@intentius/chant 0.124.14 → 0.124.15

package/dist/ci-jobs.js

@@ -0,0 +1,448 @@
+/**
+ * The job primitives chant's three CI generators share (#3765): the scheduled
+ * Op pipeline (`generateOpsPipeline`), the Op waves pipeline
+ * (`generateOpWavesPipeline`) and the component pipeline (`chant build
+ * --components --generate`, with `--pr-loop`, `--wave-gate` and
+ * `--promote-to`). Each forge lexicon builds its documents from these, so a
+ * trigger, a token, a permission rule or an image default is decided once:
+ *
+ *  - the image a generated job runs in, {@link CI_IMAGE};
+ *  - the branches a trigger filters on, {@link triggerBranches};
+ *  - the job token and secret expressions of GitHub Actions and Forgejo
+ *    Actions, {@link GITHUB_JOB_TOKEN} and {@link githubSecret};
+ *  - the `permissions:` a finding-mode needs and the rules for adding to it,
+ *    {@link permissionsFor} and {@link mergePermissions};
+ *  - the `setup` steps and `environment` a job may carry, checked once per
+ *    forge ({@link assertSetupSteps}, {@link assertEnvironment},
+ *    {@link gitlabSetupScript}, {@link assertGitlabEnvironment});
+ *  - GitLab's `rules:` expressions and `id_tokens:` declaration.
+ *
+ * The Forgejo dialect (action refs, dropped `permissions:` and
+ * `environment:`, the header note naming what was dropped) is the forgejo
+ * lexicon's, in its `components/ci-jobs.ts`, since the transform it applies
+ * lives there.
+ */
+// ── Every forge ─────────────────────────────────────────────────────────────
+/**
+ * The image every generated job runs in unless the caller names another. It
+ * carries node and npm, which `chant` needs, and git, which a job that reads
+ * the base commit or pushes to `chant/lifecycle` needs (#3789).
+ */
+export const CI_IMAGE = "node:22";
+/**
+ * The branch a `push` trigger filters on when it names none. A generator
+ * works from a spec, not a checkout, so it cannot read a project's real
+ * default branch; a project on another one names it.
+ */
+export const DEFAULT_BRANCH = "main";
+/**
+ * The branches a push trigger filters on: the ones given, or
+ * {@link DEFAULT_BRANCH} when none are. An empty list is none, on every
+ * forge.
+ */
+export function pushBranches(branches) {
+    return branches && branches.length > 0 ? [...branches] : [DEFAULT_BRANCH];
+}
+/**
+ * The branches a trigger filters on: a `pull_request` trigger's list, or
+ * undefined for every branch; a `push` trigger's, with {@link pushBranches}'
+ * default; none for `cron`.
+ */
+export function triggerBranches(trigger) {
+    switch (trigger.kind) {
+        case "cron":
+            return undefined;
+        case "pull_request":
+            return trigger.branches && trigger.branches.length > 0 ? [...trigger.branches] : undefined;
+        case "push":
+            return pushBranches(trigger.branches);
+    }
+}
+/** A job id every forge accepts, from a kebab- or camel-cased name. */
+export function ciJobName(name) {
+    return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+/** A command template with each `{name}` part filled in. */
+export function fillCommand(template, name) {
+    return template.map((part) => part.replace("{name}", name));
+}
+/** `{ [key]: map }` when the map has an entry, else `{}`: for spreading an optional mapping into a document. */
+export function nonEmpty(key, map) {
+    return map && Object.keys(map).length > 0 ? { [key]: map } : {};
+}
+/**
+ * A job's `environment:` mapping. Always the mapping form, never the string
+ * shorthand, so adding a `url` later is a new key rather than a reshaped
+ * value. GitHub and GitLab read the same two keys.
+ */
+export function environmentDoc(environment) {
+    return { name: environment.name, ...(environment.url === undefined ? {} : { url: environment.url }) };
+}
+/** The directory part of a relative path, `.` when there is none. */
+export function dirnameOf(path) {
+    const i = path.lastIndexOf("/");
+    return i <= 0 ? "." : path.slice(0, i);
+}
+// ── GitHub Actions and Forgejo Actions ──────────────────────────────────────
+/** The runner label a generated job asks for; the Forgejo dialect rewrites it to the project's label. */
+export const GITHUB_RUNNER = "ubuntu-latest";
+/** The job token, which GitHub and Forgejo both mint for every run. */
+export const GITHUB_JOB_TOKEN = "${{ github.token }}";
+/** A repository secret, by name. */
+export function githubSecret(name) {
+    return `\${{ secrets.${name} }}`;
+}
+/**
+ * A repository secret, or the job token when the secret is unset (#3624). An
+ * unset secret reads as the empty string, so a workflow generated for a
+ * production token still runs in a fork or a fresh repository, with what the
+ * job token may do.
+ */
+export function githubSecretOrJobToken(name) {
+    return `\${{ secrets.${name} || github.token }}`;
+}
+/** Each name mapped from the repository secret of the same name. */
+export function githubSecretEnv(names) {
+    return Object.fromEntries(names.map((n) => [n, githubSecret(n)]));
+}
+/**
+ * Least-privilege `permissions:` for a finding-mode. `report` needs no write
+ * access; `issue` needs only `issues: write`; `pull-request` (and
+ * `merge-request`, generated the same way when a GitLab-authored spec is
+ * targeted at github) needs `contents: write` to push the reconcile branch
+ * plus `pull-requests: write` to open the PR. `comment` changes nothing in
+ * the repository, so its whole scope is `{ contents: read, pull-requests:
+ * write }`.
+ */
+export function permissionsForMode(mode) {
+    switch (mode) {
+        case "issue":
+            return { contents: "read", issues: "write" };
+        case "comment":
+            return { contents: "read", "pull-requests": "write" };
+        case "pull-request":
+        case "merge-request":
+            return { contents: "write", "pull-requests": "write" };
+        case "report":
+            return { contents: "read" };
+    }
+}
+/**
+ * {@link permissionsForMode} on a trigger. A `pull_request` trigger reports
+ * its finding as a comment on the triggering PR itself (#2084): any mode but
+ * `report` posts something to act on a finding, so on that trigger every
+ * such mode also gets `pull-requests: write` for the comment.
+ */
+export function permissionsFor(mode, trigger) {
+    const base = permissionsForMode(mode);
+    if (trigger.kind === "pull_request" && mode !== "report")
+        return { ...base, "pull-requests": "write" };
+    return base;
+}
+/**
+ * Every scope `GITHUB_TOKEN` accepts in a workflow's `permissions:` mapping,
+ * kebab-cased as GitHub spells them. An additive scope outside this set is
+ * refused by name rather than emitted: GitHub ignores an unknown key, so
+ * `id_token` or `idToken` would generate a workflow that looks like it grants
+ * OIDC and hands the run no token at all.
+ */
+export const GITHUB_TOKEN_SCOPES = new Set([
+    "actions",
+    "attestations",
+    "checks",
+    "contents",
+    "deployments",
+    "discussions",
+    "id-token",
+    "issues",
+    "models",
+    "packages",
+    "pages",
+    "pull-requests",
+    "repository-projects",
+    "security-events",
+    "statuses",
+]);
+/**
+ * Merge a spec's additive `permissions` over the finding-mode's own set
+ * (#2242), refusing by name anything that is not strictly additive:
+ *
+ *  - a blanket `write-all`/`read-all`, in either the key or the value
+ *    position, which is the exact thing {@link permissionsForMode} exists to
+ *    avoid;
+ *  - a scope GitHub does not define ({@link GITHUB_TOKEN_SCOPES}), because
+ *    GitHub ignores the key and the run silently gets nothing;
+ *  - a scope the mode already grants, at any value — additive means additive,
+ *    so this can neither downgrade `contents: write` to read nor restate it.
+ *    A mode whose set is wrong is fixed by changing the mode, where the
+ *    scope and the behavior that spends it stay together;
+ *  - `pull-requests: write` on a trigger with no pull request. Pull-request
+ *    access is what the finding-modes own: `pull-request` grants it together
+ *    with the `contents: write` needed to push the branch first, and
+ *    `comment` grants it on the one trigger that carries a pull request to
+ *    comment on. Adding it beside a mode that posts nothing, on a cron or
+ *    push run, grants write access no step in the generated job can spend.
+ */
+export function mergePermissions(name, base, additive, trigger) {
+    const merged = { ...base };
+    for (const [rawScope, value] of Object.entries(additive)) {
+        const scope = rawScope.trim();
+        const where = `Scheduled Op "${name}" adds permission "${scope}: ${value}"`;
+        if (scope === "write-all" || scope === "read-all" || String(value).endsWith("-all")) {
+            throw new Error(`${where}, a blanket grant. \`permissions\` on a scheduled Op is additive over the ` +
+                `least-privilege set its finding-mode needs, one named scope at a time. Name the scopes the ` +
+                `job actually spends (e.g. { "id-token": "write" }).`);
+        }
+        if (!GITHUB_TOKEN_SCOPES.has(scope)) {
+            throw new Error(`${where}, which is not a GITHUB_TOKEN permission scope. GitHub ignores an unrecognized key, so ` +
+                `this would emit a workflow that reads as granted and hands the run nothing. Known scopes: ` +
+                `${[...GITHUB_TOKEN_SCOPES].sort().join(", ")}.`);
+        }
+        if (scope in base) {
+            throw new Error(`${where}, but its finding-mode already grants "${scope}: ${base[scope]}". These permissions are ` +
+                `additive only — they never replace, widen or downgrade a scope the mode computed. Change the ` +
+                `Op's findingMode if that set is wrong, and add only scopes no mode grants (e.g. "id-token").`);
+        }
+        if (scope === "pull-requests" && trigger.kind !== "pull_request") {
+            throw new Error(`${where}, but this Op's trigger is "${trigger.kind}", which carries no pull request. Pull-request ` +
+                `write access belongs to a finding-mode: "pull-request" grants it with the contents: write its ` +
+                `branch push needs, and "comment" grants it on the pull_request trigger. Set findingMode instead ` +
+                `of adding the scope here.`);
+        }
+        merged[scope] = value;
+    }
+    return merged;
+}
+/**
+ * Refs that name an action repository's own default branch. A generated
+ * workflow is committed once and then re-run unattended, often over a cloud
+ * role, so "whatever was pushed to that repo last" is not a version — the
+ * code that assumes the role can change between the run somebody reviewed and
+ * the next one. A release channel the action's author cuts deliberately (`v6`,
+ * `v6.2.4`, `stable`) or a commit sha is a version, and both pass.
+ */
+const DEFAULT_BRANCH_REFS = new Set(["main", "master", "head", "default"]);
+/** `owner/repo` or `owner/repo/subpath`, then `@ref`. */
+const USES_PATTERN = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)((?:\/[A-Za-z0-9_.-]+)*)@([^\s@]+)$/;
+/**
+ * Validate a `setup` list for GitHub or Forgejo Actions (#2242). A `run`
+ * entry needs a non-empty line and nothing else. A `uses` entry has to be a
+ * pinned `owner/repo[/subpath]@ref`: no bare `owner/repo`, since an unpinned
+ * action resolves to its default branch, and no ref in
+ * {@link DEFAULT_BRANCH_REFS} for the same reason spelled out loud. Local
+ * (`./path`) and container (`docker://`) refs are refused too — they are
+ * legal GitHub Actions, but the generator emits a workflow into a repository
+ * it has never seen, so it cannot know a local path resolves there.
+ */
+export function assertSetupSteps(name, setup) {
+    setup.forEach((step, index) => {
+        const where = `Scheduled Op "${name}" setup step ${index + 1}`;
+        if ("uses" in step) {
+            const ref = step.uses.trim();
+            const match = USES_PATTERN.exec(ref);
+            if (!match) {
+                throw new Error(`${where} has \`uses: "${step.uses}"\`, which is not a pinned action reference. ` +
+                    `Write it as owner/repo@ref (optionally owner/repo/subpath@ref), e.g. ` +
+                    `"aws-actions/configure-aws-credentials@v6". A local "./path" or "docker://" ref is not ` +
+                    `accepted here: this generator emits a workflow into a repository it cannot inspect, so it ` +
+                    `has no way to tell whether such a ref resolves there.`);
+            }
+            const gitRef = match[4];
+            if (DEFAULT_BRANCH_REFS.has(gitRef.toLowerCase())) {
+                throw new Error(`${where} pins \`uses: "${step.uses}"\` to "${gitRef}", the action repository's own default ` +
+                    `branch, which names whatever was pushed there last rather than a version. A generated ` +
+                    `workflow is committed once and re-run unattended, often over a cloud role, so pin a release ` +
+                    `tag or a commit sha instead (e.g. "${match[1]}/${match[2]}@v1" or "@<40-char sha>").`);
+            }
+            return;
+        }
+        if (step.run.trim() === "") {
+            throw new Error(`${where} has an empty \`run\` line. Give it a command, or drop the entry.`);
+        }
+    });
+}
+/** One setup entry as a GitHub Actions step: `with:` and `env:` only when they hold something. */
+export function setupStepDoc(step) {
+    if ("uses" in step) {
+        return {
+            uses: step.uses,
+            ...nonEmpty("with", step.with),
+            ...nonEmpty("env", step.env),
+        };
+    }
+    return { run: step.run, ...nonEmpty("env", step.env) };
+}
+/**
+ * Validate an `environment` for GitHub Actions (#2257). GitHub creates an
+ * environment it has never seen on first use rather than failing the run,
+ * and an environment created that way carries no protection rules at all —
+ * so a job can name one and read as gated while being gated by nothing.
+ * Neither the generator nor GitHub can tell those apart at build time, which
+ * is why what is refused here is only the shape that could never bind: a
+ * name that is blank, and a `url` that is neither absolute nor an expression
+ * the forge resolves.
+ */
+export function assertEnvironment(name, environment) {
+    const where = `Scheduled Op "${name}" environment`;
+    if (environment.name.trim() === "") {
+        throw new Error(`${where} has an empty \`name\`. An environment is named repository configuration — the ` +
+            `protection rules and reviewers live on the environment, not in this workflow — so there is ` +
+            `nothing for a blank name to resolve to. Give it the environment's name, or drop the option.`);
+    }
+    if (environment.url === undefined)
+        return;
+    const url = environment.url.trim();
+    if (url === "") {
+        throw new Error(`${where} "${environment.name}" has an empty \`url\`. Omit the field rather than setting it to "".`);
+    }
+    if (!/^https?:\/\//.test(url) && !url.includes("${{")) {
+        throw new Error(`${where} "${environment.name}" has \`url: "${environment.url}"\`, which is neither an absolute ` +
+            `http(s) URL nor a \${{ }} expression. GitHub renders this value as the deployment's own link, ` +
+            `so a relative path becomes a dead link on the environment page rather than an error anywhere. ` +
+            `Write the full URL, or an expression the run resolves to one.`);
+    }
+}
+// ── GitLab CI ───────────────────────────────────────────────────────────────
+/** The pipeline source GitLab reports for a merge-request pipeline. */
+export const GITLAB_MERGE_REQUEST_SOURCE = '$CI_PIPELINE_SOURCE == "merge_request_event"';
+/** The pipeline source GitLab reports for a pipeline schedule. */
+export const GITLAB_SCHEDULE_SOURCE = '$CI_PIPELINE_SOURCE == "schedule"';
+/** A job variable that makes the runner clone the whole history, which a job reading the base commit needs. */
+export const GITLAB_FULL_HISTORY = { GIT_DEPTH: "0" };
+/** The `rules:` if-expression for a push to `branch`, a quoted name or an expression such as `$CI_DEFAULT_BRANCH`. */
+export function gitlabPushRule(branch) {
+    return `$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == ${branch}`;
+}
+/**
+ * Refuse a branch name that cannot be interpolated into a `rules:`
+ * if-expression. The expression is a string GitLab parses, so a `"` would end
+ * it early and a `$` would expand as a variable — either one silently changes
+ * which pipelines match the job, which is worse than not generating it.
+ * `subject` names what filters, such as `Scheduled Op "apply"`.
+ */
+export function assertGitlabBranch(subject, branch) {
+    if (branch.trim() === "") {
+        throw new Error(`${subject} has an empty branch filter. Name a branch, or drop the filter.`);
+    }
+    if (/["$\\]/.test(branch)) {
+        throw new Error(`${subject} filters on branch "${branch}", which carries a character this generator ` +
+            `cannot put in a GitLab \`rules:\` expression: a quote would end the expression early and a "$" ` +
+            `would expand as a CI/CD variable, either of which silently changes which pipelines run the job. ` +
+            `Name a branch without \`"\`, \`$\` or \`\\\`.`);
+    }
+}
+/**
+ * One `rules:` entry per branch a trigger filters on, each checked by
+ * {@link assertGitlabBranch}. Two or more branches are two or more entries:
+ * `rules:` is an OR over its list, which is how GitLab spells the alternation
+ * github expresses as a `branches:` array. A cron trigger is selected by
+ * `selector`, the CI/CD variable a pipeline schedule sets, and the Op's name.
+ */
+export function gitlabRules(subject, trigger, selector) {
+    switch (trigger.kind) {
+        case "cron":
+            return [{ if: `${GITLAB_SCHEDULE_SOURCE} && $${selector.variable} == "${selector.value}"` }];
+        case "pull_request": {
+            const branches = triggerBranches(trigger);
+            if (!branches)
+                return [{ if: GITLAB_MERGE_REQUEST_SOURCE }];
+            return branches.map((branch) => {
+                assertGitlabBranch(subject, branch);
+                return { if: `${GITLAB_MERGE_REQUEST_SOURCE} && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "${branch}"` };
+            });
+        }
+        case "push":
+            return pushBranches(trigger.branches).map((branch) => {
+                assertGitlabBranch(subject, branch);
+                return { if: gitlabPushRule(JSON.stringify(branch)) };
+            });
+    }
+}
+/**
+ * The `id_tokens:` entry an `id-token: write` spec gets. The name is the
+ * environment variable the JWT lands in, which the job's own setup line reads
+ * (`aws sts assume-role-with-web-identity --web-identity-token
+ * "$CHANT_ID_TOKEN"`, or the provider's equivalent).
+ *
+ * `$CI_SERVER_URL` as the audience is GitLab's own documented default: an
+ * identity provider federated to a GitLab instance is registered with that
+ * instance's URL as its audience, and the variable expands to exactly that on
+ * gitlab.com and on a self-managed instance alike.
+ */
+export const GITLAB_ID_TOKEN_NAME = "CHANT_ID_TOKEN";
+export const GITLAB_ID_TOKEN_AUDIENCE = "$CI_SERVER_URL";
+/**
+ * Turn additive `permissions` (#2242) into the one GitLab declaration that
+ * carries the same meaning, refusing everything else by name.
+ *
+ * `id-token: write` is that one: GitLab's OIDC surface is `id_tokens:`, a
+ * per-job declaration of a JWT the job exchanges for cloud credentials
+ * itself. `id-token: read` is refused rather than mapped, because GitLab
+ * either mints the token into the job or does not. Every other scope is
+ * refused: GitLab has no per-job token-scope mapping at all, and a scope
+ * quietly dropped would emit a job that reads as granted and runs with
+ * nothing.
+ */
+export function gitlabIdTokens(name, permissions) {
+    let wantsIdToken = false;
+    for (const [rawScope, value] of Object.entries(permissions ?? {})) {
+        const scope = rawScope.trim();
+        if (scope === "id-token") {
+            if (value !== "write") {
+                throw new Error(`Scheduled Op "${name}" adds permission "id-token: ${value}", but GitLab either mints an ` +
+                    `OIDC token into a job or does not — there is no read-only half of an \`id_tokens:\` ` +
+                    `declaration. Ask for { "id-token": "write" }, or drop the option.`);
+            }
+            wantsIdToken = true;
+            continue;
+        }
+        throw new Error(`Scheduled Op "${name}" adds permission "${scope}: ${value}", but GitLab CI has no per-job ` +
+            `token-scope mapping — there is no \`permissions:\` key to add it to (#2242). The one scope that ` +
+            `does cross over is "id-token": "write", which becomes an \`id_tokens:\` declaration. Drop the ` +
+            `option here, or generate this Op for github.`);
+    }
+    return wantsIdToken ? { [GITLAB_ID_TOKEN_NAME]: { aud: GITLAB_ID_TOKEN_AUDIENCE } } : undefined;
+}
+/**
+ * A `setup` list as GitLab `script:` lines. A `uses` entry is a GitHub
+ * Actions marketplace action, which GitLab has no shape for, so it is refused
+ * by name rather than dropped. `subject` names whose setup it is, such as
+ * `Scheduled Op "apply"`.
+ */
+export function gitlabSetupScript(subject, setup) {
+    return (setup ?? []).map((step, index) => {
+        if ("uses" in step) {
+            throw new Error(`${subject} setup step ${index + 1} is \`uses: "${step.uses}"\`, a GitHub Actions ` +
+                `marketplace action. GitLab CI jobs run \`script\` lines only, so there is nothing to translate it ` +
+                `into (#2242). Express the setup as a \`{ run }\` entry, or generate it for github/forgejo.`);
+        }
+        return step.run;
+    });
+}
+/**
+ * Validate an `environment` on GitLab's own terms (#2257). A GitLab job
+ * naming an environment that does not exist creates an unprotected one on
+ * first deploy rather than failing, so the only shapes worth refusing at
+ * build time are the ones that could never bind: a blank name, and a `url`
+ * that is neither absolute nor a variable expression GitLab expands, which
+ * would render as a dead "View deployment" link.
+ */
+export function assertGitlabEnvironment(name, environment) {
+    const where = `Scheduled Op "${name}" environment`;
+    if (environment.name.trim() === "") {
+        throw new Error(`${where} has an empty \`name\`. A GitLab environment is a project object, and its approval ` +
+            `rules live on that object rather than in this file, so a blank name resolves to nothing. ` +
+            `Give it the environment's name, or drop the option.`);
+    }
+    if (environment.url === undefined)
+        return;
+    const url = environment.url.trim();
+    if (url === "") {
+        throw new Error(`${where} "${environment.name}" has an empty \`url\`. Omit the field rather than setting it to "".`);
+    }
+    if (!/^https?:\/\//.test(url) && !url.includes("$")) {
+        throw new Error(`${where} "${environment.name}" has \`url: "${environment.url}"\`, which is neither an absolute ` +
+            `http(s) URL nor a variable expression GitLab expands. It becomes the environment's own link, ` +
+            `so a relative path is a dead link on the environment page rather than an error anywhere.`);
+    }
+}

package/dist/components/pr-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,yBAAyB;IACzB,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CA2B3H;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D"}
+{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,yBAAyB;IACzB,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CA2B3H;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D"}

package/dist/components/pr-pipeline.js

@@ -36,6 +36,7 @@
  * that one of its units reaches selects that unit.
  */
 import { PR_APPLY_GATE } from "../pr-loop.js";
+import { CI_IMAGE, GITHUB_JOB_TOKEN } from "../ci-jobs.js";
 /** Where both jobs write their reports, kept as a CI artifact. */
 export const PR_LOOP_REPORT_DIR = ".chant/pr";
 /**
@@ -50,7 +51,7 @@ export const PR_APPLY_RECORD = ".chant/pr-resume/pr-apply.json";
  * `PR_LOOP_SETUP` adds OpenTofu on top of it. A caller who sets `image`
  * brings both and gets no setup lines.
  */
-export const PR_LOOP_IMAGE = "node:22";
+export const PR_LOOP_IMAGE = CI_IMAGE;
 /** Installs OpenTofu into `PR_LOOP_IMAGE`. */
 export const PR_LOOP_SETUP = [
     "command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)",
@@ -71,7 +72,7 @@ export function prLoopJobs(forge, env, options = {}, member) {
         ...(member ? ["--member", member] : []),
     ];
     const github = forge !== "gitlab";
-    const token = github ? { GITHUB_TOKEN: "${{ github.token }}" } : {};
+    const token = github ? { GITHUB_TOKEN: GITHUB_JOB_TOKEN } : {};
     return [
         {
             jobName: "plan",

package/dist/composite.d.ts

@@ -74,8 +74,16 @@ export declare class CompositeRegistry {
  * });
  * export const storage = SecureStorage({ name: "data" });
  * ```
- */
-export declare function Composite<P, M extends CompositeFactoryMembers = CompositeMembers>(factory: (props: P) => M, name?: string): CompositeDefinition<P, M>;
+ *
+ * `D` (chant#3787) lets a lexicon give the definition a more precise call
+ * signature than `(props: P) => M`, such as a generic one whose members' types
+ * depend on the literal props it is called with. It is a type only: the value
+ * is the same definition, and `D` must still be a `CompositeDefinition<P, M>`,
+ * so an intersection with the precise signature first is the usual form. It
+ * is passed as a type argument rather than by casting the result, because the
+ * fold recognizes a composite by its `export const X = Composite(...)` shape.
+ */
+export declare function Composite<P, M extends CompositeFactoryMembers = CompositeMembers, D extends CompositeDefinition<P, M> = CompositeDefinition<P, M>>(factory: (props: P) => M, name?: string): D;
 /**
  * chant#3608 — the composite whose call built `entity`, or `undefined` for an
  * entity no chant composite built.

package/dist/composite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composite.d.ts","sourceRoot":"","sources":["../src/composite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAG7D;;GAEG;AACH,eAAO,MAAM,gBAAgB,eAAgC,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAE/B,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAO/D,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,uBAAuB,GAAG,gBAAgB;IACrF,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,uBAAuB,GAAG,gBAAgB;IAC1F,CAAC,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAE3F;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,WAAW,CAAmD;IAE7E,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,IAAI,CAE9D;IAED,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAE9C;IAED,MAAM,CAAC,KAAK,IAAI,IAAI,CAEnB;IAED,MAAM,KAAK,IAAI,IAAI,MAAM,CAExB;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,uBAAuB,GAAG,gBAAgB,EAC/E,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EACxB,IAAI,CAAC,EAAE,MAAM,GACZ,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CA6C3B;AAoBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,GAAE,MAAe,GAC5B,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAqFzB;AAED;;GAEG;AACH,KAAK,gBAAgB,CAAC,CAAC,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,IAC3C,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACzD,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,SAAS,gBAAgB,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAC9E,UAAU,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,EACrC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GACvC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAc1D;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,eAAuC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,cAAc,eAA0C,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,gBAAgB,EAClD,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,EAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAM1B;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,EAC9C,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAC/D,KAAK,EAAE,CAAC,EACR,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,CAAC,CAEH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,IAAI,EAAE,CAAC,EACP,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAC9B,CAAC,CAqBH"}
+{"version":3,"file":"composite.d.ts","sourceRoot":"","sources":["../src/composite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAG7D;;GAEG;AACH,eAAO,MAAM,gBAAgB,eAAgC,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAE/B,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAO/D,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,uBAAuB,GAAG,gBAAgB;IACrF,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,uBAAuB,GAAG,gBAAgB;IAC1F,CAAC,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAE3F;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,WAAW,CAAmD;IAE7E,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,IAAI,CAE9D;IAED,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAE9C;IAED,MAAM,CAAC,KAAK,IAAI,IAAI,CAEnB;IAED,MAAM,KAAK,IAAI,IAAI,MAAM,CAExB;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CACvB,CAAC,EACD,CAAC,SAAS,uBAAuB,GAAG,gBAAgB,EACpD,CAAC,SAAS,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,EAE/D,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EACxB,IAAI,CAAC,EAAE,MAAM,GACZ,CAAC,CA6CH;AAoBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,GAAE,MAAe,GAC5B,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAqFzB;AAED;;GAEG;AACH,KAAK,gBAAgB,CAAC,CAAC,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,IAC3C,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACzD,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,SAAS,gBAAgB,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAC9E,UAAU,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,EACrC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GACvC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAc1D;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,eAAuC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,cAAc,eAA0C,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,gBAAgB,EAClD,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,EAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAM1B;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,EAC9C,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAC/D,KAAK,EAAE,CAAC,EACR,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,CAAC,CAEH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,IAAI,EAAE,CAAC,EACP,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAC9B,CAAC,CAqBH"}

package/dist/composite.js

@@ -51,6 +51,14 @@ CompositeRegistry.definitions = new Map();
  * });
  * export const storage = SecureStorage({ name: "data" });
  * ```
+ *
+ * `D` (chant#3787) lets a lexicon give the definition a more precise call
+ * signature than `(props: P) => M`, such as a generic one whose members' types
+ * depend on the literal props it is called with. It is a type only: the value
+ * is the same definition, and `D` must still be a `CompositeDefinition<P, M>`,
+ * so an intersection with the precise signature first is the usual form. It
+ * is passed as a type argument rather than by casting the result, because the
+ * fold recognizes a composite by its `export const X = Composite(...)` shape.
  */
 export function Composite(factory, name) {
     const id = Symbol();

package/dist/discovery/collect.d.ts

@@ -2,7 +2,8 @@ import { type Declarable } from "../declarable.js";
 /**
  * Collects all declarable entities from imported modules.
  * CompositeInstance exports are expanded into individual entities
- * with `{exportName}_{memberName}` naming.
+ * with `{exportName}_{memberName}` naming, and so are host composite
+ * instances the fold resolved (chant#3612, ./host-composite.ts).
  * LexiconOutput exports are also collected so that build() can
  * extract them and pass them to the serializer.
  *

package/dist/discovery/collect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/discovery/collect.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAmI9D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAiEzB"}
+{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/discovery/collect.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAgJ9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAiEzB"}

package/dist/discovery/collect.js

@@ -4,6 +4,7 @@ import { isCompositeInstance, expandComposite, compositeOfMember } from "../comp
 import { isLexiconOutput } from "../lexicon-output.js";
 import { DiscoveryError } from "../errors.js";
 import { setProvenance } from "../provenance.js";
+import { expandHostComposite, hostCompositeName } from "./host-composite.js";
 /**
  * The entity key for an export. `export default` is per-module — the `Op` pattern
  * (`export default op`) uses it, and two op files must not collide on the literal
@@ -106,6 +107,19 @@ function enumerateEntries(modules) {
                     });
                 }
             }
+            else if (hostCompositeName(value) !== undefined) {
+                // chant#3612 — a host composite instance the fold resolved, expanded
+                // here rather than by one caller, so `build()` and `foldProject`
+                // report the same entities for it. See ./host-composite.ts.
+                for (const [expandedName, entity] of expandHostComposite(name, value)) {
+                    entries.push({
+                        bareKey: expandedName,
+                        value: entity,
+                        file,
+                        provenance: { sourceFile: file, compositeInstance: name },
+                    });
+                }
+            }
             else if (isLexiconOutput(value)) {
                 // LexiconOutput is not a Declarable but build() expects to find them in
                 // the entities map so it can collect and pass them to serializers.
@@ -118,7 +132,8 @@ function enumerateEntries(modules) {
 /**
  * Collects all declarable entities from imported modules.
  * CompositeInstance exports are expanded into individual entities
- * with `{exportName}_{memberName}` naming.
+ * with `{exportName}_{memberName}` naming, and so are host composite
+ * instances the fold resolved (chant#3612, ./host-composite.ts).
  * LexiconOutput exports are also collected so that build() can
  * extract them and pass them to the serializer.
  *

package/dist/discovery/fold-import.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fold-import.d.ts","sourceRoot":"","sources":["../../src/discovery/fold-import.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAMjC,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAkC,KAAK,iBAAiB,EAAyB,MAAM,cAAc,CAAC;AAqD7G,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEnF,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,mGAAmG;AACnG,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC,CAAC;AAElF,MAAM,MAAM,cAAc,GACtB;IACE,EAAE,EAAE,IAAI,CAAC;IACT;;;;;;;;OAQG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,CAAC;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,GAAE,SAAS,YAAY,EAAO,EACxC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EACvD,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,OAAO,UAAQ;AACf;;;;;;;;;;;GAWG;AACH,eAAe,GAAE,SAAS,MAAM,EAAO;AACvC,uEAAuE;AACvE,SAAS,UAAQ;AACjB;;;GAGG;AACH,WAAW,GAAE,SAAS,MAAM,EAAO,GAClC,WAAW,CA2Bb;AAqJD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAQD,gKAAgK;AAChK,wBAAgB,mBAAmB,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAEnE;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AA2RD,oDAAoD;AACpD,UAAU,aAAa;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;yEAGqE;IACrE,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC;CACjC;AAED,4FAA4F;AAC5F,UAAU,sBAAsB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC;CACjC;AAqwCD;;;;;;;;;;GAUG;AACH,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CACxF;AAmZD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,kBAAkB,GAAG,MAAM,GAAG,SAAS,CA0D3G;AAi8DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,SAAS,YAAY,EAAO,EACxC,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,cAAc,CAAC,CAEzB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAwCzG;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,GACrD,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAE9B;AAED,yDAAyD;AACzD,MAAM,MAAM,aAAa;AACvB,oFAAoF;AAClF,UAAU;AACZ,+EAA+E;GAC7E,SAAS,CAAC;AAEd,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAChF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,GACrD,OAAO,CAAC,SAAS,CAAC,CAkDpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACjE,0GAA0G;IAC1G,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;IAC3D,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,UAAU,GAAE,SAAS,YAAY,EAAO,EACxC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAkE1C"}
+{"version":3,"file":"fold-import.d.ts","sourceRoot":"","sources":["../../src/discovery/fold-import.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAMjC,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAkC,KAAK,iBAAiB,EAAyB,MAAM,cAAc,CAAC;AAqD7G,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGnF,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,mGAAmG;AACnG,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC,CAAC;AAElF,MAAM,MAAM,cAAc,GACtB;IACE,EAAE,EAAE,IAAI,CAAC;IACT;;;;;;;;OAQG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,CAAC;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,GAAE,SAAS,YAAY,EAAO,EACxC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EACvD,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,OAAO,UAAQ;AACf;;;;;;;;;;;GAWG;AACH,eAAe,GAAE,SAAS,MAAM,EAAO;AACvC,uEAAuE;AACvE,SAAS,UAAQ;AACjB;;;GAGG;AACH,WAAW,GAAE,SAAS,MAAM,EAAO,GAClC,WAAW,CA2Bb;AAqJD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAQD,gKAAgK;AAChK,wBAAgB,mBAAmB,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAEnE;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AA2RD,oDAAoD;AACpD,UAAU,aAAa;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;yEAGqE;IACrE,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC;CACjC;AAED,4FAA4F;AAC5F,UAAU,sBAAsB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC;CACjC;AAqwCD;;;;;;;;;;GAUG;AACH,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CACxF;AAmZD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,kBAAkB,GAAG,MAAM,GAAG,SAAS,CA0D3G;AAk5DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,SAAS,YAAY,EAAO,EACxC,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,cAAc,CAAC,CAEzB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAwCzG;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,GACrD,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAE9B;AAED,yDAAyD;AACzD,MAAM,MAAM,aAAa;AACvB,oFAAoF;AAClF,UAAU;AACZ,+EAA+E;GAC7E,SAAS,CAAC;AAEd,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAChF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,GACrD,OAAO,CAAC,SAAS,CAAC,CAkDpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACjE,0GAA0G;IAC1G,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;IAC3D,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,UAAU,GAAE,SAAS,YAAY,EAAO,EACxC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAkE1C"}