@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/dist/op/activities/terraform.d.ts

@@ -4,9 +4,8 @@
  *
  * Shaped after `lexicons/k3s/src/op/activities/k3s.ts`: `promisify(exec)` with
  * the caller's `AbortSignal` forwarded so a local timeout or Ctrl-C kills the
- * child, `safeHeartbeat` on an interval around the long calls, and every
- * command and environment string produced by a pure exported function so a
- * test can assert on it without running terraform.
+ * child, and every command and environment string produced by a pure exported
+ * function so a test can assert on it without running terraform.
  *
  * Two invariants hold for every call:
  *
@@ -18,15 +17,61 @@
  *     (terraform answers `flag provided but not defined: -input`), so it
  *     carries the environment variable alone.
  *
- * `terraformApply` takes a saved plan file and nothing else. A bare apply
- * re-plans at apply time, which is exactly the gap an approval gate exists to
- * close, so it is refused rather than offered.
+ * `terraformApply` takes a saved plan file and nothing else on a stock root,
+ * since a bare apply re-plans at apply time, which is exactly the gap an
+ * approval gate exists to close, so it is refused rather than offered. On a
+ * live root (#2103, `terraform.binary: "choudoufu"` plus a declared estate)
+ * it is the opposite: choudoufu refuses a plan file by design, so
+ * `terraformApply` refuses one there and runs a bare `apply -auto-approve`
+ * instead.
+ *
+ * `choudoufuLivePlan`, `choudoufuLiveLs` and `choudoufuLiveCheck` (#2103) are
+ * choudoufu-only activities living in this same module for the same reason
+ * the four above do: pure command builders, the `promisify(exec)` shape, and
+ * no dependency on the lexicon's HCL parse. `./live-detect.ts` is a
+ * deliberately separate, cheap regex-based read of "does this root declare a
+ * live estate," used only to decide how `terraformApply` reads a non-zero
+ * exit and to
+ * auto-detect `-estate` for the two live-only reads that need it; the
+ * accurate, AST-based version lives in `../../hcl/parse.ts` and stays out of
+ * this module's dependency graph. `choudoufu version` is checked once per
+ * module load (`ensureChoudoufuVersion`) and refuses a binary older than
+ * {@link MIN_CHOUDOUFU_VERSION}.
  */
 import type { TerraformConfig, TerraformRootConfig } from "../../config.js";
+import { type AdoptionCandidate } from "../adoption.js";
 /** Plan file written into the root directory when a step names none. */
 export declare const DEFAULT_PLAN_FILE = "chant.tfplan";
 /** Binary used when the `terraform` namespace records no preference. */
 export declare const DEFAULT_TERRAFORM_BINARY = "terraform";
+/** Where {@link choudoufuLivePlan} writes GitHub issue #788's JSON document, relative to the root directory. */
+export declare const DEFAULT_LIVE_PLAN_DOCUMENT_FILE = "chant.live-plan.json";
+/**
+ * choudoufu below this refuses. v0.12.0 brought `live-plan -json`, `live-ls`
+ * and `live-check -json` (#2103); v0.13.0 brought the approval artifact
+ * ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878), PR
+ * 889): under a live block `plan -out=FILE` is accepted and `apply FILE`
+ * re-plans the live system and refuses on a mismatch with exit status 3.
+ * {@link terraformApply} depends on that refusal existing, so the floor is
+ * the release that shipped it rather than the one before.
+ */
+export declare const MIN_CHOUDOUFU_VERSION = "0.13.0";
+/**
+ * choudoufu's own refusal summary for `-out` on the `live-plan -estate`
+ * surface (`internal/command/live_mode.go`). That is the one surface where a
+ * saved plan file is still refused: a directory reached through `-estate` has
+ * no `live` block, so plain `plan` and `apply` there are ordinary state-backed
+ * commands and a file written from this form would be applied by something
+ * that never heard of the estate. Under a `live` block `plan -out` is
+ * accepted (choudoufu #878).
+ */
+export declare const CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL = "Saved plan files are not available under live resource markers";
+/** Exit status choudoufu's approval refusals carry: not 1 (any ordinary failure), not 2 (`-detailed-exitcode`). */
+export declare const CHOUDOUFU_APPROVAL_EXIT_CODE = 3;
+/** Summary line of choudoufu's refusal when the fresh live plan differs from the approved plan file. */
+export declare const CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL = "The approved plan no longer matches the live system";
+/** Summary line of choudoufu's sibling refusal when the plan file was produced against another estate. */
+export declare const CHOUDOUFU_WRONG_ESTATE_REFUSAL = "The approved plan belongs to a different estate";
 /** Fields every activity here takes: which root, and where the project is. */
 export interface TerraformRootArgs {
     /**
@@ -55,16 +100,73 @@ export interface TerraformPlanArgs extends TerraformRootArgs {
 }
 export interface TerraformApplyArgs extends TerraformRootArgs {
     /**
-     * The saved plan file to apply, relative to the root directory — normally
+     * The saved plan file to apply, relative to the root directory, normally
      * `plan.out.planFile`, the Plan step's own output. Required: this activity
-     * has no bare-apply mode.
+     * applies a saved plan and has no bare-apply mode, on either kind of root.
+     *
+     * On a live root this file is the approval artifact
+     * [choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878) asked
+     * for, in the stock form choudoufu v0.13.0 shipped (PR 889). `plan -out`
+     * writes stock's own plan file; `apply <planfile>` never replays it, and
+     * never reads it as prior state or as an ownership answer. It re-plans
+     * against the live system the way every live-markers run does, then
+     * compares its fresh plan with the file's, down to the planned values, and
+     * refuses with exit status 3 when they differ. So the seam #2106 left named
+     * and unused on these args is now this field itself, and there is nothing
+     * separate to pass.
      */
-    planFile: string;
+    planFile?: string;
 }
 export interface TerraformShowArgs extends TerraformRootArgs {
     /** Show this saved plan file. Omitted, the activity shows current state. */
     planFile?: string;
 }
+export interface ChoudoufuLivePlanArgs extends TerraformRootArgs {
+    /**
+     * The estate whose ownership markers this run looks for (`-estate`).
+     * Omitted, it is auto-detected from the root's `live` block or
+     * `estate.chdf.hcl` sidecar, the same estate the root's own configuration
+     * declares, which is what a live root's every other activity assumes too.
+     */
+    estate?: string;
+    /**
+     * Render the human half as choudoufu's adoption ledger (`-adoption-only`)
+     * instead of the ordinary plan (#2105).
+     *
+     * This activity already makes two live reads, one for the `-json` document
+     * and one for the human render, because the document carries no rendering of
+     * the plan itself. This flag changes only the second of them, which is what
+     * makes it possible at all: choudoufu refuses `-adoption-only` and `-json` on
+     * one invocation ("this run cannot produce both reports at once"), so the two
+     * reports have to come from two runs whether or not chant wants both. The
+     * cost is that the second read asks the estate-wide sweep the account-bounded
+     * question ("which live resources carry no ownership marker at all"), so it
+     * is slower than the ordinary render, not faster.
+     */
+    adoptionOnly?: boolean;
+}
+export interface ChoudoufuLiveLsArgs extends TerraformRootArgs {
+    /** The estate to list (`-estate`). Omitted, auto-detected the same way {@link ChoudoufuLivePlanArgs.estate} is. */
+    estate?: string;
+    /** `-consistent`: poll past the Resource Groups Tagging API's eventual-consistency window. */
+    consistent?: boolean;
+}
+export type ChoudoufuLiveCheckArgs = TerraformRootArgs;
+export interface ChoudoufuAdoptArgs extends TerraformRootArgs {
+    /**
+     * The adoptable matches to claim, normally `ledger.out.adoptions` from a
+     * {@link choudoufuLivePlan} step run with `adoptionOnly`. Each carries the
+     * two marker values and, where choudoufu printed one, the tagging command
+     * that writes them.
+     */
+    adoptions: AdoptionCandidate[];
+    /**
+     * The contested candidates the same ledger refused, normally
+     * `ledger.out.contested`. Passed in so the Op's result names what was not
+     * adopted and why, beside what was; nothing here is ever written.
+     */
+    contested?: AdoptionCandidate[];
+}
 /** What {@link terraformInit} resolved. */
 export interface TerraformInitResult {
     /** Absolute path of the root module directory that was initialized. */
@@ -94,14 +196,148 @@ export interface TerraformPlanResult extends PlanChangeCounts {
     /** `terraform show -no-color <planFile>` — the human-readable plan. */
     text: string;
 }
+/**
+ * Why a live apply refused the approval artifact it was handed. Both are
+ * choudoufu's exit status 3, which is neither 1 (any ordinary failure, which
+ * a pipeline must not route back to a reviewer) nor `-detailed-exitcode`'s 2.
+ *
+ *   - `"approval-mismatch"`: the fresh live plan's change set or planned
+ *     values differ from the approved file's.
+ *   - `"wrong-estate"`: the file was produced from a configuration naming
+ *     another estate.
+ */
+export type TerraformApprovalRefusal = "approval-mismatch" | "wrong-estate";
 /** What {@link terraformApply} resolved. */
 export interface TerraformApplyResult {
-    /** The plan file that was applied. */
-    planFile: string;
+    /** The plan file that was applied, or that was refused. */
+    planFile?: string;
     /** Absolute path of the root module directory. */
     dir: string;
-    /** Always `true` on success; the activity throws otherwise. */
+    /** `true` when the plan was applied. `false` exactly when {@link refused} is set. */
     applied: boolean;
+    /**
+     * Set when a live apply refused the approval artifact (choudoufu exit 3).
+     * This is a result, not a thrown error, so a workflow can route the run
+     * back to review instead of treating it as a broken step.
+     */
+    refused?: TerraformApprovalRefusal;
+    /** choudoufu's own refusal text, verbatim, when {@link refused} is set. */
+    refusal?: string;
+}
+/** Counts projected out of `live-plan -json`'s `unowned` section. */
+export interface LivePlanUnownedCounts {
+    /** Live resources at a declared identity carrying no ownership marker for this estate. */
+    unowned: number;
+    /** Of those, how many an exact content match makes adoptable. */
+    adoptable: number;
+}
+/**
+ * What {@link choudoufuLivePlan} resolved. `adds`/`changes`/`destroys` (#2106,
+ * {@link PlanChangeCounts}) are parsed off the human-readable render's own
+ * "Plan: N to add, N to change, N to destroy." summary line
+ * ({@link parseChoudoufuPlanSummary}), not off GitHub issue #788's JSON
+ * document: that document is deliberately scoped to the three sections a
+ * stock plan's `-json` has no notion of at all (`bound`, `omissions`,
+ * `unowned`; `internal/command/views/live_plan.go`'s own `LivePlanDocument`
+ * doc comment says as much — "the stock plan's -json...can stay separate")
+ * and carries no resource-change diff of its own. The ordinary create/change/
+ * destroy diff — including the delete choudoufu's own `undeclared_tagged`
+ * quadrant folds into it for an orphaned marked resource, per that same
+ * file's `StatelessRemoval` doc comment ("the plan's own resource diff
+ * carries the destroy itself for those") — renders only in the human form,
+ * the same summary line a stock `terraform plan` prints
+ * (`internal/command/views/operation_test.go`'s own fixtures confirm the
+ * exact wording), which is why the human run's text, already fetched here for
+ * the approver to read, is what this activity parses instead of the JSON.
+ */
+export interface ChoudoufuLivePlanResult extends LivePlanUnownedCounts, PlanChangeCounts {
+    /** `true` when `-detailed-exitcode` reported exit 2: the live plan proposes changes. */
+    drift: boolean;
+    /** GitHub issue #788's JSON document (`bound`, `omissions`, `unowned`), captured whole. */
+    json: unknown;
+    /**
+     * The human-readable plan, from a second `live-plan` run without `-json`
+     * (the document carries no render of it) — or, under
+     * {@link ChoudoufuLivePlanArgs.adoptionOnly}, choudoufu's own adoption ledger.
+     */
+    text: string;
+    /**
+     * chant's rendering of the adoption ledger over the `-json` document
+     * (#2105): one line per adoptable match with its address, its live identity
+     * and the two marker values, then any contested address, listed and never
+     * offered. Present on every run, `-adoption-only` or not, since it is a
+     * projection of the document rather than a second report.
+     */
+    ledger: string;
+    /**
+     * What a finding mode posts: {@link ChoudoufuLivePlanResult.text} and then
+     * {@link ChoudoufuLivePlanResult.ledger}. The one field an issue or PR body
+     * references, so that the JSON document has no path into a body at all.
+     */
+    finding: string;
+    /** Adoptable matches: exactly one live resource at the declared address, with the marker pair that claims it. */
+    adoptions: AdoptionCandidate[];
+    /** Every candidate at a declared address more than one live resource sits at. Never adoptable. */
+    contested: AdoptionCandidate[];
+    /** How many declared addresses are contested — the count `contested` above spells out. */
+    ambiguous: number;
+    /** Absolute path of the root module directory. */
+    dir: string;
+    /** Where the JSON document was written, relative to `dir`; {@link DEFAULT_LIVE_PLAN_DOCUMENT_FILE} unless overridden. */
+    documentPath: string;
+    /** The estate this plan ran against. */
+    estate: string;
+}
+/** What {@link choudoufuLiveLs} resolved. */
+export interface ChoudoufuLiveLsResult {
+    /** The `-json` listing, parsed: every resource the account holds under the estate. */
+    json: unknown;
+    /** Absolute path of the root module directory (`live-ls` needs no configuration, but this activity still runs in it). */
+    dir: string;
+    /** The estate that was listed. */
+    estate: string;
+}
+/** One adoption {@link choudoufuAdopt} declined, with the reason an operator acts on. */
+export interface AdoptionRefusal {
+    /** The declared instance address that was not claimed. */
+    addr: string;
+    /** The live resource's identity, when the refusal is about a particular one. */
+    identity: string;
+    /** Why, in a sentence, always naming the two marker values a hand-write would need. */
+    reason: string;
+}
+/** What {@link choudoufuAdopt} resolved. */
+export interface ChoudoufuAdoptResult {
+    /**
+     * How the markers were written. Only `"tag-write"` today; the field exists
+     * because #2105 weighed a second mechanism (choudoufu's `adopt` policy verb)
+     * and a later run of this activity should say which one it used rather than
+     * leave a reader to infer it from the absence of a field. See the activity's
+     * own doc for why the policy verb is not reachable from outside the
+     * configuration.
+     */
+    mechanism: "tag-write";
+    /** The declared addresses whose live resources now carry this estate's markers. */
+    adopted: string[];
+    /** `adopted.length`, as a scalar an outcome attribute can carry. */
+    adoptedCount: number;
+    /** Every candidate this run declined, contested addresses included, with the reason. */
+    refused: AdoptionRefusal[];
+    /** How many declared addresses were contested — never adopted, always reported. */
+    ambiguous: number;
+    /** Absolute path of the root module directory. */
+    dir: string;
+}
+/** What {@link choudoufuLiveCheck} resolved. */
+export interface ChoudoufuLiveCheckResult {
+    /** `true` when the configuration is refused under live resource markers (a non-zero exit). */
+    refused: boolean;
+    /** GitHub issue #790's declared roster, parsed, when the output could be parsed as JSON. */
+    json: unknown;
+    /** The raw `-json` output. */
+    text: string;
+    /** Absolute path of the root module directory. */
+    dir: string;
 }
 /** What {@link terraformShow} resolved. */
 export interface TerraformShowResult extends PlanChangeCounts {
@@ -149,11 +385,56 @@ export declare function terraformPlanCommand(opts: {
     varFiles?: string[];
     destroy?: boolean;
 }): string;
-/** `terraform apply <planFile>` — a saved plan, never a bare apply. */
+/**
+ * `terraform apply <planFile>` — a saved plan, never a bare apply. The same
+ * command on a live root: choudoufu v0.13.0 admits a plan file under a `live`
+ * block, and a matched one applies without re-prompting, exactly as stock's
+ * own `apply <planfile>` does, so no `-auto-approve` is needed or passed.
+ */
 export declare function terraformApplyCommand(opts: {
     binary: string;
     planFile: string;
 }): string;
+/**
+ * `live-plan -detailed-exitcode -json -estate=<estate>`. `-json` is what
+ * prints GitHub issue #788's document instead of the plan; the human render
+ * needs a second invocation without it (see {@link choudoufuLivePlan}).
+ *
+ * `adoptionOnly` makes that second invocation print the adoption ledger and
+ * nothing else (GitHub issue #587). It is refused here alongside `json`
+ * because choudoufu refuses the pair itself, and a builder that emitted a
+ * command the binary rejects would move the error to the far side of a
+ * process spawn for no gain.
+ */
+export declare function choudoufuLivePlanCommand(opts: {
+    binary: string;
+    estate: string;
+    json: boolean;
+    adoptionOnly?: boolean;
+    noColor?: boolean;
+}): string;
+/** `live-ls -estate=<estate> -json [-consistent]`. */
+export declare function choudoufuLiveLsCommand(opts: {
+    binary: string;
+    estate: string;
+    consistent?: boolean;
+}): string;
+/**
+ * `live-check -json`. No `DIR` argument: the activity already runs in the
+ * root directory (`cwd`), so `-json` alone checks it, since DIR defaults to
+ * `.`. Makes no cloud calls; a non-zero exit is a refusal, not a failure this
+ * builder's caller need distinguish from one.
+ */
+export declare function choudoufuLiveCheckCommand(opts: {
+    binary: string;
+}): string;
+/**
+ * Project `live-plan -json`'s `unowned` section into counts: how many live
+ * resources at a declared identity carry no ownership marker for this
+ * estate, and of those, how many an exact content match makes adoptable
+ * (`adopt_tofu_estate`/`adopt_tofu_address` present).
+ */
+export declare function countLivePlanUnowned(document: unknown): LivePlanUnownedCounts;
 /**
  * `terraform show`. The one command here that takes no `-input` flag
  * (terraform answers `flag provided but not defined: -input`), so automation
@@ -171,6 +452,30 @@ export declare function terraformShowCommand(opts: {
  * counts as one add and one destroy, exactly as terraform reports it.
  */
 export declare function countPlanChanges(planJson: unknown): PlanChangeCounts;
+/**
+ * Parse the ordinary "Plan: N to add, N to change, N to destroy." (or "...N
+ * to import, N to add...") summary line out of a human-readable `live-plan`
+ * render (#2106). "No changes." — the exit-0 case — matches nothing and
+ * reads as zero on every count, the same conservative default
+ * {@link countPlanChanges} falls back to on a shape it does not recognize.
+ */
+export declare function parseChoudoufuPlanSummary(text: string): PlanChangeCounts;
+/** Whether `version` is strictly older than `min`, comparing `major.minor.patch` numerically. */
+export declare function isOlderVersion(version: string, min: string): boolean;
+/**
+ * Extract the release version from `choudoufu version`'s human-readable
+ * output: `"choudoufu v0.12.0 (based on OpenTofu v1.13.0)\non darwin_arm64"`.
+ * `choudoufu version -json`'s `terraform_version` field is the wrong number
+ * here: it names the upstream OpenTofu base this build forked from, not the
+ * choudoufu release itself (`internal/command/views/version.go`), so this
+ * reads the human form's `choudoufu vX.Y.Z` prefix instead. A dev build with
+ * no release tag baked in (`version.Fork` unset) prints only the upstream
+ * line and carries no choudoufu version to check at all: `undefined` here,
+ * same as an output this cannot parse.
+ */
+export declare function parseChoudoufuVersion(versionOutput: string): string | undefined;
+/** Test-only: clear the cached version check so a test can simulate a fresh module load. */
+export declare function __resetChoudoufuVersionCheckForTests(): void;
 /**
  * `terraform init` in the named root, with the root's `backendConfig` supplied
  * as `-backend-config` flags. Uses the longInfra profile: init downloads
@@ -192,10 +497,30 @@ export declare function terraformInit(args: TerraformInitArgs, signal?: AbortSig
  */
 export declare function terraformPlan(args: TerraformPlanArgs, signal?: AbortSignal): Promise<TerraformPlanResult>;
 /**
- * `terraform apply <planFile>` in the named root. A saved plan only: without
- * one, apply re-plans at apply time and acts on something no gate ever saw,
- * so a missing `planFile` is refused here rather than quietly widened into a
- * bare apply.
+ * Which of choudoufu's two approval refusals an exit-3 apply printed, or
+ * `undefined` when the output carries neither summary line. Reads both the
+ * stderr the diagnostic is written to and the stdout the fresh plan is
+ * rendered on, since the two travel separately.
+ */
+export declare function classifyApprovalRefusal(output: string): TerraformApprovalRefusal | undefined;
+/**
+ * `terraform apply <planFile>` in the named root, on a stock root and on a
+ * live one alike.
+ *
+ * Neither kind has a bare-apply mode here: without a saved `planFile`, apply
+ * re-plans at apply time and acts on something no gate ever saw, so a missing
+ * one is refused before the CLI runs. choudoufu v0.13.0 is what makes the
+ * live half of that true (choudoufu #878, PR 889): `plan -out` is accepted
+ * under a `live` block, and `apply <planfile>` re-plans against the live
+ * system, compares its fresh plan with the file's down to the planned values,
+ * and applies only when they agree.
+ *
+ * When they do not, choudoufu exits **3**, neither 1 (any ordinary failure)
+ * nor `-detailed-exitcode`'s 2, with one of two named refusals. That is an
+ * answer rather than a breakage, so it comes back as a result (`refused`,
+ * `refusal`) instead of a thrown error, and a workflow can route the run back
+ * to review. Exit 3 is read this way only on a live root; on a stock root
+ * nothing produces it and every non-zero exit stays a failure.
  *
  * Uses the longInfra profile.
  */
@@ -210,4 +535,107 @@ export declare function terraformApply(args: TerraformApplyArgs, signal?: AbortS
  * provider.
  */
 export declare function terraformShow(args: TerraformShowArgs, signal?: AbortSignal): Promise<TerraformShowResult>;
+/**
+ * `choudoufu live-plan -detailed-exitcode -json -estate=<estate>`, plus a
+ * second `live-plan` without `-json` for the human-readable render. GitHub
+ * issue #788's JSON document carries no render of the plan itself
+ * (`views.LivePlanDocument` has no such field), so unlike `terraformPlan`'s
+ * single saved artifact this genuinely needs two live reads.
+ *
+ * The exit code is the answer, exactly as `terraformPlan`'s is: 0 is no
+ * drift, 2 is drift, and anything else is a failure thrown with choudoufu's
+ * own stderr attached. The JSON document is written to `documentPath` (under
+ * `dir`) for a later step or reviewer to open directly.
+ *
+ * Uses the longInfra profile: like `terraformPlan`, this reads the live
+ * system in full (the estate-wide sweep).
+ */
+/**
+ * The JSON document within a `live-plan -json` stdout: everything from the
+ * first line that is a bare `{` to the end. Stock keeps stdout to the
+ * document; choudoufu's `-estate` path precedes it with refresh progress
+ * lines (choudoufu #894). Returns the input unchanged when no such line
+ * exists, so a clean stdout parses as before and a broken one fails in
+ * `JSON.parse` with the real text in the error.
+ */
+export declare function liveDocumentFrom(stdout: string): string;
+export declare function choudoufuLivePlan(args: ChoudoufuLivePlanArgs & {
+    documentPath?: string;
+}, signal?: AbortSignal): Promise<ChoudoufuLivePlanResult>;
+/**
+ * `choudoufu live-ls -estate=<estate> -json [-consistent]`: every resource
+ * the account holds under the estate, read straight from the Resource Groups
+ * Tagging API. No configuration, state or record store is read.
+ *
+ * Uses the fastIdempotent profile: like `terraformShow`, this reads an
+ * artifact-shaped answer and does not plan.
+ */
+export declare function choudoufuLiveLs(args: ChoudoufuLiveLsArgs, signal?: AbortSignal): Promise<ChoudoufuLiveLsResult>;
+/**
+ * Claim the adoptable matches an adoption ledger found, by writing the two
+ * ownership markers onto each live resource (#2105).
+ *
+ * ## Why a tag write and not a policy verb
+ *
+ * choudoufu's `policy` block has an `adopt` verb for exactly this cell
+ * (`declared_untagged`), and `site/content/docs/use/migrate.md` names
+ * `policy { declared_untagged = "adopt" }` as the way to adopt a whole estate
+ * at once instead of one resource at a time. That would have been the smaller
+ * write: one apply, no tagging calls of chant's own. It is not reachable from
+ * outside the configuration, and #2105 checked both ways in:
+ *
+ *   - a `live` block in a terraform override file is dropped in silence.
+ *     `Module.mergeFile` (choudoufu's `internal/configs/module.go`) merges
+ *     backends, cloud blocks, providers and resources from an override file
+ *     and has no `Lives` case at all, so an `override.tf` carrying
+ *     `terraform { live { policy { declared_untagged = "adopt" } } }` changes
+ *     nothing. Measured, not inferred: a policy block with a deliberately
+ *     invalid verb in an override file passes `live-check` clean, and the same
+ *     block in a primary file is refused by name.
+ *   - a second primary file carrying one is refused outright: "A module may
+ *     have only one 'live' block." So is a sidecar beside an in-block form.
+ *
+ * Which leaves editing the root's own checked-in live configuration, running
+ * an apply, and putting it back — a mutation of a reviewed file, with a
+ * failure mode (a run that dies between the two edits) that leaves the estate
+ * declaring "adopt everything declared and unmarked" for every later apply.
+ * chant does not do that to a repository it does not own.
+ *
+ * So the mechanism is the tag write, which choudoufu's own migration guide
+ * calls the whole contract: "There is no `choudoufu adopt` command and no need
+ * for one. Two tags is the whole contract (`live/MARKERS.md`), so any tool
+ * that writes two tags can adopt a resource." The command each write runs is
+ * the paste-ready one choudoufu printed under `live-plan -adoption-only`,
+ * carried on the candidate — built from choudoufu's own provider
+ * configuration, so it lands on the region and endpoint the plan just read
+ * rather than wherever an operator's AWS CLI profile points, and shell-quoted
+ * by choudoufu for exactly this use.
+ *
+ * ## What it refuses
+ *
+ * A candidate with no printed command (a service whose tagging call this fork
+ * does not spell out: IAM, Route53, S3) is refused with its two marker values
+ * named, not guessed at. A contested address — more than one live resource at
+ * one declared identity — is refused because no single tag write claims it;
+ * `contested` is passed in so the Op's own result names what was refused
+ * beside what was written, and nothing in this function can adopt one, since
+ * `readAdoptionLedger` never puts a contested candidate in `adoptions`.
+ *
+ * Uses the longInfra profile: one tagging round trip per resource, against the
+ * cloud.
+ */
+export declare function choudoufuAdopt(args: ChoudoufuAdoptArgs, signal?: AbortSignal): Promise<ChoudoufuAdoptResult>;
+/**
+ * `choudoufu live-check -json`: whether the configuration in this root can
+ * move under live resource markers, and what stops it if it cannot. Makes no
+ * cloud calls and needs no `live` block at all, since the check this activity
+ * runs works on any configuration, which is why it needs no `estate`.
+ *
+ * A non-zero exit is a refusal choudoufu reports, not a failure of this
+ * activity: `refused: true` carries it back rather than throwing. An abort
+ * or a spawn failure (no numeric exit code) still throws.
+ *
+ * Uses the fastIdempotent profile: no cloud calls, no state.
+ */
+export declare function choudoufuLiveCheck(args: ChoudoufuLiveCheckArgs, signal?: AbortSignal): Promise<ChoudoufuLiveCheckResult>;
 //# sourceMappingURL=terraform.d.ts.map

package/dist/op/activities/terraform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../../src/op/activities/terraform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAczE,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAIpD,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,kCAAkC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1G;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAMT;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,CAYpE;AAsED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAe9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAqC9B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA2B9B"}
+{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../../src/op/activities/terraform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAWrB,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD,gHAAgH;AAChH,eAAO,MAAM,+BAA+B,yBAAyB,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,mEACsB,CAAC;AAEnE,mHAAmH;AACnH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,wGAAwG;AACxG,eAAO,MAAM,mCAAmC,wDAAwD,CAAC;AAEzG,0GAA0G;AAC1G,eAAO,MAAM,8BAA8B,oDAAoD,CAAC;AAIhG,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEvD,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE5E,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB,EAAE,gBAAgB;IACtF,wFAAwF;IACxF,KAAK,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,kGAAkG;IAClG,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yHAAyH;IACzH,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,IAAI,EAAE,OAAO,CAAC;IACd,yHAAyH;IACzH,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,kCAAkC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1G;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAExF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAcT;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAI7G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,qBAAqB,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,CAYpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAMxE;AAgBD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAOpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/E;AA8BD,4FAA4F;AAC5F,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAwED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAoC9B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAI5F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA2B9B;AAmBD;;;;;;;;;;;;;;GAcG;AACH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CA4ElC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA8C/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}