@intentius/chant 0.124.45 → 0.124.46

package/dist/config.js

@@ -7,86 +7,11 @@ import { evaluateProjectConfig } from "./config-sandbox.js";
 import { lexiconNames, pathLexiconRoot, registerLexiconDeclarations } from "./lexicon-module.js";
 import { decideConfigSchema } from "./op/decide-config.js";
 import { PublishDeclarationSchema } from "./lifecycle/publish-declaration.js";
-/** The declared name of one `environments` entry, whichever form it takes. */
-export function environmentName(entry) {
-    return typeof entry === "string" ? entry : entry.name;
-}
-/**
- * Every declared environment's name, in `environments` order. `undefined` in,
- * `undefined` out — mirrors the field itself being optional, so a caller that
- * already writes `config.environments?.something` can keep doing so:
- * `environmentNames(config.environments)?.includes(name)`.
- */
-export function environmentNames(environments) {
-    return environments?.map(environmentName);
-}
-/**
- * Whether a declared environment name is a glob pattern rather than a literal
- * (#1221) — it contains at least one `*`.
- */
-export function isEnvironmentPattern(declaredName) {
-    return declaredName.includes("*");
-}
-/**
- * Anchored `*`-glob match (#1221): each `*` in `pattern` matches any run of
- * characters (possibly empty); everything else matches itself. Deliberately
- * the whole surface — no `?`, no character classes, no regex. A pattern with
- * no `*` degenerates to string equality.
- */
-export function matchesEnvironmentPattern(pattern, name) {
-    const parts = pattern.split("*");
-    if (parts.length === 1)
-        return pattern === name;
-    const first = parts[0];
-    const last = parts[parts.length - 1];
-    if (!name.startsWith(first))
-        return false;
-    let cursor = first.length;
-    for (let i = 1; i < parts.length - 1; i++) {
-        const part = parts[i];
-        if (part === "")
-            continue;
-        const at = name.indexOf(part, cursor);
-        if (at === -1)
-            return false;
-        cursor = at + part.length;
-    }
-    return name.length - cursor >= last.length && name.endsWith(last);
-}
-/**
- * Environment-membership test (#1221): is `name` covered by this project's
- * declared `environments`? A literal entry matches by equality; an entry
- * containing `*` matches as a glob pattern (`"pr-*"` covers `pr-42`).
- * Literals are checked first across the whole list, then patterns — so a
- * name that is declared outright never depends on pattern order. `undefined`
- * / empty `environments` returns `false`; callers that treat "no declared
- * environments" as "anything goes" (e.g. {@link unknownEnvError} in
- * `./env.ts`) guard that case themselves.
- */
-export function matchesDeclaredEnvironment(environments, name) {
-    const names = environmentNames(environments) ?? [];
-    if (names.includes(name))
-        return true;
-    return names.some((declared) => isEnvironmentPattern(declared) && matchesEnvironmentPattern(declared, name));
-}
-/**
- * The endpoint `name` declares (chant #1166) — `undefined` for a bare-string
- * entry, an entry with no `endpoint` set, or a name this project doesn't
- * declare at all. `./live-endpoint.ts`'s `applyLiveEndpoint` is the consumer:
- * it injects this into the ambient env var each observing lexicon's CLI
- * shell-out reads (e.g. `AWS_ENDPOINT_URL`), unless that var is already set —
- * ambient always wins.
- *
- * A pattern entry (#1221) can carry an endpoint too: `{ name: "pr-*",
- * endpoint }` supplies the endpoint for every `pr-<n>` environment. A literal
- * entry always wins over a pattern — declaring `pr-special` alongside
- * `pr-*` resolves `pr-special` to the literal entry's endpoint (or none).
- */
-export function environmentEndpoint(environments, name) {
-    const found = environments?.find((e) => environmentName(e) === name) ??
-        environments?.find((e) => isEnvironmentPattern(environmentName(e)) && matchesEnvironmentPattern(environmentName(e), name));
-    return found && typeof found !== "string" ? found.endpoint : undefined;
-}
+// The environment and ownership helpers that read a config already loaded
+// live in ./config-environments.ts, which loads nothing, so a bundle that
+// needs only them stays clear of the loader below (#4356 follow-up).
+export { environmentEndpoint, environmentName, environmentNames, isEnvironmentPattern, isOwnershipParamRef, matchesDeclaredEnvironment, matchesEnvironmentPattern, resolveOwnershipStack, } from "./config-environments.js";
+import { isOwnershipParamRef, resolveOwnershipStack } from "./config-environments.js";
 /**
  * Zod schema for ChantConfig validation.
  */
@@ -120,6 +45,10 @@ export const ChantConfigSchema = z.object({
     build: z.object({
         fold: z.boolean().optional(),
     }).optional(),
+    // Strict like `run`: a misspelt `lint` would leave the gate on with nothing said.
+    graph: z.object({
+        lint: z.enum(["gate", "report"]).optional(),
+    }).strict().optional(),
     buildParams: z.record(z.string(), z.object({
         type: z.enum(["string", "number", "boolean"]),
         default: z.union([z.string(), z.number(), z.boolean()]).optional(),
@@ -358,22 +287,6 @@ function warnIfFragmentShadowsProjectConfig(configPath) {
 }
 /** Top-level keys that make a config a *project* config rather than a lint fragment. */
 const PROJECT_CONFIG_KEYS = new Set(Object.keys(ChantConfigSchema.shape).filter((k) => k !== "lint"));
-/** Whether an `ownership.env` entry is a build-parameter reference rather than a literal. */
-export function isOwnershipParamRef(env) {
-    return typeof env === "object" && env !== null && typeof env.param === "string";
-}
-/**
- * The ownership stack identity alone — `ownership.stack` when marking is on
- * (no `stack`, or `enabled: false`, means off). For callers that need the
- * stack and nothing else (a field manager, a prune selector) and so have no
- * build parameters to resolve `env` against.
- */
-export function resolveOwnershipStack(config) {
-    const o = config.ownership;
-    if (!o || !o.stack || o.enabled === false)
-        return undefined;
-    return o.stack;
-}
 /**
  * Resolve the `env` half of the ownership marker (#1396). A literal is
  * returned as-is. A `{ param }` reference is looked up in this build's resolved

package/dist/graph-detail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-detail.d.ts","sourceRoot":"","sources":["../src/graph-detail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAkB,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAExC,eAAO,MAAM,MAAM;aACjB,MAAM,EAAE,CAAC;aACT,UAAU,EAAE,CAAC;aACb,WAAW,EAAE,CAAC;aACd,UAAU,EAAE,CAAC;CACL,CAAC;AAEX,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAYpE;AAqPD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAYtF"}
+{"version":3,"file":"graph-detail.d.ts","sourceRoot":"","sources":["../src/graph-detail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAkB,MAAM,YAAY,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAExC,eAAO,MAAM,MAAM;aACjB,MAAM,EAAE,CAAC;aACT,UAAU,EAAE,CAAC;aACb,WAAW,EAAE,CAAC;aACd,UAAU,EAAE,CAAC;CACL,CAAC;AAEX,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAYpE;AAgQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAYtF"}

package/dist/graph-detail.js

@@ -1,3 +1,4 @@
+import { subTemplateRefs } from "./graph-sub-template.js";
 export const DETAIL = {
     STACKS: 0,
     COMPOSITES: 1,
@@ -28,12 +29,12 @@ function paintAttrs(attrs) {
             out[k] = v;
     return out;
 }
-/** A `{ $ref: "producer.attribute" }` envelope — a reference, not a property tree. */
+/** A `{ $ref: "producer.attribute" }` or `{ $sub: "..." }` (#4373) envelope — a reference, not a property tree. */
 function isRefEnvelope(v) {
     return (typeof v === "object" &&
         v !== null &&
         !Array.isArray(v) &&
-        typeof v.$ref === "string");
+        (typeof v.$ref === "string" || typeof v.$sub === "string"));
 }
 /** T2's resource view of a node's attrs: overlay paint, scalar fields
  * (identity, status-relevant values), and top-level reference envelopes.
@@ -235,7 +236,8 @@ function toAttributes(ir) {
     });
     return { ...ir, edges };
 }
-/** Find the attribute in a `{ $ref: "producer.attribute" }` envelope under attrs. */
+/** Find the attribute in a `{ $ref: "producer.attribute" }` envelope under attrs,
+ * or in a `{ $sub }` envelope's `${producer.attribute}` (#4373). */
 function findRefAttr(attrs, producer) {
     let found;
     const visit = (v) => {
@@ -254,6 +256,16 @@ function findRefAttr(attrs, producer) {
                 return;
             }
         }
+        const sub = v.$sub;
+        if (typeof sub === "string") {
+            const vars = v.$vars;
+            const bound = new Set(vars && typeof vars === "object" ? Object.keys(vars) : []);
+            const hit = subTemplateRefs(sub, bound).find((r) => r.name === producer && r.attr);
+            if (hit) {
+                found = hit.attr;
+                return;
+            }
+        }
         for (const val of Object.values(v))
             visit(val);
     };

package/dist/graph-effective.d.ts

@@ -1,4 +1,5 @@
-import type { GraphIR } from "./graph-ir.js";
+import type { GraphIR, IRNode } from "./graph-ir.js";
+import { type CapabilityPack } from "./capabilities/view.js";
 /**
  * Fold DERIVED reachability facts onto EC2 instance nodes so a single-node query
  * can answer questions that are otherwise a multi-hop join with a union (#1139).
@@ -20,6 +21,36 @@ import type { GraphIR } from "./graph-ir.js";
  * With these, "instances SSH-reachable from the internet" is one predicate:
  *   `kind:EC2::Instance attr:internetFacing=true attr:effectiveIngress=tcp:22:0.0.0.0/0`
  * — no hand-joined CLI sweep, no over/under-counting.
+ *
+ * Both are capability rules (#4375): `internet-facing`, `in-sg` and
+ * `ingress-of` in `capabilities/aws.paths`, over the lexicon-neutral view, so
+ * one rule serves CloudFormation kinds and Terraform's AWS types (#4362)
+ * alike. What stays here is the attribute surface: which nodes get the facts,
+ * and how a rule's evidence is spelled as `proto:port:cidr` and `...Via`.
+ */
+export declare function enrichEffectiveTopology(ir: GraphIR, packs?: CapabilityPack[]): GraphIR;
+/**
+ * The Terraform type of a `resource` or `data` node: `aws_instance` for
+ * `aws_instance.web`, `data.aws_ami` for `data.aws_ami.ubuntu`. Undefined for
+ * any other node.
+ *
+ * This is the one reading of a terraform node's type. `chant search`'s `kind:`
+ * (#4366), its rows and `--explain` count, `--count-by kind` (#4360) and the
+ * effective-topology folds (#4362) all call it, so they cannot disagree.
+ *
+ * The terraform lexicon puts every resource on the IR as `Terraform::Resource`
+ * (and every data source as `Terraform::Data`) and carries the block's type
+ * label as `attrs.type` (#4366), which is read first. A node without one (an
+ * older producer, or a `chant graph --live` node built from state) falls back
+ * to the block's address (`aws_instance.web`, or `module.app.aws_instance.web`)
+ * in `attrs.address`, whose second-to-last segment is the type, and failing
+ * that to its id, whose last path segment is the address too. A data source
+ * keeps its `data.` prefix: `data.aws_ami` reads an AMI, it does not manage one.
+ */
+export declare function terraformType(n: IRNode | undefined): string | undefined;
+/**
+ * The provider resource type of a terraform `resource` node (`aws_instance`),
+ * or undefined for any other node, data sources included. See {@link terraformType}.
  */
-export declare function enrichEffectiveTopology(ir: GraphIR): GraphIR;
+export declare function terraformResourceType(n: IRNode | undefined): string | undefined;
 //# sourceMappingURL=graph-effective.d.ts.map

package/dist/graph-effective.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-effective.d.ts","sourceRoot":"","sources":["../src/graph-effective.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAU,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CA2F5D"}
+{"version":3,"file":"graph-effective.d.ts","sourceRoot":"","sources":["../src/graph-effective.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAa,KAAK,cAAc,EAAa,MAAM,qBAAqB,CAAC;AAGhF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,GAAE,cAAc,EAAO,GAAG,OAAO,CA4C1F;AAkGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUvE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE/E"}

package/dist/graph-effective.js

@@ -1,3 +1,6 @@
+import { CapabilityEngine } from "./capabilities/matcher.js";
+import { buildView } from "./capabilities/view.js";
+import { resolvePacks, shippedRules } from "./capabilities/catalog.js";
 /**
  * Fold DERIVED reachability facts onto EC2 instance nodes so a single-node query
  * can answer questions that are otherwise a multi-hop join with a union (#1139).
@@ -19,89 +22,233 @@
  * With these, "instances SSH-reachable from the internet" is one predicate:
  *   `kind:EC2::Instance attr:internetFacing=true attr:effectiveIngress=tcp:22:0.0.0.0/0`
  * — no hand-joined CLI sweep, no over/under-counting.
+ *
+ * Both are capability rules (#4375): `internet-facing`, `in-sg` and
+ * `ingress-of` in `capabilities/aws.paths`, over the lexicon-neutral view, so
+ * one rule serves CloudFormation kinds and Terraform's AWS types (#4362)
+ * alike. What stays here is the attribute surface: which nodes get the facts,
+ * and how a rule's evidence is spelled as `proto:port:cidr` and `...Via`.
  */
-export function enrichEffectiveTopology(ir) {
-    const byId = new Map(ir.nodes.map((n) => [n.id, n]));
-    const edges = ir.edges ?? [];
-    const kind = (n) => n?.kind ?? "";
-    const isKind = (n, suffix) => !!n && (kind(n) === suffix || kind(n).endsWith("::" + suffix));
-    const via = (...names) => (v) => names.includes(v);
-    /** Out-neighbours of `id` (edges from → to), optionally filtered by viaAttr. */
-    const out = (id, pred) => edges
-        .filter((e) => e.from === id && (!pred || pred(e.viaAttr ?? e.kind ?? "")))
-        .map((e) => byId.get(e.to))
-        .filter((x) => !!x);
-    /** In-neighbours of `id` (edges to ← from), optionally filtered by viaAttr. */
-    const incoming = (id, pred) => edges
-        .filter((e) => e.to === id && (!pred || pred(e.viaAttr ?? e.kind ?? "")))
-        .map((e) => byId.get(e.from))
-        .filter((x) => !!x);
-    const normalizeIngress = (sg) => {
-        const rules = sg.attrs?.["SecurityGroupIngress"];
-        if (!Array.isArray(rules))
-            return [];
-        return rules.map((r) => {
-            const rule = r;
-            const proto = String(rule.IpProtocol ?? "-1");
-            const from = rule.FromPort;
-            const to = rule.ToPort;
-            const port = from == null ? "all" : from === to ? `${from}` : `${from}-${to}`;
-            const cidr = rule.CidrIp ??
-                rule.CidrIpv6 ??
-                (rule.SourceSecurityGroupId ? `sg:${String(rule.SourceSecurityGroupId)}` : "?");
-            return `${proto}:${port}:${cidr}`;
-        });
-    };
-    /** Security groups reachable from an instance — direct and via launch template. */
-    const effectiveSgs = (inst) => {
-        const direct = out(inst.id, via("SecurityGroupIds", "SecurityGroupId"));
-        const templates = out(inst.id, via("LaunchTemplate", "LaunchTemplateId"));
-        const viaTemplate = templates
-            .flatMap((lt) => out(lt.id, via("LaunchTemplateData", "SecurityGroupIds", "SecurityGroupId")))
-            .filter((n) => isKind(n, "SecurityGroup"));
-        const all = [...direct.filter((n) => isKind(n, "SecurityGroup")), ...viaTemplate];
-        return [...new Map(all.map((s) => [s.id, s])).values()];
-    };
-    /** The IGW an instance's subnet routes to (evidence), or undefined. */
-    const internetFacingVia = (inst) => {
-        for (const subnet of out(inst.id, via("SubnetId")).filter((n) => isKind(n, "Subnet"))) {
-            const assocs = incoming(subnet.id, via("SubnetId")).filter((a) => isKind(a, "SubnetRouteTableAssociation"));
-            const routeTables = assocs.flatMap((a) => out(a.id, via("RouteTableId")).filter((n) => isKind(n, "RouteTable")));
-            for (const rt of routeTables) {
-                const routes = incoming(rt.id, via("RouteTableId")).filter((n) => isKind(n, "Route"));
-                for (const route of routes) {
-                    const dest = route.attrs?.["DestinationCidrBlock"];
-                    const igw = out(route.id, via("GatewayId")).find((g) => isKind(g, "InternetGateway"));
-                    if (igw && (dest == null || dest === "0.0.0.0/0")) {
-                        const id = igw.id.includes("::") ? igw.id.slice(igw.id.lastIndexOf("::") + 2) : igw.id;
-                        return `${rt.id.includes("::") ? rt.id.slice(rt.id.lastIndexOf("::") + 2) : rt.id} → ${id}`;
-                    }
-                }
-            }
-        }
-        return undefined;
-    };
+export function enrichEffectiveTopology(ir, packs = []) {
+    const view = buildView(ir, resolvePacks(packs));
+    const engine = new CapabilityEngine(view, shippedRules().rules);
+    const facing = engine.set("internet-facing");
+    const groups = engine.relation("in-sg").out;
     const nodes = ir.nodes.map((n) => {
-        if (!isKind(n, "Instance"))
+        const tf = terraformResourceType(n) === "aws_instance";
+        if (!tf && !isKind(n, "Instance"))
             return n;
-        const effectiveIngress = effectiveSgs(n).flatMap(normalizeIngress);
+        const attrs = (n.attrs ?? {});
+        const reached = [...(groups.get(n.id) ?? new Map())];
+        const ingress = reached.flatMap(([sg]) => ingressStrings(view, sg));
+        const effectiveIngress = tf ? [...new Set(ingress)] : ingress;
         // A live enrichment may already have set internetFacing (+ its evidence) for
         // a subnet chant doesn't model declaratively (e.g. the account's default
         // VPC). Keep that truth; otherwise derive it from the declared route topology.
-        const attrs = (n.attrs ?? {});
         const liveFacing = attrs["internetFacing"] === true;
-        const declaredVia = internetFacingVia(n);
+        const evidence = facing.get(n.id);
+        const declaredVia = evidence && evidence.hops.length > 0 ? facingVia(view, evidence, tf) : undefined;
         const via = attrs["internetFacingVia"] ?? declaredVia;
+        const ingressVia = tf ? reached.map(([sg, ev]) => groupPath(view, ev, sg)).join(", ") : "";
         return {
             ...n,
-            attrs: { ...attrs, effectiveIngress, internetFacing: liveFacing || !!declaredVia, ...(via ? { internetFacingVia: via } : {}) },
+            attrs: {
+                ...attrs,
+                effectiveIngress,
+                internetFacing: liveFacing || !!declaredVia,
+                ...(via ? { internetFacingVia: via } : {}),
+                ...(ingressVia ? { effectiveIngressVia: `security groups ${ingressVia}` } : {}),
+            },
         };
     });
     // Record what this pass computed, so a caller can report the graph's derived surface
     // without hardcoding attribute names. Only kinds actually enriched are listed.
     const enriched = nodes.some((n) => isKind(n, "Instance"));
-    const derivedAttrs = enriched
-        ? { ...(ir.derivedAttrs ?? {}), Instance: ["internetFacing", "effectiveIngress"] }
+    const enrichedTf = nodes.some((n) => terraformResourceType(n) === "aws_instance");
+    const derivedAttrs = enriched || enrichedTf
+        ? {
+            ...(ir.derivedAttrs ?? {}),
+            ...(enriched ? { Instance: ["internetFacing", "effectiveIngress"] } : {}),
+            ...(enrichedTf ? { aws_instance: ["internetFacing", "effectiveIngress"] } : {}),
+        }
         : ir.derivedAttrs;
     return { ...ir, nodes, ...(derivedAttrs ? { derivedAttrs } : {}) };
 }
+function isKind(n, suffix) {
+    const kind = n?.kind ?? "";
+    return !!n && (kind === suffix || kind.endsWith("::" + suffix));
+}
+function bare(id) {
+    return id.includes("::") ? id.slice(id.lastIndexOf("::") + 2) : id;
+}
+/** A node's name in a fold's evidence: a terraform address, or a bare logical id. */
+function display(view, id) {
+    const v = view.nodes.get(id);
+    if (v && v.lexicon === "terraform")
+        return id.slice(id.lastIndexOf("/") + 1);
+    return bare(id);
+}
+/** The ids an evidence path visits, in walk order. */
+function visited(ev, start) {
+    const out = start ? [start] : [];
+    let at = start;
+    for (const h of ev.hops) {
+        const next = at === undefined ? h.to : h.from === at ? h.to : h.from;
+        if (at === undefined)
+            out.push(h.from === next ? h.to : h.from);
+        out.push(next);
+        at = next;
+    }
+    return out;
+}
+/** `internetFacingVia`, as each fold always spelled it. */
+function facingVia(view, ev, tf) {
+    const ids = visited(ev);
+    const of = (label) => ids.find((id) => view.nodes.get(id)?.label === label);
+    const rt = of("RouteTable");
+    const igw = of("InternetGateway");
+    if (!rt || !igw)
+        return undefined;
+    if (!tf)
+        return `${bare(rt)} → ${bare(igw)}`;
+    const subnet = of("Subnet");
+    const route = of("Route");
+    const how = route && view.nodes.get(route)?.attrs.block ? "inline route" : route ? display(view, route) : "route";
+    return `subnet route ${subnet ? display(view, subnet) : "?"} -> ${display(view, rt)} -> ${display(view, igw)} (${how})`;
+}
+/** One reached group, as `effectiveIngressVia` names it: the group, or the template it came through. */
+function groupPath(view, ev, sg) {
+    const lt = visited(ev).find((id) => view.nodes.get(id)?.label === "LaunchTemplate");
+    return lt ? `${display(view, lt)} -> ${display(view, sg)}` : display(view, sg);
+}
+const STYLE_ORDER = ["cfn", "tf-inline", "tf-sg-rule", "tf-vpc-rule"];
+/** A group's ingress rules as `proto:port:source` strings, inline rules first. */
+function ingressStrings(view, sg) {
+    const rules = view.edges
+        .filter((e) => e.from === sg && e.name === "ingress")
+        .map((e) => view.nodes.get(e.to))
+        .filter((r) => r && r.label === "IngressRule");
+    const order = (r) => (r.attrs.block ? -1 : STYLE_ORDER.indexOf(String(r.attrs.style)));
+    return [...rules]
+        .sort((a, b) => order(a) - order(b))
+        .flatMap((r) => {
+        const raw = (r.body ?? {});
+        switch (r.attrs.style) {
+            case "tf-inline":
+                return terraformIngress(raw, { proto: "protocol", cidrs: ["cidr_blocks", "ipv6_cidr_blocks", "prefix_list_ids"], groups: ["security_groups"] });
+            case "tf-sg-rule":
+                return terraformIngress(raw, { proto: "protocol", cidrs: ["cidr_blocks", "ipv6_cidr_blocks", "prefix_list_ids"], groups: ["source_security_group_id"] });
+            case "tf-vpc-rule":
+                return terraformIngress(raw, { proto: "ip_protocol", cidrs: ["cidr_ipv4", "cidr_ipv6", "prefix_list_id"], groups: ["referenced_security_group_id"] });
+            default:
+                return [cloudFormationIngress(raw)];
+        }
+    });
+}
+/** One CloudFormation ingress rule as `proto:port:source`. */
+function cloudFormationIngress(rule) {
+    const proto = String(rule.IpProtocol ?? "-1");
+    const from = rule.FromPort;
+    const to = rule.ToPort;
+    const port = from == null ? "all" : from === to ? `${from}` : `${from}-${to}`;
+    const source = rule.SourceSecurityGroupId;
+    const group = source && typeof source === "object" && typeof source.$ref === "string"
+        ? String(source.$ref).replace(/\.[A-Za-z]+$/, "")
+        : source;
+    const cidr = rule.CidrIp ??
+        rule.CidrIpv6 ??
+        (group ? `sg:${String(group)}` : "?");
+    return `${proto}:${port}:${cidr}`;
+}
+/** The chant entity types every terraform `resource` and `data` block carries. */
+const TERRAFORM_RESOURCE = "Terraform::Resource";
+const TERRAFORM_DATA = "Terraform::Data";
+/**
+ * The Terraform type of a `resource` or `data` node: `aws_instance` for
+ * `aws_instance.web`, `data.aws_ami` for `data.aws_ami.ubuntu`. Undefined for
+ * any other node.
+ *
+ * This is the one reading of a terraform node's type. `chant search`'s `kind:`
+ * (#4366), its rows and `--explain` count, `--count-by kind` (#4360) and the
+ * effective-topology folds (#4362) all call it, so they cannot disagree.
+ *
+ * The terraform lexicon puts every resource on the IR as `Terraform::Resource`
+ * (and every data source as `Terraform::Data`) and carries the block's type
+ * label as `attrs.type` (#4366), which is read first. A node without one (an
+ * older producer, or a `chant graph --live` node built from state) falls back
+ * to the block's address (`aws_instance.web`, or `module.app.aws_instance.web`)
+ * in `attrs.address`, whose second-to-last segment is the type, and failing
+ * that to its id, whose last path segment is the address too. A data source
+ * keeps its `data.` prefix: `data.aws_ami` reads an AMI, it does not manage one.
+ */
+export function terraformType(n) {
+    if (!n || (n.kind !== TERRAFORM_RESOURCE && n.kind !== TERRAFORM_DATA))
+        return undefined;
+    const label = n.attrs?.["type"];
+    let type = typeof label === "string" && label.length > 0 ? label : undefined;
+    if (type === undefined) {
+        const parts = terraformAddress(n).split(".");
+        type = parts.length >= 2 ? parts[parts.length - 2] : undefined;
+    }
+    if (type === undefined)
+        return undefined;
+    return n.kind === TERRAFORM_DATA ? `data.${type}` : type;
+}
+/**
+ * The provider resource type of a terraform `resource` node (`aws_instance`),
+ * or undefined for any other node, data sources included. See {@link terraformType}.
+ */
+export function terraformResourceType(n) {
+    return n?.kind === TERRAFORM_RESOURCE ? terraformType(n) : undefined;
+}
+function terraformAddress(n) {
+    const address = n.attrs?.["address"];
+    if (typeof address === "string" && address.length > 0)
+        return address;
+    return n.id.slice(n.id.lastIndexOf("/") + 1).replace(/~\d+$/, "");
+}
+function bodyOf(n) {
+    const body = n.attrs?.["body"];
+    return body && typeof body === "object" && !Array.isArray(body) ? body : {};
+}
+/** A block-or-list attribute as a list: hcl2json renders nested blocks as arrays. */
+function list(value) {
+    if (value == null)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+/** `${aws_security_group.x.id}` -> `aws_security_group.x`; anything else unchanged. */
+function sourceRef(value) {
+    const s = String(value);
+    const m = /^\$\{([A-Za-z0-9_.-]+?)(?:\.(?:id|arn|name))?\}$/.exec(s);
+    return m ? m[1] : s;
+}
+/**
+ * One terraform ingress rule, in any of its three spellings, normalized to the
+ * `proto:port:source` strings the CloudFormation fold produces. A rule with
+ * several CIDRs or sources yields one string per source, so each is queryable
+ * on its own.
+ */
+function terraformIngress(rule, fields) {
+    const rawProto = String(rule[fields.proto] ?? "-1").toLowerCase();
+    const proto = rawProto === "all" ? "-1" : rawProto;
+    const from = rule["from_port"];
+    const to = rule["to_port"];
+    const port = proto === "-1" || from == null
+        ? "all"
+        : String(from) === String(to ?? from)
+            ? `${from}`
+            : `${from}-${to}`;
+    const sources = [];
+    for (const f of fields.cidrs)
+        for (const c of list(rule[f]))
+            sources.push(String(c));
+    for (const f of fields.groups)
+        for (const g of list(rule[f]))
+            sources.push(`sg:${sourceRef(g)}`);
+    if (rule["self"] === true)
+        sources.push("sg:self");
+    if (sources.length === 0)
+        sources.push("?");
+    return sources.map((src) => `${proto}:${port}:${src}`);
+}

package/dist/graph-ir.d.ts

@@ -1,6 +1,8 @@
 import { type Declarable } from "./declarable.js";
+import { subTemplateRefs } from "./graph-sub-template.js";
 import type { ResourceMetadata } from "./lexicon.js";
 import type { UnobservedEntity } from "./observation.js";
+export { subTemplateRefs };
 /**
  * Graph IR — the engine-neutral, lint-gated representation of a project's
  * resolved infrastructure graph. Painters (mermaid, graphviz, custom SVG) and
@@ -25,6 +27,20 @@ export interface SourceLoc {
 export interface AttrRefEnvelope {
     $ref: string;
 }
+/**
+ * A CloudFormation `Fn::Sub` in an attribute projection (#4373), in place of
+ * `{ $intrinsic: true }`. `$sub` is the template exactly as it serializes, so
+ * `${assets.Arn}/*` names the producer and attribute a reader would otherwise
+ * have to guess. `$vars` is the two-argument form's variable map, each value
+ * projected like any other attr. Every `${Name}` or `${Name.Attr}` in the
+ * template that names a node, and every reference in `$vars`, is also an edge.
+ * `${!Literal}` (CloudFormation's escape), pseudo-parameters (`${AWS::Region}`)
+ * and names `$vars` binds are not.
+ */
+export interface SubEnvelope {
+    $sub: string;
+    $vars?: Record<string, unknown>;
+}
 /** One resource in the graph. */
 export interface IRNode {
     /** Logical name (the export name, or composite-expanded name). */
@@ -420,6 +436,13 @@ export interface GraphIR {
      * the passes produced, not a list maintained by hand.
      */
     derivedAttrs?: Record<string, string[]>;
+    /**
+     * With `chant graph --format ir --capability-view` (#4378): the
+     * lexicon-neutral view capability rules read, built by this chant through
+     * the project's own lexicon mappings and adapters. A `ViewDocument`
+     * (`capabilities/view.ts`). Absent unless asked for.
+     */
+    capabilityView?: unknown;
 }
 /**
  * Build the graph IR from resolved entities (the output of `discover`). Pure and

package/dist/graph-ir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD;;;;;;;;;GASG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEzF,qFAAqF;AACrF,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,uFAAuF;IACvF,IAAI,EAAE,UAAU,CAAC;IACjB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,EAAE,UAAU,CAAC;IACjB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,eAAe,EAAE,CAI/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAGlE;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;8EAG0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC;;;mDAG+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;8BAM8B;AAC9B,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB;yEACqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;oEACoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB;;gFAE4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC;AAwOD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAqGT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAiDlG;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,uBAAuB,EAAE,GAAG,OAAO,CAkBrG;AAYD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAyEzE;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAInG;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAwB9F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAqEpG"}
+{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;;;;GASG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEzF,qFAAqF;AACrF,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,uFAAuF;IACvF,IAAI,EAAE,UAAU,CAAC;IACjB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,EAAE,UAAU,CAAC;IACjB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,eAAe,EAAE,CAI/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAGlE;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;8EAG0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC;;;mDAG+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;8BAM8B;AAC9B,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB;yEACqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;oEACoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB;;gFAE4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAkWD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAqGT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAiDlG;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,uBAAuB,EAAE,GAAG,OAAO,CAkBrG;AAYD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAyEzE;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAInG;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAwB9F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAqEpG"}