@intentius/chant 0.106.3 → 0.107.1

package/src/lifecycle/gate-ledger.ts

@@ -106,6 +106,23 @@ export function isApprovalUrl(raw: string): boolean {
   }
 }
 
+/**
+ * The answer record a gate that asks a decision point cites (#3170): the
+ * point, the record's id (what `chant workspace points answer` takes) and its
+ * path from the repository root. On a pending fact it is the open question
+ * the run waits on; on a resolution, the answer that passed the gate, with
+ * the answer, the decider that gave it and the people who did.
+ */
+export interface GateAnswerRef {
+  point: string;
+  id: string;
+  path: string;
+  answer?: string | boolean;
+  /** `table`, `model` or `quorum`. */
+  decider?: string;
+  answeredBy?: string[];
+}
+
 /** One immutable gate-resolution record. */
 export interface GateResolutionRecord {
   /** Schema version, so an incompatible future shape is detected before being misread. */
@@ -204,6 +221,13 @@ export interface GateResolutionRecord {
    * verifies. Absent on an unsigned approval.
    */
   seal?: GateApprovalSeal;
+  /**
+   * The answer record that passed the gate, on a gate that asks a decision
+   * point (#3170). The run writes this resolution itself when the point's
+   * question is answered with an answer the gate passes on; the record's
+   * `constrains` names the gate back (`gate:<op>/<gate>`).
+   */
+  answer?: GateAnswerRef;
 }
 
 /** A gate approval's seal (#3163): who signed, the key's fingerprint (reported, never trusted), and the armored signature. */
@@ -283,6 +307,12 @@ export interface PendingGateRecord {
    * the run produced, and `chant operator status` to show quorum progress.
    */
   approval?: ResolvedGateApproval;
+  /**
+   * The open question this gate waits on, on a gate that asks a decision
+   * point (#3170). It is answered with `chant workspace points answer <id>`,
+   * not `chant approve`.
+   */
+  answer?: GateAnswerRef;
 }
 
 export type PendingGateInput = Omit<PendingGateRecord, "version" | "kind">;

package/src/op/activities/apply.test.ts

@@ -749,3 +749,46 @@ describe('defaultOutput (target-aware apply output)', () => {
     expect(defaultOutput('grafana')).toBe('dist/grafana.json');
   });
 });
+
+describe("nativeApply: ruler dispatches to the prometheus lexicon (chant #3372)", () => {
+  const spy = () => {
+    const calls: Array<Parameters<ClickHouseApplier>[0]> = [];
+    const applier: ClickHouseApplier = async (args) => {
+      calls.push(args);
+      return applyResult([{ kind: "RuleGroup", name: "shop/api", action: "created" }]);
+    };
+    return { calls, applier };
+  };
+  const applyRuler = (args: Parameters<typeof nativeApply>[0], applier: ClickHouseApplier) =>
+    nativeApply(args, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, applier);
+
+  test("output maps to the build path, env to the environment, and owned-only prunes", async () => {
+    const { calls, applier } = spy();
+    const result = await applyRuler({ target: "ruler", env: "prod", deleteMode: "owned-only" }, applier);
+    expect(calls).toEqual([{ buildPath: "dist/rules.yml", environment: "prod", prune: true }]);
+    expect(result).toEqual({ applied: 1, pruned: 0, notAttempted: 0 });
+    expect(defaultOutput("ruler")).toBe("dist/rules.yml");
+  });
+
+  test("the default does not prune", async () => {
+    const { calls, applier } = spy();
+    await applyRuler({ target: "ruler", env: "prod" }, applier);
+    expect(calls[0].prune).toBe(false);
+  });
+
+  test("ruler has a native rollback, which re-applies the previous groups", async () => {
+    expect(hasNativeRollback("ruler")).toBe(true);
+    const calls: unknown[] = [];
+    const result = await compensateApply(
+      { target: "ruler", env: "prod", output: "dist/rules.yml" },
+      undefined,
+      undefined,
+      async (args) => {
+        calls.push(args);
+        return { restored: 2, removed: 1, alertmanagerRestored: false, hadSnapshot: true };
+      },
+    );
+    expect(calls).toEqual([{ buildPath: "dist/rules.yml", environment: "prod" }]);
+    expect(result).toEqual({ restored: 2, removed: 1 });
+  });
+});

package/src/op/activities/apply.ts

@@ -28,7 +28,10 @@
  * classified changes need, over its HTTP interface. `postgres` joined after
  * that (#3280): the sql lexicon's `postgresApply`, which sends a Postgres
  * server the statements a build's classified changes need, grouped into
- * transactions, with `CONCURRENTLY` statements outside them.
+ * transactions, with `CONCURRENTLY` statements outside them. `ruler` joined
+ * last (#3372): the prometheus lexicon's `rulerApply`, which posts rule groups
+ * to a Mimir, Cortex or Loki ruler and uploads a Mimir or Cortex Alertmanager
+ * config, inside the namespaces the project declares.
  * **The dispatcher stayed here**, because "which
  * mechanism applies this target" is not any one product's knowledge — and
  * because the activity keeps its name, its arguments and its place in
@@ -48,7 +51,7 @@ import { importLexiconPackage } from "../../lexicon-module";
 const execAsync = promisify(exec);
 
 /** The native apply mechanism for a target. */
-export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "gcp" | "fly" | "grafana" | "clickhouse" | "postgres";
+export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "gcp" | "fly" | "grafana" | "clickhouse" | "postgres" | "ruler";
 
 /**
  * How apply treats resources no longer declared.
@@ -69,7 +72,11 @@ export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "
  *   stack is reported not-prunable), `postgres` drops the objects in the
  *   declared schemas whose comment carries the project's marker (via the sql
  *   lexicon's `postgresApply`; never an object another tool keeps, and a
- *   project with no ownership stack is reported not-prunable), and
+ *   project with no ownership stack is reported not-prunable), `ruler`
+ *   deletes groups the ruler has and the project does not declare, only inside
+ *   the ruler namespaces the profile declares (via the prometheus lexicon's
+ *   `rulerApply`; a namespace the project does not declare is never listed,
+ *   so never touched, unlike `mimirtool rules sync`), and
  *   `cloudformation` is bounded by the stack — which holds, because a
  *   resource CFN did not create is not in the stack.
  * - `gated` — same delete scope as `owned-only`, but an approval gate precedes
@@ -256,6 +263,23 @@ export type ClickHouseApplier = (
  */
 export type PostgresApplier = ClickHouseApplier;
 
+/**
+ * The prometheus lexicon's ruler applier, as this module needs to call it
+ * (#3372): `rulerApply` composed with the lexicon's own `toApplyResult`.
+ *
+ * `environment` selects `prometheus.profiles.<environment>` (else the
+ * `PROMETHEUS_RULER_*` variables), which carries the ruler kind and URL, the
+ * `X-Scope-OrgID` tenant and the declared namespaces. The namespaces are the
+ * ownership boundary: nothing outside them is read, written or deleted.
+ */
+export type RulerApplier = ClickHouseApplier;
+
+/** The prometheus lexicon's ruler rollback, as {@link compensateApply} needs to call it. */
+export type RulerRollback = (
+  args: { buildPath: string; environment?: string },
+  signal?: AbortSignal,
+) => Promise<{ restored: number; removed: number; alertmanagerRestored: boolean; hadSnapshot: boolean }>;
+
 /**
  * The aws lexicon's CloudFormation applier, as this module needs to call it
  * (#1449). Structural, like {@link K8sApplier} and {@link AzureApplier}.
@@ -533,6 +557,51 @@ async function loadPostgresApplier(): Promise<PostgresApplier> {
   return async (args, signal) => toApplyResult(await postgresApply(args, signal));
 }
 
+/**
+ * Load the prometheus lexicon's `rulerApply` (#3372). Same variable-specifier
+ * trick as {@link loadK8sApplier}, for the same reason.
+ */
+async function loadRulerApplier(): Promise<RulerApplier> {
+  const spec = "@intentius/chant-lexicon-prometheus/api/apply";
+  type PromModule = {
+    rulerApply?: (args: { buildPath: string; environment?: string; prune?: boolean }, signal?: AbortSignal) => Promise<unknown>;
+    toApplyResult?: (result: unknown) => ApplyResult;
+  };
+  let mod: PromModule;
+  try {
+    mod = (await importLexiconPackage(spec)) as PromModule;
+  } catch (err) {
+    throw new Error(
+      `apply target "ruler" needs @intentius/chant-lexicon-prometheus, which could not be loaded ` +
+        `(${err instanceof Error ? err.message : String(err)}). Ruler applies go through the prometheus ` +
+        `lexicon's applier (chant #3372); install the prometheus lexicon and list it in chant.config.ts.`,
+    );
+  }
+  const { rulerApply, toApplyResult } = mod;
+  if (typeof rulerApply !== "function" || typeof toApplyResult !== "function") {
+    throw new Error("the installed @intentius/chant-lexicon-prometheus exports no rulerApply — it predates chant #3372");
+  }
+  return async (args, signal) => toApplyResult(await rulerApply(args, signal));
+}
+
+/** Load the prometheus lexicon's `rulerRollback` (#3372), the compensation twin of {@link loadRulerApplier}. */
+async function loadRulerRollback(): Promise<RulerRollback> {
+  const spec = "@intentius/chant-lexicon-prometheus/api/apply";
+  let mod: { rulerRollback?: RulerRollback };
+  try {
+    mod = (await importLexiconPackage(spec)) as { rulerRollback?: RulerRollback };
+  } catch (err) {
+    throw new Error(
+      `rollback for target "ruler" needs @intentius/chant-lexicon-prometheus, which could not be loaded ` +
+        `(${err instanceof Error ? err.message : String(err)}). Install the prometheus lexicon and list it in chant.config.ts.`,
+    );
+  }
+  if (typeof mod.rulerRollback !== "function") {
+    throw new Error("the installed @intentius/chant-lexicon-prometheus exports no rulerRollback — it predates chant #3372");
+  }
+  return mod.rulerRollback;
+}
+
 /**
  * Load the aws lexicon's `awsApply` (#1449). Same variable-specifier trick as
  * {@link loadK8sApplier}, for the same reason.
@@ -591,7 +660,8 @@ async function loadAwsRollback(): Promise<AwsRollback> {
  * (the CNRM manifest) for gcp, `dist/fly.json` (the serialized plan) for fly,
  * `dist/grafana.json` (the index the grafana serializer writes, with the
  * dashboard files beside it) for grafana, `dist/schema.json` (the sql
- * lexicon's build output) for clickhouse and postgres. Pure — exported for
+ * lexicon's build output) for clickhouse and postgres, `dist/rules.yml` (the
+ * rule file, with `alertmanager.yml` beside it) for ruler. Pure — exported for
  * testing.
  */
 export function defaultOutput(target: ApplyTarget): string {
@@ -603,6 +673,8 @@ export function defaultOutput(target: ApplyTarget): string {
       return "dist/gcp.yaml";
     case "fly":
       return "dist/fly.json";
+    case "ruler":
+      return "dist/rules.yml";
     case "grafana":
       return "dist/grafana.json";
     case "clickhouse":
@@ -671,6 +743,7 @@ export async function nativeApply(
   grafanaApplier?: GrafanaApplier,
   clickhouseApplier?: ClickHouseApplier,
   postgresApplier?: PostgresApplier,
+  rulerApplier?: RulerApplier,
 ): Promise<NativeApplyResult> {
   const output = args.output ?? defaultOutput(args.target);
   const deleteMode = args.deleteMode ?? "never";
@@ -790,6 +863,18 @@ export async function nativeApply(
     return collapseEnvelope(envelope, args.env);
   }
 
+  if (args.target === "ruler") {
+    // ruler (#3372): the prometheus lexicon's applier. env selects
+    // `prometheus.profiles.<env>`, whose ruler names the tenant and the
+    // namespaces the project owns. A delete stays inside those namespaces.
+    const apply = rulerApplier ?? (await loadRulerApplier());
+    const envelope = await apply({ buildPath: output, environment: args.env, prune: deleteMode !== "never" }, signal);
+    // A group with no declared namespace, a plain Prometheus or Alertmanager
+    // with no upload API, and a refused write ride the envelope as
+    // NOT-ATTEMPTED, so an Op can gate on them.
+    return collapseEnvelope(envelope, args.env);
+  }
+
   // cloudformation (#1449): the aws lexicon's native applier. env is the stack
   // name and output the template path; endpoint resolution (#1694) and
   // capability derivation (#980) are awsApply's own, so nothing else is passed.
@@ -811,7 +896,7 @@ export async function nativeApply(
  * with compensation on rather than warn at rollback time.
  */
 export function hasNativeRollback(target: ApplyTarget): boolean {
-  return target === "cloudformation";
+  return target === "cloudformation" || target === "ruler";
 }
 
 export interface CompensateApplyArgs {
@@ -821,6 +906,8 @@ export interface CompensateApplyArgs {
   env: string;
   /** Explicit rollback command, used in preference to the native default. */
   command?: string;
+  /** The build output the apply read — `ruler` finds the previous-group snapshot beside it. */
+  output?: string;
 }
 
 /** What a compensation did. */
@@ -834,6 +921,10 @@ export interface CompensateApplyResult {
   rolledBack?: boolean;
   /** The settled post-rollback stack status — cloudformation. */
   status?: string;
+  /** Groups put back to their previous form — ruler. */
+  restored?: number;
+  /** Groups the apply created, deleted again — ruler. */
+  removed?: number;
 }
 
 /**
@@ -856,6 +947,7 @@ export async function compensateApply(
   args: CompensateApplyArgs,
   signal?: AbortSignal,
   rollback?: AwsRollback,
+  rulerRollback?: RulerRollback,
 ): Promise<CompensateApplyResult> {
   if (args.command) {
     const { stdout, stderr } = await execAsync(args.command, { signal });
@@ -874,12 +966,25 @@ export async function compensateApply(
     };
   }
 
+  if (args.target === "ruler") {
+    // ruler (#3372): re-apply the previous group set the last apply saved.
+    const roll = rulerRollback ?? (await loadRulerRollback());
+    const result = await roll({ buildPath: args.output ?? defaultOutput("ruler"), environment: args.env }, signal);
+    console.log(
+      result.hadSnapshot
+        ? `[${args.env}] ruler rollback: restored ${result.restored} group(s), removed ${result.removed}` +
+            (result.alertmanagerRestored ? ", restored the Alertmanager config" : "")
+        : `[${args.env}] ruler rollback: no apply left a snapshot, nothing to restore`,
+    );
+    return { restored: result.restored, removed: result.removed };
+  }
+
   // Defensive: unreachable from an ApplyOp, which refuses this combination at
   // build time (#1449). Reaching it means the op was assembled without that
   // check, and the honest outcome is a failure that says the state stands.
   throw new Error(
     `no automatic rollback for target "${args.target}" — the partial apply to ${args.env} was NOT ` +
       `reverted and cannot be. ApplyOp refuses compensate for this target at build time; either ` +
-      `supply compensate.command or use a target with a mapped rollback (cloudformation).`,
+      `supply compensate.command or use a target with a mapped rollback (cloudformation, ruler).`,
   );
 }

package/src/op/builders.ts

@@ -4,6 +4,7 @@ import { WORK_LEASE_STEP_ID, type OpConfig, type PhaseDefinition, type StepDefin
 import { isEffectReceipt, type EffectReceiptDeclaration } from "../effect-receipt";
 import { receiptCheckInput } from "./receipt-store";
 import { gateApprovalProblems } from "./gate-approval";
+import { gatePointProblems } from "./gate-point";
 import { makeOutProxy, stepOutput, type StepOutputRef, type WithStepRefs } from "./step-output-ref";
 import type { ChantBuildArgs } from "./activities/build";
 import type { ShellCmdArgs } from "./activities/shell";
@@ -128,15 +129,25 @@ export function activity(
  *
  * Pass `approval` to require a quorum of human approvers, or to evaluate a
  * policy for each approval (#2508). See {@link GateStep.approval}.
+ *
+ * Pass `point` to have the gate ask a declared decision point instead
+ * (#3170): `gate("apply", { plan: plan.out.digest, point: "prod-apply" })`.
+ * The point's deciders and quorum decide, `chant workspace points answer`
+ * answers an open question, and the run passes on the answer. See
+ * {@link GateStep.point}.
  */
 export function gate(
   name: string,
-  opts?: { timeout?: string; description?: string; plan?: GateStep["plan"]; approval?: GateStep["approval"] },
+  opts?: { timeout?: string; description?: string; plan?: GateStep["plan"]; approval?: GateStep["approval"]; point?: GateStep["point"] },
 ): GateStep {
   if (opts?.approval !== undefined) {
     const problems = gateApprovalProblems(opts.approval);
     if (problems.length > 0) throw new Error(`gate(${JSON.stringify(name)}): ${problems[0]}`);
   }
+  if (opts?.point !== undefined) {
+    const problems = gatePointProblems(opts.point, opts.approval !== undefined);
+    if (problems.length > 0) throw new Error(`gate(${JSON.stringify(name)}): ${problems[0]}`);
+  }
   return {
     kind: "gate",
     gate: name,
@@ -144,6 +155,7 @@ export function gate(
     ...(opts?.description ? { description: opts.description } : {}),
     ...(opts?.plan !== undefined ? { plan: opts.plan } : {}),
     ...(opts?.approval !== undefined ? { approval: opts.approval } : {}),
+    ...(opts?.point !== undefined ? { point: opts.point } : {}),
   };
 }
 

package/src/op/composites/apply-op.ts

@@ -12,7 +12,8 @@
  * (chant #1449), the metadata marker (machines) and managed app
  * (volumes/ips/certs/secrets) on `fly` (chant #1449), the ownership labels on
  * `grafana` (chant #3011), the comment marker on `clickhouse` (chant #3208)
- * and `postgres` (chant #3280),
+ * and `postgres` (chant #3280), the declared ruler namespaces on `ruler`
+ * (chant #3372),
  * and the stack itself on `cloudformation`, which a
  * resource CFN did not create is not in. All of
  * them are owned-only. See {@link DeleteMode}.
@@ -41,6 +42,15 @@
  *   delete: "gated",
  *   gate: { gate: "approve-apply", description: "Approve prod apply with deletes" },
  * });
+ *
+ * // the gate asks the prod-apply decision point (#3170): answered with
+ * // `chant workspace points answer <id>`, then re-run
+ * export const { op } = ApplyOp({
+ *   name: "prod-apply",
+ *   env: "prod",
+ *   target: "kubectl",
+ *   gate: { gate: "approve-apply", point: "prod-apply" },
+ * });
  * ```
  *
  * @see #112 — stateless-authoritative state model + live import
@@ -50,6 +60,7 @@ import { Op, phase, activity, gate } from "../builders";
 import { stepOutput } from "../step-output-ref";
 import { gateName } from "../gate-name";
 import type { OpResource } from "../resource";
+import type { GateStep } from "../types";
 import { defaultOutput, hasNativeRollback, type ApplyTarget, type DeleteMode } from "../activities/apply";
 
 export interface ApplyOpConfig {
@@ -57,7 +68,7 @@ export interface ApplyOpConfig {
   name: string;
   /** Environment — CFN stack name / ARM resource group / kube context env /
    * the `grafana.profiles.<env>` entry on `grafana` / the `sql.profiles.<env>`
-   * entry on `clickhouse` and `postgres`; a log label on `gcp` and
+   * entry on `clickhouse` and `postgres`, the `prometheus.profiles.<env>` entry on `ruler`; a log label on `gcp` and
    * `fly`. */
   env: string;
   /** Native apply mechanism. Default: "kubectl". */
@@ -65,7 +76,7 @@ export interface ApplyOpConfig {
   /** Built manifest/template path. Default per target: `dist` (dir) for kubectl,
    * `template.json` (file) for CloudFormation/ARM, `dist/gcp.yaml` for gcp,
    * `dist/fly.json` for fly, `dist/grafana.json` (the build index) for
-   * grafana, `dist/schema.json` for clickhouse and postgres. Must match your
+   * grafana, `dist/schema.json` for clickhouse and postgres, `dist/rules.yml` for ruler. Must match your
    * build output. */
   output?: string;
   /** Project directory to build. Default: ".". */
@@ -97,6 +108,13 @@ export interface ApplyOpConfig {
     signalName?: string;
     timeout?: string;
     description?: string;
+    /**
+     * A declared decision point the gate asks (#3170), in place of `chant
+     * approve`: its deciders and quorum decide, and `chant workspace points
+     * answer` answers an open question. The point declares the input
+     * `gate.planDigest`, since the gate binds the plan. See `GateStep.point`.
+     */
+    point?: GateStep["point"];
   };
   /**
    * Saga-style rollback on partial apply failure, run as an `onFailure` phase.
@@ -164,6 +182,7 @@ export function ApplyOp(config: ApplyOpConfig): ApplyOpResources {
           // the gate refuses, naming the approved digest and the planned one,
           // instead of applying what nobody read.
           plan: stepOutput("plan", "planDigest"),
+          ...(config.gate?.point !== undefined ? { point: config.gate.point } : {}),
           description:
             config.gate?.description ??
             `Approve apply to ${config.env} (delete mode: ${deleteMode}` +
@@ -202,7 +221,7 @@ export function ApplyOp(config: ApplyOpConfig): ApplyOpResources {
   if (config.compensate !== undefined && config.compensate !== false && !rollbackAvailable) {
     throw new Error(
       `ApplyOp "${config.name}": compensate is enabled, but target "${target}" has no automatic ` +
-        `rollback — the only mapped one today is cloudformation's rollbackStack. Either supply ` +
+        `rollback — the mapped ones are cloudformation's rollbackStack and the ruler's previous-group re-apply. Either supply ` +
         `compensate: { command: "..." } with a rollback of your own, or set compensate: false.`,
     );
   }
@@ -229,6 +248,7 @@ export function ApplyOp(config: ApplyOpConfig): ApplyOpResources {
               activity("compensateApply", {
                 target,
                 env: config.env,
+                ...(target === "ruler" ? { output } : {}),
                 ...(compensateCommand ? { command: compensateCommand } : {}),
               }),
             ]),

package/src/op/gate-approval.ts

@@ -12,7 +12,9 @@
  *   and lets only the quorum bind. `"enforce"` lets a permit pass the gate on
  *   its own, which is how an agent principal passes a low-risk plan.
  * - `context`: plan attributes handed to the policy (risk labels, changed
- *   paths), resolved at run time like a gate's `plan`.
+ *   paths), resolved at run time like a gate's `plan`. A gate whose `plan`
+ *   names a step that returned a change set also gets `context.plan`, that
+ *   change set's summary (#3182, `./gate-plan-context.ts`).
  *
  * Core does not know Cedar. A {@link GatePolicyRef} names the lexicon that
  * made it, and {@link loadGatePolicyEvaluator} imports that lexicon's
@@ -34,6 +36,7 @@
 import { createHash } from "node:crypto";
 import { lexiconModulePath, importLexiconPackage } from "../lexicon-module";
 import { isStepOutputRef, type StepOutputRef } from "./step-output-ref";
+import { GATE_PLAN_CONTEXT_KEY } from "./gate-plan-context";
 
 /** What a policy's decision does to the gate. */
 export type GateApprovalMode = "log-only" | "enforce";
@@ -74,7 +77,13 @@ export interface GateApproval {
   policy?: GatePolicyRef;
   /** Default `"log-only"`, so a new policy is observed against real gate traffic before it binds. */
   mode?: GateApprovalMode;
-  /** Plan attributes handed to the policy as Cedar `context`. A {@link StepOutputRef} is resolved at run time. */
+  /**
+   * Plan attributes handed to the policy as Cedar `context`. A {@link StepOutputRef} is resolved at run time.
+   *
+   * `plan` is reserved (#3182): when the gate's `plan` names a step that
+   * returned a change set (`terraformPlan`, `composeChangeSet`, ...), the run
+   * puts that change set's `GatePlanSummary` there on its own.
+   */
   context?: Record<string, GateContextValue>;
 }
 
@@ -205,6 +214,13 @@ export function gateApprovalProblems(approval: unknown): string[] {
       problems.push("`approval.context` is only read by a policy, and this gate declares none");
     } else {
       for (const [key, value] of Object.entries(a.context)) {
+        if (key === GATE_PLAN_CONTEXT_KEY) {
+          problems.push(
+            `\`approval.context.${key}\` is reserved: the run fills it with the plan's change-set summary (#3182) ` +
+              "when the gate's `plan` names the step that planned it",
+          );
+          continue;
+        }
         if (!isContextValue(value)) {
           problems.push(
             `\`approval.context.${key}\` must be a string, number, boolean, list of strings, or a step output reference`,