@intentius/chant 0.124.40 → 0.124.42

package/dist/components/pr-pipeline.d.ts

@@ -8,8 +8,11 @@
  * values they read from the forge live here so the three cannot disagree.
  *
  * - The plan job runs `chant components pr-plan` against the pull request's
- *   target commit. It posts the note and the `chant/plan` status and writes
- *   nothing to `chant/lifecycle`, since it runs the pull request's code.
+ *   target commit. It writes nothing to `chant/lifecycle` and holds no forge
+ *   token, since it runs the pull request's code (#4295): it writes the note
+ *   and the status into its report with `--no-status`, and the `plan-note`
+ *   job after it posts them with `chant components pr-post`
+ *   ({@link prLoopPostJob}, ../ci-handover.ts).
  * - The record job (#4168 step 1, the default) runs `chant components
  *   pr-record` against the commit the push replaced. It plans the same
  *   members on the merged commit, stores the change set and writes the merge
@@ -80,6 +83,7 @@
 import type { ForgeKind } from "../pr-forge.js";
 import type { DriverComponent } from "./driver.js";
 import type { GatedWavePipelineOptions } from "./gated-wave-pipeline.js";
+import type { PipelineCloudIdentity } from "../ci-identity.js";
 /** Where both jobs write their reports, kept as a CI artifact. */
 export declare const PR_LOOP_REPORT_DIR = ".chant/pr";
 /**
@@ -124,6 +128,16 @@ export interface PrLoopPipelineOptions {
      * false, so a merge deploys nothing. `waveGate` needs it.
      */
     applyOnMerge?: boolean;
+    /**
+     * Apply an open pull request before it merges (#4301, ws-106): the apply
+     * job runs `pr-apply --before-merge` at the pull request's head, started
+     * by a `/chant apply` comment on GitHub and Forgejo, or on GitLab by a
+     * pipeline of the target branch with `CHANT_APPLY_PR` set. A merge still
+     * records. `pr-apply` refuses unless the declaration at base sets
+     * `ci.workflow: "apply-before-merge"`. It takes neither `applyOnMerge`,
+     * `waveGate` nor `build`.
+     */
+    applyBeforeMerge?: boolean;
     /**
      * Stream each job's run events (#4007): `--events-json` on both commands,
      * and `CHANT_RUN_EVENTS_DIR` set to {@link PR_LOOP_EVENTS_DIR}. Default false.
@@ -156,11 +170,27 @@ export interface PrLoopPipelineOptions {
      * wave. Set from `--wave-gate` beside `--pr-loop` ({@link prLoopWithWaves}).
      */
     waveGate?: string;
+    /**
+     * The plan and apply cloud identities (#4296), from `ci.identity.cloud`
+     * resolved for the pipeline's environment and member
+     * (`resolveCloudIdentity` in ../ci-identity.ts). The plan job trades its
+     * OIDC token for the plan identity before the checkout, the record job
+     * for the plan identity, and the apply jobs for the apply identity.
+     * Absent: no job requests an OIDC token.
+     */
+    identity?: PipelineCloudIdentity;
     /**
      * Which GitHub-shaped forge the workflow is for. Set by the forgejo
      * generator, which reuses the github one; a caller never needs to.
      */
     forge?: "github" | "forgejo";
+    /**
+     * An environment per open pull request (#4298, `ci.prEnvironment`): an
+     * `env-up` job on each opened, updated or reopened pull request, an
+     * `env-down` job when it closes, and an `env-sweep` job on a schedule
+     * ({@link prEnvJobs}). Set from `--pr-env` beside `--pr-loop`. Default false.
+     */
+    prEnvironment?: boolean;
 }
 /** One job's command and the forge values it reads, as environment variables for its step. */
 export interface PrLoopJob {
@@ -215,6 +245,22 @@ export declare function prLoopBuildLines(env: string, options?: PrLoopPipelineOp
  * the commands then run in its directory, so `--output` is relative to it.
  */
 export declare function prLoopJobs(forge: ForgeKind, env: string, options?: PrLoopPipelineOptions, member?: string): PrLoopJob[];
+/** The name of the job that posts the plan's note and status (#4295). */
+export declare const PR_PLAN_NOTE_JOB = "plan-note";
+/**
+ * The plan-note job's command and the values it reads (#4295). It runs in a
+ * fresh job after the plan, at the target branch's commit, and posts the
+ * note and the `chant/plan` status from the report the plan job handed on,
+ * with the forge token the plan job never held. `HEAD_SHA` is the commit
+ * the plan job checked out, `PR_NUMBER` the pull request, and on GitHub and
+ * Forgejo `PLAN_RESULT` the plan job's result, which fails the status when
+ * the plan job failed. `BASE_SHA` is the commit the note job checks out on
+ * GitLab, whose runner checks out the pipeline's own commit.
+ */
+export declare function prLoopPostJob(forge: ForgeKind, env: string, member?: string): {
+    command: string;
+    env: Record<string, string>;
+};
 /**
  * What starts the apply under apply on merge (#4168 step 9): on GitHub the
  * tick's workflow finishing (`workflow_run`, since tags its token pushes start
@@ -264,6 +310,16 @@ export declare function prRecordGroup(env: string, member?: string): string;
  * refuses a record made for another pull request, gate or digest.
  */
 export declare function prApplyRecordKey(env: string, commit: string, member?: string): string;
+/** The GitLab variable a person sets on a pipeline of the target branch to apply a merge request before it merges (#4301). */
+export declare const GITLAB_APPLY_PR_VAR = "CHANT_APPLY_PR";
+/** The comment that starts the apply before merge on GitHub and Forgejo (#4301). */
+export declare const APPLY_COMMENT = "/chant apply";
+/**
+ * The line that checks out pull request `$PR_NUMBER`'s head (#4301) in a job
+ * of the target branch: the forge's `refs/pull/<n>/head`, or GitLab's
+ * `refs/merge-requests/<n>/head`. A number that is not one fails the job.
+ */
+export declare function pullRequestCheckout(forge: ForgeKind): string;
 /**
  * The line that checks out the newest green commit of `branch` (#4168 step
  * 9), after fetching the branch and its tags, for the apply job. `chant ci
@@ -290,4 +346,38 @@ export declare function gitlabBaseFallback(branch?: string): string;
  * generators' default.
  */
 export declare function githubBaseFallback(branch?: string): string;
+/** Where the pull request environment jobs (#4298) write their reports, kept as a CI artifact. */
+export declare const PR_ENV_REPORT_DIR = ".chant/pr-env";
+/** The cron the generated `env-sweep` job runs on (#4298): hourly, at a minute off the hour. */
+export declare const PR_ENV_SWEEP_CRON = "17 * * * *";
+/** One job of a pull request's environment (#4298): its command and the forge values it reads. */
+export interface PrEnvJob {
+    jobName: "env-up" | "env-post" | "env-down" | "env-sweep";
+    /** The command line. `env-up` reads `$BASE_SHA` and `$PR_NUMBER`, `env-down` `$PR_NUMBER`. */
+    command: string;
+    /** Values the command reads, as the forge spells them. `CHANT_ENV` is the pull request's environment. */
+    env: Record<string, string>;
+    /** With `build`: the build and lint lines, run before the command. */
+    build?: string[];
+}
+/** The name of the job that keeps an environment's record and posts its note (#4298, #4295). */
+export declare const PR_ENV_POST_JOB = "env-post";
+/**
+ * The jobs of a pull request's environment (#4298), when `prEnvironment` is
+ * on, in this order:
+ *
+ * - `env-up` runs `chant components pr-env up --no-push`. It runs the
+ *   change's code, so it gets no forge token (#4295): it passes no
+ *   `--forge`, and it hands its report and its record on.
+ * - `env-post` runs `pr-env post` in a fresh job at the target branch's
+ *   commit, with the token: it keeps the record on chant/lifecycle and posts
+ *   the note and the `chant/pr-env` status. On GitHub and Forgejo it reads
+ *   the up job's result as `UP_RESULT`.
+ * - `env-down` runs `pr-env down --reason closed`, and `env-sweep` runs
+ *   `pr-env sweep`. Neither builds the change's code: a teardown reads the
+ *   markers off the live resources.
+ *
+ * Each writes its report under {@link PR_ENV_REPORT_DIR}.
+ */
+export declare function prEnvJobs(forge: ForgeKind, options?: PrLoopPipelineOptions, member?: string): PrEnvJob[];
 //# sourceMappingURL=pr-pipeline.d.ts.map

package/dist/components/pr-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAKtE,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sIAAsI;IACtI,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2OAA2O;IAC3O,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAkE3H;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,SAAS,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAQ3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAW3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,yIAAyI;AACzI,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D"}
+{"version":3,"file":"pr-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/pr-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5D,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,eAAe,mCAAmC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAW,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,aAAa,UAEzB,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAAqC,CAAC;AAErE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sIAAsI;IACtI,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2OAA2O;IAC3O,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACvD;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE,CAG3F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CA0F3H;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAc9H;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,SAAS,CAEzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,wBAAwB,GAAG,qBAAqB,CAQ3H;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAW3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,yIAAyI;AACzI,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAErF;AAoBD,8HAA8H;AAC9H,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,oFAAoF;AACpF,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAG5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,kGAAkG;AAClG,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IAC1D,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,gGAAgG;AAChG,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,qBAA0B,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,CAkC5G"}

package/dist/components/pr-pipeline.js

@@ -8,8 +8,11 @@
  * values they read from the forge live here so the three cannot disagree.
  *
  * - The plan job runs `chant components pr-plan` against the pull request's
- *   target commit. It posts the note and the `chant/plan` status and writes
- *   nothing to `chant/lifecycle`, since it runs the pull request's code.
+ *   target commit. It writes nothing to `chant/lifecycle` and holds no forge
+ *   token, since it runs the pull request's code (#4295): it writes the note
+ *   and the status into its report with `--no-status`, and the `plan-note`
+ *   job after it posts them with `chant components pr-post`
+ *   ({@link prLoopPostJob}, ../ci-handover.ts).
  * - The record job (#4168 step 1, the default) runs `chant components
  *   pr-record` against the commit the push replaced. It plans the same
  *   members on the merged commit, stores the change set and writes the merge
@@ -79,6 +82,7 @@
  */
 import { PR_APPLY_GATE } from "../pr-loop.js";
 import { CI_IMAGE, GITHUB_JOB_TOKEN } from "../ci-jobs.js";
+import { withoutForgeTokens } from "../ci-handover.js";
 import { EMPTY_TREE_SHA } from "./changed-files.js";
 import { layerWaves } from "../gated-waves.js";
 /** The variable `chant ci run` reads its runner key from (`RUNNER_KEY_ENV` in ../workspace/ci-green.ts). */
@@ -126,6 +130,13 @@ export function prLoopBuildLines(env, options = {}) {
  */
 export function prLoopJobs(forge, env, options = {}, member) {
     const gate = options.gate ?? PR_APPLY_GATE;
+    const early = options.applyBeforeMerge === true;
+    if (early && options.applyOnMerge)
+        throw new Error("--apply-before-merge applies an open pull request and a merge records, so it takes no --apply-on-merge; pass one of them");
+    if (early && options.waveGate)
+        throw new Error("--apply-before-merge applies the pull request's plan in one job, so it takes no --wave-gate");
+    if (early && (options.build || options.buildCommand))
+        throw new Error("--apply-before-merge runs no build before its requires checks, so it takes no --pr-build or --pr-build-command yet");
     const common = [
         "--env", env, "--gate", gate, "--output", PR_LOOP_REPORT_DIR, "--forge", forge,
         ...(member ? ["--member", member] : []),
@@ -142,7 +153,8 @@ export function prLoopJobs(forge, env, options = {}, member) {
     // #4156: the flags `chant ci run` rebuilds `command` from. It finds the member from the directory it runs in.
     const ciRun = (job) => [
         "chant", "ci", "run", job, "--in-place", ...(job === "plan" ? ["--no-push"] : []),
-        ...(job === "apply" ? [] : ["--base", '"$BASE_SHA"']), ...(job === "plan" ? ["--pr", '"$PR_NUMBER"'] : []),
+        ...(job === "apply" && !early ? [] : ["--base", '"$BASE_SHA"']), ...(job === "plan" || (job === "apply" && early) ? ["--pr", '"$PR_NUMBER"'] : []),
+        ...(job === "apply" && early ? ["--apply-before-merge"] : []),
         "--env", env, "--gate", gate, "--forge", forge,
         ...(job !== "record" && options.waveGate ? ["--wave-gate", options.waveGate] : []),
         ...(job !== "plan" && options.branch ? ["--branch", JSON.stringify(options.branch)] : []),
@@ -152,35 +164,54 @@ export function prLoopJobs(forge, env, options = {}, member) {
         ...(options.reportUrl ? ["--report-url", JSON.stringify(options.reportUrl)] : []),
     ];
     const runEnv = (env) => (github ? { ...env, [RUNNER_KEY_ENV]: `\${{ secrets.${RUNNER_KEY_ENV} }}` } : env);
+    // #4295: the plan runs the pull request's code, so it gets no forge token. It writes the note and the
+    // status into its report (--no-status), and the plan-note job posts them (prLoopPostJob).
     const planEnv = github
-        ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...jobEnv }
-        : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...jobEnv };
+        ? { BASE_SHA: "${{ github.event.pull_request.base.sha }}", PR_NUMBER: "${{ github.event.pull_request.number }}", ...withoutForgeTokens(jobEnv) }
+        : { BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: "$CI_MERGE_REQUEST_IID", ...withoutForgeTokens(jobEnv) };
     const greenBranch = github ? JSON.stringify(options.branch ?? "main") : options.branch ? JSON.stringify(options.branch) : "$CI_DEFAULT_BRANCH";
     const applyEnv = github ? { BASE_SHA: "${{ github.event.before }}", ...jobEnv } : { BASE_SHA: "$CI_COMMIT_BEFORE_SHA", ...jobEnv };
+    // #4301: the apply before merge runs in a job of the target branch, whose commit is the base, at the pull request's head.
+    const earlyEnv = github
+        ? { BASE_SHA: "${{ github.sha }}", PR_NUMBER: "${{ github.event.issue.number }}", ...jobEnv }
+        : { BASE_SHA: "$CI_COMMIT_SHA", PR_NUMBER: `$${GITLAB_APPLY_PR_VAR}`, ...jobEnv };
+    const greenApply = {
+        // #4168 step 9: the apply applies the newest green commit, measured from the one applied before it.
+        jobName: "apply",
+        command: [
+            "chant", "components", "pr-apply", "--green", ...common,
+            ...(options.requireReview === true ? ["--require-review"] : []),
+            ...(options.waveGate ? ["--wave-gate", options.waveGate] : []),
+            "--resume", PR_APPLY_RECORD,
+        ].join(" "),
+        env: jobEnv,
+        checkout: [greenCheckout(greenBranch)],
+        greenBranch,
+        ...build,
+        run: { command: ciRun("apply").join(" "), env: runEnv(jobEnv) },
+    };
+    const earlyApply = {
+        // #4301: the requires checks run inside pr-apply, before any of the head's code loads.
+        jobName: "apply",
+        command: [
+            "chant", "components", "pr-apply", "--before-merge", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common,
+            ...(options.requireReview === true ? ["--require-review"] : []),
+            "--resume", PR_APPLY_RECORD,
+        ].join(" "),
+        env: earlyEnv,
+        checkout: [pullRequestCheckout(forge)],
+        run: { command: ciRun("apply").join(" "), env: runEnv(earlyEnv) },
+    };
     return [
         {
             jobName: "plan",
             // With `waveGate` the plan's note says the later waves may stop at their own gates (#4003).
-            command: ["chant", "components", "pr-plan", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common, ...(options.waveGate ? ["--wave-gate", options.waveGate] : [])].join(" "),
+            command: ["chant", "components", "pr-plan", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...common, ...(options.waveGate ? ["--wave-gate", options.waveGate] : []), "--no-status"].join(" "),
             env: planEnv,
             ...build,
             run: { command: ciRun("plan").join(" "), env: runEnv(planEnv) },
         },
-        {
-            // #4168 step 9: the apply applies the newest green commit, measured from the one applied before it.
-            jobName: "apply",
-            command: [
-                "chant", "components", "pr-apply", "--green", ...common,
-                ...(options.requireReview === true ? ["--require-review"] : []),
-                ...(options.waveGate ? ["--wave-gate", options.waveGate] : []),
-                "--resume", PR_APPLY_RECORD,
-            ].join(" "),
-            env: jobEnv,
-            checkout: [greenCheckout(greenBranch)],
-            greenBranch,
-            ...build,
-            run: { command: ciRun("apply").join(" "), env: runEnv(jobEnv) },
-        },
+        early ? earlyApply : greenApply,
         {
             jobName: "record",
             command: ["chant", "components", "pr-record", "--base", '"$BASE_SHA"', ...common].join(" "),
@@ -191,6 +222,33 @@ export function prLoopJobs(forge, env, options = {}, member) {
         },
     ];
 }
+/** The name of the job that posts the plan's note and status (#4295). */
+export const PR_PLAN_NOTE_JOB = "plan-note";
+/**
+ * The plan-note job's command and the values it reads (#4295). It runs in a
+ * fresh job after the plan, at the target branch's commit, and posts the
+ * note and the `chant/plan` status from the report the plan job handed on,
+ * with the forge token the plan job never held. `HEAD_SHA` is the commit
+ * the plan job checked out, `PR_NUMBER` the pull request, and on GitHub and
+ * Forgejo `PLAN_RESULT` the plan job's result, which fails the status when
+ * the plan job failed. `BASE_SHA` is the commit the note job checks out on
+ * GitLab, whose runner checks out the pipeline's own commit.
+ */
+export function prLoopPostJob(forge, env, member) {
+    const github = forge !== "gitlab";
+    const command = [
+        "chant", "components", "pr-post", "--pr", '"$PR_NUMBER"', "--head", '"$HEAD_SHA"',
+        "--env", env, "--output", PR_LOOP_REPORT_DIR, "--forge", forge,
+        ...(member ? ["--member", member] : []),
+        ...(github ? ["--result", '"$PLAN_RESULT"'] : []),
+    ].join(" ");
+    return {
+        command,
+        env: github
+            ? { PR_NUMBER: "${{ github.event.pull_request.number }}", HEAD_SHA: "${{ github.sha }}", PLAN_RESULT: "${{ needs.plan.result }}", GITHUB_TOKEN: GITHUB_JOB_TOKEN }
+            : { PR_NUMBER: "$CI_MERGE_REQUEST_IID", HEAD_SHA: "$CI_COMMIT_SHA", BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA" },
+    };
+}
 /**
  * What starts the apply under apply on merge (#4168 step 9): on GitHub the
  * tick's workflow finishing (`workflow_run`, since tags its token pushes start
@@ -286,6 +344,19 @@ function pushBaseFallback(target, commit, diffBase) {
         (diffBase ? `BASE_SHA="\${${diffBase}:-}"; if [ -z "$BASE_SHA" ]; then ${fromBranch}fi; ` : fromBranch) +
         "fi; export BASE_SHA");
 }
+/** The GitLab variable a person sets on a pipeline of the target branch to apply a merge request before it merges (#4301). */
+export const GITLAB_APPLY_PR_VAR = "CHANT_APPLY_PR";
+/** The comment that starts the apply before merge on GitHub and Forgejo (#4301). */
+export const APPLY_COMMENT = "/chant apply";
+/**
+ * The line that checks out pull request `$PR_NUMBER`'s head (#4301) in a job
+ * of the target branch: the forge's `refs/pull/<n>/head`, or GitLab's
+ * `refs/merge-requests/<n>/head`. A number that is not one fails the job.
+ */
+export function pullRequestCheckout(forge) {
+    const ref = forge === "gitlab" ? 'refs/merge-requests/$PR_NUMBER/head' : 'refs/pull/$PR_NUMBER/head';
+    return `echo "$PR_NUMBER" | grep -Eq '^[0-9]+$' && git fetch --quiet origin "+${ref}:refs/remotes/origin/chant-apply/$PR_NUMBER" && git checkout --quiet --detach "refs/remotes/origin/chant-apply/$PR_NUMBER"`;
+}
 /**
  * The line that checks out the newest green commit of `branch` (#4168 step
  * 9), after fetching the branch and its tags, for the apply job. `chant ci
@@ -324,3 +395,61 @@ export function gitlabBaseFallback(branch) {
 export function githubBaseFallback(branch) {
     return pushBaseFallback(JSON.stringify(branch ?? "main"), "$GITHUB_SHA");
 }
+/** Where the pull request environment jobs (#4298) write their reports, kept as a CI artifact. */
+export const PR_ENV_REPORT_DIR = ".chant/pr-env";
+/** The cron the generated `env-sweep` job runs on (#4298): hourly, at a minute off the hour. */
+export const PR_ENV_SWEEP_CRON = "17 * * * *";
+/** The name of the job that keeps an environment's record and posts its note (#4298, #4295). */
+export const PR_ENV_POST_JOB = "env-post";
+/**
+ * The jobs of a pull request's environment (#4298), when `prEnvironment` is
+ * on, in this order:
+ *
+ * - `env-up` runs `chant components pr-env up --no-push`. It runs the
+ *   change's code, so it gets no forge token (#4295): it passes no
+ *   `--forge`, and it hands its report and its record on.
+ * - `env-post` runs `pr-env post` in a fresh job at the target branch's
+ *   commit, with the token: it keeps the record on chant/lifecycle and posts
+ *   the note and the `chant/pr-env` status. On GitHub and Forgejo it reads
+ *   the up job's result as `UP_RESULT`.
+ * - `env-down` runs `pr-env down --reason closed`, and `env-sweep` runs
+ *   `pr-env sweep`. Neither builds the change's code: a teardown reads the
+ *   markers off the live resources.
+ *
+ * Each writes its report under {@link PR_ENV_REPORT_DIR}.
+ */
+export function prEnvJobs(forge, options = {}, member) {
+    const github = forge !== "gitlab";
+    const out = ["--output", PR_ENV_REPORT_DIR, ...(member ? ["--member", member] : [])];
+    const common = ["--forge", forge, ...out];
+    const token = github ? { GITHUB_TOKEN: GITHUB_JOB_TOKEN } : {};
+    const prNumber = github ? "${{ github.event.pull_request.number }}" : "$CI_MERGE_REQUEST_IID";
+    const prEnv = { CHANT_ENV: `pr-${prNumber}` };
+    const buildLines = prLoopBuildLines('"$CHANT_ENV"', options);
+    return [
+        {
+            jobName: "env-up",
+            // #4295: no --forge and no token; the record stays in the report directory for env-post.
+            command: ["chant", "components", "pr-env", "up", "--base", '"$BASE_SHA"', "--pr", '"$PR_NUMBER"', ...out, "--no-push"].join(" "),
+            env: { BASE_SHA: github ? "${{ github.event.pull_request.base.sha }}" : "$CI_MERGE_REQUEST_DIFF_BASE_SHA", PR_NUMBER: prNumber, ...prEnv },
+            ...(buildLines.length > 0 ? { build: buildLines } : {}),
+        },
+        {
+            jobName: PR_ENV_POST_JOB,
+            command: ["chant", "components", "pr-env", "post", "--pr", '"$PR_NUMBER"', "--head", '"$HEAD_SHA"', ...common, ...(github ? ["--result", '"$UP_RESULT"'] : [])].join(" "),
+            env: github
+                ? { PR_NUMBER: prNumber, HEAD_SHA: "${{ github.sha }}", UP_RESULT: "${{ needs.env-up.result }}", ...token }
+                : { PR_NUMBER: prNumber, HEAD_SHA: "$CI_COMMIT_SHA", BASE_SHA: "$CI_MERGE_REQUEST_DIFF_BASE_SHA" },
+        },
+        {
+            jobName: "env-down",
+            command: ["chant", "components", "pr-env", "down", "--pr", '"$PR_NUMBER"', "--reason", "closed", ...common].join(" "),
+            env: { PR_NUMBER: prNumber, ...prEnv, ...token },
+        },
+        {
+            jobName: "env-sweep",
+            command: ["chant", "components", "pr-env", "sweep", ...common].join(" "),
+            env: { ...token },
+        },
+    ];
+}

package/dist/components/pr-policy.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Gate-time policy on the pull-request path (#4294): `ci.policy` in the
+ * workspace declaration, run by `chant components pr-plan` and `pr-apply`
+ * over the change-set document the gate binds (`CapabilityPlan.changeSet`,
+ * composed by `planPrSet`).
+ *
+ * The settings and the policy directory are both read at the base the job
+ * measures the change from, so a pull request cannot loosen, edit or delete
+ * the policy that judges it. The engine and its result shapes are
+ * `../gate-policy.ts`.
+ *
+ * - deny: pr-apply applies nothing unless an override counts
+ *   (`../override-gate.ts`, subject the gate's op, such as `pr-12`). The
+ *   first refusal records the denial on `_gates/policy-override.jsonl`, so
+ *   `chant approve policy-override <op> --rule <id> --reason <text>` can
+ *   answer it. The gate's own approval is still needed. The override is
+ *   spent just before anything applies.
+ * - hold: the plan needs a person's approval of its own digest. pr-apply
+ *   always asks for one, so a hold changes one path: a green commit's plan
+ *   no longer applies under the approvals of the merges it carries.
+ * - error: the policy did not run or gave no readable answer. pr-apply
+ *   applies nothing.
+ */
+import type { WorkspaceTree } from "../workspace/tree.js";
+import { type GatePolicyExec, type GatePolicySettings, type GatePolicyVerdict } from "../gate-policy.js";
+import type { ChangeSetDocument } from "../change-set.js";
+import type { GateLedgerPort } from "../op/gate.js";
+import type { PrPolicyReport } from "../pr-loop.js";
+/** `ci.policy` as read at base. */
+export interface PrLoopPolicy {
+    /** Absent when the declaration at base sets none. */
+    settings?: GatePolicySettings;
+    /** The commit it was read at. */
+    base: string;
+    /** The tree of the declaration's directory at base, where the policy directory is read. */
+    tree?: WorkspaceTree;
+    /** A line for the log when no policy runs because the base has no declaration, or could not be read. */
+    note?: string;
+}
+/**
+ * The policy a pull-request job in `cwd` runs, from the declaration at
+ * `base`. Throws when the declaration at base cannot be read and the
+ * working tree's names a policy: running none would let the change waive it.
+ */
+export declare function prLoopPolicyAt(cwd: string, base: string): PrLoopPolicy;
+/** What the engine reads as `input`. */
+export interface PrPolicyInput {
+    version: 1;
+    stage: "plan" | "apply";
+    /** The gate's op, `pr-<n>`. */
+    op: string;
+    gate: string;
+    env: string;
+    pr: number | null;
+    base: string;
+    head: string;
+    /** The change-set document the gate binds. Its `entries` are every change the plan proposes. */
+    changeSet: ChangeSetDocument;
+}
+/** Run the policy over `input`. Undefined when the base sets no policy. */
+export declare function runPrPolicy(read: PrLoopPolicy, input: PrPolicyInput, exec?: GatePolicyExec): GatePolicyVerdict | undefined;
+/** The verdict as the report keeps it. */
+export declare function prPolicyReport(verdict: GatePolicyVerdict, base: string): PrPolicyReport;
+export interface PrPolicyOverrideInput {
+    port: GateLedgerPort;
+    /** The override's subject: the gate's op. */
+    subject: string;
+    /** The digest the gate binds: the change-set document's. */
+    digest: string;
+    rules: readonly string[];
+    /** The commit the overriders and signers are read at. */
+    base: string;
+    cwd: string;
+    /** Count only sealed overrides, as a sealed gate counts only sealed approvals. */
+    sealed: boolean;
+    /** Record the denial when no override counts and none stands. The plan stage records nothing. */
+    record: boolean;
+    description?: string;
+    now?: string;
+}
+/** Where an override of a denial stands. */
+export type PrPolicyOverride = {
+    status: "overridden";
+    override: NonNullable<PrPolicyReport["override"]>;
+} | {
+    status: "none";
+    refusals: string[];
+    command: string;
+    overriders: string[];
+    recorded: boolean;
+    moved?: {
+        by: string;
+    };
+};
+/**
+ * Decide a denied plan against the override ledger, as an Op waves job
+ * decides a denied run (`settleDenials` in `../op/op-waves-run.ts`).
+ */
+export declare function decidePrPolicyOverride(input: PrPolicyOverrideInput): Promise<PrPolicyOverride>;
+/**
+ * Spend the override the apply runs under: append its applied record before
+ * anything applies. Throws when it could not be written or did not reach the
+ * remote, and the caller applies nothing.
+ */
+export declare function spendPrPolicyOverride(port: GateLedgerPort, subject: string, override: NonNullable<PrPolicyReport["override"]>, at?: {
+    now?: string;
+    commit?: string;
+}): Promise<void>;
+//# sourceMappingURL=pr-policy.d.ts.map

package/dist/components/pr-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-policy.d.ts","sourceRoot":"","sources":["../../src/components/pr-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CActE;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAW1H;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAWvF;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE7H;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2CpG;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/L"}