NodeJS.ProcessEnv): string;
+/** The backend `init` recorded for the root, or undefined when it has not been initialised with one. */
+export declare function initialisedBackend(dir: string, env?: NodeJS.ProcessEnv): InitialisedBackend | undefined;
+/** The workspace the binary runs in: `TF_WORKSPACE`, else the one `workspace select` recorded, else `default`. */
+export declare function workspaceOf(dir: string, env?: NodeJS.ProcessEnv): string;
+/** The S3 key of a workspace's state, as the S3 backend names it: the key in `default`, else `<workspace_key_prefix>/<workspace>/<key>`. */
+export declare function s3StateKey(key: string, workspace: string, prefix?: string): string;
+/**
+ * Whether the root's code has a `cloud` block, over the configuration files
+ * `binary` reads: `.tf` and `.tf.json`, plus `.tofu` and `.tofu.json` for a
+ * tofu or choudoufu root, from the lexicon's one lister (chant#4457).
+ */
+export declare function hasCloudBlock(dir: string, binary?: string): boolean;
+/** Where a root's backend is read from, before `init` runs. */
+export interface DeclaredBackendInput {
+    /** `terraform.roots.<name>.backendConfig`: the `-backend-config` pairs chant's own init passes, last. */
+    backendConfig?: Readonly<Record<string, string>>;
+    /** `terraform.roots.<name>.backendConfigFiles`: the backend-config files chant's own init passes before the pairs (chant#4459), relative to the root. */
+    backendConfigFiles?: readonly string[];
+    /** The job's environment: its `TF_CLI_ARGS` and `TF_CLI_ARGS_init` may carry `-backend-config` flags. */
+    env?: NodeJS.ProcessEnv;
+    /** `terraform.binary`, which says which of the root's files are its code (chant#4457). */
+    binary?: string;
+}
+/** The `-backend-config` flags in `TF_CLI_ARGS` then `TF_CLI_ARGS_init`, in order: `key=value` pairs, and the paths of backend-config files. */
+export declare function cliBackendConfig(env?: NodeJS.ProcessEnv): {
+    pairs: Record<string, string>;
+    files: string[];
+    ordered: Array<{
+        file: string;
+    } | {
+        key: string;
+        value: string;
+    }>;
+};
+/**
+ * The backend the root's code declares, with the `-backend-config` flags of
+ * `TF_CLI_ARGS`, `TF_CLI_ARGS_init` and then `backendConfig` over it, in the
+ * order init applies them: what `init` would record, as far as chant can read
+ * it before init runs. A `cloud` block is `{ type: "cloud" }`. Undefined when
+ * the code declares neither, which init records as no backend (local).
+ */
+export declare function declaredBackend(dir: string, input?: DeclaredBackendInput): InitialisedBackend | undefined;
+/** A root's backend as both sources give it, and the one the verdict reads. */
+export interface BackendReading {
+    /** From the root's code and the `-backend-config` flags, before init. */
+    declared?: InitialisedBackend;
+    /** What `init` recorded. */
+    recorded?: InitialisedBackend;
+    /** The recorded backend when there is one, else the declared one, else local. */
+    backend: InitialisedBackend;
+    /** Why the two disagree, naming both, when both exist and they do. */
+    disagreement?: string;
+}
+/** Where a root's backend is read from: {@link DeclaredBackendInput}, plus what `init` recorded, which the root's data dir holds unless given. */
+export interface ReadBackendInput extends DeclaredBackendInput {
+    /** What `init` recorded; `null` for none. Read from the root's data dir when absent. */
+    recorded?: InitialisedBackend | null;
+}
+/**
+ * A root's backend from its code and flags and from what `init` recorded,
+ * compared (chant#4478). They disagree when both exist and name another type,
+ * or when a key both give a plain value has two values; a key only one side
+ * gives (a default init filled in, a value from a backend-config file chant
+ * did not read) is no disagreement. Code that declares no backend leaves the
+ * record to stand.
+ */
+export declare function readBackend(dir: string, input?: ReadBackendInput): BackendReading;
+/**
+ * Whether chant can lock the root's state, from one {@link BackendReading}:
+ * undefined when it can, else the refusal and why. The one verdict the
+ * composition's `backend` fallback (#4438) and the state refusals (#4437)
+ * both give (chant#4478).
+ */
+export declare function lockRefusal(reading: BackendReading): StateRefusal | undefined;
+/**
+ * Where the root's state is, or why chant does not lock it, from
+ * {@link readBackend}: what `init` recorded (`backend` stands in for it),
+ * compared with the root's code, `backendConfigFiles` and `backendConfig`. A root neither declares
+ * nor records a backend for reads as a local one.
+ */
+export declare function stateObject(dir: string, env?: NodeJS.ProcessEnv, backend?: InitialisedBackend | undefined, binary?: string, flags?: Pick<DeclaredBackendInput, "backendConfig" | "backendConfigFiles">): StateObject;
+/** `s3://<bucket>/<key>`, `gs://<bucket>/<key>`, `az://<account>/<container>/<key>`, or the local file's path; undefined for a refusal. */
+export declare function stateLocation(o: StateObject): string | undefined;
+//# sourceMappingURL=backend.d.ts.map

package/dist/state/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/state/backend.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACrD,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,MAAM,CAAC;AAKhD,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,+BAA+B;AAC/B,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,4GAA4G;AAC5G,MAAM,MAAM,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvF,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,UAAU,CAAC;AAE3G,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;AAEtF,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE1D,sCAAsC;AACtC,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;AAErD,eAAO,MAAM,SAAS,MAAO,WAAW,KAAG,CAAC,IAAI,YAA8B,CAAC;AAE/E,2EAA2E;AAC3E,eAAO,MAAM,QAAQ,MAAO,WAAW,KAAG,CAAC,IAAI,WAAqD,CAAC;AAErG,0IAA0I;AAC1I,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAsC,CAAC;AAEtF,+EAA+E;AAC/E,eAAO,MAAM,KAAK,QAGd,CAAC;AAIL,8HAA8H;AAC9H,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIjF;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,GAAG,SAAS,CAYpH;AAED,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQrF;AAED,4IAA4I;AAC5I,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,GAAG,MAAM,CAElF;AASD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAmBnE;AAID,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,yGAAyG;IACzG,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,yJAAyJ;IACzJ,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,yGAAyG;IACzG,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD,gJAAgJ;AAChJ,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAwBnL;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,kBAAkB,GAAG,SAAS,CA6C7G;AAOD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,iFAAiF;IACjF,OAAO,EAAE,kBAAkB,CAAC;IAC5B,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,kJAAkJ;AAClJ,MAAM,WAAW,gBAAiB,SAAQ,oBAAoB;IAC5D,wFAAwF;IACxF,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,gBAAqB,GAAG,cAAc,CAmBrF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,GAAG,SAAS,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,kBAAkB,GAAG,SAAwC,EACtE,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,GAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,oBAAoB,CAAM,GAC7E,WAAW,CA4Cb;AAmED,2IAA2I;AAC3I,wBAAgB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAMhE"}