@intentius/sql-yodeler 0.3.0 → 0.5.0

package/dist/chant/access.js

@@ -0,0 +1,155 @@
+/**
+ * Access control under review. On Postgres (#45): row-level security,
+ * policies, the roles a schema declares, grants and default privileges, as
+ * chant's sql lexicon plans and applies them where `sql.profiles.<env>.access`
+ * is on (yodel.config.ts's `environments.<env>.access` sets it per
+ * environment). On ClickHouse (#46): users, roles, row policies and grants,
+ * which chant plans and applies where `sql.profiles.<env>.access` is on, as
+ * on Postgres.
+ *
+ * The plan already lists each access change with its rule and class. This
+ * module picks them out so `yodel plan`, `yodel new`, lint and the pull
+ * request comment can show them together, and names the changes that take
+ * access away: a privilege revoked (SQLPG297), a policy dropped (SQLPG292),
+ * row-level security turned off or no longer forced (SQLPG293), and on
+ * ClickHouse a privilege or role revoked (SQLCH274). A revoke no `REVOKE`
+ * declaration asks for takes away a privilege granted by hand (or one whose
+ * declaration was deleted) from the role that holds it, so it is called out
+ * on its own. ClickHouse takes no `REVOKE` declaration: a grantee's grant
+ * declarations are all it holds, so every revoke there is one of these.
+ */
+import { environmentAccess } from "../config/settings.js";
+/** chant's access rules: policies, row-level security, roles, grants, revokes, default privileges; on ClickHouse role settings, user clauses, row policies, grants and revokes. */
+export const ACCESS_RULES = new Set([
+    "SQLPG290", "SQLPG291", "SQLPG292", "SQLPG293", "SQLPG294", "SQLPG296", "SQLPG297", "SQLPG298",
+    "SQLCH270", "SQLCH271", "SQLCH272", "SQLCH273", "SQLCH274",
+]);
+/** The entity types of ClickHouse's access declarations: `user`, `role`, `policy` and `grant`. */
+export const CH_ACCESS_TYPES = new Set(["ClickHouse::User", "ClickHouse::Role", "ClickHouse::RowPolicy", "ClickHouse::Grant"]);
+/** The entity types of access declarations. */
+export const ACCESS_TYPES = new Set(["Postgres::Policy", "Postgres::Role", "Postgres::Grant", "Postgres::DefaultPrivileges", ...CH_ACCESS_TYPES]);
+/** The `field` chant gives a created policy or role in a plan. */
+const ACCESS_FIELDS = new Set(["policy", "role"]);
+/** How chant keys a ClickHouse access object in a plan: `role r`, `user u`, `row policy p ON db.t`, `grants g` (`../chant/plan.ts` labels a declared one `<export> (<key>)`). */
+const CH_ACCESS_KEY = /^(?:[^(]* \()?(?:user|role|row policy|grants) /;
+/** A plan change that is about access control. */
+export const isAccessChange = (c) => ACCESS_RULES.has(c.rule) || (c.rule === "SQLPG200" && ACCESS_FIELDS.has(c.field)) || (c.rule === "SQLCH200" && CH_ACCESS_KEY.test(c.object));
+/** A migration step that is about access control. */
+export function isAccessStep(s) {
+    // chant's ownership comment after a CREATE is not a change anyone reviews.
+    if (s.kind === "statement")
+        return !/^\s*COMMENT\s+ON\b/i.test(s.sql) && (ACCESS_TYPES.has(s.type) || ACCESS_RULES.has(s.rule) || /\bROW\s+LEVEL\s+SECURITY\b/i.test(s.sql));
+    return s.changes.some((c) => ACCESS_RULES.has(c.rule));
+}
+const OFF = /\b(?:DISABLE|NO\s+FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/i;
+/** Why a statement takes access away, or `undefined`. */
+export function takesAccessAway(s) {
+    if (s.rule === "SQLPG297")
+        return "revokes a privilege";
+    if (s.rule === "SQLCH274")
+        return s.sql !== undefined && !/\sON\s/i.test(s.sql.replace(/\bON\s+CLUSTER\s+\S+/i, "")) ? "revokes a role" : "revokes a privilege";
+    if (s.rule === "SQLPG292")
+        return "drops a policy";
+    if (s.rule === "SQLPG293" && s.sql !== undefined && OFF.test(s.sql))
+        return /NO\s+FORCE/i.test(s.sql) ? "stops forcing row-level security on the table's owner" : "turns row-level security off";
+    return undefined;
+}
+/** The ACL entries the build's declarations decide, as chant keys them (`relation app.t TO reader`), with the declarations behind each. */
+async function declaredEntries(build) {
+    const { pgSchemaFromBuildOutput } = await import("@intentius/chant-lexicon-sql/postgres/plan/schema");
+    const { declaredAccess } = await import("@intentius/chant-lexicon-sql/postgres/access/acl");
+    const objects = pgSchemaFromBuildOutput(JSON.stringify(build));
+    const major = typeof build.postgresMajor === "number" ? build.postgresMajor : 18;
+    return declaredAccess(objects, { major }).exportsOf;
+}
+/** The access changes of a plan, a revoke of what nothing declares marked {@link AccessItem.byHand}. */
+export async function accessItems(changes, build) {
+    const access = changes.filter(isAccessChange);
+    if (access.length === 0)
+        return [];
+    const declared = access.some((c) => c.rule === "SQLPG297") ? await declaredEntries(build) : new Map();
+    // A revoke the declarations ask for is theirs; any other takes away what a grant made by hand (or a deleted declaration) gave.
+    const revokes = new Set(build.objects.filter((o) => o.type === "Postgres::Grant" && /^\s*REVOKE\b/i.test(o.ddl)).map((o) => o.export));
+    // ClickHouse takes no REVOKE declaration: a grantee's grant declarations are the whole of what it holds, so every revoke takes away what none of them grants.
+    const byHand = (c) => c.rule === "SQLCH274" || (c.rule === "SQLPG297" && !(declared.get(c.object) ?? []).some((e) => revokes.has(e)));
+    return access.map((c) => ({
+        object: c.object,
+        rule: c.rule,
+        class: c.class,
+        field: c.field,
+        ...(c.before !== undefined ? { before: c.before } : {}),
+        ...(c.after !== undefined ? { after: c.after } : {}),
+        ...(byHand(c) ? { byHand: true } : {}),
+    }));
+}
+/** A plan's access section: whether access is managed in environment `name` (and where that is set), and the plan's access changes. */
+export async function accessReview(project, name, changes, build) {
+    const chant = project.profileAccess?.[name];
+    const { access, source } = environmentAccess(project.yodel?.config.environments?.[name], chant !== undefined ? { access: chant } : undefined, name);
+    return { managed: access, source, changes: await accessItems(changes, build) };
+}
+const list = (v) => (typeof v === "string" ? v.split(",").map((x) => x.trim()).filter(Boolean) : []);
+/** The privileges a revoke takes away: what the role held before and does not after. */
+export const removed = (c) => {
+    const after = new Set(list(c.after));
+    return list(c.before).filter((x) => !after.has(x));
+};
+const value = (v) => (v === undefined || v === null || v === "" ? "nothing" : typeof v === "string" ? v : JSON.stringify(v));
+/** What a revoke takes away, from whom: `relation app.t FROM reader: insert` (Postgres), `INSERT ON db.t FROM reader` (ClickHouse, whose plan names the grantee as `grants <grantee>`). */
+export function revokeLine(c) {
+    const grantee = /^(?:[^(]* \()?grants (.+?)\)?$/.exec(c.object)?.[1];
+    if (grantee !== undefined)
+        return `${value(c.before)} FROM ${grantee}`;
+    return `${c.object.replace(/ TO /, " FROM ")}: ${removed(c).join(", ")}`;
+}
+/** The plan's access section, as text: every change with its rule and class, then the revokes of privileges granted by hand. */
+export function renderAccessReview(review, environment) {
+    const where = review.source === "default" ? "off by default" : `from ${review.source}`;
+    if (!review.managed)
+        return review.changes.length > 0 ? [] : [`Access control: not managed in ${environment} (${where}); policies, grants, roles and users are not planned.`];
+    const lines = [`Access control (managed in ${environment}, ${where}): ${review.changes.length === 0 ? "no change" : `${String(review.changes.length)} change${review.changes.length === 1 ? "" : "s"}`}`];
+    for (const c of review.changes)
+        lines.push(`  ${c.rule} ${c.class}  ${c.object}  ${c.field}: ${value(c.before)} -> ${value(c.after)}${c.byHand ? "  (granted by hand)" : ""}`);
+    const byHand = review.changes.filter((c) => c.byHand);
+    if (byHand.length > 0) {
+        lines.push("", `Revoked by this apply, though no declaration revokes ${byHand.length === 1 ? "it" : "them"}: privileges granted by hand (or whose declaration was deleted). The role loses ${byHand.length === 1 ? "it" : "them"} once the apply runs:`, ...byHand.map((c) => `  ${revokeLine(c)}`), `To keep ${byHand.length === 1 ? "it" : "them"}, declare ${byHand.length === 1 ? "it" : "them"} with grant\`...\`.`);
+    }
+    return lines;
+}
+/** The access steps of a migration, each with why it takes access away when it does. */
+export function accessSteps(steps) {
+    const out = [];
+    steps.forEach((step, index) => {
+        if (!isAccessStep(step))
+            return;
+        const away = step.kind === "statement" ? takesAccessAway(step) : undefined;
+        // chant files a Postgres revoke no declaration is behind under the ACL entry, `acl <entry>`; a ClickHouse revoke never has one.
+        const undeclared = step.kind === "statement" && ((step.rule === "SQLPG297" && step.object.startsWith("acl ")) || step.rule === "SQLCH274");
+        out.push({ index, step, ...(away ? { away } : {}), ...(undeclared ? { undeclared: true } : {}) });
+    });
+    return out;
+}
+/** A migration's access steps as lines: how many, and each one that takes access away. */
+export function describeAccessSteps(steps, md = false) {
+    const access = accessSteps(steps);
+    if (access.length === 0)
+        return [];
+    const code = (s) => (md ? `\`${s}\`` : s);
+    const away = access.filter((a) => a.away);
+    const lines = [`Access control: ${String(access.length)} step${access.length === 1 ? "" : "s"} (${[...new Set(access.map((a) => (a.step.kind === "statement" ? `${a.step.rule} ${a.step.class}` : a.step.kind)))].join(", ")})${away.length > 0 ? `, ${String(away.length)} taking access away:` : ""}`];
+    for (const a of away)
+        lines.push(`${md ? "- " : "  "}step ${String(a.index)} ${a.away ?? ""}${a.undeclared ? " that no declaration grants any more" : ""}: ${code(a.step.kind === "statement" ? a.step.sql.split("\n")[0] ?? "" : a.step.name)}`);
+    return lines;
+}
+/**
+ * ClickHouse: whether environment `name` manages access, from yodel.config.ts
+ * or `sql.profiles.<env>.access`. chant plans and applies the users, roles,
+ * row policies and grants only where the profile's `access` is on, and the
+ * declarative path refuses a yodel.config.ts that says otherwise
+ * (`declarativeAccessRefusal`), so the two agree there.
+ */
+export function clickhouseAccessManaged(project, name) {
+    const chant = project.profileAccess?.[name];
+    return environmentAccess(project.yodel?.config.environments?.[name], chant !== undefined ? { access: chant } : undefined, name).access;
+}
+//# sourceMappingURL=access.js.map

package/dist/chant/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/chant/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,mLAAmL;AACnL,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IACvD,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC3D,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEpJ,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;AAEvK,kEAAkE;AAClE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAElD,iLAAiL;AACjL,MAAM,aAAa,GAAG,gDAAgD,CAAC;AAEvE,kDAAkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAsD,EAAW,EAAE,CAChG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/I,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,CAAgB;IAC3C,2EAA2E;IAC3E,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7K,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,GAAG,GAAG,sDAAsD,CAAC;AAEnE,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,CAAiC;IAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,qBAAqB,CAAC;IACxD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChK,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,gBAAgB,CAAC;IACnD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,8BAA8B,CAAC;IACjM,OAAO,SAAS,CAAC;AACnB,CAAC;AAsBD,2IAA2I;AAC3I,KAAK,UAAU,eAAe,CAAC,KAAkB;IAC/C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;IACtG,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,OAAO,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoC,EAAE,KAAkB;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAoB,CAAC;IACxH,+HAA+H;IAC/H,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvI,8JAA8J;IAC9J,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjK,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAiD,EAAE,IAAY,EAAE,OAAoC,EAAE,KAAkB;IAC1J,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpJ,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAExH,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAuC,EAAY,EAAE;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9I,2LAA2L;AAC3L,MAAM,UAAU,UAAU,CAAC,CAAkD;IAC3E,MAAM,OAAO,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,OAAO,EAAE,CAAC;IACvE,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAmB;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kCAAkC,WAAW,KAAK,KAAK,uDAAuD,CAAC,CAAC;IAC9K,MAAM,KAAK,GAAG,CAAC,8BAA8B,WAAW,KAAK,KAAK,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1M,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/K,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,wDAAwD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,mFAAmF,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,uBAAuB,EACxO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1C,WAAW,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,KAA+B;IACzD,MAAM,GAAG,GAAoF,EAAE,CAAC;IAChG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,gIAAgI;QAChI,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAC3I,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CAAC,KAA+B,EAAE,EAAE,GAAG,KAAK;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzS,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClP,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiD,EAAE,IAAY;IACrG,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACzI,CAAC"}

package/dist/chant/drift.d.ts

@@ -17,7 +17,7 @@ import type { LiveDiffResult, UnobservedResource } from "@intentius/chant/lifecy
 import type { DeepDiffResult, DeepEntityDrift } from "@intentius/chant/lifecycle/deep-diff";
 import { type Environment, type Project } from "../project.js";
 import { type ServerInfo } from "../server.js";
-import type { BuildOutput } from "./build.js";
+import type { Build, BuildOutput } from "./build.js";
 /** The `lexicons.sql` section of `chant lifecycle diff --live --json`. */
 export interface SqlLiveDiff {
     resources?: LiveDiffResult;
@@ -69,6 +69,22 @@ export interface RecordedSource {
     dispose: () => void;
 }
 export declare function writeRecordedSource(projectDir: string, schema: BuildOutput): Promise<RecordedSource>;
+/** ClickHouse access objects of a recorded schema as declarations: each its DDL in its tag, names as text (the recorded DDL has them resolved). */
+export declare function recordedAccessSource(objects: ReadonlyArray<{
+    export: string;
+    type?: string;
+    ddl: string;
+}>): string;
+/**
+ * ClickHouse grants (#46), which `chant lifecycle diff` leaves unobserved (a
+ * grant is compared as part of its grantee's grants): yodel plans `build`
+ * against the environment and reads each `grants <grantee>` change as drift.
+ * A grant declared and not held is `absent`; one held and not declared
+ * (granted by hand, which the next apply revokes) is `changed`, declared
+ * nothing. A grantee the server does not have is gone. The grant
+ * declarations come off `unobserved`, since they were compared.
+ */
+export declare function withClickHouseGrants(drift: Drift, project: Project, env: Environment, build: Build): Promise<Drift>;
 /** Exit code: an owned object changed or is gone. */
 export declare const DRIFTED = 2;
 /** `2` on drift; `1` when there is none but part of the environment could not be read; `0` when clean. */

package/dist/chant/drift.js

@@ -19,6 +19,8 @@ import { dirname, join } from "node:path";
 import { YodelError } from "../project.js";
 import { lastJsonLine, runChant } from "./process.js";
 import { describeServer } from "../server.js";
+import { CH_ACCESS_TYPES } from "./access.js";
+import { planEnvironment } from "./plan.js";
 /**
  * A stable fingerprint of the drift: the environment and what drifted
  * (each changed object's changes, declared and live, and the objects gone),
@@ -39,7 +41,9 @@ export function driftFingerprint(drift) {
 }
 export async function writeRecordedSource(projectDir, schema) {
     const { sqlTemplateGenerator } = await import("@intentius/chant-lexicon-sql/import-generator");
-    const resources = schema.objects.map((o) => {
+    // chant's ClickHouse generator writes no user, role, row policy or grant (#46); those go in a file of their own, each its recorded DDL.
+    const access = schema.objects.filter((o) => CH_ACCESS_TYPES.has(o.type ?? ""));
+    const resources = schema.objects.filter((o) => !CH_ACCESS_TYPES.has(o.type ?? "")).map((o) => {
         const own = o;
         const where = typeof own.database === "string" ? { database: own.database } : typeof own.schema === "string" ? { schema: own.schema } : {};
         return { type: o.type ?? "", logicalId: o.export, properties: { ...where, name: typeof own.name === "string" ? own.name : o.export, ddl: o.ddl } };
@@ -54,6 +58,8 @@ export async function writeRecordedSource(projectDir, schema) {
             mkdirSync(dirname(path), { recursive: true });
             writeFileSync(path, f.content);
         }
+        if (access.length > 0)
+            writeFileSync(join(dir, "access.ts"), recordedAccessSource(access));
     }
     catch (e) {
         dispose();
@@ -61,6 +67,52 @@ export async function writeRecordedSource(projectDir, schema) {
     }
     return { dir, dispose };
 }
+const CH_ACCESS_TAG = { "ClickHouse::User": "user", "ClickHouse::Role": "role", "ClickHouse::RowPolicy": "policy", "ClickHouse::Grant": "grant" };
+/** ClickHouse access objects of a recorded schema as declarations: each its DDL in its tag, names as text (the recorded DDL has them resolved). */
+export function recordedAccessSource(objects) {
+    const tags = [...new Set(objects.map((o) => CH_ACCESS_TAG[o.type ?? ""] ?? ""))].filter(Boolean).sort();
+    const lines = [`import { ${tags.join(", ")} } from "@intentius/chant-lexicon-sql/clickhouse";`, ""];
+    for (const o of objects)
+        lines.push(`export const ${o.export} = ${CH_ACCESS_TAG[o.type ?? ""] ?? "grant"}\`${o.ddl.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${")}\`;`);
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * ClickHouse grants (#46), which `chant lifecycle diff` leaves unobserved (a
+ * grant is compared as part of its grantee's grants): yodel plans `build`
+ * against the environment and reads each `grants <grantee>` change as drift.
+ * A grant declared and not held is `absent`; one held and not declared
+ * (granted by hand, which the next apply revokes) is `changed`, declared
+ * nothing. A grantee the server does not have is gone. The grant
+ * declarations come off `unobserved`, since they were compared.
+ */
+export async function withClickHouseGrants(drift, project, env, build) {
+    const grants = build.output.objects.filter((o) => o.type === "ClickHouse::Grant");
+    if (grants.length === 0)
+        return drift;
+    const plan = await planEnvironment(project, env, build);
+    const byGrantee = new Map();
+    const missing = [];
+    for (const c of plan.diff.changes) {
+        if (!c.object.startsWith("grants "))
+            continue;
+        if (c.rule === "SQLCH200") {
+            missing.push(c.object);
+            continue;
+        }
+        if (c.rule !== "SQLCH273" && c.rule !== "SQLCH274")
+            continue;
+        const e = byGrantee.get(c.object) ?? { name: c.object, type: "ClickHouse::Grant", changes: [] };
+        e.changes.push(c.rule === "SQLCH273" ? { path: c.field, kind: "absent", declared: c.after } : { path: c.field, kind: "changed", live: c.before });
+        byGrantee.set(c.object, e);
+    }
+    const compared = new Set(grants.map((o) => o.export));
+    return {
+        ...drift,
+        changed: [...drift.changed, ...byGrantee.values()],
+        missing: [...drift.missing, ...missing].sort(),
+        unobserved: drift.unobserved.filter((u) => !compared.has(u.name)),
+    };
+}
 /** Exit code: an owned object changed or is gone. */
 export const DRIFTED = 2;
 /** `2` on drift; `1` when there is none but part of the environment could not be read; `0` when clean. */
@@ -93,7 +145,8 @@ export function driftFromLifecycle(environment, doc) {
 }
 /** Runs `chant lifecycle diff <env> --live --json` in the project and reads the drift from it. */
 export async function readDrift(project, env, options = {}) {
-    const result = await runChant(["lifecycle", "diff", env.name, "--live", "--json", ...(options.src ? ["--src", options.src] : [])], {
+    // Always scoped to the declared schema: a build of the project root reads every .sql file in it, migrations and ORM DDL included.
+    const result = await runChant(["lifecycle", "diff", env.name, "--live", "--json", "--src", options.src ?? project.sourceDir], {
         cwd: project.dir,
         ...(options.env ? { env: options.env } : {}),
     });

package/dist/chant/drift.js.map

@@ -1 +1 @@
-{"version":3,"file":"drift.js","sourceRoot":"","sources":["../../src/chant/drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAkC,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAgC/D;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAY;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;KACvL,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChH,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,MAAmB;IAC/E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,+CAA+C,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,GAAG,GAAG,CAAwE,CAAC;QACrF,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3I,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;IACrJ,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AAEzB,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACzE,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,GAAY;IAClE,MAAM,QAAQ,GAAI,GAA8D,EAAE,QAAQ,CAAC;IAC3F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAI,GAAwC,EAAE,MAAM,CAAC;QACjE,MAAM,IAAI,UAAU,CAClB,MAAM;YACJ,CAAC,CAAC,wFAAwF;YAC1F,CAAC,CAAC,iDAAiD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,WAAW;QACX,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACnD,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAgB,EAAE,UAAqD,EAAE;IACzH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACjI,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAAC,wBAAwB,GAAG,CAAC,IAAI,wBAAwB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,KAAY,EAAE,KAA0G;IAC9K,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GACP,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,gDAAgD,CAAC,CAAC,CAAC,KAAK;YACxE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/E,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAoC,CAAC;gBAC5F,MAAM,OAAO,GAAI,GAAG,CAAC,OAAO,CAAC,CAAC,KAA+B,CAAC,OAAO,CAAC;gBACtE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAI,CAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvJ,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAsC;IAC/E,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,UAAU,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1G,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC/D,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,4CAA4C,CAAC;IAClF,OAAO,OAAO,CAAC,SAAS;QACtB,CAAC,CAAC,4BAA4B,OAAO,CAAC,SAAS,gEAAgE;QAC/G,CAAC,CAAC,gFAAgF,CAAC;AACvF,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,WAAW,CAAC,KAAY,EAAE,MAAmB;IAC3D,MAAM,KAAK,GAAa,CAAC,YAAY,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;IAC3J,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjK,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+CAA+C,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5G,IAAI,KAAK,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;AAEjE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAY,EAAE,MAA8B,EAAE,KAA4C;IAC5H,MAAM,KAAK,GAAa,CAAC,KAAK,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uEAAuE,EAAE,EAAE,CAAC,CAAC;IAC7K,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjK,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,WAAW,qEAAqE,CAAC,CAAC;IACxH,IAAI,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC;IACpE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"drift.js","sourceRoot":"","sources":["../../src/chant/drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAkC,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA+B5C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAY;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;KACvL,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChH,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,MAAmB;IAC/E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,+CAA+C,CAAC,CAAC;IAC/F,wIAAwI;IACxI,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3F,MAAM,GAAG,GAAG,CAAwE,CAAC;QACrF,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3I,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;IACrJ,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,aAAa,GAAqC,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;AAEpL,mJAAmJ;AACnJ,MAAM,UAAU,oBAAoB,CAAC,OAAsE;IACzG,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxG,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,MAAM,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9L,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAY,EAAE,OAAgB,EAAE,GAAgB,EAAE,KAAY;IACvG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QAC7D,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAChG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAClJ,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QAClD,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AAEzB,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACzE,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,GAAY;IAClE,MAAM,QAAQ,GAAI,GAA8D,EAAE,QAAQ,CAAC;IAC3F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAI,GAAwC,EAAE,MAAM,CAAC;QACjE,MAAM,IAAI,UAAU,CAClB,MAAM;YACJ,CAAC,CAAC,wFAAwF;YAC1F,CAAC,CAAC,iDAAiD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,WAAW;QACX,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACnD,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAgB,EAAE,UAAqD,EAAE;IACzH,kIAAkI;IAClI,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE;QAC5H,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAAC,wBAAwB,GAAG,CAAC,IAAI,wBAAwB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,KAAY,EAAE,KAA0G;IAC9K,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GACP,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,gDAAgD,CAAC,CAAC,CAAC,KAAK;YACxE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/E,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAoC,CAAC;gBAC5F,MAAM,OAAO,GAAI,GAAG,CAAC,OAAO,CAAC,CAAC,KAA+B,CAAC,OAAO,CAAC;gBACtE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAI,CAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvJ,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAsC;IAC/E,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,UAAU,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1G,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC/D,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,4CAA4C,CAAC;IAClF,OAAO,OAAO,CAAC,SAAS;QACtB,CAAC,CAAC,4BAA4B,OAAO,CAAC,SAAS,gEAAgE;QAC/G,CAAC,CAAC,gFAAgF,CAAC;AACvF,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,WAAW,CAAC,KAAY,EAAE,MAAmB;IAC3D,MAAM,KAAK,GAAa,CAAC,YAAY,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;IAC3J,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjK,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+CAA+C,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5G,IAAI,KAAK,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;AAEjE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAY,EAAE,MAA8B,EAAE,KAA4C;IAC5H,MAAM,KAAK,GAAa,CAAC,KAAK,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uEAAuE,EAAE,EAAE,CAAC,CAAC;IAC7K,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,IAAI,cAAc,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjK,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,WAAW,qEAAqE,CAAC,CAAC;IACxH,IAAI,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC;IACpE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/chant/plan.d.ts

@@ -25,14 +25,30 @@ export interface Plan {
 }
 /** Exit code: the plan has a change that needs a rebuild (or expand-and-contract) Op. */
 export declare const PLAN_NEEDS_OP = 2;
-/** `2` when any change needs its own Op, `0` otherwise. */
+/**
+ * `2` when any change needs its own Op, or a live object in the declared
+ * databases could not be read (chant's `unreadable`, an object whose
+ * definition does not parse, #46): a plan that cannot say what it would do
+ * to it is not one to apply. `0` otherwise.
+ */
 export declare function planExitCode(plan: Plan): number;
+/** The live objects a ClickHouse plan could not read, as chant names them. */
+export declare const unreadableOf: (plan: Plan) => Array<{
+    object: string;
+    type: string;
+    reason: string;
+}>;
 /**
  * The changes to objects the build declares. A plan also lists live objects
  * the project does not declare, as drops; an ApplyOp never touches those
  * (it only prunes objects carrying chant's marker), so they are not work
  * left for apply. chant labels a declared object `<export> (<name>)` and an
- * undeclared one by its name alone.
+ * undeclared one by its name alone. A privilege change (#45) is labelled by
+ * its ACL entry (`relation app.t TO reader`); chant plans one only where the
+ * environment manages access, always on a declared object, and the apply
+ * makes it, so it is work too. So is a ClickHouse grantee's grants (#46),
+ * labelled `grants <grantee>`: chant reads only the grantees the build
+ * declares a grant to.
  */
 export declare function declaredChanges(plan: Plan, build: Build): ClassifiedChange[];
 /** The plan as `yodel plan --json` prints it: chant's diff, with the environment and dialect it is of. */

package/dist/chant/plan.js

@@ -7,24 +7,42 @@
 import { YodelError } from "../project.js";
 /** Exit code: the plan has a change that needs a rebuild (or expand-and-contract) Op. */
 export const PLAN_NEEDS_OP = 2;
-/** `2` when any change needs its own Op, `0` otherwise. */
+/**
+ * `2` when any change needs its own Op, or a live object in the declared
+ * databases could not be read (chant's `unreadable`, an object whose
+ * definition does not parse, #46): a plan that cannot say what it would do
+ * to it is not one to apply. `0` otherwise.
+ */
 export function planExitCode(plan) {
-    return plan.refused.length > 0 ? PLAN_NEEDS_OP : 0;
+    return plan.refused.length > 0 || unreadableOf(plan).length > 0 ? PLAN_NEEDS_OP : 0;
 }
+/** The live objects a ClickHouse plan could not read, as chant names them. */
+export const unreadableOf = (plan) => (plan.dialect === "clickhouse" ? (plan.diff.unreadable ?? []) : []);
 /**
  * The changes to objects the build declares. A plan also lists live objects
  * the project does not declare, as drops; an ApplyOp never touches those
  * (it only prunes objects carrying chant's marker), so they are not work
  * left for apply. chant labels a declared object `<export> (<name>)` and an
- * undeclared one by its name alone.
+ * undeclared one by its name alone. A privilege change (#45) is labelled by
+ * its ACL entry (`relation app.t TO reader`); chant plans one only where the
+ * environment manages access, always on a declared object, and the apply
+ * makes it, so it is work too. So is a ClickHouse grantee's grants (#46),
+ * labelled `grants <grantee>`: chant reads only the grantees the build
+ * declares a grant to.
  */
 export function declaredChanges(plan, build) {
     const exports = new Set(build.output.objects.map((o) => o.export));
     return plan.diff.changes.filter((c) => {
+        if (PRIVILEGE_RULES.has(c.rule))
+            return true;
+        if (plan.dialect === "clickhouse" && c.object.startsWith("grants "))
+            return true;
         const at = c.object.indexOf(" (");
         return at > 0 && c.object.endsWith(")") && exports.has(c.object.slice(0, at));
     });
 }
+/** chant's rules for a privilege granted, revoked, or a default privilege changed. */
+const PRIVILEGE_RULES = new Set(["SQLPG296", "SQLPG297", "SQLPG298"]);
 /** The plan as `yodel plan --json` prints it: chant's diff, with the environment and dialect it is of. */
 export function planJson(plan) {
     return { environment: plan.environment, dialect: plan.dialect, ...plan.diff };

package/dist/chant/plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/chant/plan.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,UAAU,EAAmD,MAAM,eAAe,CAAC;AAkB5F,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,KAAY;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,IAAI,UAAU,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAgB,EAAE,KAAY,EAAE,UAAuC,EAAE;IAC/H,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAe,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,KAAa;IACxD,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAC3F,OAAO,YAAY,CAAC,IAAI,CAAC,IAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;IAC3F,OAAO,UAAU,CAAC,IAAI,CAAC,IAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/chant/plan.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,UAAU,EAAmD,MAAM,eAAe,CAAC;AAkB5F,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAU,EAA2D,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,IAAmB,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEzL;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,KAAY;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAEtE,0GAA0G;AAC1G,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,IAAI,UAAU,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAgB,EAAE,KAAY,EAAE,UAAuC,EAAE;IAC/H,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAe,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,KAAa;IACxD,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAC3F,OAAO,YAAY,CAAC,IAAI,CAAC,IAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;IAC3F,OAAO,UAAU,CAAC,IAAI,CAAC,IAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/ci/login.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The cloud login a CI job runs before yodel (#132), when a role it holds
+ * has a password minted by a cloud token source: the job's OIDC token,
+ * exchanged by the cloud's own command line, which then mints the database
+ * token (`aws rds generate-db-auth-token`, `gcloud sql generate-login-token`,
+ * `az account get-access-token`). yodel.config.ts `ci.login` says what to
+ * log in as ({@link CiLogin}); this renders the steps per forge. Nothing
+ * here calls a cloud: the rendered job does, when it runs.
+ *
+ * The token, per forge:
+ * - GitHub: the job requests it for the cloud's audience
+ *   (ACTIONS_ID_TOKEN_REQUEST_URL, granted by `id-token: write`) and writes
+ *   it to the token file.
+ * - GitLab: the job's `id_tokens` variable (AWS_ID_TOKEN, GCP_ID_TOKEN,
+ *   AZURE_ID_TOKEN) is written to the token file.
+ * - Forgejo gives a job no OIDC token: a login is rendered only when the
+ *   config's `tokenFile` names a token the runner provides.
+ *
+ * The login, per cloud, from the token file:
+ * - aws: AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_SESSION_NAME,
+ *   which the aws command line assumes the role with.
+ * - gcp: an external_account credential configuration over the token file
+ *   (the workload identity provider, impersonating the service account),
+ *   `gcloud auth login --cred-file` with it, and GOOGLE_APPLICATION_CREDENTIALS.
+ * - azure: `az login --service-principal --federated-token`, and
+ *   AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * On GitHub and Forgejo the variables go to $GITHUB_ENV, so every later step
+ * has them (the report too); on GitLab they are the job's `variables`, so
+ * after_script has them too.
+ */
+import type { AwsLogin, AzureLogin, CiLogin, CloudLogins, GcpLogin } from "../config/define.js";
+import type { CloudToken, Role } from "../credentials.js";
+export type Cloud = keyof CloudLogins;
+export declare const CLOUDS: readonly Cloud[];
+/** The cloud whose login a token source mints from. */
+export declare const CLOUD_OF: Record<CloudToken, Cloud>;
+export type LoginForge = "github" | "gitlab" | "forgejo";
+/** One cloud's login in one job. */
+export type Login = {
+    cloud: "aws";
+    config: AwsLogin;
+} | {
+    cloud: "gcp";
+    config: GcpLogin;
+} | {
+    cloud: "azure";
+    config: AzureLogin;
+};
+/** What a job adds for its logins: variables every later command has, and the lines to run before yodel. */
+export interface LoginSteps {
+    /** One per cloud: its name and its lines, in order. */
+    steps: Array<{
+        name: string;
+        lines: string[];
+    }>;
+    /** GitLab: the job's variables. On GitHub and Forgejo the lines write them to $GITHUB_ENV instead. */
+    variables: Record<string, string>;
+}
+/** The ID token's audience a cloud accepts. GCP's is the workload identity provider's own. */
+export declare function audience(login: Login): string;
+/** The GitLab ID token variable per cloud, as #50 named them. */
+export declare const GITLAB_ID_TOKEN: Record<Cloud, string>;
+/** The login config for `env`'s roles minted by `token`: the environment's own, else the project's. */
+export declare function loginFor(login: CiLogin | undefined, env: string, token: CloudToken): Login | undefined;
+/**
+ * The logins of a job holding `held` roles, each cloud once. A job logs in
+ * once per cloud, so two environments it holds that name different logins
+ * for one cloud are refused.
+ */
+export declare function jobLogins(login: CiLogin | undefined, held: ReadonlyArray<readonly [string, Role]>, cloudOf: (env: string, role: Role) => CloudToken | undefined): Login[];
+/**
+ * The login steps of a job on `forge`, for `logins`. On Forgejo a cloud
+ * without a `tokenFile` is left out: the runner's own identity mints there.
+ */
+export declare function loginSteps(forge: LoginForge, logins: readonly Login[]): LoginSteps;
+/** What is wrong with yodel.config.ts `ci.login`, if anything. */
+export declare function loginProblem(value: unknown, where: string): string | undefined;