@intentius/chant 0.45.0 → 0.49.0

package/dist/components/verbs/r2-sync.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `r2-sync` — bulk object upload to a Cloudflare R2 bucket (chant #1293,
+ * epic #1296), the direct analogue of `s3-sync`
+ * (lexicons/aws/src/components/apply.ts): same input shape (`from`/`to`/
+ * `delete`), same mutating-no-native-rollback disposition
+ * (`rollbackPolicy: "needs-opt-out"`, ../../lint/rules/comp/comp003-mutating-no-rollback.ts),
+ * learnable as the same idea per #1293's own verification bullet. See
+ * ./wrangler.ts's module doc for why this lives in core rather than a
+ * cloudflare lexicon.
+ *
+ * R2 has no first-party bulk-sync CLI the way S3 has `aws s3 sync`, but its
+ * API is S3-compatible, so it takes any S3-compatible sync tool — this wraps
+ * `rclone` (its `sync`/`copy` distinguish "mirror, deleting extras" from
+ * "upload only" exactly the way `s3-sync`'s `delete` flag does) through the
+ * same injectable `ProcessRunner` (./process-runner.ts) `./sign.ts` and
+ * `./wrangler.ts` use. No live `rclone`, no network, ever, in a test run —
+ * every test substitutes `MockProcessRunner`.
+ */
+import type { Capability } from "../capability.js";
+import { type ProcessRunner } from "./process-runner.js";
+/** Thrown when `R2SyncInput.to` is not an `r2://bucket[/prefix]` URI. */
+export declare class R2SyncInvalidDestinationError extends Error {
+    readonly to: string;
+    constructor(to: string);
+}
+/**
+ * Translate an `r2://bucket/prefix` destination to rclone's `<remote>:<path>`
+ * form. `remote` is the name of an rclone remote already configured against
+ * R2's S3-compatible endpoint (`<account-id>.r2.cloudflarestorage.com`) —
+ * out of this capability's scope the same way `s3-sync` doesn't configure
+ * AWS credentials; default `"r2"` is the conventional alias. Exported for
+ * tests, mirroring ./sign.ts's `buildSignArgs`.
+ */
+export declare function toRcloneDest(to: string, remote?: string): string;
+export interface R2SyncInput {
+    /** Local path, or archive-relative path, to sync from. */
+    from: string;
+    /** Destination bucket URI, `"r2://bucket/prefix"` — mirrors `s3-sync`'s `S3SyncInput.to` shape. */
+    to: string;
+    /** Delete destination keys not present in the source. Default: false. */
+    delete?: boolean;
+    /** rclone remote name pointed at R2. Default: `"r2"`. */
+    remote?: string;
+}
+export interface R2SyncOutput {
+    /** Number of objects uploaded (new or changed). */
+    uploaded: number;
+    /** Number of objects deleted (only possible when `delete: true`). */
+    deleted: number;
+}
+/**
+ * Build the `rclone` invocation for `input`. `rclone sync` deletes
+ * destination-only files by default (matching `s3-sync`'s opt-in `delete:
+ * true`); `rclone copy` never deletes (matching the `s3-sync` default) — so
+ * the verb dispatches on `input.delete` rather than passing a `--delete`
+ * flag rclone doesn't have. `-v` gives the per-file action lines
+ * `parseRcloneStats` reads. Exported for tests, mirroring ./sign.ts's
+ * `buildSignArgs`.
+ */
+export declare function buildR2SyncArgs(input: R2SyncInput): string;
+/** Count uploaded/deleted objects out of `rclone -v`'s stdout. Exported for tests. */
+export declare function parseRcloneStats(stdout: string): R2SyncOutput;
+/**
+ * Bulk-sync a directory of objects to an R2 bucket via `rclone`
+ * (endpoint-aware only through the rclone remote's own config — this
+ * capability never touches R2 credentials directly). Mutating, no native
+ * undo (an overwritten or deleted object is gone), so — like `s3-sync` —
+ * `rollbackPolicy: "needs-opt-out"`: COMP003 requires the component to
+ * acknowledge the compensation gap explicitly (a `noRollback` reason, a
+ * component-level `rollback` phase, or a sibling `rollback-previous`/
+ * `snapshot-before` step).
+ */
+export declare function createR2SyncCapability(processRunner?: ProcessRunner): Capability<R2SyncInput, R2SyncOutput>;
+/** Default `r2-sync` capability, backed by the real `ProcessRunner`. */
+export declare const r2SyncCapability: Capability<R2SyncInput, R2SyncOutput>;
+//# sourceMappingURL=r2-sync.d.ts.map

package/dist/components/verbs/r2-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-sync.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/r2-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAwC,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAO5F,yEAAyE;AACzE,qBAAa,6BAA8B,SAAQ,KAAK;aAC1B,EAAE,EAAE,MAAM;gBAAV,EAAE,EAAE,MAAM;CAMvC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,SAAO,GAAG,MAAM,CAK9D;AAED,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,EAAE,EAAE,MAAM,CAAC;IACX,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAI1D;AAQD,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAI7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,GAAE,aAAsC,GACpD,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAUvC;AAED,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,WAAW,EAAE,YAAY,CAA4B,CAAC"}

package/dist/components/verbs/wrangler.d.ts

@@ -0,0 +1,108 @@
+/**
+ * `wrangler-deploy` / `wrangler-versions-promote` — the Cloudflare Workers
+ * apply leaves (chant #1293, epic #1296). The epic cedes the Workers plane
+ * entirely to `wrangler` (first-party, schema-backed, already owns the
+ * config format, bindings model, local dev, and deploy) — these two verbs
+ * are a typed wrapper over that CLI, not a reimplementation of it.
+ *
+ * Placement: core, not a cloudflare lexicon. #1293's own analysis weighed
+ * three options — core (generic verb, fastest, costs a little conceptual
+ * tidiness since `wrangler-deploy` shells a specific vendor CLI), a
+ * capability-only cloudflare lexicon (the "correct" home, but `LexiconPlugin`
+ * tier-1 completeness — serializer, lint rules, post-synth, LSP, examples,
+ * docs — is heavy ceremony for three verbs and no resource types), or
+ * generalizing to a `cli-deploy` verb parameterised by tool (tempting, but
+ * premature and it re-opens the verb set the bounded-primitives thesis
+ * depends on staying closed). Core wins on the same precedent `sign`/
+ * `attest-provenance` (./sign.ts) already set: a specific vendor CLI
+ * (`cosign`) shelled out through the injectable `ProcessRunner`
+ * (./process-runner.ts), no cloud-specific SDK client needed the way AWS's
+ * `CloudExecutor` (./cloud-executor.ts) models CloudFormation/ECS/Lambda.
+ * `wrangler` fits that exact shape. Revisit if/when the zone-plane lexicon
+ * (#1294) lands and gives these three verbs a natural cloudflare-owned home.
+ *
+ * `wrangler-versions-promote` is also the direct evidence for #1296's
+ * "three new verbs cover a whole new cloud" claim: Cloudflare's native
+ * Worker version rollback maps onto the existing `RollbackPolicy: "native"`
+ * (../capability.ts) with no compensation code to hand-write — both verbs
+ * here declare a `rollback` (auto-derived "native" per ../capability.ts's
+ * `Capability.rollbackPolicy` doc) that re-promotes to whichever version was
+ * live before the step ran, the same best-effort captured-previous-state
+ * pattern lexicons/aws/src/components/apply.ts's `lambda-deploy` uses for
+ * its alias rollback.
+ *
+ * No real Cloudflare control-plane emulator exists yet (#1295, epic #1296),
+ * so — like ./sign.ts — every real path here shells out through the
+ * injectable `ProcessRunner` and every test substitutes `MockProcessRunner`
+ * (./__tests__/mock-process-runner.ts): no live `wrangler`, no network, ever,
+ * in a test run. CI coverage is plan-shape/invocation-shape assertions only,
+ * per #1293's own "Verification" section.
+ */
+import type { Capability } from "../capability.js";
+import { type ProcessRunner } from "./process-runner.js";
+/** Thrown when `wrangler deploy`'s stdout carries no parseable Version ID — fail-closed rather than returning a capability output downstream steps (`wrangler-versions-promote`, wired via `"@Deploy.versionId"`) would silently receive as `undefined`. */
+export declare class WranglerVersionIdNotFoundError extends Error {
+    readonly stdout: string;
+    constructor(stdout: string);
+}
+/** Extract the deployed Worker version id from `wrangler deploy`'s stdout. Exported so tests can assert on it directly, mirroring ./sign.ts's `buildSignArgs`. */
+export declare function parseWranglerVersionId(stdout: string): string;
+export interface WranglerDeployInput {
+    /** Path to the Worker's `wrangler.jsonc`/`wrangler.toml`. */
+    config: string;
+    /** Named environment within the config (`wrangler deploy --env <env>`). */
+    env?: string;
+}
+export interface WranglerDeployOutput {
+    /** The version id wrangler assigned this deploy — wire into `wrangler-versions-promote` (e.g. `"@Deploy.versionId"`). */
+    versionId: string;
+}
+/**
+ * Deploy a Worker from a `wrangler.jsonc`/`wrangler.toml` via `wrangler
+ * deploy`, and return the version id it published — the analogue of
+ * `lambda-deploy` (../../lexicons/aws/src/components/apply.ts) for the
+ * Workers plane.
+ *
+ * Rollback: `wrangler-versions-promote` back to whichever version was live
+ * before this step ran (captured up front via `wrangler versions list`, the
+ * same best-effort captured-previous pattern `lambda-deploy` uses for its
+ * alias). A no-op on a first deploy — nothing was live to restore.
+ */
+export declare function createWranglerDeployCapability(processRunner?: ProcessRunner): Capability<WranglerDeployInput, WranglerDeployOutput>;
+/** Default `wrangler-deploy` capability, backed by the real `ProcessRunner`. */
+export declare const wranglerDeployCapability: Capability<WranglerDeployInput, WranglerDeployOutput>;
+export interface WranglerVersionsPromoteInput {
+    /** Path to the Worker's `wrangler.jsonc`/`wrangler.toml`. */
+    config: string;
+    /** Version id to promote — typically wired from a prior `wrangler-deploy` step (`"@Deploy.versionId"`) or a prior version id when this step composes as an explicit rollback. */
+    versionId: string;
+    /** Traffic percentage to route to `versionId`. Default: 100 (full promote/rollback). Below 100 is the gradual-deployment lever. */
+    percentage?: number;
+    /** Named environment within the config (`wrangler versions deploy --env <env>`). */
+    env?: string;
+}
+export interface WranglerVersionsPromoteOutput {
+    /** The version id that was promoted. */
+    versionId: string;
+    /** The traffic percentage actually routed to it. */
+    percentage: number;
+}
+/**
+ * Promote a Worker version to (some percentage of) live traffic via
+ * `wrangler versions deploy <version-id>@<percentage> --yes` — both the
+ * gradual-deployment lever (`percentage` < 100) and, at `percentage: 100`,
+ * the rollback mechanism: Cloudflare's native version rollback is a promote
+ * to a prior version id, not a redeploy, so this same verb composes as the
+ * explicit compensation step a component wires up (#1293's "verification"
+ * example: forced failure after `wrangler-deploy` -> `wrangler-versions-promote`
+ * back to the prior version, no hand-written compensation needed).
+ *
+ * Also declares its own `rollback` (native, no `rollbackPolicy` override
+ * needed — see ../capability.ts): re-promotes to whichever version was live
+ * before *this* promote call, for the case where the promote step itself is
+ * composed directly (not just as `wrangler-deploy`'s compensation).
+ */
+export declare function createWranglerVersionsPromoteCapability(processRunner?: ProcessRunner): Capability<WranglerVersionsPromoteInput, WranglerVersionsPromoteOutput>;
+/** Default `wrangler-versions-promote` capability, backed by the real `ProcessRunner`. */
+export declare const wranglerVersionsPromoteCapability: Capability<WranglerVersionsPromoteInput, WranglerVersionsPromoteOutput>;
+//# sourceMappingURL=wrangler.d.ts.map

package/dist/components/verbs/wrangler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler.d.ts","sourceRoot":"","sources":["../../../src/components/verbs/wrangler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAwC,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA2B5F,4PAA4P;AAC5P,qBAAa,8BAA+B,SAAQ,KAAK;aAC3B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI3C;AASD,kKAAkK;AAClK,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI7D;AA8BD,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,yHAAyH;IACzH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,aAAa,GAAE,aAAsC,GACpD,UAAU,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAuBvD;AAED,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,mBAAmB,EAAE,oBAAoB,CACzD,CAAC;AAInC,MAAM,WAAW,4BAA4B;IAC3C,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,iLAAiL;IACjL,SAAS,EAAE,MAAM,CAAC;IAClB,mIAAmI;IACnI,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,aAAa,GAAE,aAAsC,GACpD,UAAU,CAAC,4BAA4B,EAAE,6BAA6B,CAAC,CAwBzE;AAED,0FAA0F;AAC1F,eAAO,MAAM,iCAAiC,EAAE,UAAU,CACxD,4BAA4B,EAC5B,6BAA6B,CACc,CAAC"}

package/dist/config.d.ts

@@ -36,6 +36,29 @@ export declare function environmentName(entry: EnvironmentDeclaration): string;
  * `environmentNames(config.environments)?.includes(name)`.
  */
 export declare function environmentNames(environments: EnvironmentDeclaration[] | undefined): string[] | undefined;
+/**
+ * Whether a declared environment name is a glob pattern rather than a literal
+ * (#1221) — it contains at least one `*`.
+ */
+export declare function isEnvironmentPattern(declaredName: string): boolean;
+/**
+ * Anchored `*`-glob match (#1221): each `*` in `pattern` matches any run of
+ * characters (possibly empty); everything else matches itself. Deliberately
+ * the whole surface — no `?`, no character classes, no regex. A pattern with
+ * no `*` degenerates to string equality.
+ */
+export declare function matchesEnvironmentPattern(pattern: string, name: string): boolean;
+/**
+ * Environment-membership test (#1221): is `name` covered by this project's
+ * declared `environments`? A literal entry matches by equality; an entry
+ * containing `*` matches as a glob pattern (`"pr-*"` covers `pr-42`).
+ * Literals are checked first across the whole list, then patterns — so a
+ * name that is declared outright never depends on pattern order. `undefined`
+ * / empty `environments` returns `false`; callers that treat "no declared
+ * environments" as "anything goes" (e.g. {@link unknownEnvError} in
+ * `./env.ts`) guard that case themselves.
+ */
+export declare function matchesDeclaredEnvironment(environments: EnvironmentDeclaration[] | undefined, name: string): boolean;
 /**
  * The endpoint `name` declares (chant #1166) — `undefined` for a bare-string
  * entry, an entry with no `endpoint` set, or a name this project doesn't
@@ -43,6 +66,11 @@ export declare function environmentNames(environments: EnvironmentDeclaration[]
  * it injects this into the ambient env var each observing lexicon's CLI
  * shell-out reads (e.g. `AWS_ENDPOINT_URL`), unless that var is already set —
  * ambient always wins.
+ *
+ * A pattern entry (#1221) can carry an endpoint too: `{ name: "pr-*",
+ * endpoint }` supplies the endpoint for every `pr-<n>` environment. A literal
+ * entry always wins over a pattern — declaring `pr-special` alongside
+ * `pr-*` resolves `pr-special` to the literal entry's endpoint (or none).
  */
 export declare function environmentEndpoint(environments: EnvironmentDeclaration[] | undefined, name: string): string | undefined;
 export declare const ChantConfigSchema: z.ZodObject<{
@@ -127,6 +155,9 @@ export declare const ChantConfigSchema: z.ZodObject<{
         }>>;
         vexSources: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    knowledge: z.ZodOptional<z.ZodObject<{
+        dir: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$loose>;
 /**
  * Top-level chant project configuration.
@@ -335,6 +366,20 @@ export interface ChantConfig {
         /** Default VEX document paths (OpenVEX/CycloneDX) applied to every gate. Read where the gate step is composed. */
         vexSources?: string[];
     };
+    /**
+     * OKF knowledge bundle location (#1864, design #1059, epic #1057) — the
+     * *input* side of `chant explain --format okf` (#1058): a project may
+     * author knowledge as an OKF v0.2 bundle (a directory of markdown files
+     * with YAML frontmatter) that `./okf-read.ts`'s `loadOkfBundle` reads and
+     * binds to discovered entities via each concept's `binds` frontmatter key.
+     * Convention-first: `knowledge/` beside `chant.config.ts` is used when this
+     * is unset. Set `dir` only when that name is already taken by something
+     * else in the project. See {@link resolveKnowledgeDir}.
+     */
+    knowledge?: {
+        /** Bundle directory, relative to the project root. Defaults to `"knowledge"`. */
+        dir?: string;
+    };
 }
 /**
  * Resolved project configuration with metadata about how it was loaded.
@@ -516,4 +561,13 @@ export declare function resolveSigningDefaults(config: ChantConfig): ResolvedSig
  * configure how the capability is constructed and are read separately.
  */
 export declare function resolveVulnPolicy(config: ChantConfig): Partial<VulnPolicy>;
+/**
+ * Resolve the OKF knowledge bundle directory (#1864, design #1059):
+ * `knowledge.dir` relative to `projectPath` when configured, else the
+ * `knowledge/` convention beside `chant.config.ts`. Never checks existence —
+ * a project with no bundle yet resolves a path all the same, and
+ * `okf-read.ts`'s `loadOkfBundle` treats a missing directory as an empty
+ * bundle rather than an error.
+ */
+export declare function resolveKnowledgeDir(config: ChantConfig, projectPath: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAIzD;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAEzG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxH;AAaD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwDd,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAExC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,0EAA0E;QAC1E,IAAI,EAAE,MAAM,CAAC;QACb,8EAA8E;QAC9E,GAAG,EAAE,MAAM,CAAC;QACZ;mFAC2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;;;WASG;QACH,GAAG,CAAC,EAAE,YAAY,CAAC;QACnB,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;QAEf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,8KAA8K;QAC9K,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,+OAA+O;QAC/O,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,4cAA4c;QAC5c,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE;QACR,wJAAwJ;QACxJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,sRAAsR;QACtR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2IAA2I;QAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0IAA0I;QAC1I,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,4UAA4U;QAC5U,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QACX,kEAAkE;QAClE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gEAAgE;QAChE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,wEAAwE;QACxE,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0FAA0F;QAC1F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,0FAA0F;QAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,0EAA0E;QAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,8DAA8D;QAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wEAAwE;QACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;QACpC,+EAA+E;QAC/E,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,yKAAyK;QACzK,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5B,kHAAkH;QAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;IAEpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAgB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CASrF;AA0ED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,GAAG,IAAI;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAE3F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC5C,eAAe,GAAG,SAAS,CAI7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAGrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAE1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gJAAgJ;IAChJ,OAAO,EAAE,OAAO,CAAC;IACjB,qIAAqI;IACrI,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,6RAA6R;IAC7R,sBAAsB,EAAE;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,CAanF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiB1E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAIzD;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAEzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAehF;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAClD,IAAI,EAAE,MAAM,GACX,OAAO,CAIT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,sBAAsB,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKxH;AAaD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2Dd,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAExC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,0EAA0E;QAC1E,IAAI,EAAE,MAAM,CAAC;QACb,8EAA8E;QAC9E,GAAG,EAAE,MAAM,CAAC;QACZ;mFAC2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;;;WASG;QACH,GAAG,CAAC,EAAE,YAAY,CAAC;QACnB,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN;;;;;;;WAOG;QACH,IAAI,CAAC,EAAE,OAAO,CAAC;QAEf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,8KAA8K;QAC9K,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,+OAA+O;QAC/O,MAAM,CAAC,EAAE,UAAU,CAAC;QACpB,4cAA4c;QAC5c,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE;QACR,wJAAwJ;QACxJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,sRAAsR;QACtR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,2IAA2I;QAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0IAA0I;QAC1I,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,4UAA4U;QAC5U,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QACX,kEAAkE;QAClE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gEAAgE;QAChE,YAAY,CAAC,EAAE,QAAQ,CAAC;QACxB,wEAAwE;QACxE,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0FAA0F;QAC1F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,0FAA0F;QAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,0EAA0E;QAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,8DAA8D;QAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wEAAwE;QACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;QACpC,+EAA+E;QAC/E,OAAO,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAChD,yKAAyK;QACzK,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5B,kHAAkH;QAClH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IAEF;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE;QACV,iFAAiF;QACjF,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;IAEpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAgB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CASrF;AA0ED,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,GAAG,IAAI;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAE3F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC5C,eAAe,GAAG,SAAS,CAI7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,GACvD,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAGrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,CAE1F;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gJAAgJ;IAChJ,OAAO,EAAE,OAAO,CAAC;IACjB,qIAAqI;IACrI,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,6RAA6R;IAC7R,sBAAsB,EAAE;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,uBAAuB,CAanF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiB1E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/deep-observation.d.ts

@@ -220,6 +220,20 @@ export interface DeepNormalizationHooks {
      * reads as permanent drift.
      */
     unresolved?(node: DeepNode): boolean;
+    /**
+     * Return true when this value is secret material the diff must never hold —
+     * it is collapsed to {@link MASKED} on BOTH sides (the hook runs over the
+     * declared and the live tree alike), so presence and key names still
+     * classify while values never reach a diff row, a log line, or a snapshot.
+     *
+     * The pass masks by key name on its own ({@link isSensitiveKey}); this hook
+     * exists for the lexicons whose secret-bearing paths are structural rather
+     * than name-shaped — a Kubernetes Secret's `data` carries arbitrary key
+     * names (`app.conf`), and #1365 decision 6 draws the hard line: drift on a
+     * secret observes presence, declared key-set, and metadata — never a value
+     * or a value-derived hash.
+     */
+    mask?(node: DeepNode): boolean;
 }
 /** Everything the pass needs besides the tree itself. */
 export interface NormalizeDeepOptions {

package/dist/deep-observation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observation.d.ts","sourceRoot":"","sources":["../src/deep-observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC9C;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC5C,qBAAqB,CAMvB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,yBAAyB,CAG3B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,0FAA0F;AAC1F,eAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAOnD,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC/C;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;CACtC;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAiBtE;AA0CD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmHzB;AAKD,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CA8CtB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAK9D"}
+{"version":3,"file":"deep-observation.d.ts","sourceRoot":"","sources":["../src/deep-observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC9C;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC5C,qBAAqB,CAMvB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,yBAAyB,CAG3B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,0FAA0F;AAC1F,eAAO,MAAM,MAAM,eAAe,CAAC;AAEnC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAOnD,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC/C;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;CAChC;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxC;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAiBtE;AA0CD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsHzB;AAKD,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CA8CtB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAK9D"}

package/dist/effect-receipt.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Effect receipts (chant #1831, epic #1703).
+ *
+ * A RECEIPT is the declared witness that an out-of-band effect (a migration,
+ * a seed job, a one-shot bootstrap) has run — declared, diffed, and observed
+ * like any resource, but observe-only to the generic apply path: the
+ * `effect()` step (#1834) is the sole writer, on success, last. Anything
+ * else silently converts at-least-once into never (epic decision log, item
+ * 3). That write-exclusion is #1832's enforcement; what THIS module provides
+ * is the recognition marker that makes it possible: core code (lint, plan,
+ * apply) identifies receipts via {@link EFFECT_RECEIPT_MARKER} without any
+ * lexicon knowledge, while per-lexicon rows (#1835's `AWS::SSM::Parameter`)
+ * materialize them as real resources. Unlike a secret provenance declaration
+ * (./secret-provenance.ts), a receipt DOES serialize — the marker identifies,
+ * it does not exclude.
+ *
+ * The resolution split (epic decision log, item 5):
+ *
+ * - STATIC inputs hash at synthesis, in the serializer — a fully static
+ *   receipt's expectation is already known when the template is written
+ *   ({@link receiptExpectation}).
+ * - REFERENCE inputs (attr-refs and other intrinsics — deploy-time values)
+ *   are recorded in placeholder form at synthesis and resolve in the plan
+ *   engine (#1832) and again in the effect step (#1834), via
+ *   {@link resolveReceiptExpectation}. Synthesis resolves NOTHING:
+ *   {@link receiptExpectation} refuses a hash-flavor receipt that still
+ *   carries references rather than hashing a placeholder.
+ * - Build-time `params.*` are not references here: they fold to literals
+ *   before discovery ever runs (../params.ts), so by the time this factory
+ *   sees them they are static.
+ *
+ * Nothing in this module reads live state. Every function is pure over the
+ * declaration and, for resolution, the caller-supplied resolver.
+ *
+ * Hashing is JCS-style canonical JSON (RFC 8785 shape: sorted keys, standard
+ * ECMAScript number/string encoding — implemented minimally here, no
+ * dependency) digested with sha256 ({@link canonicalJson},
+ * `sha256:<hex>` like the build-ledger digests in ./lifecycle/build-ledger.ts).
+ */
+import { type Declarable } from "./declarable.js";
+import { type Intrinsic } from "./intrinsic.js";
+/** The closed union of receipt flavors. */
+export type EffectReceiptFlavor = "existence" | "hash";
+/** Every receipt flavor, for exhaustiveness checks. */
+export declare const EFFECT_RECEIPT_FLAVORS: readonly EffectReceiptFlavor[];
+/** Marker symbol identifying an effect receipt. `Symbol.for` so it survives
+ * the entity-wire codec (./discovery/entity-wire-codec.ts) and so a lexicon
+ * row can stamp the SAME symbol on its materialized resource — core's lint
+ * (#1833), plan (#1832), and apply write-exclusion recognize receipts through
+ * this marker alone, lexicon-independently. */
+export declare const EFFECT_RECEIPT_MARKER: unique symbol;
+/** The `entityType` the core factory stamps. Lexicon materialization rows
+ * (#1835) use their own entityType and carry the marker instead. */
+export declare const EFFECT_RECEIPT_ENTITY_TYPE = "Chant::EffectReceipt";
+/**
+ * The expected stored value of an `existence`-flavor receipt: a fixed marker
+ * constant, the same for every existence receipt. Present-and-equal means the
+ * effect has run; anything else renders an effect-will-fire row (#1832).
+ */
+export declare const EXISTENCE_EXPECTATION = "chant.effect-receipt:exists";
+/**
+ * An effect receipt declaration — a Declarable, so discovery collects it,
+ * `chant list` shows it, and (unlike a secret declaration) serialization
+ * keeps it: a lexicon row turns it into a real, observable resource.
+ */
+export interface EffectReceiptDeclaration extends Declarable {
+    readonly [EFFECT_RECEIPT_MARKER]: true;
+    /** `"chant"` for the plain factory; a lexicon row (#1835) declares its own. */
+    readonly lexicon: string;
+    /** The core factory stamps EFFECT_RECEIPT_ENTITY_TYPE; a lexicon row uses its materialized kind. */
+    readonly entityType: string;
+    /** The receipt's own name (the export-level identity of the witness). */
+    readonly name: string;
+    /** The effect this receipt witnesses — the identity the `effect()` step
+     * (#1834) and the receipt path (#1835) key on. */
+    readonly effect: string;
+    /** How the receipt is compared: mere presence, or a digest of the inputs. */
+    readonly flavor: EffectReceiptFlavor;
+    /**
+     * The effect's inputs as recorded at synthesis: static values verbatim,
+     * references (intrinsics) kept in placeholder form — never resolved here.
+     */
+    readonly inputs: Readonly<Record<string, unknown>>;
+}
+/** Factory options for {@link EffectReceipt}. */
+export interface EffectReceiptOptions {
+    /** The effect this receipt witnesses. Non-empty. */
+    readonly effect: string;
+    /** `existence` — presence is the witness; `hash` — a digest of the inputs
+     * is, so changed inputs re-propose the fire. */
+    readonly flavor: EffectReceiptFlavor;
+    /** The effect's inputs. Static values hash at synthesis; intrinsic values
+     * (attr-refs, deploy-time references) resolve at plan and at run. */
+    readonly inputs?: Record<string, unknown>;
+}
+/**
+ * Declare an effect receipt. The returned object is a locked Declarable:
+ * declared fields are immutable, plain-data input structures are frozen
+ * (intrinsics are left live — discovery still stamps logical names onto
+ * attr-refs), and the top-level object stays extensible for discovery's own
+ * symbol-keyed metadata.
+ */
+export declare function EffectReceipt(name: string, options: EffectReceiptOptions): EffectReceiptDeclaration;
+/** Type guard for an effect receipt — the recognition read core's guards use.
+ * True for the core declaration AND for any lexicon-materialized resource
+ * that carries the marker. */
+export declare function isEffectReceipt(value: unknown): value is EffectReceiptDeclaration;
+/**
+ * Extract the effect receipts from a discovered entity map — the read surface
+ * for lint (#1833), the plan engine (#1832), and the apply write-exclusion.
+ * Keyed by entity name (export name), the same key `DiscoveryResult.entities`
+ * uses.
+ */
+export declare function collectEffectReceipts(entities: ReadonlyMap<string, Declarable>): Map<string, EffectReceiptDeclaration>;
+/**
+ * Split an entity map into the apply-bound set and the receipts (#1832).
+ *
+ * The write-exclusion seam: receipts are observe-only to the generic apply
+ * path — the `effect()` step is the sole writer (epic #1703, decision 3), and
+ * a receipt the generic apply stamped would silently convert at-least-once
+ * into never. The build calls this at serializer-input assembly, the one core
+ * choke point every applier's input flows through (appliers consume serialized
+ * build outputs), so no lexicon's serialized apply document ever contains a
+ * receipt and no applier's desired or prune set can. Receipts still reach the
+ * serializer — for visibility rendering outside the apply-bound document
+ * (#1835) — via `SerializeContext.receipts`, never in the entity map.
+ */
+export declare function splitReceiptEntities(entities: ReadonlyMap<string, Declarable>): {
+    applyBound: Map<string, Declarable>;
+    receipts: Map<string, EffectReceiptDeclaration>;
+};
+/**
+ * JCS-style canonical JSON (the RFC 8785 shape, implemented minimally):
+ * object keys sorted by UTF-16 code units, numbers and strings in standard
+ * ECMAScript `JSON.stringify` encoding, no insignificant whitespace.
+ * `toJSON()` is honored the way `JSON.stringify` honors it — which is what
+ * puts an intrinsic's PLACEHOLDER envelope (e.g. an attr-ref's
+ * `{"__attrRef":{...}}`) into the canonical form rather than a resolved
+ * value. Non-representable values (undefined outside an object property,
+ * functions, symbols, bigints, non-finite numbers, cycles) throw — a hash
+ * input silently coerced is a wrong expectation.
+ */
+export declare function canonicalJson(value: unknown): string;
+/** The paths (dot/bracket, rooted at `inputs`) of every reference (intrinsic)
+ * input still unresolved on the receipt. Empty means the receipt is fully
+ * static and {@link receiptExpectation} can stamp its digest at synthesis. */
+export declare function referenceInputPaths(receipt: EffectReceiptDeclaration): string[];
+/**
+ * The receipt's expected stored value, computable at synthesis:
+ *
+ * - `existence` → {@link EXISTENCE_EXPECTATION}, always.
+ * - `hash` → `sha256:<hex>` over the canonical JSON of
+ *   `{ effect, inputs }` — the effect name is bound into the digest so the
+ *   same inputs under a different effect never collide.
+ *
+ * A hash-flavor receipt that still carries reference inputs THROWS instead
+ * of hashing placeholders: synthesis resolves nothing (epic decision log,
+ * item 5). The plan engine and the effect step get the digest through
+ * {@link resolveReceiptExpectation}.
+ */
+export declare function receiptExpectation(receipt: EffectReceiptDeclaration): string;
+/**
+ * Resolves one reference input to its live value. `path` is the reference's
+ * location (as {@link referenceInputPaths} renders it). Must return a
+ * JSON-representable value — returning `undefined` or another intrinsic is
+ * an error, reported with the path.
+ */
+export type ReceiptInputResolver = (ref: Intrinsic, path: string) => unknown;
+/**
+ * The receipt's expected stored value with references resolved — the form
+ * the plan engine (#1832) compares against the live receipt and the effect
+ * step (#1834) writes on success. Deterministic over the receipt and the
+ * resolver's answers; resolves nothing itself and reads no live state (the
+ * resolver is the caller's seam to deploy-time values).
+ */
+export declare function resolveReceiptExpectation(receipt: EffectReceiptDeclaration, resolver: ReceiptInputResolver): string;
+//# sourceMappingURL=effect-receipt.d.ts.map

package/dist/effect-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-receipt.d.ts","sourceRoot":"","sources":["../src/effect-receipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE1D,2CAA2C;AAC3C,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,MAAM,CAAC;AAEvD,uDAAuD;AACvD,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAA0B,CAAC;AAE5F;;;;+CAI+C;AAC/C,eAAO,MAAM,qBAAqB,eAAqC,CAAC;AAExE;oEACoE;AACpE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oGAAoG;IACpG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;sDACkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;oDACgD;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;yEACqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,wBAAwB,CAmCnG;AAoBD;;8BAE8B;AAC9B,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,wBAAwB,CAOjF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GACxC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAMvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG;IAC/E,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;CACjD,CAQA;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMpD;AA4DD;;8EAE8E;AAC9E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAI/E;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAW5E;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;AAE7E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,oBAAoB,GAC7B,MAAM,CAIR"}

package/dist/env.d.ts

@@ -28,7 +28,18 @@ export declare function env(fallback?: string): string | undefined;
  * when it's valid (or when the project declares no environments, in which case
  * any name is accepted). `declared` entries may be a bare name or `{ name,
  * endpoint }` (#1166) — {@link environmentNames} reduces either to the names
- * this checks against.
+ * this checks against. An entry containing `*` is a glob pattern (#1221):
+ * `"pr-*"` legalizes every `pr-<n>` environment. Literal entries are checked
+ * first, then patterns — see {@link matchesDeclaredEnvironment}.
  */
 export declare function unknownEnvError(requested: string | undefined, declared: EnvironmentDeclaration[] | undefined): string | undefined;
+/**
+ * True when an environment name looks like production — `prod`, `production`,
+ * and separator-delimited variants (`prod-eu`, `us-prod`, `production2`).
+ * `chant lifecycle teardown <env> --yes` demands an extra confirmation for
+ * these (#1222): a typo that survives the declared-environments check should
+ * still not delete production on one flag. Name-shaped, deliberately — chant
+ * has no other signal for which environment is the one that pays the bills.
+ */
+export declare function isProdLikeEnvironment(name: string): boolean;
 //# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAoB,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAEzE,0DAA0D;AAC1D,eAAO,MAAM,OAAO,cAAc,CAAC;AAEnC,iFAAiF;AACjF,wBAAgB,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,sBAAsB,EAAE,GAAG,SAAS,GAC7C,MAAM,GAAG,SAAS,CAKpB"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAgD,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAErG,0DAA0D;AAC1D,eAAO,MAAM,OAAO,cAAc,CAAC;AAEnC,iFAAiF;AACjF,wBAAgB,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,sBAAsB,EAAE,GAAG,SAAS,GAC7C,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/fold/subset.d.ts

@@ -165,7 +165,7 @@ export declare function unsupportedExpressionMessage(node: ts.Node): string;
  * the value. Returns the first violation within this member, or
  * `undefined` when it's fully in the subset.
  */
-export declare function checkObjectMember(prop: ts.ObjectLiteralElementLike, intrinsics?: readonly IntrinsicDef[]): SubsetViolation | undefined;
+export declare function checkObjectMember(prop: ts.ObjectLiteralElementLike, intrinsics?: readonly IntrinsicDef[], allowCompositeStepAccess?: boolean): SubsetViolation | undefined;
 /**
  * The canonical recursive shape classifier: is `node`'s expression *shape*
  * within the subset `fold()` can reduce? Mirrors `fold()`'s own dispatch
@@ -175,6 +175,19 @@ export declare function checkObjectMember(prop: ts.ObjectLiteralElementLike, int
  * environment-dependent exceptions). Returns the first (deepest,
  * `fold()`-evaluation-order) unsupported node, or `undefined` when `node`'s
  * whole shape is foldable.
+ *
+ * `allowCompositeStepAccess` (chant #1544) is an EVL-only, MORE-permissive
+ * divergence in the same direction as points 1/2/2b/2c in the module doc
+ * above: a call immediately narrowed to a single member access — the
+ * `Checkout({...}).step` shape every lexicon's single-action `Composite()`
+ * wrappers document as their embedded-inline idiom (see composites.mdx —
+ * "normally embedded inline as `checkout.step` inside a `Job`'s `steps`
+ * array") — is treated as shape-valid. `fold()` itself never passes this
+ * (it has no such parameter to pass; only EVL001 opts in), so `fold()`'s own
+ * behavior is unchanged: it still falls the file back to the run path for
+ * this shape, exactly as composites.mdx describes as the expected, correct
+ * outcome — not an error. What changes is that EVL001 stops treating that
+ * ordinary, documented fallback as a lint error.
  */
-export declare function findSubsetViolation(node: ts.Node, intrinsics?: readonly IntrinsicDef[]): SubsetViolation | undefined;
+export declare function findSubsetViolation(node: ts.Node, intrinsics?: readonly IntrinsicDef[], allowCompositeStepAccess?: boolean): SubsetViolation | undefined;
 //# sourceMappingURL=subset.d.ts.map

package/dist/fold/subset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subset.d.ts","sourceRoot":"","sources":["../../src/fold/subset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+GG;AAEH,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/C,uGAAuG;AACvG,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,EAAE,CAAC,UAAU,CAchE,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,EAAE,CAAC,UAAU,CAG/D,CAAC;AAEH,gHAAgH;AAChH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,EAAE,CAAC,YAAY,GACpB,IAAI,IAAI,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,cAAc,CAE9D;AAED,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,cAAc,CAErG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,SAAK,GAAG,MAAM,CAGnE;AAQD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,GAAG,MAAM,CAEzE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,iCAAiC,8BAA8B,CAAC;AAE7E,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM,CAEtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,CAErE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,EAAE,CAAC,wBAAwB,EACjC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,GACnC,eAAe,GAAG,SAAS,CAc7B;AAWD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,GACnC,eAAe,GAAG,SAAS,CAiK7B"}
+{"version":3,"file":"subset.d.ts","sourceRoot":"","sources":["../../src/fold/subset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+GG;AAEH,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/C,uGAAuG;AACvG,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,EAAE,CAAC,UAAU,CAchE,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,EAAE,CAAC,UAAU,CAG/D,CAAC;AAEH,gHAAgH;AAChH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,EAAE,CAAC,YAAY,GACpB,IAAI,IAAI,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,cAAc,CAE9D;AAED,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,cAAc,CAErG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,SAAK,GAAG,MAAM,CAGnE;AAQD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,GAAG,MAAM,CAEzE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,iCAAiC,8BAA8B,CAAC;AAE7E,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM,CAEtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,CAErE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,EAAE,CAAC,wBAAwB,EACjC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,EACpC,wBAAwB,CAAC,EAAE,OAAO,GACjC,eAAe,GAAG,SAAS,CAc7B;AAYD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,EACpC,wBAAwB,CAAC,EAAE,OAAO,GACjC,eAAe,GAAG,SAAS,CA2K7B"}

package/dist/index.d.ts

@@ -6,6 +6,9 @@
 export * from "./declarable.js";
 export * from "./composite.js";
 export * from "./provenance.js";
+export * from "./secret-provenance.js";
+export * from "./secret-materialization.js";
+export * from "./effect-receipt.js";
 export * from "./build-params.js";
 export * from "./intrinsic.js";
 export * from "./types.js";
@@ -42,6 +45,7 @@ export * from "./lint/selectors.js";
 export * from "./lint/named-checks.js";
 export * from "./lint/post-synth.js";
 export * from "./lint/policy.js";
+export * from "./lint/pipeline-change-gate.js";
 export * from "./lint/rule-loader.js";
 export * from "./lint/discover.js";
 export * from "./import/parser.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAClE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5F,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAClE,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5F,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}