@intentius/chant 0.124.31 → 0.124.33

package/dist/workspace/ci-runner-start.d.ts

@@ -0,0 +1,77 @@
+/**
+ * `chant ci runner-start sign|verify` and `chant ci run --require-runner-start`
+ * (#4147): the runner-start statement (../runner-start.ts) checked against
+ * `.chant/trust.json` at base.
+ *
+ * - `sign` is for the provisioner that starts a runner for one job: it signs
+ *   the job's ids with a runner key the job never holds and prints the
+ *   envelope, which the provisioner puts where the job looks for it.
+ * - `verify` is for the job: it names itself from the forge's variables,
+ *   reads the statement, and fails unless a runner key `.chant/trust.json`
+ *   at base lists, whose principal holds the `runner` role, signed it for
+ *   this job.
+ * - `ci run --require-runner-start` makes the same check before the job's
+ *   first step, so an apply refuses before it trades for any credentials.
+ *
+ * Requiring the statement is opt-in (#4156). With nothing asking for it,
+ * nothing reads it, and a runner with none never refuses, warns or hides
+ * anything.
+ *
+ * {@link runnerStartReadiness} says whether a repository could require it
+ * at base, and what is missing, for the isolated-runners security group
+ * (#4168, section 8), whose WSP165 check reports these gaps.
+ */
+import type { CommandContext } from "../cli/registry.js";
+import { type CiJobIdentity, type RunnerStartVerdict } from "../runner-start.js";
+import { type TrustPolicy } from "./trust/policy.js";
+/**
+ * Check this job's runner-start statement against `.chant/trust.json` at
+ * `base`. `commit` is the commit the job runs, in place of the forge's
+ * variable. Never throws.
+ */
+export declare function checkRunnerStart(input: {
+    top: string;
+    base: string;
+    env?: Record<string, string | undefined>;
+    commit?: string;
+    readFile?: (path: string) => string;
+}): RunnerStartVerdict;
+/** One thing a repository lacks before it can require runner-start statements. */
+export interface RunnerStartGap {
+    /** Not a read-contract reason code: the isolated-runners group (#4168) maps each to its own security code. */
+    gap: "no-runner-key" | "no-runner-role" | "trust-unreadable";
+    reason: string;
+}
+/**
+ * Whether `.chant/trust.json` in `policy` lets a job require a runner-start
+ * statement: a key under `runners` whose principal holds the `runner` role.
+ * `configured` is true when there are no gaps. For the isolated-runners
+ * security group (#4168); nothing here refuses or warns.
+ */
+export declare function runnerStartReadiness(policy: TrustPolicy): {
+    configured: boolean;
+    gaps: RunnerStartGap[];
+};
+/** {@link runnerStartReadiness} for the repository around `cwd` at `base` (default `HEAD`). */
+export declare function runnerStartReadinessAt(cwd: string, base?: string): {
+    configured: boolean;
+    gaps: RunnerStartGap[];
+};
+/** The job named by `--job`: JSON, or `@<file>` holding it. */
+export declare function parseJobSpec(spec: string): CiJobIdentity;
+/** `chant ci runner-start sign|verify`. */
+export declare function runCiRunnerStart(ctx: CommandContext): Promise<number>;
+/**
+ * The check `ci run --require-runner-start` makes before the job's first
+ * step: the statement for this job, verified against `.chant/trust.json` at
+ * `base`. Throws with the verdict's reason unless it verified.
+ */
+export declare function requireRunnerStart(input: {
+    top: string;
+    base: string;
+    commit: string;
+    env: Record<string, string | undefined>;
+}): Extract<RunnerStartVerdict, {
+    status: "verified";
+}>;
+//# sourceMappingURL=ci-runner-start.d.ts.map

package/dist/workspace/ci-runner-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-runner-start.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-runner-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAKL,KAAK,aAAa,EAElB,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAOhF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,GAAG,kBAAkB,CAUzL;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,8GAA8G;IAC9G,GAAG,EAAE,eAAe,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,EAAE,CAAA;CAAE,CAezG;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAS,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,EAAE,CAAA;CAAE,CAKlH;AAkBD,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAuBxD;AAID,2CAA2C;AAC3C,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B3E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC,CAMrL"}

package/dist/workspace/ci-runner-start.js

@@ -0,0 +1,185 @@
+/**
+ * `chant ci runner-start sign|verify` and `chant ci run --require-runner-start`
+ * (#4147): the runner-start statement (../runner-start.ts) checked against
+ * `.chant/trust.json` at base.
+ *
+ * - `sign` is for the provisioner that starts a runner for one job: it signs
+ *   the job's ids with a runner key the job never holds and prints the
+ *   envelope, which the provisioner puts where the job looks for it.
+ * - `verify` is for the job: it names itself from the forge's variables,
+ *   reads the statement, and fails unless a runner key `.chant/trust.json`
+ *   at base lists, whose principal holds the `runner` role, signed it for
+ *   this job.
+ * - `ci run --require-runner-start` makes the same check before the job's
+ *   first step, so an apply refuses before it trades for any credentials.
+ *
+ * Requiring the statement is opt-in (#4156). With nothing asking for it,
+ * nothing reads it, and a runner with none never refuses, warns or hides
+ * anything.
+ *
+ * {@link runnerStartReadiness} says whether a repository could require it
+ * at base, and what is missing, for the isolated-runners security group
+ * (#4168, section 8), whose WSP165 check reports these gaps.
+ */
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { formatError } from "../cli/format.js";
+import { ciJobFromEnv, RUNNER_START_SIGNER_ROLE, signRunnerStart, verifyRunnerStartForJob, } from "../runner-start.js";
+import { gitRevisionSource } from "./record-source.js";
+import { gitTop } from "./tree.js";
+import { loadRunnerKey } from "./trust/dsse.js";
+import { emptyPolicy, readTrustPolicy } from "./trust/policy.js";
+/** The policy at `base` in the repository around `cwd`. */
+function policyAt(top, base) {
+    return readTrustPolicy(gitRevisionSource(top, base), base);
+}
+/**
+ * Check this job's runner-start statement against `.chant/trust.json` at
+ * `base`. `commit` is the commit the job runs, in place of the forge's
+ * variable. Never throws.
+ */
+export function checkRunnerStart(input) {
+    const policy = policyAt(input.top, input.base);
+    if (policy.problems.length > 0)
+        return { status: "untrusted", reason: `.chant/trust.json at ${input.base.slice(0, 12)} cannot be read: ${policy.problems.join("; ")}` };
+    return verifyRunnerStartForJob({
+        runners: policy.runners,
+        roles: policy.roles,
+        ...(input.env ? { env: input.env } : {}),
+        ...(input.commit ? { commit: input.commit } : {}),
+        ...(input.readFile ? { readFile: input.readFile } : {}),
+    });
+}
+/**
+ * Whether `.chant/trust.json` in `policy` lets a job require a runner-start
+ * statement: a key under `runners` whose principal holds the `runner` role.
+ * `configured` is true when there are no gaps. For the isolated-runners
+ * security group (#4168); nothing here refuses or warns.
+ */
+export function runnerStartReadiness(policy) {
+    const gaps = [];
+    if (policy.problems.length > 0) {
+        gaps.push({ gap: "trust-unreadable", reason: `.chant/trust.json cannot be read: ${policy.problems.join("; ")}` });
+        return { configured: false, gaps };
+    }
+    if (policy.runners.length === 0) {
+        gaps.push({ gap: "no-runner-key", reason: ".chant/trust.json lists no key under runners for a provisioner to sign with: chant workspace trust runner add <principal> --key <ssh-ed25519 line>" });
+    }
+    else {
+        const holders = new Set((policy.roles[RUNNER_START_SIGNER_ROLE] ?? []).map((p) => p.normalize("NFKC").trim().toLowerCase()));
+        if (!policy.runners.some((r) => holders.has(r.principal.normalize("NFKC").trim().toLowerCase()))) {
+            gaps.push({ gap: "no-runner-role", reason: `no principal under runners holds the ${RUNNER_START_SIGNER_ROLE} role in .chant/trust.json: "roles": { "${RUNNER_START_SIGNER_ROLE}": ["<principal>"] }` });
+        }
+    }
+    return { configured: gaps.length === 0, gaps };
+}
+/** {@link runnerStartReadiness} for the repository around `cwd` at `base` (default `HEAD`). */
+export function runnerStartReadinessAt(cwd, base = "HEAD") {
+    const top = gitTop(cwd);
+    if (!top)
+        return runnerStartReadiness(emptyPolicy(null, [`${cwd} is not in a git repository`]));
+    const commit = revParse(top, base);
+    return runnerStartReadiness(commit ? policyAt(top, commit) : emptyPolicy(null, [`${base} is not a commit`]));
+}
+function revParse(top, rev) {
+    try {
+        return execFileSync("git", ["rev-parse", "--verify", "-q", `${rev}^{commit}`], { cwd: top, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The base `verify` reads trust at: `--base`, else the remote's default branch, else `HEAD`. */
+function verifyBase(top, base) {
+    const rev = base ?? (revParse(top, "refs/remotes/origin/HEAD") ? "refs/remotes/origin/HEAD" : "HEAD");
+    const commit = revParse(top, rev);
+    if (!commit)
+        throw new Error(`--base ${rev} is not a commit in this repository`);
+    return commit;
+}
+/** The job named by `--job`: JSON, or `@<file>` holding it. */
+export function parseJobSpec(spec) {
+    const text = spec.startsWith("@") ? readFileSync(resolve(spec.slice(1)), "utf8") : spec;
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new Error("--job takes the job as JSON, or @<file> holding it: {\"system\":\"github\",\"repo\":\"owner/name\",\"run\":\"<id>\",\"attempt\":\"1\",\"job\":\"apply\",\"commit\":\"<sha>\",\"runner\":\"<name>\"}");
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("--job takes a JSON object");
+    const o = raw;
+    const str = (k) => (o[k] === undefined ? undefined : String(o[k]));
+    const known = ["system", "repo", "run", "attempt", "job", "commit", "runner"];
+    const extra = Object.keys(o).filter((k) => !known.includes(k));
+    if (extra.length > 0)
+        throw new Error(`--job has fields chant does not know: ${extra.join(", ")}`);
+    return {
+        system: (str("system") ?? ""),
+        repo: str("repo") ?? "",
+        run: str("run") ?? "",
+        attempt: str("attempt") ?? "1",
+        job: str("job") ?? "",
+        commit: str("commit") ?? "",
+        ...(str("runner") ? { runner: str("runner") } : {}),
+    };
+}
+const USAGE = "chant ci runner-start sign --key <runner key.pem> --principal <name> --job <json|@file> [-o <file>]\n  chant ci runner-start verify [--base <rev>] [--commit <sha>] [--json]";
+/** `chant ci runner-start sign|verify`. */
+export async function runCiRunnerStart(ctx) {
+    const { args } = ctx;
+    const action = args.extraPositional;
+    try {
+        if (action === "sign") {
+            if (!args.key)
+                throw new Error("--key names the provisioner's runner key, an Ed25519 private key in PEM, which the job never holds");
+            if (!args.ciPrincipal)
+                throw new Error("--principal names the principal .chant/trust.json lists the key for under runners");
+            if (!args.ciJob)
+                throw new Error("--job names the job the runner was started for, as JSON or @<file>");
+            const job = parseJobSpec(args.ciJob);
+            const pem = readFileSync(resolve(args.key), "utf8");
+            const loaded = loadRunnerKey(pem);
+            const envelope = signRunnerStart(job, { principal: args.ciPrincipal, key: loaded.key, publicKey: loaded.publicKey });
+            const text = `${JSON.stringify(envelope)}\n`;
+            if (args.output)
+                writeFileSync(resolve(args.output), text, { mode: 0o644 });
+            else
+                process.stdout.write(text);
+            return 0;
+        }
+        if (action === "verify") {
+            const top = gitTop(process.cwd());
+            if (!top)
+                throw new Error("verify reads .chant/trust.json at a commit, and this directory is not in a git repository");
+            const base = verifyBase(top, args.base);
+            const verdict = checkRunnerStart({ top, base, ...(args.commit ? { commit: args.commit } : {}) });
+            if (args.json)
+                process.stdout.write(`${JSON.stringify({ ...verdict, base })}\n`);
+            else
+                console.error(`ci runner-start: ${verdict.status}: ${verdict.reason}`);
+            return verdict.status === "verified" ? 0 : 1;
+        }
+        throw new Error(`ci runner-start takes sign or verify${action ? `, not ${JSON.stringify(action)}` : ""}`);
+    }
+    catch (err) {
+        console.error(formatError({ message: `chant ci runner-start: ${err instanceof Error ? err.message : String(err)}`, hint: USAGE }));
+        return 1;
+    }
+}
+/**
+ * The check `ci run --require-runner-start` makes before the job's first
+ * step: the statement for this job, verified against `.chant/trust.json` at
+ * `base`. Throws with the verdict's reason unless it verified.
+ */
+export function requireRunnerStart(input) {
+    const named = ciJobFromEnv(input.env);
+    if (!named.ok)
+        throw new Error(`--require-runner-start needs a forge job to check: ${named.reason}`);
+    const verdict = checkRunnerStart({ top: input.top, base: input.base, env: input.env, commit: input.commit });
+    if (verdict.status !== "verified")
+        throw new Error(`--require-runner-start: ${verdict.status}: ${verdict.reason}`);
+    return verdict;
+}

package/dist/workspace/ci-serve.d.ts

@@ -3,11 +3,15 @@
  * host. It polls the forge for the open pull requests into the target branch
  * and for the branch's head, and runs the pull-request jobs with
  * {@link ciRun} (./ci-run.ts): `plan` for each new pull request head, and
- * `apply` for each new commit on the target branch, measured from the head
- * the previous poll saw (the push's `before`).
+ * `record` for each new commit on the target branch (#4168), measured from
+ * the head the previous poll saw (the push's `before`). The record applies
+ * nothing; with `applyOnMerge` (`--apply-on-merge`) the commit gets `apply`
+ * in its place, as before #4168. After each job settles it runs `ci tick`
+ * from the runs the jobs recorded, when the declaration has `ci.green`.
+ * What the list below says of the apply holds for it under `applyOnMerge`.
  *
  * - Dedupe. A state file in the state directory keeps every job it started,
- *   keyed by job and commit (`plan:<pr>:<sha>`, `apply:<sha>`), with how it
+ *   keyed by job and commit (`plan:<pr>:<sha>`, `record:<sha>`, `apply:<sha>`), with how it
  *   ended, and the target head the last apply was measured to. A job already
  *   in it is not started again, unless it failed and `rerunFailed` asks for
  *   it: the forge's "re-run failed jobs".
@@ -23,8 +27,34 @@
  *   as its `--resume` record, so a re-run of a failed apply at the same
  *   commit finishes under the approval it has. This replaces the forge's CI
  *   cache.
+ * - A gate per wave (#4003). With `--wave-gate` the apply job runs
+ *   `pr-apply --wave-gate`, which applies the waves in order and stops at
+ *   the first whose moved plan waits on its own gate. The job fails, and the
+ *   resume record keeps the waves that applied; once the wave's plan is
+ *   approved, `rerunFailed` runs the apply again and it carries on from
+ *   that wave.
  * - Capacity. At most `maxJobs` jobs run at once. A job over the limit is not
  *   recorded, so a later poll starts it.
+ * - Fast-forwards only (#4122). An apply runs only when the target's new head
+ *   descends from the head seen before it. Any other move, such as a force
+ *   push back to an older commit, is recorded as seen and not applied.
+ * - `[skip ci]` (#4122). A target head or pull request head whose commit
+ *   message says `[skip ci]` or `[ci skip]` is recorded as seen and not run,
+ *   as Actions does.
+ * - Build requests (#4169). With `buildCommand`, each `ci/build/<sha>`
+ *   tag the tick or `ci run --at` pushed is served once: the command runs
+ *   in a fresh detached worktree of the commit, with `CHANT_BUILD_COMMIT`,
+ *   `CHANT_BUILD_PHASES` (comma-separated) and `CHANT_BUILD_REASON` set,
+ *   and is expected to run the phases' Ops (`chant run <op>`), whose
+ *   records the tick reads. A build counts against `maxJobs`, and the state
+ *   file keeps it under `build:<sha>`. Without `buildCommand` the tags are
+ *   left alone.
+ * - The forge's ledger (#4121). Before each job, when no other job of this
+ *   serve runs, the clone's `chant/lifecycle` follows the forge's: it is
+ *   deleted when the forge has none, and reset to the forge's when neither
+ *   contains the other. Each is a warning. A local branch ahead of the
+ *   forge's keeps its facts, and the job's push sends them. Nothing here
+ *   pushes the ledger.
  *
  * Host mode only: each job runs in a fresh worktree on this host as this
  * user, with the clean environment `ciRun` gives it. A pull request from a
@@ -35,6 +65,7 @@
  * {@link ciServeObserve} is the poll that makes them; a webhook handler would
  * turn a checked payload into the same triggers and schedule them.
  */
+import { type BuildRequest } from "./ci-builds.js";
 import { type OpenPullRequest } from "../pr-forge.js";
 import type { CommandContext } from "../cli/registry.js";
 import { type CiJobName, type CiRunRequest, type CiRunResult } from "./ci-run.js";
@@ -47,7 +78,11 @@ export interface CiServeForge {
     /** The merged pull request that produced a commit, as pr-apply finds it (`pullRequestFor`). Without it an apply gets no `--pr`. */
     pullRequestFor?(sha: string): Promise<number | null>;
 }
-/** A job the forge's state calls for: the plan of a pull request's head, or the apply of a target-branch commit. */
+/**
+ * A job the forge's state calls for: the plan of a pull request's head, or
+ * for a target-branch commit its record (#4168) or, with `applyOnMerge`,
+ * its apply.
+ */
 export type CiServeTrigger = {
     job: "plan";
     commit: string;
@@ -55,7 +90,7 @@ export type CiServeTrigger = {
     pr: number;
     rerun?: boolean;
 } | {
-    job: "apply";
+    job: "apply" | "record";
     commit: string;
     base: string;
     rerun?: boolean;
@@ -85,9 +120,18 @@ export interface CiServeState {
     env: string;
     branch: string;
     member?: string;
-    /** The target branch's head the last apply was measured to, or the head the first poll found. */
+    /** The target branch's head the last apply was measured to, or the last head seen and not applied. */
     target?: string;
     jobs: Record<string, CiServeJobState>;
+    /** Plans seen and not run, by state key, with why (#4122). */
+    skipped?: Record<string, "skip-ci">;
+    /** The build requests served (#4169), by `build:<sha>`, with how each ended. */
+    builds?: Record<string, {
+        tag: string;
+        status: "running" | "ok" | "fail";
+        startedAt: string;
+        settledAt?: string;
+    }>;
 }
 /** What a pass did, in order, for the log. */
 export type CiServeEvent = {
@@ -125,6 +169,30 @@ export type CiServeEvent = {
     status: "ok" | "fail";
     failure?: string;
     report?: string;
+} | {
+    type: "not-run";
+    job: CiJobName;
+    commit: string;
+    pr?: number;
+    reason: "not-fast-forward" | "skip-ci";
+    branch?: string;
+    from?: string;
+} | {
+    type: "ledger";
+    action: "deleted" | "reset";
+    local: string;
+    forge?: string;
+} | {
+    type: "build";
+    commit: string;
+    phases: string[];
+    status: "started" | "ok" | "fail" | "held";
+    exitCode?: number;
+}
+/** `ci tick` after the pass (#4168): the tags it made from the runs. */
+ | {
+    type: "tick";
+    made: string[];
 } | {
     type: "error";
     message: string;
@@ -147,6 +215,18 @@ export interface CiServeOptions {
     authors?: readonly string[];
     /** Run again the failed apply at the target's head, and the failed plans of open heads. */
     rerunFailed?: boolean;
+    /**
+     * Apply each new target-branch commit (#4168), as `ci serve` did before
+     * #4168. Default false: each new commit gets the record job, which applies
+     * nothing.
+     */
+    applyOnMerge?: boolean;
+    /**
+     * Run after each pass that settled a job (#4168): `ci tick` from the runs
+     * the jobs recorded. Returns the tags it made, or undefined when the
+     * declaration has no `ci.green`. The command passes one; a test may not.
+     */
+    tick?: () => Promise<string[] | undefined>;
     /** Passed to each job. `job.hostEnv` gets `GITHUB_REPOSITORY` set to `repo`. */
     job?: CiServeJobOptions;
     /** This process's lease identity. Default `currentHolderId()`. */
@@ -156,10 +236,22 @@ export interface CiServeOptions {
     now?: () => Date;
     /** Runs a job. Default {@link ciRun}. */
     run?: (req: CiRunRequest) => Promise<CiRunResult>;
+    /**
+     * The shell line that builds a requested commit (#4169), run in a fresh
+     * worktree of it. Without it `ci/build/<sha>` tags are not served.
+     */
+    buildCommand?: string;
+    /** Runs a build. Default: `sh -c <buildCommand>` in a detached worktree of the commit. */
+    build?: (input: {
+        top: string;
+        request: BuildRequest;
+        command: string;
+    }) => Promise<number>;
 }
 /** The jobs this process runs now, by state key, shared by every pass of one loop. */
 export interface CiServeRuntime {
-    inflight: Map<string, Promise<CiServeJobState>>;
+    /** Jobs and build requests (#4169) alike, by state key: they share `maxJobs`. */
+    inflight: Map<string, Promise<unknown>>;
 }
 export declare const newCiServeRuntime: () => CiServeRuntime;
 /** The state key of a job. */
@@ -168,17 +260,34 @@ export declare function ciServeKey(t: {
     commit: string;
     pr?: number;
 }): string;
+/**
+ * Make the clone's `chant/lifecycle` follow the forge's (#4121). The clone's
+ * branch outlives the forge's, so a ledger the forge deleted or rewrote would
+ * make the next pr-apply find the two diverged and stall.
+ *
+ * - The forge has none: the local branch and its remote-tracking ref go.
+ * - Neither contains the other: the local branch and its remote-tracking ref
+ *   are reset to the forge's tip.
+ * - The local branch is ahead of the forge's, or behind it, or the same: it
+ *   is left, and an apply's push sends what it holds that the forge lacks.
+ *
+ * Nothing is pushed, so a rewritten ledger never goes back to the forge. A
+ * forge that can't be reached leaves everything as it is; the job's own
+ * fetch says why.
+ */
+export declare function reconcileCiServeLedger(top: string): CiServeEvent | undefined;
 /** Where a serve keeps its state when `--state` names nowhere: beside the run events, in the repository's common git directory. */
 export declare function defaultCiServeStateDir(cwd: string): string;
 /** The state file, or a new one. */
 export declare function readCiServeState(file: string, fresh: Omit<CiServeState, "schema" | "jobs">): CiServeState;
 /**
  * One poll of the forge, as triggers: an apply when the target's head moved
- * since the last apply (none on the first poll, which only notes the head),
+ * since the last apply by a fast-forward (none on the first poll, which only
+ * notes the head, and none for a head whose message says `[skip ci]`),
  * then a plan for each open pull request head not yet planned, oldest pull
  * request first. A job already in the state file is left out unless it
- * failed and `rerunFailed` is set. The first poll's head is written to the
- * state file.
+ * failed and `rerunFailed` is set. The first poll's head, and a head seen
+ * and not applied, are written to the state file.
  */
 export declare function ciServeObserve(opts: CiServeOptions, rt?: CiServeRuntime): Promise<{
     triggers: CiServeTrigger[];
@@ -197,11 +306,21 @@ export interface CiServeScheduled {
  * reported and not recorded, so the next poll finds it again.
  */
 export declare function ciServeSchedule(opts: CiServeOptions, triggers: readonly CiServeTrigger[], rt?: CiServeRuntime): Promise<CiServeScheduled>;
-/** One pass: observe, schedule, and with `wait` wait for the jobs it started. */
+/** One pass: observe, schedule, serve build requests, and with `wait` wait for the jobs it started. */
 export declare function ciServePass(opts: CiServeOptions, rt?: CiServeRuntime, wait?: boolean): Promise<{
     events: CiServeEvent[];
     jobs: CiServeJobState[];
 }>;
+/**
+ * Serve the build requests (#4169): fetch the `ci/build/*` tags, and start
+ * `buildCommand` for each one not in the state file yet, oldest first, while
+ * fewer than `maxJobs` jobs run. A build that fails is recorded and not run
+ * again; the tick decides what its phases say.
+ */
+export declare function ciServeBuilds(opts: CiServeOptions, rt: CiServeRuntime): {
+    started: Promise<void>[];
+    events: CiServeEvent[];
+};
 /**
  * The loop: a pass every `intervalMs` until `signal` aborts, jobs running
  * across passes up to `maxJobs`. A pass the forge fails is logged and the

package/dist/workspace/ci-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-serve.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,OAAO,EAA2E,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAKxJ,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD,gHAAgH;AAChH,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxD,mIAAmI;IACnI,cAAc,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED,oHAAoH;AACpH,MAAM,MAAM,cAAc,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpE,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,CAAC,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACvC;AAED,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5G;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/H;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,mHAAmH;AACnH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,OAAO,CAAC,CAAC;AAErJ,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,gBAAgB,CAAC;IACxB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iHAAiH;IACjH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,2FAA2F;IAC3F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gFAAgF;IAChF,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,yCAAyC;IACzC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnD;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;CACjD;AAED,eAAO,MAAM,iBAAiB,QAAO,cAA2C,CAAC;AAEjF,8BAA8B;AAC9B,wBAAgB,UAAU,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErF;AAYD,mIAAmI;AACnI,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAsBD,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,YAAY,CAOzG;AAaD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,GAAE,cAAoC,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CA0CpK;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;IACpC,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,EAAE,EAAE,GAAE,cAAoC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyEpK;AAgDD,iFAAiF;AACjF,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,GAAE,cAAoC,EAAE,IAAI,UAAO,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAM3K;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBpH;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAkB1D;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAkBjE;AAUD,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKjE;AAED,gCAAgC;AAChC,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+ErE"}
+{"version":3,"file":"ci-serve.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAMH,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAExF,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAKtD,OAAO,EAA0F,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAKvK,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD,gHAAgH;AAChH,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxD,mIAAmI;IACnI,cAAc,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E;IAAE,GAAG,EAAE,OAAO,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/E,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,CAAC,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpH;AAED,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5G;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/H;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACxI;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AACpH,wEAAwE;GACtE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,mHAAmH;AACnH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,OAAO,CAAC,CAAC;AAErJ,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,gBAAgB,CAAC;IACxB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iHAAiH;IACjH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,2FAA2F;IAC3F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC3C,gFAAgF;IAChF,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,yCAAyC;IACzC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7F;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC;AAED,eAAO,MAAM,iBAAiB,QAAO,cAA2C,CAAC;AAEjF,8BAA8B;AAC9B,wBAAgB,UAAU,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErF;AAsBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAwB5E;AAuBD,mIAAmI;AACnI,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAsBD,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,YAAY,CAOzG;AAaD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,GAAE,cAAoC,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CAuEpK;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;IACpC,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,EAAE,EAAE,GAAE,cAAoC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+EpK;AAgDD,uGAAuG;AACvG,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,GAAE,cAAoC,EAAE,IAAI,UAAO,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAQ3K;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAA;CAAE,CA4C5H;AAoCD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBpH;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAiC1D;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAkBjE;AAUD,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKjE;AAED,gCAAgC;AAChC,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqGrE"}