@intentius/chant 0.124.40 → 0.124.42

package/dist/gate-policy.js

@@ -0,0 +1,242 @@
+/**
+ * Gate-time policy (#4294): a policy engine run over a plan's change set,
+ * with the policy read at base, whose rules deny a plan or hold it for a
+ * person.
+ *
+ * The engine is any command that prints conftest's JSON result
+ * (`conftest test --output json`) or OPA's (`opa eval --format json`). The
+ * rules are counted as conftest counts them:
+ *
+ * - `deny`, `violation`, `deny_<name>` and `violation_<name>` deny the plan.
+ *   A denied plan applies only under an override that counts
+ *   (`./override-gate.ts`), on top of the gate's own approval.
+ * - `hold` and `hold_<name>` hold the plan: it waits for a person's approval
+ *   of its digest, even where the gate would let it through without one.
+ *   conftest runs only deny and warn rules, so a hold needs the opa shape.
+ * - `warn` and `warn_<name>` are advice. They fail nothing.
+ *
+ * There is no outcome that lets a plan apply with nobody approving it: a
+ * non-empty change set always waits for a person (ws-104, ws-080). A rule
+ * named `allow_unattended` is read as no rule at all.
+ *
+ * A policy that cannot run, or gives no answer this module can read, is an
+ * error, and the caller stops the apply: no path waives a policy.
+ *
+ * Like `./override-gate.ts` this module reads what it is handed and imports
+ * only node built-ins, so a product can bundle it into one file
+ * (`gate-policy-bundle.test.ts`). The pull-request jobs' use of it is in
+ * `./components/pr-policy.ts`.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** The result shapes chant reads: conftest's and OPA's. */
+export const GATE_POLICY_ENGINES = ["conftest", "opa"];
+/** Where the policy is read when the settings name no `path`. */
+export const DEFAULT_POLICY_PATH = "policy";
+export const DENY_RULE = /^(deny|violation)(_[A-Za-z0-9]+)*$/;
+export const WARN_RULE = /^warn(_[A-Za-z0-9]+)*$/;
+export const HOLD_RULE = /^hold(_[A-Za-z0-9]+)*$/;
+const ruleId = (query) => query.replace(/^data\./, "");
+function messageOf(v) {
+    if (typeof v === "string")
+        return v;
+    if (v !== null && typeof v === "object" && typeof v.msg === "string")
+        return v.msg;
+    return JSON.stringify(v);
+}
+/** The findings in `conftest test --output json`. Undefined when it is not that shape. */
+export function conftestFindings(stdout) {
+    let results;
+    try {
+        results = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (!Array.isArray(results))
+        return undefined;
+    const out = { denials: [], holds: [], warnings: [] };
+    for (const r of results) {
+        if (r === null || typeof r !== "object")
+            return undefined;
+        for (const f of r.failures ?? []) {
+            // conftest names the query that denied in the failure's metadata; an older one gives only the namespace.
+            const rule = typeof f.metadata?.query === "string" ? ruleId(f.metadata.query) : `${r.namespace ?? "main"}.deny`;
+            out.denials.push({ rule, message: messageOf(f.msg) });
+        }
+        for (const w of r.warnings ?? [])
+            out.warnings.push(messageOf(w.msg));
+    }
+    return out;
+}
+/** The rules of one package's value, and with `nested` its child packages one level down. */
+function packageFindings(doc, out, pkg, nested) {
+    for (const [name, value] of Object.entries(doc).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        // A rule matches when its value is true, a message, or a non-empty set of messages.
+        const said = Array.isArray(value) ? value.map(messageOf) : value === true ? [name] : typeof value === "string" && value !== "" ? [value] : [];
+        if (DENY_RULE.test(name)) {
+            for (const message of said)
+                out.denials.push({ rule: `${pkg}.${name}`, message });
+        }
+        else if (HOLD_RULE.test(name)) {
+            for (const message of said)
+                out.holds.push({ rule: `${pkg}.${name}`, message });
+        }
+        else if (WARN_RULE.test(name)) {
+            out.warnings.push(...said);
+        }
+        else if (nested && value !== null && typeof value === "object" && !Array.isArray(value)) {
+            packageFindings(value, out, `${pkg}.${name}`, false);
+        }
+    }
+}
+/**
+ * The findings in `opa eval --format json data.<namespace>`. The query's
+ * value is the package: its rules are read by name. An array value is a
+ * deny set named after the query. A query that is undefined has no rule
+ * that matched. Undefined when the output is not that shape.
+ */
+export function opaFindings(stdout, namespace = "main") {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || parsed.errors !== undefined)
+        return undefined;
+    const value = parsed.result?.[0]?.expressions?.[0]?.value;
+    const out = { denials: [], holds: [], warnings: [] };
+    if (value === undefined)
+        return out;
+    if (Array.isArray(value)) {
+        out.denials.push(...value.map((v) => ({ rule: namespace, message: messageOf(v) })));
+        return out;
+    }
+    if (value === null || typeof value !== "object")
+        return undefined;
+    packageFindings(value, out, namespace, true);
+    return out;
+}
+/** A verdict from what the engine found. */
+export function gatePolicyVerdict(engine, found) {
+    const rules = [...new Set(found.denials.map((d) => d.rule))].sort();
+    return {
+        result: found.denials.length > 0 ? "denied" : found.holds.length > 0 ? "held" : "passed",
+        engine,
+        denials: found.denials,
+        rules,
+        holds: found.holds,
+        warnings: found.warnings,
+    };
+}
+const errorVerdict = (engine, error) => ({ result: "error", engine, denials: [], rules: [], holds: [], warnings: [], error });
+/** The argv one check runs: the settings' `command` with its placeholders filled, or the engine's own. */
+export function gatePolicyArgv(settings, at) {
+    if (settings.command)
+        return settings.command.map((a) => a.replaceAll("{policy}", at.policy).replaceAll("{input}", at.input));
+    if ((settings.engine ?? "conftest") === "opa") {
+        return ["opa", "eval", "--format", "json", "--data", at.policy, "--input", at.input, `data.${settings.namespace ?? "main"}`];
+    }
+    return ["conftest", "test", "--no-color", "--output", "json", "--policy", at.policy, ...(settings.namespace ? ["--namespace", settings.namespace] : ["--all-namespaces"]), at.input];
+}
+/** Runs the engine with the job's environment. */
+export const defaultGatePolicyExec = (argv, cwd) => {
+    const r = spawnSync(argv[0], argv.slice(1), { cwd, encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 });
+    return { status: r.error ? null : r.status, stdout: r.stdout ?? "", stderr: `${r.stderr ?? ""}${r.error ? r.error.message : ""}` };
+};
+const tail = (text) => text.trim().split("\n").slice(-3).join(" ");
+/** Run the engine once over `input` and read its answer. */
+export function checkGatePolicy(options) {
+    const { settings } = options;
+    const engine = settings.engine ?? "conftest";
+    const work = mkdtempSync(join(tmpdir(), "chant-policy-input-"));
+    try {
+        const file = join(work, "input.json");
+        writeFileSync(file, typeof options.input === "string" ? options.input : JSON.stringify(options.input));
+        const argv = gatePolicyArgv(settings, { policy: options.policyDir, input: file });
+        const r = (options.exec ?? defaultGatePolicyExec)(argv, options.cwd ?? options.policyDir);
+        if (r.status === null)
+            return errorVerdict(engine, `${argv[0]} did not run: ${tail(r.stderr) || "no such command"}`);
+        const found = engine === "opa" ? opaFindings(r.stdout, settings.namespace ?? "main") : conftestFindings(r.stdout);
+        if (found === undefined)
+            return errorVerdict(engine, `${argv[0]} gave no ${engine} result (exit ${r.status}): ${tail(r.stderr || r.stdout)}`);
+        // conftest exits 1 on a denial and 2 or more when it could not run; opa exits 0 on a query it ran.
+        if (found.denials.length === 0 && r.status !== 0)
+            return errorVerdict(engine, `${argv[0]} exited ${r.status}: ${tail(r.stderr)}`);
+        return gatePolicyVerdict(engine, found);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy the policy directory `path` out of `tree` (the tree at base) into a
+ * new temporary directory, so the engine reads the policy as the base has
+ * it and never the change's copy. Returns the directory and how to remove
+ * it, or the reason there is no policy to read.
+ */
+export function exportGatePolicy(tree, path) {
+    const root = path.replace(/^\.\/+/, "").replace(/\/+$/, "");
+    const kind = root === "" || root === "." ? "dir" : tree.stat(root);
+    if (kind === undefined)
+        return { error: `the policy directory ${path} does not exist at base` };
+    const dir = mkdtempSync(join(tmpdir(), "chant-policy-"));
+    const cleanup = () => rmSync(dir, { recursive: true, force: true });
+    const copy = (from, to) => {
+        for (const entry of tree.list(from) ?? []) {
+            const src = from === "" || from === "." ? entry.name : `${from}/${entry.name}`;
+            const dest = join(to, entry.name);
+            if (entry.type === "dir") {
+                mkdirSync(dest, { recursive: true });
+                copy(src, dest);
+            }
+            else {
+                writeFileSync(dest, tree.bytes ? tree.bytes(src) : tree.read(src));
+            }
+        }
+    };
+    try {
+        if (kind === "file")
+            writeFileSync(join(dir, root.split("/").pop()), tree.bytes ? tree.bytes(root) : tree.read(root));
+        else
+            copy(root, dir);
+    }
+    catch (err) {
+        cleanup();
+        return { error: `the policy at ${path} could not be read at base: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    return { dir, cleanup };
+}
+/** The settings, checked. Throws with what is wrong. `where` names them, such as `ci.policy`. */
+export function assertGatePolicySettings(where, raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error(`${where} must be { engine?, path?, namespace?, command? }`);
+    for (const [key, value] of Object.entries(raw)) {
+        if (key === "engine") {
+            if (!GATE_POLICY_ENGINES.includes(value))
+                throw new Error(`${where}.engine must be ${GATE_POLICY_ENGINES.join(" or ")}, the result shape the command prints`);
+        }
+        else if (key === "path" || key === "namespace") {
+            if (typeof value !== "string" || value.trim() === "")
+                throw new Error(`${where}.${key} must be a non-empty string`);
+            if (key === "path" && (value.startsWith("/") || value.split("/").includes("..")))
+                throw new Error(`${where}.path must be a directory inside the workspace, relative to its declaration`);
+        }
+        else if (key === "command") {
+            if (!Array.isArray(value) || value.length === 0 || !value.every((a) => typeof a === "string" && a !== ""))
+                throw new Error(`${where}.command must be argv, a non-empty list of strings`);
+            if (!value.some((a) => a.includes("{input}")))
+                throw new Error(`${where}.command must pass the input file as {input}`);
+        }
+        else if (key === "outcomes" || key === "allow_unattended" || key === "allowUnattended") {
+            throw new Error(`${where}.${key}: chant's policy step denies and holds only; a non-empty plan always waits for a person (ws-104), so there is no unattended outcome`);
+        }
+        else {
+            throw new Error(`${where}.${key} is not a setting; the settings are engine, path, namespace and command`);
+        }
+    }
+}

package/dist/lifecycle/gate-checkpoint.d.ts

@@ -6,7 +6,7 @@
  * The run writes the file just before it appends the pending fact, and puts
  * the file's digest on that fact as `checkpointDigest`. `chant approve`
  * copies the digest onto the approval, the way it copies the plan digest, and
- * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * a seal covers it (`./gate-seal.ts`). A later run that
  * resumes at the gate reads the file back and checks it against the digest
  * the approver saw, so a value pushed onto the branch after the approval is
  * refused rather than carried into the steps after the gate.

package/dist/lifecycle/gate-checkpoint.js

@@ -6,7 +6,7 @@
  * The run writes the file just before it appends the pending fact, and puts
  * the file's digest on that fact as `checkpointDigest`. `chant approve`
  * copies the digest onto the approval, the way it copies the plan digest, and
- * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * a seal covers it (`./gate-seal.ts`). A later run that
  * resumes at the gate reads the file back and checks it against the digest
  * the approver saw, so a value pushed onto the branch after the approval is
  * refused rather than carried into the steps after the gate.

package/dist/{workspace/trust → lifecycle}/gate-seal.d.ts

@@ -17,7 +17,7 @@
  * signers line with no `no-touch-required` option (which the signers parser
  * does not accept). An RSA signature over SHA-1 does not verify.
  */
-import type { Signer } from "./trust-files.js";
+import type { Signer } from "../workspace/trust/trust-files.js";
 /**
  * The ssh signature namespace of a gate approval's seal (#3163, ws-080), so a
  * verdict, record or commit signature can't stand in for one.

package/dist/lifecycle/gate-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-seal.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,kIAAkI;AAClI,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAWxE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAGtG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAKpE;AA8BD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAmCD,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CA0CtI;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU9D;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID,kJAAkJ;AAClJ,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAmB1F"}

package/dist/lifecycle/query.d.ts

@@ -0,0 +1,68 @@
+import type { LedgerReadPort } from "./ledger-port.js";
+/** The version of the table schema below. */
+export declare const QUERY_SCHEMA_VERSION = 1;
+/**
+ * Each table's columns, in order, with their SQLite type. A column named in
+ * the doc as JSON holds a JSON text, for `json_extract`. Every table starts
+ * with `member`: the workspace member whose ledger the row came from, or NULL
+ * for a project outside a workspace.
+ */
+export declare const QUERY_TABLES: {
+    /** One row per resource in each environment's newest snapshot. `attributes` is JSON. */
+    readonly resources: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["stack", "TEXT"], readonly ["lexicon", "TEXT"], readonly ["name", "TEXT"], readonly ["type", "TEXT"], readonly ["physical_id", "TEXT"], readonly ["status", "TEXT"], readonly ["last_updated", "TEXT"], readonly ["ownership", "TEXT"], readonly ["attributes", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["observed_at", "TEXT"]];
+    /** One row per snapshot file: what was observed, when, and how many resources it holds. */
+    readonly snapshots: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["stack", "TEXT"], readonly ["lexicon", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["observed_at", "TEXT"], readonly ["depth", "TEXT"], readonly ["resources", "INTEGER"], readonly ["unobserved", "INTEGER"]];
+    /** One row per Op run record. `labels` and `outcomes` are JSON. */
+    readonly runs: readonly [readonly ["member", "TEXT"], readonly ["id", "TEXT"], readonly ["op", "TEXT"], readonly ["env", "TEXT"], readonly ["started", "TEXT"], readonly ["ended", "TEXT"], readonly ["status", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["forge", "TEXT"], readonly ["run_url", "TEXT"], readonly ["failure_code", "TEXT"], readonly ["failure_reason", "TEXT"], readonly ["failed_phase", "TEXT"], readonly ["gate", "TEXT"], readonly ["steward", "TEXT"], readonly ["labels", "TEXT"], readonly ["outcomes", "TEXT"]];
+    /** One row per gate ledger line: `kind` is `pending` or `resolution`. `signed` is 1 for a sealed approval. */
+    readonly gates: readonly [readonly ["member", "TEXT"], readonly ["op", "TEXT"], readonly ["gate", "TEXT"], readonly ["kind", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["resolved_by", "TEXT"], readonly ["relayed_by", "TEXT"], readonly ["approver_kind", "TEXT"], readonly ["plan_digest", "TEXT"], readonly ["environment", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["run_id", "TEXT"], readonly ["url", "TEXT"], readonly ["note", "TEXT"], readonly ["expires_at", "TEXT"], readonly ["origin", "TEXT"], readonly ["empty", "INTEGER"], readonly ["signed", "INTEGER"]];
+    /** One row per deploy record in `<env>/releases.jsonl`. `promoted_from`, `restores` and `redeploys` are JSON. */
+    readonly deploys: readonly [readonly ["member", "TEXT"], readonly ["env", "TEXT"], readonly ["component", "TEXT"], readonly ["digest", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["run_id", "TEXT"], readonly ["forge", "TEXT"], readonly ["run_url", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["actor", "TEXT"], readonly ["approver", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["digest_kind", "TEXT"], readonly ["promoted_from", "TEXT"], readonly ["restores", "TEXT"], readonly ["redeploys", "TEXT"]];
+    /** One row per release file whose content hashes to its digest. `envs` joins its targets' environments with commas; `artifacts` is JSON. */
+    readonly releases: readonly [readonly ["member", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["release_member", "TEXT"], readonly ["git_sha", "TEXT"], readonly ["envs", "TEXT"], readonly ["artifacts", "TEXT"]];
+    /** One row per line of `_releases/cuts.jsonl`. `signed` is 1 for a signed cut. */
+    readonly cuts: readonly [readonly ["member", "TEXT"], readonly ["release_digest", "TEXT"], readonly ["label", "TEXT"], readonly ["actor", "TEXT"], readonly ["timestamp", "TEXT"], readonly ["run_id", "TEXT"], readonly ["forge", "TEXT"], readonly ["channel", "TEXT"], readonly ["signed", "INTEGER"], readonly ["composed_base", "TEXT"]];
+};
+export type QueryTable = keyof typeof QUERY_TABLES;
+/** The table that describes the others: one row per column, with the schema version. */
+export declare const SCHEMA_TABLE = "chant_schema";
+type Value = string | number | null;
+export type QueryRow = Record<string, Value>;
+/** The rows of each table, as loaded. */
+export type QueryData = Record<QueryTable, QueryRow[]>;
+/** One ledger to read: a member's, or the project's own with `member` null. */
+export interface QueryLedger {
+    member: string | null;
+    port: LedgerReadPort;
+}
+export interface QueryLoad {
+    data: QueryData;
+    /** Lines and files that could not be read as their kind, per table. Left out of the rows. */
+    malformed: Record<QueryTable, number>;
+}
+export interface QueryResult {
+    schemaVersion: number;
+    columns: string[];
+    rows: QueryRow[];
+    /** How many rows each table held. */
+    tables: Record<QueryTable, number>;
+    malformed: Record<QueryTable, number>;
+}
+/** A statement that can't run, or a Node.js with no SQLite. The message is for a person. */
+export declare class QueryError extends Error {
+}
+/**
+ * Read every table's rows from the ledgers, in the order given. A ledger
+ * whose branch is absent reads as no rows. A line or file that is not its
+ * kind is counted in `malformed` and left out, as each ledger's own reader
+ * does.
+ */
+export declare function loadQueryData(ledgers: readonly QueryLedger[]): Promise<QueryLoad>;
+/** The first word of a statement, past whitespace and comments. */
+export declare function firstWord(sql: string): string;
+/** Run one read-only statement over the tables. */
+export declare function runQuery(sql: string, load: QueryLoad): Promise<QueryResult>;
+/** The rows as an aligned table, a header and a count. */
+export declare function formatQueryResult(r: QueryResult): string;
+export {};
+//# sourceMappingURL=query.d.ts.map

package/dist/lifecycle/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/lifecycle/query.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC;;;;;GAKG;AACH,eAAO,MAAM,YAAY;IACvB,wFAAwF;;IAExF,2FAA2F;;IAE3F,mEAAmE;;IAEnE,8GAA8G;;IAE9G,iHAAiH;;IAEjH,4IAA4I;;IAE5I,kFAAkF;;CAEH,CAAC;AAElF,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,YAAY,CAAC;AAEnD,wFAAwF;AACxF,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,KAAK,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AACpC,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,4FAA4F;AAC5F,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAsDxC;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAyEvF;AA6BD,mEAAmE;AACnE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,mDAAmD;AACnD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCjF;AAID,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAMxD"}

package/dist/lifecycle/query.js

@@ -0,0 +1,246 @@
+import { parseGateLedger, GATES_DIR } from "./gate-ledger.js";
+import { parseReleaseLedger, releaseLedgerLines } from "./release-read.js";
+import { CUTS_FILE, parseCuts, parseRelease, RELEASES_DIR, verifyReleaseDigest } from "./release-store.js";
+import { opOfRunLedgerFile, parseRunLedger } from "./run-ledger.js";
+/** The version of the table schema below. */
+export const QUERY_SCHEMA_VERSION = 1;
+/**
+ * Each table's columns, in order, with their SQLite type. A column named in
+ * the doc as JSON holds a JSON text, for `json_extract`. Every table starts
+ * with `member`: the workspace member whose ledger the row came from, or NULL
+ * for a project outside a workspace.
+ */
+export const QUERY_TABLES = {
+    /** One row per resource in each environment's newest snapshot. `attributes` is JSON. */
+    resources: [["member", "TEXT"], ["env", "TEXT"], ["stack", "TEXT"], ["lexicon", "TEXT"], ["name", "TEXT"], ["type", "TEXT"], ["physical_id", "TEXT"], ["status", "TEXT"], ["last_updated", "TEXT"], ["ownership", "TEXT"], ["attributes", "TEXT"], ["git_sha", "TEXT"], ["observed_at", "TEXT"]],
+    /** One row per snapshot file: what was observed, when, and how many resources it holds. */
+    snapshots: [["member", "TEXT"], ["env", "TEXT"], ["stack", "TEXT"], ["lexicon", "TEXT"], ["git_sha", "TEXT"], ["observed_at", "TEXT"], ["depth", "TEXT"], ["resources", "INTEGER"], ["unobserved", "INTEGER"]],
+    /** One row per Op run record. `labels` and `outcomes` are JSON. */
+    runs: [["member", "TEXT"], ["id", "TEXT"], ["op", "TEXT"], ["env", "TEXT"], ["started", "TEXT"], ["ended", "TEXT"], ["status", "TEXT"], ["git_sha", "TEXT"], ["forge", "TEXT"], ["run_url", "TEXT"], ["failure_code", "TEXT"], ["failure_reason", "TEXT"], ["failed_phase", "TEXT"], ["gate", "TEXT"], ["steward", "TEXT"], ["labels", "TEXT"], ["outcomes", "TEXT"]],
+    /** One row per gate ledger line: `kind` is `pending` or `resolution`. `signed` is 1 for a sealed approval. */
+    gates: [["member", "TEXT"], ["op", "TEXT"], ["gate", "TEXT"], ["kind", "TEXT"], ["timestamp", "TEXT"], ["resolved_by", "TEXT"], ["relayed_by", "TEXT"], ["approver_kind", "TEXT"], ["plan_digest", "TEXT"], ["environment", "TEXT"], ["release_digest", "TEXT"], ["git_sha", "TEXT"], ["run_id", "TEXT"], ["url", "TEXT"], ["note", "TEXT"], ["expires_at", "TEXT"], ["origin", "TEXT"], ["empty", "INTEGER"], ["signed", "INTEGER"]],
+    /** One row per deploy record in `<env>/releases.jsonl`. `promoted_from`, `restores` and `redeploys` are JSON. */
+    deploys: [["member", "TEXT"], ["env", "TEXT"], ["component", "TEXT"], ["digest", "TEXT"], ["git_sha", "TEXT"], ["run_id", "TEXT"], ["forge", "TEXT"], ["run_url", "TEXT"], ["timestamp", "TEXT"], ["actor", "TEXT"], ["approver", "TEXT"], ["release_digest", "TEXT"], ["digest_kind", "TEXT"], ["promoted_from", "TEXT"], ["restores", "TEXT"], ["redeploys", "TEXT"]],
+    /** One row per release file whose content hashes to its digest. `envs` joins its targets' environments with commas; `artifacts` is JSON. */
+    releases: [["member", "TEXT"], ["release_digest", "TEXT"], ["release_member", "TEXT"], ["git_sha", "TEXT"], ["envs", "TEXT"], ["artifacts", "TEXT"]],
+    /** One row per line of `_releases/cuts.jsonl`. `signed` is 1 for a signed cut. */
+    cuts: [["member", "TEXT"], ["release_digest", "TEXT"], ["label", "TEXT"], ["actor", "TEXT"], ["timestamp", "TEXT"], ["run_id", "TEXT"], ["forge", "TEXT"], ["channel", "TEXT"], ["signed", "INTEGER"], ["composed_base", "TEXT"]],
+};
+/** The table that describes the others: one row per column, with the schema version. */
+export const SCHEMA_TABLE = "chant_schema";
+/** A statement that can't run, or a Node.js with no SQLite. The message is for a person. */
+export class QueryError extends Error {
+}
+const TABLE_NAMES = Object.keys(QUERY_TABLES);
+const empty = (v) => Object.fromEntries(TABLE_NAMES.map((t) => [t, v()]));
+const json = (v) => (v === undefined || v === null ? null : JSON.stringify(v));
+const str = (v) => (typeof v === "string" ? v : null);
+const bit = (v) => (v ? 1 : 0);
+/** Whether a parsed `.json` file under an environment is a snapshot (an observation baseline or another file is not). */
+function isSnapshot(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const s = v;
+    return typeof s.lexicon === "string" && typeof s.environment === "string" && typeof s.commit === "string" && typeof s.timestamp === "string" && !!s.resources && typeof s.resources === "object" && !Array.isArray(s.resources);
+}
+function snapshotRows(member, env, file, s, data) {
+    // The file name folds the stack in as `<stack>__<lexicon>` (git.ts snapshotStorageKey); the record names it too.
+    const key = file.slice(0, -".json".length);
+    const stack = s.stack ?? (key.includes("__") ? key.slice(0, key.lastIndexOf("__")) : null);
+    const at = { git_sha: s.commit, observed_at: s.timestamp };
+    const resources = Object.entries(s.resources);
+    data.snapshots.push({ member, env, stack, lexicon: s.lexicon, ...at, depth: s.depth ?? "identity", resources: resources.length, unobserved: Object.keys(s.unobserved ?? {}).length });
+    for (const [name, r] of resources) {
+        data.resources.push({ member, env, stack, lexicon: s.lexicon, name, type: str(r?.type), physical_id: str(r?.physicalId), status: str(r?.status), last_updated: str(r?.lastUpdated), ownership: str(r?.ownership), attributes: json(r?.attributes), ...at });
+    }
+}
+function gateRow(member, r) {
+    const pending = r.kind === "pending";
+    const res = pending ? undefined : r;
+    const origin = r.origin;
+    return {
+        member,
+        op: r.op,
+        gate: r.gate,
+        kind: pending ? "pending" : "resolution",
+        timestamp: r.timestamp,
+        resolved_by: res?.resolvedBy ?? null,
+        relayed_by: str(res?.relayedBy),
+        approver_kind: str(res?.approver?.kind),
+        plan_digest: str(r.planDigest),
+        environment: str(r.environment),
+        release_digest: str(r.releaseDigest),
+        git_sha: str(r.gitSha),
+        run_id: str(r.runId),
+        url: str(res?.url),
+        note: str(res?.note),
+        expires_at: pending ? str(r.expiresAt) : null,
+        origin: str(origin),
+        empty: bit(res?.empty === true),
+        signed: bit(res?.seal !== undefined),
+    };
+}
+/**
+ * Read every table's rows from the ledgers, in the order given. A ledger
+ * whose branch is absent reads as no rows. A line or file that is not its
+ * kind is counted in `malformed` and left out, as each ledger's own reader
+ * does.
+ */
+export async function loadQueryData(ledgers) {
+    const data = empty(() => []);
+    const malformed = empty(() => 0);
+    for (const { member, port } of ledgers) {
+        const trees = (await port.trees()).sort();
+        for (const env of trees.filter((t) => !t.startsWith("_"))) {
+            for (const file of (await port.list(env)).sort()) {
+                if (file.endsWith(".json")) {
+                    const text = await port.read(env, file);
+                    let parsed;
+                    try {
+                        parsed = text === null ? null : JSON.parse(text);
+                    }
+                    catch {
+                        parsed = null;
+                    }
+                    // Other JSON files live beside the snapshots (the observation baseline); only a snapshot-shaped one is read.
+                    if (isSnapshot(parsed))
+                        snapshotRows(member, env, file, parsed, data);
+                    continue;
+                }
+                if (file === "releases.jsonl") {
+                    const { records, malformed: bad } = parseReleaseLedger(releaseLedgerLines(await port.read(env, file)));
+                    malformed.deploys += bad;
+                    for (const d of records) {
+                        data.deploys.push({ member, env: d.env, component: d.component, digest: d.digest, git_sha: d.gitSha, run_id: d.runId, forge: str(d.runOrigin?.forge), run_url: str(d.runOrigin?.url), timestamp: d.timestamp, actor: d.actor, approver: str(d.approver), release_digest: str(d.releaseDigest), digest_kind: str(d.digestKind), promoted_from: json(d.promotedFrom), restores: json(d.restores), redeploys: json(d.redeploys) });
+                    }
+                    continue;
+                }
+                if (opOfRunLedgerFile(file) !== null) {
+                    const text = await port.read(env, file);
+                    if (text === null)
+                        continue;
+                    const { records, malformed: bad } = parseRunLedger(text);
+                    malformed.runs += bad;
+                    for (const r of records) {
+                        data.runs.push({ member, id: r.id, op: r.op, env: r.env, started: r.started, ended: r.ended, status: r.status, git_sha: str(r.gitSha), forge: str(r.runOrigin?.forge), run_url: str(r.runOrigin?.url), failure_code: str(r.failure?.code), failure_reason: str(r.failure?.reason), failed_phase: str(r.failure?.phase), gate: str(r.gate?.name), steward: str(r.steward), labels: json(r.labels ?? {}), outcomes: json(r.outcomes ?? {}) });
+                    }
+                }
+            }
+        }
+        if (trees.includes(GATES_DIR)) {
+            for (const file of (await port.list(GATES_DIR)).sort()) {
+                if (!file.endsWith(".jsonl"))
+                    continue;
+                const text = await port.read(GATES_DIR, file);
+                if (text === null)
+                    continue;
+                const { resolutions, pending, malformed: bad } = parseGateLedger(text);
+                malformed.gates += bad;
+                // Both kinds share the file; ledger order is time order, so they are merged back by timestamp.
+                const lines = [...pending, ...resolutions].sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+                for (const r of lines)
+                    data.gates.push(gateRow(member, r));
+            }
+        }
+        if (trees.includes(RELEASES_DIR)) {
+            for (const file of (await port.list(RELEASES_DIR)).sort()) {
+                if (file === CUTS_FILE) {
+                    const { cuts, malformed: bad } = parseCuts(await port.read(RELEASES_DIR, file));
+                    malformed.cuts += bad;
+                    for (const c of cuts) {
+                        data.cuts.push({ member, release_digest: c.releaseDigest, label: c.label, actor: c.actor, timestamp: c.timestamp, run_id: c.runId, forge: str(c.runOrigin?.forge), channel: str(c.channel), signed: bit(c.signature !== null), composed_base: str(c.composed?.base) });
+                    }
+                    continue;
+                }
+                if (!file.endsWith(".json"))
+                    continue;
+                const text = await port.read(RELEASES_DIR, file);
+                const release = text === null ? null : parseRelease(text);
+                // `readAllReleases` (release-store.ts) counts a file whose content does not hash to its digest as malformed; so does this.
+                if (!release || release.releaseDigest.replace(/:/g, "_") !== file.slice(0, -".json".length) || !verifyReleaseDigest(release)) {
+                    malformed.releases++;
+                    continue;
+                }
+                data.releases.push({ member, release_digest: release.releaseDigest, release_member: release.member, git_sha: release.commit, envs: release.targets.map((t) => t.env).join(","), artifacts: json(release.artifactDigests) });
+            }
+        }
+    }
+    return { data, malformed };
+}
+/** node:sqlite, without the experimental warning some Node.js versions print when it loads. */
+async function sqlite() {
+    const emit = process.emitWarning;
+    process.emitWarning = ((warning, ...rest) => {
+        if (/SQLite/.test(typeof warning === "string" ? warning : warning.message))
+            return;
+        return emit.call(process, warning, ...rest);
+    });
+    try {
+        const name = "node:sqlite";
+        return (await import(name));
+    }
+    catch {
+        throw new QueryError(`chant query runs on the SQLite built into Node.js 22.13 or later; this is Node.js ${process.versions.node}`);
+    }
+    finally {
+        process.emitWarning = emit;
+    }
+}
+/** The first word of a statement, past whitespace and comments. */
+export function firstWord(sql) {
+    const s = sql.replace(/^(\s+|--[^\n]*(\n|$)|\/\*[\s\S]*?\*\/)*/, "");
+    return (/^[A-Za-z]+/.exec(s)?.[0] ?? "").toLowerCase();
+}
+/** Run one read-only statement over the tables. */
+export async function runQuery(sql, load) {
+    if (sql.trim() === "")
+        throw new QueryError('chant query needs a statement: chant query "SELECT * FROM resources"');
+    if (!["select", "with", "values"].includes(firstWord(sql)))
+        throw new QueryError("chant query runs one SELECT (or WITH, or VALUES) statement; it changes nothing");
+    const { DatabaseSync } = await sqlite();
+    const db = new DatabaseSync(":memory:");
+    try {
+        db.exec(`CREATE TABLE ${SCHEMA_TABLE} ("version" INTEGER, "table_name" TEXT, "column_name" TEXT, "type" TEXT, "position" INTEGER)`);
+        const describe = db.prepare(`INSERT INTO ${SCHEMA_TABLE} VALUES (?, ?, ?, ?, ?)`);
+        for (const table of TABLE_NAMES) {
+            const cols = QUERY_TABLES[table];
+            db.exec(`CREATE TABLE ${table} (${cols.map(([c, t]) => `"${c}" ${t}`).join(", ")})`);
+            cols.forEach(([c, t], i) => describe.run(QUERY_SCHEMA_VERSION, table, c, t, i + 1));
+            const insert = db.prepare(`INSERT INTO ${table} VALUES (${cols.map(() => "?").join(", ")})`);
+            db.exec("BEGIN");
+            for (const row of load.data[table])
+                insert.run(...cols.map(([c]) => row[c] ?? null));
+            db.exec("COMMIT");
+        }
+        db.exec("PRAGMA query_only = ON");
+        let stmt;
+        try {
+            stmt = db.prepare(sql);
+        }
+        catch (e) {
+            throw new QueryError(`the query does not run: ${e.message}`);
+        }
+        let rows;
+        try {
+            rows = stmt.all();
+        }
+        catch (e) {
+            throw new QueryError(`the query does not run: ${e.message}`);
+        }
+        const columns = typeof stmt.columns === "function" ? stmt.columns().map((c) => c.name) : Object.keys(rows[0] ?? {});
+        const tables = Object.fromEntries(TABLE_NAMES.map((t) => [t, load.data[t].length]));
+        return { schemaVersion: QUERY_SCHEMA_VERSION, columns, rows: rows.map((r) => ({ ...r })), tables, malformed: load.malformed };
+    }
+    finally {
+        db.close();
+    }
+}
+const cell = (v) => (v === null || v === undefined ? "" : String(v));
+/** The rows as an aligned table, a header and a count. */
+export function formatQueryResult(r) {
+    const widths = r.columns.map((c) => Math.max(c.length, ...r.rows.map((row) => cell(row[c]).length)));
+    const line = (vals) => vals.map((v, i) => v.padEnd(widths[i])).join("  ").trimEnd();
+    const out = [line(r.columns), line(widths.map((w) => "-".repeat(w))), ...r.rows.map((row) => line(r.columns.map((c) => cell(row[c]))))];
+    out.push(`(${r.rows.length} ${r.rows.length === 1 ? "row" : "rows"})`);
+    return out.join("\n");
+}

package/dist/lifecycle/run-ledger.d.ts

@@ -60,4 +60,17 @@ export declare function readRunLedger(environment: string, op: string, opts?: {
     records: OpRunRecord[];
     malformed: number;
 }>;
+/** The run ledger file name for `op` under `<env>/`, `runs__<op>.jsonl`. */
+export declare function runLedgerFile(op: string): string;
+/** The op a run ledger file name holds, or null when `file` is not one. */
+export declare function opOfRunLedgerFile(file: string): string | null;
+/**
+ * Parse the text of one run ledger file the way {@link readRunLedger} reads
+ * it (#4297): a reader that fetches the file itself, such as `chant query`,
+ * gets the same records and the same malformed count.
+ */
+export declare function parseRunLedger(content: string): {
+    records: OpRunRecord[];
+    malformed: number;
+};
 //# sourceMappingURL=run-ledger.d.ts.map

package/dist/lifecycle/run-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAA+C,MAAM,eAAe,CAAC;AASrI,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CAkDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCxD"}
+{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAA+C,MAAM,eAAe,CAAC;AASrI,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CAkDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAIxD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA+B7F"}