@intentius/chant 0.124.30 → 0.124.31

package/dist/workspace/ci-run-index.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The run index (#4098, epic #4101): where the chant runner says which jobs it
+ * ran, at the `--report-url` root, for behold and the demo kiosk to find runs
+ * without a forge or a workflow file.
+ *
+ * ```
+ * <url>/runs/index.json
+ * ```
+ *
+ * One document, `ci-run-index/v1` (`ci-run-index.schema.json`). Each settled
+ * `chant ci run` job with `--report-url` set adds an entry to its front, so
+ * the newest run is first, and the list is cut to the newest `limit` entries,
+ * 200 by default. An entry's `key` is the folder the job's report went to
+ * (`reportKey`, `<pr>/<commit>`), so a reader goes from the index to
+ * `<url>/<key>/pr-<job>.json`.
+ *
+ * The update reads the index, changes it and writes it back through the same
+ * `file://` and `s3://` paths the report upload uses (pr-report-url.ts). A
+ * `file://` write goes through a temporary name and a rename. Two runners
+ * updating one index at once can lose an entry, and that is out of scope:
+ * `chant ci serve` is one host. Within one process the updates for one URL
+ * take turns, so `ci serve --max-jobs 2` does not race itself.
+ *
+ * An index that can't be parsed is replaced with a warning. An index this
+ * chant can't read for any other reason, or a newer contract, is left alone
+ * with a warning. Nothing here fails a job.
+ */
+import type { RunOrigin } from "../lifecycle/release-ledger.js";
+import type { CommandContext } from "../cli/registry.js";
+import { type ReportGet, type ReportPut, type ReportTarget } from "../pr-report-url.js";
+export declare const CI_RUN_INDEX_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/ci-run-index/v1/ci-run-index.schema.json";
+export declare const CI_RUN_INDEX_CONTRACT = 1;
+/** The first chant that writes the index. */
+export declare const CI_RUN_INDEX_FLOOR = "0.124.31";
+/** Where the index is kept, below the report URL. */
+export declare const CI_RUN_INDEX_KEY = "runs/index.json";
+/** How many entries the index keeps unless told otherwise. */
+export declare const CI_RUN_INDEX_LIMIT = 200;
+/** One job the runner ran. */
+export interface CiRunIndexEntry {
+    job: "plan" | "apply";
+    /** The pull request, or null when the job found none. */
+    pr: number | null;
+    commit: string;
+    status: "ok" | "fail";
+    /** Why a failed job failed: the `failure.code` of its run record. */
+    failure?: {
+        code: string;
+    };
+    member?: string;
+    started: string;
+    ended: string;
+    runId: string;
+    /** The folder the job's report is under, below the report URL: `<pr>/<commit>[/<member>]`. */
+    key: string;
+    runOrigin: RunOrigin;
+}
+export interface CiRunIndex {
+    $schema: typeof CI_RUN_INDEX_SCHEMA_ID;
+    contract: typeof CI_RUN_INDEX_CONTRACT;
+    chant: string;
+    /** When the index was last written. */
+    updated: string;
+    /** Newest first. */
+    runs: CiRunIndexEntry[];
+}
+/** The index as `text` holds it, or why it can't be used: `corrupt` is replaced, `newer` is left alone. */
+export declare function parseCiRunIndex(text: string): {
+    index: CiRunIndex;
+} | {
+    corrupt: string;
+} | {
+    newer: number;
+};
+/** `entry` at the front of `runs`, replacing an entry with its run id, cut to the newest `limit`. */
+export declare function addRunEntry(runs: readonly CiRunIndexEntry[], entry: CiRunIndexEntry, limit: number): CiRunIndexEntry[];
+/**
+ * Add `entry` to the index at `target`. Never throws: a problem is a warning
+ * and the index stays as it was, or is replaced when it was unreadable JSON.
+ */
+export declare function updateCiRunIndex(input: {
+    target: ReportTarget;
+    entry: CiRunIndexEntry;
+    limit?: number;
+    warn: (message: string) => void;
+    now?: () => Date;
+    put?: ReportPut;
+    get?: ReportGet;
+}): Promise<void>;
+/** The index at `target`, or null when none is there. Throws a line a person can read when it can't be read. */
+export declare function readCiRunIndex(target: ReportTarget, get?: ReportGet): Promise<CiRunIndex | null>;
+/** The text `chant ci runs` prints: one line per run, newest first. */
+export declare function formatCiRunIndex(index: CiRunIndex): string;
+/** `chant ci runs` (#4098): list the index at the report URL. */
+export declare function runCiRuns(ctx: CommandContext): Promise<number>;
+//# sourceMappingURL=ci-run-index.d.ts.map

package/dist/workspace/ci-run-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-run-index.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-run-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAwC,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAG3H,eAAO,MAAM,sBAAsB,0FAA0F,CAAC;AAC9H,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAC7C,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAClD,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACtB,yDAAyD;IACzD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC;IACtB,qEAAqE;IACrE,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,sBAAsB,CAAC;IACvC,QAAQ,EAAE,OAAO,qBAAqB,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AAID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAc7G;AAED,qGAAqG;AACrG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,EAAE,CAEtH;AAKD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;AAED,gHAAgH;AAChH,wBAAsB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,GAAE,SAA6B,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAQzH;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAS1D;AAID,iEAAiE;AACjE,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAcpE"}

package/dist/workspace/ci-run-index.js

@@ -0,0 +1,162 @@
+/**
+ * The run index (#4098, epic #4101): where the chant runner says which jobs it
+ * ran, at the `--report-url` root, for behold and the demo kiosk to find runs
+ * without a forge or a workflow file.
+ *
+ * ```
+ * <url>/runs/index.json
+ * ```
+ *
+ * One document, `ci-run-index/v1` (`ci-run-index.schema.json`). Each settled
+ * `chant ci run` job with `--report-url` set adds an entry to its front, so
+ * the newest run is first, and the list is cut to the newest `limit` entries,
+ * 200 by default. An entry's `key` is the folder the job's report went to
+ * (`reportKey`, `<pr>/<commit>`), so a reader goes from the index to
+ * `<url>/<key>/pr-<job>.json`.
+ *
+ * The update reads the index, changes it and writes it back through the same
+ * `file://` and `s3://` paths the report upload uses (pr-report-url.ts). A
+ * `file://` write goes through a temporary name and a rename. Two runners
+ * updating one index at once can lose an entry, and that is out of scope:
+ * `chant ci serve` is one host. Within one process the updates for one URL
+ * take turns, so `ci serve --max-jobs 2` does not race itself.
+ *
+ * An index that can't be parsed is replaced with a warning. An index this
+ * chant can't read for any other reason, or a newer contract, is left alone
+ * with a warning. Nothing here fails a job.
+ */
+import { formatError } from "../cli/format.js";
+import { parseReportUrl, reportGet, reportPut } from "../pr-report-url.js";
+import { readerVersion } from "./declaration.js";
+export const CI_RUN_INDEX_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/ci-run-index/v1/ci-run-index.schema.json";
+export const CI_RUN_INDEX_CONTRACT = 1;
+/** The first chant that writes the index. */
+export const CI_RUN_INDEX_FLOOR = "0.124.31";
+/** Where the index is kept, below the report URL. */
+export const CI_RUN_INDEX_KEY = "runs/index.json";
+/** How many entries the index keeps unless told otherwise. */
+export const CI_RUN_INDEX_LIMIT = 200;
+const messageOf = (err) => (err instanceof Error ? err.message : String(err));
+/** The index as `text` holds it, or why it can't be used: `corrupt` is replaced, `newer` is left alone. */
+export function parseCiRunIndex(text) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (err) {
+        return { corrupt: `it is not JSON (${messageOf(err)})` };
+    }
+    if (doc === null || typeof doc !== "object" || Array.isArray(doc))
+        return { corrupt: "it is not an object" };
+    const d = doc;
+    if (typeof d.contract === "number" && d.contract > CI_RUN_INDEX_CONTRACT)
+        return { newer: d.contract };
+    if (d.contract !== CI_RUN_INDEX_CONTRACT)
+        return { corrupt: "it is not a ci-run-index document" };
+    if (!Array.isArray(d.runs))
+        return { corrupt: "it has no runs list" };
+    const runs = d.runs.filter((r) => r !== null && typeof r === "object" && typeof r.runId === "string");
+    return { index: { ...doc, runs } };
+}
+/** `entry` at the front of `runs`, replacing an entry with its run id, cut to the newest `limit`. */
+export function addRunEntry(runs, entry, limit) {
+    return [entry, ...runs.filter((r) => r.runId !== entry.runId)].slice(0, limit);
+}
+/** The turn each index URL is waiting for, so updates in one process run one after another. */
+const turns = new Map();
+/**
+ * Add `entry` to the index at `target`. Never throws: a problem is a warning
+ * and the index stays as it was, or is replaced when it was unreadable JSON.
+ */
+export function updateCiRunIndex(input) {
+    const where = `${input.target.url}/${CI_RUN_INDEX_KEY}`;
+    const put = input.put ?? reportPut(input.target);
+    const get = input.get ?? reportGet(input.target);
+    const limit = Math.max(1, Math.floor(input.limit ?? CI_RUN_INDEX_LIMIT));
+    const work = async () => {
+        let runs = [];
+        try {
+            const text = await get(CI_RUN_INDEX_KEY);
+            if (text !== null) {
+                const parsed = parseCiRunIndex(text);
+                if ("corrupt" in parsed)
+                    input.warn(`the run index at ${where} is replaced, since ${parsed.corrupt}`);
+                else if ("newer" in parsed)
+                    return input.warn(`the run index at ${where} is contract ${parsed.newer}, which this chant does not write; it is left as it is`);
+                else
+                    runs = parsed.index.runs;
+            }
+        }
+        catch (err) {
+            return input.warn(`could not read the run index at ${where}, so it is not updated: ${messageOf(err)}`);
+        }
+        const index = {
+            $schema: CI_RUN_INDEX_SCHEMA_ID,
+            contract: CI_RUN_INDEX_CONTRACT,
+            chant: readerVersion(),
+            updated: (input.now?.() ?? new Date()).toISOString(),
+            runs: addRunEntry(runs, input.entry, limit),
+        };
+        try {
+            await put(CI_RUN_INDEX_KEY, JSON.stringify(index, null, 2) + "\n", "application/json");
+        }
+        catch (err) {
+            input.warn(`could not write the run index at ${where}: ${messageOf(err)}`);
+        }
+    };
+    const previous = turns.get(where) ?? Promise.resolve();
+    const next = previous.then(work, work);
+    const settled = next.catch(() => undefined);
+    turns.set(where, settled);
+    void settled.then(() => {
+        if (turns.get(where) === settled)
+            turns.delete(where);
+    });
+    return next.catch((err) => input.warn(`could not update the run index at ${where}: ${messageOf(err)}`));
+}
+/** The index at `target`, or null when none is there. Throws a line a person can read when it can't be read. */
+export async function readCiRunIndex(target, get = reportGet(target)) {
+    const where = `${target.url}/${CI_RUN_INDEX_KEY}`;
+    const text = await get(CI_RUN_INDEX_KEY);
+    if (text === null)
+        return null;
+    const parsed = parseCiRunIndex(text);
+    if ("corrupt" in parsed)
+        throw new Error(`the run index at ${where} is unusable: ${parsed.corrupt}`);
+    if ("newer" in parsed)
+        throw new Error(`the run index at ${where} is contract ${parsed.newer}; this chant reads contract ${CI_RUN_INDEX_CONTRACT}`);
+    return parsed.index;
+}
+/** The text `chant ci runs` prints: one line per run, newest first. */
+export function formatCiRunIndex(index) {
+    if (index.runs.length === 0)
+        return "no runs in the index";
+    return index.runs
+        .map((r) => {
+        const pr = r.pr === null ? "no PR" : `PR ${r.pr}`;
+        const why = r.status === "fail" ? ` (${r.failure?.code ?? "failed"})` : "";
+        return `${r.ended}  ${r.job.padEnd(5)}  ${r.status}${why}  ${pr}  ${r.commit.slice(0, 12)}  ${r.runId}  ${r.key}`;
+    })
+        .join("\n");
+}
+const RUNS_USAGE = "chant ci runs --report-url <s3://<bucket>/<prefix> | file://<directory>> [--json]";
+/** `chant ci runs` (#4098): list the index at the report URL. */
+export async function runCiRuns(ctx) {
+    try {
+        const raw = ctx.args.reportUrl;
+        if (!raw)
+            throw new Error("--report-url names where the index is kept");
+        const target = parseReportUrl(raw);
+        if ("error" in target)
+            throw new Error(target.error);
+        const index = await readCiRunIndex(target);
+        if (index === null)
+            throw new Error(`there is no run index at ${target.url}/${CI_RUN_INDEX_KEY}`);
+        console.log(ctx.args.json ? JSON.stringify(index, null, 2) : formatCiRunIndex(index));
+        return 0;
+    }
+    catch (err) {
+        console.error(formatError({ message: `chant ci runs: ${messageOf(err)}`, hint: RUNS_USAGE }));
+        return 1;
+    }
+}

package/dist/workspace/ci-run-index.schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/workspace/ci-run-index/v1/ci-run-index.schema.json",
+  "title": "chant ci run index",
+  "description": "The runs the chant runner has run, kept at <report-url>/runs/index.json (#4098, epic #4101) so a reader outside CI finds them without a forge or a workflow file. `chant ci run` adds an entry to the front after each job settles when --report-url is set, so the list is newest first, and keeps the newest 200 entries unless --run-index-limit says otherwise. `chant ci runs --json` prints the same document. An entry's `key` is the folder the job's report is under, below the report URL. The update is a read, a change and a write of the whole file, through the same s3:// and file:// paths the report upload uses; a file:// write goes through a temporary name and a rename. Two runners updating one index at once can lose an entry. That is out of scope, because `chant ci serve` is one host. Version 1 of the workspace read contract. Readers ignore fields they do not know; a field is only ever added within a version. Written by chant 0.124.31 and newer.",
+  "type": "object",
+  "required": ["$schema", "contract", "chant", "updated", "runs"],
+  "properties": {
+    "$schema": { "const": "https://intentius.io/chant/schemas/workspace/ci-run-index/v1/ci-run-index.schema.json" },
+    "contract": { "const": 1 },
+    "chant": { "type": "string", "description": "The chant that last wrote the index." },
+    "updated": { "type": "string", "description": "When the index was last written." },
+    "runs": {
+      "type": "array",
+      "description": "Newest first, at most the limit the writer was given (200 by default).",
+      "items": { "$ref": "#/$defs/run" }
+    }
+  },
+  "$defs": {
+    "run": {
+      "type": "object",
+      "required": ["job", "pr", "commit", "status", "started", "ended", "runId", "key", "runOrigin"],
+      "if": { "properties": { "status": { "const": "fail" } } },
+      "then": { "required": ["failure"], "properties": { "failure": { "type": "object" } } },
+      "properties": {
+        "job": { "enum": ["plan", "apply"] },
+        "pr": { "type": ["integer", "null"], "minimum": 1, "description": "The pull or merge request number: the one the job's report names, else --pr. null when neither has one." },
+        "commit": { "type": "string", "pattern": "^[0-9a-f]{40,64}$", "description": "The full commit the job ran at." },
+        "status": { "enum": ["ok", "fail"] },
+        "failure": {
+          "type": "object",
+          "required": ["code"],
+          "description": "Present when status is fail. The same code the run record's failure carries: setup-failed, build-failed, a report's refusal or status, or command-failed.",
+          "properties": { "code": { "type": "string" } }
+        },
+        "member": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,39}$", "description": "The workspace member whose pipeline the job ran for. Absent outside a member." },
+        "started": { "type": "string", "description": "ISO-8601 instant the job started." },
+        "ended": { "type": "string", "description": "ISO-8601 instant the job settled." },
+        "runId": { "type": "string", "description": "The Op run id, as in the run ledger on chant/lifecycle." },
+        "key": { "type": "string", "description": "reportKey(pr, commit): <pr>/<commit>, with /<member> after for a member, and unknown for a missing pr. The job's report is <report-url>/<key>/pr-<job>.json." },
+        "runOrigin": {
+          "type": "object",
+          "required": ["forge"],
+          "description": "Where the run says it ran. { forge: \"chant\" } for a job the chant runner ran.",
+          "properties": { "forge": { "type": "string" } }
+        }
+      }
+    }
+  }
+}

package/dist/workspace/ci-run.d.ts

@@ -22,7 +22,10 @@
  * own variables. The forge values a generated job reads from `${{ ... }}`
  * expressions or GitLab's predefined variables come from flags here:
  * `BASE_SHA` from `--base`, `PR_NUMBER` from `--pr`, and the commit from
- * `--commit`.
+ * `--commit`. The values a forge job gets from repository secrets come from
+ * the host's secrets file (`--secrets`, ./ci-secrets.ts, #4096), and every
+ * secret value is redacted from the run's events, record, copied report and
+ * output by the executor's `redact` option.
  *
  * The steps run in a fresh checkout of the commit: a detached `git worktree`
  * in a temporary directory outside the repository, removed when the run
@@ -37,14 +40,20 @@
  * key is given, so `chant ci tick --source runs` (#4044) judges the commit
  * from it. Its events are `kind: "pipeline"` and `runtime: "ci"`, and the
  * record and the events carry `runOrigin: { forge: "chant" }`.
+ *
+ * With a forge client (#4097) the job also sets a commit status at its
+ * commit: `pending` when it starts, `success` or `failure` when it settles.
+ * A status the forge refuses is a warning and never fails the job.
  */
 import { type PrLoopJob, type PrLoopPipelineOptions } from "../components/pr-pipeline.js";
-import { type ForgeKind } from "../pr-forge.js";
+import { type CommitStatus, type ForgeKind } from "../pr-forge.js";
 import type { CommandContext } from "../cli/registry.js";
 import type { RunOrigin } from "../lifecycle/release-ledger.js";
 import { type OpRunResult, type StepRecord } from "../op/local-executor.js";
 import type { OpRunFailureReason, OpRunRecord } from "../op/runtime.js";
 import type { OpConfig } from "../op/types.js";
+import { type Redact } from "../op/redact.js";
+import { type CiSecrets } from "./ci-secrets.js";
 /** The two jobs a pull-request pipeline has. */
 export type CiJobName = PrLoopJob["jobName"];
 export declare const CI_JOB_NAMES: readonly CiJobName[];
@@ -74,11 +83,14 @@ export declare class CiRunError extends Error {
 }
 /**
  * The job's environment: the runner's base variables, the forge variables
- * and `passEnv` names it has, `CHANT_ENV` as a generated workflow sets it,
- * the commit as the forge spells it, and the job's own variables. A job
- * variable the forge fills from an expression comes from a flag, or from
- * the runner's environment for a token such as `GITHUB_TOKEN`; a literal
- * one, such as `CHANT_RUN_EVENTS_DIR`, is kept as it is.
+ * and `passEnv` names it has, the job's secrets from the host's secrets file
+ * (#4096), `CHANT_ENV` as a generated workflow sets it, the commit as the
+ * forge spells it, and the job's own variables. A job variable the forge
+ * fills from an expression comes from a flag, or from a secret or the
+ * runner's environment for a token such as `GITHUB_TOKEN`; a literal one,
+ * such as `CHANT_RUN_EVENTS_DIR`, is kept as it is. A secret replaces the
+ * runner's variable of the same name, and none replaces a variable the
+ * runner sets for the job. `CHANT_RUNNER_KEY` is never in it.
  */
 export declare function ciJobEnv(job: PrLoopJob, input: {
     forge: ForgeKind;
@@ -86,6 +98,8 @@ export declare function ciJobEnv(job: PrLoopJob, input: {
     values: CiRunValues;
     hostEnv: Record<string, string | undefined>;
     passEnv?: readonly string[];
+    /** The secrets this job gets, from {@link ciSecretsFor}. */
+    secrets?: Record<string, string>;
 }): Record<string, string>;
 /** What {@link ciJobOp} builds the Op from. */
 export interface CiJobOpInput {
@@ -132,6 +146,51 @@ export declare function ciJobFailure(input: {
     records: readonly StepRecord[];
     reportDir: string;
 }): OpRunFailureReason | undefined;
+/** What posts a job's commit status (#4097): the `setCommitStatus` of a GitHub or Forgejo client. */
+export interface CiStatusClient {
+    setCommitStatus(sha: string, status: CommitStatus): Promise<void>;
+}
+/** Where a job's status goes (#4097). */
+export interface CiStatusConfig {
+    client: CiStatusClient;
+    /** `--status-url`: the link the status carries, `{key}` standing for `<pr>/<commit>[/<member>]`. Otherwise an https `--report-url` is used. */
+    urlTemplate?: string;
+}
+/**
+ * A job's status context: `chant/pr-plan` for the plan, and for the apply
+ * `chant/<gate>`, which is `chant/pr-apply` unless `--gate` renamed the gate.
+ * pr-plan's own status is `chant/plan` (../pr-loop.ts), a different context.
+ */
+export declare function ciStatusContext(job: CiJobName, gate?: string): string;
+/**
+ * The link a job's status carries: the `--status-url` template with `{key}`
+ * filled, else the https `--report-url` followed by the key and a slash, else
+ * none (an `s3://` or `file://` URL is not one a browser opens).
+ */
+export declare function ciStatusUrl(input: {
+    urlTemplate?: string;
+    reportUrl?: string;
+    pr?: number;
+    commit: string;
+    member?: string;
+}): string | undefined;
+/** What the settled status says: a short summary, or on failure the record's code and reason. */
+export declare function ciStatusSettled(op: string, result: Pick<CiRunResult, "status" | "record" | "failure">, seconds: number): Pick<CommitStatus, "state" | "description">;
+/**
+ * The status client for `chant ci run` and `chant ci serve` (#4097), or none:
+ * off with `--no-status`, on GitLab (its client has no commit status call
+ * here), and without a forge token. A token with the rest of the forge's
+ * variables missing gives a warning instead.
+ */
+export declare function ciStatusFromEnv(input: {
+    forge: ForgeKind;
+    hostEnv: Record<string, string | undefined>;
+    noStatus?: boolean;
+    statusUrl?: string;
+}): {
+    status?: CiStatusConfig;
+    warning?: string;
+};
 /** What `chant ci run` runs. */
 export interface CiRunRequest {
     /** Where the command was run: the project, or a workspace member's directory. */
@@ -156,8 +215,16 @@ export interface CiRunRequest {
     passEnv?: readonly string[];
     /** The runner's environment. Default `process.env`. */
     hostEnv?: Record<string, string | undefined>;
+    /**
+     * The host's secrets file, read (#4096, `--secrets`): the job gets the
+     * secrets its allowlist names, and every value in it is redacted from the
+     * run's events, record, copied report and output.
+     */
+    secrets?: CiSecrets;
     /** `--output`: where the job's report is copied, from `cwd`. Default `.chant/pr`. */
     output?: string;
+    /** `--run-index-limit`: how many runs the index at `loop.reportUrl` keeps (#4098). Default 200. */
+    runIndexLimit?: number;
     /** A runner key, PEM, that signs the run's record. */
     runnerKey?: string;
     /**
@@ -181,6 +248,8 @@ export interface CiRunRequest {
      * failed. `chant ci serve` names one per `prApplyRecordKey`.
      */
     resumeRecord?: string;
+    /** Set a commit status at the job's commit (#4097). Absent: none is set. `chant ci run` builds it from the environment. */
+    status?: CiStatusConfig;
     signal?: AbortSignal;
 }
 export interface CiRunResult {
@@ -215,8 +284,16 @@ export declare function ciJobPlace(cwd: string, top: string): {
  * before anything runs when the request can't be run.
  */
 export declare function ciRun(req: CiRunRequest): Promise<CiRunResult>;
+/**
+ * Redact every text file under `dir` in place (#4096): the job's report, its
+ * change set and its component events, as `ci run` copied them out. A
+ * JSON file stays JSON. A file with a NUL byte is taken as binary and left.
+ */
+export declare function redactTree(dir: string, redact: Redact): void;
 /** The text `chant ci run` prints when the run settles. */
 export declare function formatCiRun(r: CiRunResult): string;
+/** The secrets file `--secrets` names, else the one `CHANT_CI_SECRETS` names, read; undefined when neither names one (#4096). */
+export declare function ciSecretsOf(flag: string | undefined, env?: Record<string, string | undefined>): CiSecrets | undefined;
 /** `chant ci run plan|apply` (#4094). */
 export declare function runCiRun(ctx: CommandContext): Promise<number>;
 //# sourceMappingURL=ci-run.d.ts.map

package/dist/workspace/ci-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-run.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EAA+E,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpK,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK7D,OAAO,EAA8B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,aAAa,CAAC;AAO3E,gDAAgD;AAChD,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAC7C,eAAO,MAAM,YAAY,EAAE,SAAS,SAAS,EAAsB,CAAC;AAEpE,qEAAqE;AACrE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAA0C,CAAC;AAE5F,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,SAA8B,CAAC;AAEjE,uEAAuE;AACvE,eAAO,MAAM,eAAe,YAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAU,CAAC;AAEnI;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,CACP,CAAC;AAKX,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACtI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwBxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,0IAA0I;AAC1I,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ,CAoBrD;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,GAAG,SAAS,CAmCvJ;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,CAAC;IACjB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6HAA6H;IAC7H,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB;AA4BD,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAMrF;AAyBD;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmGnE;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CASlD;AAYD,yCAAyC;AACzC,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CnE"}
+{"version":3,"file":"ci-run.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAMH,OAAO,EAA+E,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpK,OAAO,EAAiE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK7D,OAAO,EAA8B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAOvG,gDAAgD;AAChD,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAC7C,eAAO,MAAM,YAAY,EAAE,SAAS,SAAS,EAAsB,CAAC;AAEpE,qEAAqE;AACrE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAA0C,CAAC;AAE5F,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,SAA8B,CAAC;AAEjE,uEAAuE;AACvE,eAAO,MAAM,eAAe,YAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAU,CAAC;AAEnI;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,CACP,CAAC;AAKX,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE;IACL,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,0IAA0I;AAC1I,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ,CAoBrD;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,GAAG,SAAS,CAmCvJ;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,+IAA+I;IAC/I,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMjJ;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,aAAa,CAAC,CAKpK;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/L;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,CAAC;IACjB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6HAA6H;IAC7H,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2HAA2H;IAC3H,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB;AA4BD,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAMrF;AA0ED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2BnE;AA+HD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAc5D;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CASlD;AAyBD,iIAAiI;AACjI,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,SAAS,GAAG,SAAS,CAGlI;AAED,yCAAyC;AACzC,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsDnE"}