@intentius/sql-yodeler 0.4.0 → 0.5.1

package/README.md

@@ -34,7 +34,7 @@ The documentation is at [intentius.io/sql-yodeler](https://intentius.io/sql-yode
 
 `yodel apply <env>` takes the versioned path when the project has a `migrations/` directory holding at least one migration (`yodel new` writes them); otherwise it is the declarative path, unchanged. `yodel status <env>` lists applied, pending, out-of-order and part-way migrations and checksum mismatches (`--json`; exit 0 up to date, 3 pending, 4 mismatch or out of order, 2 an Op step, 1 error).
 
-`yodel init --from <env>` adopts an existing database: it reads it with chant's import (`chant import --from`), writes the declarations to `src/`, checks they plan clean, writes the baseline migration (the first one, creating everything) and records it applied in the history without running it (a succeeded migration row whose `note` starts `baseline:`). It needs a `chant.config.ts` with `sql.profiles.<env>` already, and for ClickHouse the profile's `databases`; `yodel init --help` has the rest. On Postgres it does the same, recording the baseline in `<history schema>.history`.
+`yodel init --from <env>` adopts an existing database: it reads it with chant's import (`chant import --from`), writes the declarations to `src/`, checks they plan clean, writes the baseline migration (the first one, creating everything) and records it applied in the history without running it (a succeeded migration row whose `note` starts `baseline:`). It needs a `chant.config.ts` with `sql.profiles.<env>` already, and for ClickHouse the profile's `databases`; `yodel init --help` has the rest. On Postgres it does the same, recording the baseline in `<history schema>.history`. `yodel init --baseline <env>` then records the same baseline in another environment that already holds the schema (staging, prod): it compares that environment's live schema with the schema the baseline records, refuses naming each difference, and otherwise records the baseline applied behind the environment's gate.
 
 The history is an append-only table, `<db>.history`, one row per migration and per statement event, never updated or deleted.
 

package/dist/chant/access.d.ts

@@ -4,9 +4,8 @@
  * chant's sql lexicon plans and applies them where `sql.profiles.<env>.access`
  * is on (yodel.config.ts's `environments.<env>.access` sets it per
  * environment). On ClickHouse (#46): users, roles, row policies and grants,
- * which chant plans whenever the build declares them; yodel refuses the
- * declarative path where the environment does not manage access
- * ({@link clickhouseAccessRefusal}).
+ * which chant plans and applies where `sql.profiles.<env>.access` is on, as
+ * on Postgres.
  *
  * The plan already lists each access change with its rule and class. This
  * module picks them out so `yodel plan`, `yodel new`, lint and the pull
@@ -22,7 +21,7 @@
 import type { ClassifiedChange } from "@intentius/chant-lexicon-sql/core/classifier";
 import type { MigrationStep } from "@intentius/chant-lexicon-sql/migration-statements";
 import type { BuildOutput } from "./build.js";
-import { YodelError, type Project } from "../project.js";
+import type { Project } from "../project.js";
 /** chant's access rules: policies, row-level security, roles, grants, revokes, default privileges; on ClickHouse role settings, user clauses, row policies, grants and revokes. */
 export declare const ACCESS_RULES: ReadonlySet<string>;
 /** The entity types of ClickHouse's access declarations: `user`, `role`, `policy` and `grant`. */
@@ -76,12 +75,10 @@ export declare function accessSteps(steps: readonly MigrationStep[]): Array<{
 /** A migration's access steps as lines: how many, and each one that takes access away. */
 export declare function describeAccessSteps(steps: readonly MigrationStep[], md?: boolean): string[];
 /**
- * ClickHouse: the declarative path's refusal where environment `name` does
- * not manage access and the build declares users, roles, row policies or
- * grants. chant's ClickHouse apply (the project's ApplyOp) and `chant
- * lifecycle diff` plan every access declaration they find, with no switch of
- * their own, so yodel cannot leave them out there: rather than plan without
- * them and apply with them, it refuses. `undefined` when access is managed,
- * or nothing is declared.
+ * ClickHouse: whether environment `name` manages access, from yodel.config.ts
+ * or `sql.profiles.<env>.access`. chant plans and applies the users, roles,
+ * row policies and grants only where the profile's `access` is on, and the
+ * declarative path refuses a yodel.config.ts that says otherwise
+ * (`declarativeAccessRefusal`), so the two agree there.
  */
-export declare function clickhouseAccessRefusal(project: Pick<Project, "yodel" | "profileAccess">, name: string, build: Pick<BuildOutput, "objects">, what?: string): YodelError | undefined;
+export declare function clickhouseAccessManaged(project: Pick<Project, "yodel" | "profileAccess">, name: string): boolean;

package/dist/chant/access.js

@@ -4,9 +4,8 @@
  * chant's sql lexicon plans and applies them where `sql.profiles.<env>.access`
  * is on (yodel.config.ts's `environments.<env>.access` sets it per
  * environment). On ClickHouse (#46): users, roles, row policies and grants,
- * which chant plans whenever the build declares them; yodel refuses the
- * declarative path where the environment does not manage access
- * ({@link clickhouseAccessRefusal}).
+ * which chant plans and applies where `sql.profiles.<env>.access` is on, as
+ * on Postgres.
  *
  * The plan already lists each access change with its rule and class. This
  * module picks them out so `yodel plan`, `yodel new`, lint and the pull
@@ -20,8 +19,6 @@
  * declarations are all it holds, so every revoke there is one of these.
  */
 import { environmentAccess } from "../config/settings.js";
-import { CONFIG_FILE } from "../config/load.js";
-import { YodelError } from "../project.js";
 /** chant's access rules: policies, row-level security, roles, grants, revokes, default privileges; on ClickHouse role settings, user clauses, row policies, grants and revokes. */
 export const ACCESS_RULES = new Set([
     "SQLPG290", "SQLPG291", "SQLPG292", "SQLPG293", "SQLPG294", "SQLPG296", "SQLPG297", "SQLPG298",
@@ -145,25 +142,14 @@ export function describeAccessSteps(steps, md = false) {
     return lines;
 }
 /**
- * ClickHouse: the declarative path's refusal where environment `name` does
- * not manage access and the build declares users, roles, row policies or
- * grants. chant's ClickHouse apply (the project's ApplyOp) and `chant
- * lifecycle diff` plan every access declaration they find, with no switch of
- * their own, so yodel cannot leave them out there: rather than plan without
- * them and apply with them, it refuses. `undefined` when access is managed,
- * or nothing is declared.
+ * ClickHouse: whether environment `name` manages access, from yodel.config.ts
+ * or `sql.profiles.<env>.access`. chant plans and applies the users, roles,
+ * row policies and grants only where the profile's `access` is on, and the
+ * declarative path refuses a yodel.config.ts that says otherwise
+ * (`declarativeAccessRefusal`), so the two agree there.
  */
-export function clickhouseAccessRefusal(project, name, build, what = "the declared schema") {
-    const declared = build.objects.filter((o) => CH_ACCESS_TYPES.has(o.type ?? ""));
-    if (declared.length === 0)
-        return undefined;
+export function clickhouseAccessManaged(project, name) {
     const chant = project.profileAccess?.[name];
-    const { access, source } = environmentAccess(project.yodel?.config.environments?.[name], chant !== undefined ? { access: chant } : undefined, name);
-    if (access)
-        return undefined;
-    const names = declared.map((o) => o.export);
-    return new YodelError(`${what} declares access control (${names.slice(0, 5).join(", ")}${names.length > 5 ? `, and ${String(names.length - 5)} more` : ""}), but ${name} does not manage access (${source === "default" ? "off by default" : `${source} says false`}). ` +
-        `On ClickHouse the declarative apply and drift run chant, which plans every user, role, row policy and grant it is given, so yodel will not plan them away here and apply them there. ` +
-        `Set environments.${name}.access to true in ${CONFIG_FILE}, or move the access declarations out of the source directory.`);
+    return environmentAccess(project.yodel?.config.environments?.[name], chant !== undefined ? { access: chant } : undefined, name).access;
 }
 //# sourceMappingURL=access.js.map

package/dist/chant/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/chant/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAgB,MAAM,eAAe,CAAC;AAEzD,mLAAmL;AACnL,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IACvD,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC3D,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEpJ,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;AAEvK,kEAAkE;AAClE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAElD,iLAAiL;AACjL,MAAM,aAAa,GAAG,gDAAgD,CAAC;AAEvE,kDAAkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAsD,EAAW,EAAE,CAChG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/I,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,CAAgB;IAC3C,2EAA2E;IAC3E,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7K,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,GAAG,GAAG,sDAAsD,CAAC;AAEnE,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,CAAiC;IAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,qBAAqB,CAAC;IACxD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChK,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,gBAAgB,CAAC;IACnD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,8BAA8B,CAAC;IACjM,OAAO,SAAS,CAAC;AACnB,CAAC;AAsBD,2IAA2I;AAC3I,KAAK,UAAU,eAAe,CAAC,KAAkB;IAC/C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;IACtG,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,OAAO,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoC,EAAE,KAAkB;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAoB,CAAC;IACxH,+HAA+H;IAC/H,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvI,8JAA8J;IAC9J,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjK,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAiD,EAAE,IAAY,EAAE,OAAoC,EAAE,KAAkB;IAC1J,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpJ,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAExH,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAuC,EAAY,EAAE;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9I,2LAA2L;AAC3L,MAAM,UAAU,UAAU,CAAC,CAAkD;IAC3E,MAAM,OAAO,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,OAAO,EAAE,CAAC;IACvE,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAmB;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kCAAkC,WAAW,KAAK,KAAK,uDAAuD,CAAC,CAAC;IAC9K,MAAM,KAAK,GAAG,CAAC,8BAA8B,WAAW,KAAK,KAAK,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1M,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/K,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,wDAAwD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,mFAAmF,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,uBAAuB,EACxO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1C,WAAW,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,KAA+B;IACzD,MAAM,GAAG,GAAoF,EAAE,CAAC;IAChG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,gIAAgI;QAChI,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAC3I,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CAAC,KAA+B,EAAE,EAAE,GAAG,KAAK;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzS,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClP,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiD,EAAE,IAAY,EAAE,KAAmC,EAAE,IAAI,GAAG,qBAAqB;IACxK,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpJ,IAAI,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,UAAU,CACnB,GAAG,IAAI,6BAA6B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,4BAA4B,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,aAAa,KAAK;QAChP,uLAAuL;QACvL,oBAAoB,IAAI,sBAAsB,WAAW,gEAAgE,CAC5H,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/chant/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,mLAAmL;AACnL,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IACvD,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC3D,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEpJ,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;AAEvK,kEAAkE;AAClE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAElD,iLAAiL;AACjL,MAAM,aAAa,GAAG,gDAAgD,CAAC;AAEvE,kDAAkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAsD,EAAW,EAAE,CAChG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/I,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,CAAgB;IAC3C,2EAA2E;IAC3E,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7K,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,GAAG,GAAG,sDAAsD,CAAC;AAEnE,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,CAAiC;IAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,qBAAqB,CAAC;IACxD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChK,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,gBAAgB,CAAC;IACnD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,8BAA8B,CAAC;IACjM,OAAO,SAAS,CAAC;AACnB,CAAC;AAsBD,2IAA2I;AAC3I,KAAK,UAAU,eAAe,CAAC,KAAkB;IAC/C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;IACtG,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kDAAkD,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,OAAO,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoC,EAAE,KAAkB;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAoB,CAAC;IACxH,+HAA+H;IAC/H,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvI,8JAA8J;IAC9J,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjK,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAiD,EAAE,IAAY,EAAE,OAAoC,EAAE,KAAkB;IAC1J,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpJ,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAExH,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAuC,EAAY,EAAE;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9I,2LAA2L;AAC3L,MAAM,UAAU,UAAU,CAAC,CAAkD;IAC3E,MAAM,OAAO,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,OAAO,EAAE,CAAC;IACvE,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAmB;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kCAAkC,WAAW,KAAK,KAAK,uDAAuD,CAAC,CAAC;IAC9K,MAAM,KAAK,GAAG,CAAC,8BAA8B,WAAW,KAAK,KAAK,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1M,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/K,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,wDAAwD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,mFAAmF,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,uBAAuB,EACxO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1C,WAAW,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,KAA+B;IACzD,MAAM,GAAG,GAAoF,EAAE,CAAC;IAChG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,gIAAgI;QAChI,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAC3I,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CAAC,KAA+B,EAAE,EAAE,GAAG,KAAK;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzS,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClP,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiD,EAAE,IAAY;IACrG,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACzI,CAAC"}

package/dist/ci/login.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The cloud login a CI job runs before yodel (#132), when a role it holds
+ * has a password minted by a cloud token source: the job's OIDC token,
+ * exchanged by the cloud's own command line, which then mints the database
+ * token (`aws rds generate-db-auth-token`, `gcloud sql generate-login-token`,
+ * `az account get-access-token`). yodel.config.ts `ci.login` says what to
+ * log in as ({@link CiLogin}); this renders the steps per forge. Nothing
+ * here calls a cloud: the rendered job does, when it runs.
+ *
+ * The token, per forge:
+ * - GitHub: the job requests it for the cloud's audience
+ *   (ACTIONS_ID_TOKEN_REQUEST_URL, granted by `id-token: write`) and writes
+ *   it to the token file.
+ * - GitLab: the job's `id_tokens` variable (AWS_ID_TOKEN, GCP_ID_TOKEN,
+ *   AZURE_ID_TOKEN) is written to the token file.
+ * - Forgejo gives a job no OIDC token: a login is rendered only when the
+ *   config's `tokenFile` names a token the runner provides.
+ *
+ * The login, per cloud, from the token file:
+ * - aws: AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_SESSION_NAME,
+ *   which the aws command line assumes the role with.
+ * - gcp: an external_account credential configuration over the token file
+ *   (the workload identity provider, impersonating the service account),
+ *   `gcloud auth login --cred-file` with it, and GOOGLE_APPLICATION_CREDENTIALS.
+ * - azure: `az login --service-principal --federated-token`, and
+ *   AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * On GitHub and Forgejo the variables go to $GITHUB_ENV, so every later step
+ * has them (the report too); on GitLab they are the job's `variables`, so
+ * after_script has them too.
+ */
+import type { AwsLogin, AzureLogin, CiLogin, CloudLogins, GcpLogin } from "../config/define.js";
+import type { CloudToken, Role } from "../credentials.js";
+export type Cloud = keyof CloudLogins;
+export declare const CLOUDS: readonly Cloud[];
+/** The cloud whose login a token source mints from. */
+export declare const CLOUD_OF: Record<CloudToken, Cloud>;
+export type LoginForge = "github" | "gitlab" | "forgejo";
+/** One cloud's login in one job. */
+export type Login = {
+    cloud: "aws";
+    config: AwsLogin;
+} | {
+    cloud: "gcp";
+    config: GcpLogin;
+} | {
+    cloud: "azure";
+    config: AzureLogin;
+};
+/** What a job adds for its logins: variables every later command has, and the lines to run before yodel. */
+export interface LoginSteps {
+    /** One per cloud: its name and its lines, in order. */
+    steps: Array<{
+        name: string;
+        lines: string[];
+    }>;
+    /** GitLab: the job's variables. On GitHub and Forgejo the lines write them to $GITHUB_ENV instead. */
+    variables: Record<string, string>;
+}
+/** The ID token's audience a cloud accepts. GCP's is the workload identity provider's own. */
+export declare function audience(login: Login): string;
+/** The GitLab ID token variable per cloud, as #50 named them. */
+export declare const GITLAB_ID_TOKEN: Record<Cloud, string>;
+/** The login config for `env`'s roles minted by `token`: the environment's own, else the project's. */
+export declare function loginFor(login: CiLogin | undefined, env: string, token: CloudToken): Login | undefined;
+/**
+ * The logins of a job holding `held` roles, each cloud once. A job logs in
+ * once per cloud, so two environments it holds that name different logins
+ * for one cloud are refused.
+ */
+export declare function jobLogins(login: CiLogin | undefined, held: ReadonlyArray<readonly [string, Role]>, cloudOf: (env: string, role: Role) => CloudToken | undefined): Login[];
+/**
+ * The login steps of a job on `forge`, for `logins`. On Forgejo a cloud
+ * without a `tokenFile` is left out: the runner's own identity mints there.
+ */
+export declare function loginSteps(forge: LoginForge, logins: readonly Login[]): LoginSteps;
+/** What is wrong with yodel.config.ts `ci.login`, if anything. */
+export declare function loginProblem(value: unknown, where: string): string | undefined;

package/dist/ci/login.js

@@ -0,0 +1,199 @@
+/**
+ * The cloud login a CI job runs before yodel (#132), when a role it holds
+ * has a password minted by a cloud token source: the job's OIDC token,
+ * exchanged by the cloud's own command line, which then mints the database
+ * token (`aws rds generate-db-auth-token`, `gcloud sql generate-login-token`,
+ * `az account get-access-token`). yodel.config.ts `ci.login` says what to
+ * log in as ({@link CiLogin}); this renders the steps per forge. Nothing
+ * here calls a cloud: the rendered job does, when it runs.
+ *
+ * The token, per forge:
+ * - GitHub: the job requests it for the cloud's audience
+ *   (ACTIONS_ID_TOKEN_REQUEST_URL, granted by `id-token: write`) and writes
+ *   it to the token file.
+ * - GitLab: the job's `id_tokens` variable (AWS_ID_TOKEN, GCP_ID_TOKEN,
+ *   AZURE_ID_TOKEN) is written to the token file.
+ * - Forgejo gives a job no OIDC token: a login is rendered only when the
+ *   config's `tokenFile` names a token the runner provides.
+ *
+ * The login, per cloud, from the token file:
+ * - aws: AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_SESSION_NAME,
+ *   which the aws command line assumes the role with.
+ * - gcp: an external_account credential configuration over the token file
+ *   (the workload identity provider, impersonating the service account),
+ *   `gcloud auth login --cred-file` with it, and GOOGLE_APPLICATION_CREDENTIALS.
+ * - azure: `az login --service-principal --federated-token`, and
+ *   AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * On GitHub and Forgejo the variables go to $GITHUB_ENV, so every later step
+ * has them (the report too); on GitLab they are the job's `variables`, so
+ * after_script has them too.
+ */
+export const CLOUDS = ["aws", "gcp", "azure"];
+/** The cloud whose login a token source mints from. */
+export const CLOUD_OF = { "rds-iam": "aws", "cloud-sql-iam": "gcp", entra: "azure" };
+/** The ID token's audience a cloud accepts. GCP's is the workload identity provider's own. */
+export function audience(login) {
+    if (login.cloud === "aws")
+        return "sts.amazonaws.com";
+    if (login.cloud === "gcp")
+        return `https://iam.googleapis.com/${login.config.workloadIdentityProvider}`;
+    return "api://AzureADTokenExchange";
+}
+/** The GitLab ID token variable per cloud, as #50 named them. */
+export const GITLAB_ID_TOKEN = { aws: "AWS_ID_TOKEN", gcp: "GCP_ID_TOKEN", azure: "AZURE_ID_TOKEN" };
+/** The login config for `env`'s roles minted by `token`: the environment's own, else the project's. */
+export function loginFor(login, env, token) {
+    const cloud = CLOUD_OF[token];
+    const config = login?.environments?.[env]?.[cloud] ?? login?.[cloud];
+    return config ? { cloud, config } : undefined;
+}
+/**
+ * The logins of a job holding `held` roles, each cloud once. A job logs in
+ * once per cloud, so two environments it holds that name different logins
+ * for one cloud are refused.
+ */
+export function jobLogins(login, held, cloudOf) {
+    const out = new Map();
+    for (const [env, role] of held) {
+        const token = cloudOf(env, role);
+        if (!token)
+            continue;
+        const l = loginFor(login, env, token);
+        if (!l)
+            continue;
+        const seen = out.get(l.cloud);
+        if (seen && JSON.stringify(seen.login.config) !== JSON.stringify(l.config)) {
+            throw new Error(`yodel.config.ts ci.login: a job holds ${seen.env}'s and ${env}'s roles, which log in to ${l.cloud} differently; a job logs in once per cloud, so give them one ${l.cloud} login`);
+        }
+        if (!seen)
+            out.set(l.cloud, { login: l, env });
+    }
+    return CLOUDS.flatMap((c) => {
+        const l = out.get(c)?.login;
+        return l ? [l] : [];
+    });
+}
+/** Where a job keeps a cloud's token by default. */
+const defaultTokenFile = (forge, cloud) => {
+    if (forge === "github")
+        return `$RUNNER_TEMP/yodel-${cloud}-token`;
+    if (forge === "gitlab")
+        return `/tmp/yodel-${cloud}-token`;
+    return undefined;
+};
+/**
+ * Requests the job's OIDC token for an audience and writes it to a file:
+ * `node -e '<this>' <audience> <file>`, so every image with node runs it.
+ */
+const GITHUB_OIDC = 'const [aud, file] = process.argv.slice(1); const url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL, auth = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN; if (!url || !auth) { console.error("no OIDC token for this job: the workflow needs permissions id-token: write"); process.exit(1); } fetch(url + "&audience=" + encodeURIComponent(aud), { headers: { Authorization: "bearer " + auth } }).then(async (r) => { if (!r.ok) throw new Error("the OIDC token request answered " + r.status); require("fs").writeFileSync(file, (await r.json()).value, { mode: 0o600 }); }).catch((e) => { console.error(e.message); process.exit(1); })';
+/** Writes the gcloud credential configuration: `node -e '<this>' <provider> <service account> <token file> <config file>`. */
+const GCP_CREDENTIALS = 'const [provider, sa, token, file] = process.argv.slice(1); require("fs").writeFileSync(file, JSON.stringify({ type: "external_account", audience: "//iam.googleapis.com/" + provider, subject_token_type: "urn:ietf:params:oauth:token-type:jwt", token_url: "https://sts.googleapis.com/v1/token", service_account_impersonation_url: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/" + sa + ":generateAccessToken", credential_source: { file: token } }, null, 2))';
+const quote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** A path that may name a variable ($RUNNER_TEMP): double-quoted, so the shell expands it. */
+const path = (s) => `"${s}"`;
+/** The variables a cloud's login sets, from its token file (and gcp's credential configuration). */
+function loginVariables(l, tokenFile) {
+    if (l.cloud === "aws")
+        return { AWS_ROLE_ARN: l.config.roleArn, AWS_WEB_IDENTITY_TOKEN_FILE: tokenFile, AWS_ROLE_SESSION_NAME: l.config.sessionName ?? "yodel" };
+    if (l.cloud === "gcp")
+        return { GOOGLE_APPLICATION_CREDENTIALS: `${tokenFile}.json` };
+    return { AZURE_CLIENT_ID: l.config.clientId, AZURE_TENANT_ID: l.config.tenantId, AZURE_FEDERATED_TOKEN_FILE: tokenFile };
+}
+const STEP_NAME = { aws: "Log in to AWS (web identity)", gcp: "Log in to Google Cloud (workload identity)", azure: "Log in to Azure (federated token)" };
+/**
+ * The login steps of a job on `forge`, for `logins`. On Forgejo a cloud
+ * without a `tokenFile` is left out: the runner's own identity mints there.
+ */
+export function loginSteps(forge, logins) {
+    const out = { steps: [], variables: {} };
+    for (const l of logins) {
+        const file = l.config.tokenFile ?? defaultTokenFile(forge, l.cloud);
+        if (file === undefined)
+            continue;
+        const lines = [];
+        if (forge === "github")
+            lines.push(`node -e ${quote(GITHUB_OIDC)} ${quote(audience(l))} ${path(file)}`);
+        if (forge === "gitlab")
+            lines.push(`(umask 077 && printf '%s' "$${GITLAB_ID_TOKEN[l.cloud]}" > ${path(file)})`);
+        if (l.cloud === "gcp") {
+            lines.push(`node -e ${quote(GCP_CREDENTIALS)} ${quote(l.config.workloadIdentityProvider)} ${quote(l.config.serviceAccount)} ${path(file)} ${path(`${file}.json`)}`);
+            lines.push(`gcloud auth login --cred-file=${path(`${file}.json`)} --quiet`);
+        }
+        if (l.cloud === "azure") {
+            lines.push(`az login --service-principal --username ${quote(l.config.clientId)} --tenant ${quote(l.config.tenantId)} --federated-token "$(cat ${path(file)})" --allow-no-subscriptions --output none`);
+        }
+        const vars = loginVariables(l, file);
+        if (forge === "gitlab")
+            Object.assign(out.variables, vars);
+        else
+            lines.push(...Object.entries(vars).map(([k, v]) => `echo "${k}=${v}" >> "$GITHUB_ENV"`));
+        out.steps.push({ name: STEP_NAME[l.cloud], lines });
+    }
+    return out;
+}
+// ── yodel.config.ts ci.login, checked ───────────────────────────────────────
+const ROLE_ARN = /^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]+$/;
+const PROVIDER = /^projects\/\d+\/locations\/global\/workloadIdentityPools\/[a-z0-9-]+\/providers\/[a-z0-9-]+$/;
+const SERVICE_ACCOUNT = /^[a-z0-9-]+@[a-z0-9-]+\.iam\.gserviceaccount\.com$/;
+const AZURE_ID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/** A path, optionally under a variable ($RUNNER_TEMP/...): nothing a shell would read as more than that. */
+const TOKEN_FILE = /^(\$[A-Z_][A-Z0-9_]*)?[\w./-]+$/;
+const SESSION_NAME = /^[\w+=,.@-]{2,64}$/;
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const FIELDS = {
+    aws: {
+        roleArn: { re: ROLE_ARN, what: "a role ARN, arn:aws:iam::<account>:role/<name>", required: true },
+        tokenFile: { re: TOKEN_FILE, what: "a file path", required: false },
+        sessionName: { re: SESSION_NAME, what: "2 to 64 of letters, digits and +=,.@_-", required: false },
+    },
+    gcp: {
+        workloadIdentityProvider: { re: PROVIDER, what: "projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>", required: true },
+        serviceAccount: { re: SERVICE_ACCOUNT, what: "<name>@<project>.iam.gserviceaccount.com", required: true },
+        tokenFile: { re: TOKEN_FILE, what: "a file path", required: false },
+    },
+    azure: {
+        clientId: { re: AZURE_ID, what: "the application (client) id, a GUID", required: true },
+        tenantId: { re: AZURE_ID, what: "the directory (tenant) id, a GUID", required: true },
+        tokenFile: { re: TOKEN_FILE, what: "a file path", required: false },
+    },
+};
+function cloudsProblem(value, where, allowEnvironments) {
+    for (const [k, v] of Object.entries(value)) {
+        if (k === "environments" && allowEnvironments) {
+            if (!isRecord(v))
+                return `${where}.environments: an object keyed by environment, each { aws?, gcp?, azure? }`;
+            for (const [env, logins] of Object.entries(v)) {
+                if (!isRecord(logins))
+                    return `${where}.environments.${env}: expected { aws?, gcp?, azure? }`;
+                const problem = cloudsProblem(logins, `${where}.environments.${env}`, false);
+                if (problem)
+                    return problem;
+            }
+            continue;
+        }
+        if (!CLOUDS.includes(k))
+            return `${where}.${k}: unknown setting (expected ${[...CLOUDS, ...(allowEnvironments ? ["environments"] : [])].join(", ")})`;
+        const fields = FIELDS[k];
+        if (!isRecord(v))
+            return `${where}.${k}: expected { ${Object.keys(fields).join(", ")} }`;
+        for (const f of Object.keys(v))
+            if (!(f in fields))
+                return `${where}.${k}.${f}: unknown setting (expected ${Object.keys(fields).join(", ")})`;
+        for (const [f, spec] of Object.entries(fields)) {
+            const x = v[f];
+            if (x === undefined && !spec.required)
+                continue;
+            if (typeof x !== "string" || !spec.re.test(x))
+                return `${where}.${k}.${f}: ${spec.what}`;
+        }
+    }
+    return undefined;
+}
+/** What is wrong with yodel.config.ts `ci.login`, if anything. */
+export function loginProblem(value, where) {
+    if (!isRecord(value))
+        return `${where}: expected { aws?, gcp?, azure?, environments? }`;
+    return cloudsProblem(value, where, true);
+}
+//# sourceMappingURL=login.js.map

package/dist/ci/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/ci/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAMH,MAAM,CAAC,MAAM,MAAM,GAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAEhE,uDAAuD;AACvD,MAAM,CAAC,MAAM,QAAQ,GAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAehH,8FAA8F;AAC9F,MAAM,UAAU,QAAQ,CAAC,KAAY;IACnC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC;IACtD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,8BAA8B,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;IACxG,OAAO,4BAA4B,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAA0B,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;AAE5H,uGAAuG;AACvG,MAAM,UAAU,QAAQ,CAAC,KAA0B,EAAE,GAAW,EAAE,KAAiB;IACjF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,MAAM,EAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAA0B,EAAE,IAA4C,EAAE,OAA4D;IAC9J,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,GAAG,UAAU,GAAG,6BAA6B,CAAC,CAAC,KAAK,gEAAgE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QACrM,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAC5B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,CAAC,KAAiB,EAAE,KAAY,EAAsB,EAAE;IAC/E,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,sBAAsB,KAAK,QAAQ,CAAC;IACnE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,KAAK,QAAQ,CAAC;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,GACf,2mBAA2mB,CAAC;AAE9mB,8HAA8H;AAC9H,MAAM,eAAe,GACnB,8dAA8d,CAAC;AAEje,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACrE,8FAA8F;AAC9F,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;AAE7C,oGAAoG;AACpG,SAAS,cAAc,CAAC,CAAQ,EAAE,SAAiB;IACjD,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;IACjK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,SAAS,OAAO,EAAE,CAAC;IACtF,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,CAAC;AAC3H,CAAC;AAED,MAAM,SAAS,GAA0B,EAAE,GAAG,EAAE,8BAA8B,EAAE,GAAG,EAAE,4CAA4C,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;AAEhL;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB,EAAE,MAAwB;IACpE,MAAM,GAAG,GAAe,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChH,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;YACpK,KAAK,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,2CAA2C,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACzM,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;;YACtD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9F,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,QAAQ,GAAG,8FAA8F,CAAC;AAChH,MAAM,eAAe,GAAG,oDAAoD,CAAC;AAC7E,MAAM,QAAQ,GAAG,+EAA+E,CAAC;AACjG,4GAA4G;AAC5G,MAAM,UAAU,GAAG,iCAAiC,CAAC;AACrD,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,MAAM,MAAM,GAAmF;IAC7F,GAAG,EAAE;QACH,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gDAAgD,EAAE,QAAQ,EAAE,IAAI,EAAE;QACjG,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACnE,WAAW,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,wCAAwC,EAAE,QAAQ,EAAE,KAAK,EAAE;KACnG;IACD,GAAG,EAAE;QACH,wBAAwB,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,sFAAsF,EAAE,QAAQ,EAAE,IAAI,EAAE;QACxJ,cAAc,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,0CAA0C,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzG,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;KACpE;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,qCAAqC,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvF,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE;QACrF,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;KACpE;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,KAA8B,EAAE,KAAa,EAAE,iBAA0B;IAC9F,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,cAAc,IAAI,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,KAAK,4EAA4E,CAAC;YAC9G,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO,GAAG,KAAK,iBAAiB,GAAG,mCAAmC,CAAC;gBAC9F,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,iBAAiB,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC7E,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAE,MAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,KAAK,IAAI,CAAC,+BAA+B,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7K,MAAM,MAAM,GAAG,MAAM,CAAC,CAAU,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,KAAK,IAAI,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACzF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;gBAAE,OAAO,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9I,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,kDAAkD,CAAC;IACxF,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/ci/render.d.ts

@@ -68,7 +68,7 @@
  * in that image instead, which carries node, yodel, chant and the lexicons
  * on PATH, and no job runs `npm ci` ({@link Toolchain}).
  */
-import { type ApprovalMode } from "../config/define.js";
+import { type ApprovalMode, type CiLogin } from "../config/define.js";
 import { type CloudToken, type Role } from "../credentials.js";
 import type { Declarable } from "@intentius/chant/declarable";
 export type Forge = "github" | "gitlab" | "forgejo";
@@ -125,6 +125,8 @@ export interface Environments {
      * password, if any. An environment not here reads the default variables.
      */
     credentials?: Record<string, EnvCredentials>;
+    /** yodel.config.ts `ci.login` (#132): the cloud login a job runs before yodel when a role it holds is cloud-minted. */
+    login?: CiLogin;
 }
 /** What a job holding one role of an environment needs: the variables it reads, and the cloud identity its token source mints from. */
 export interface RoleNeeds {
@@ -188,6 +190,14 @@ export declare const REPLAY_SERVICE: Record<Dialect, ReplayService>;
 /** Waits up to 90 s for the replay server's port; a shell-free one-liner, so every forge runs it the same. */
 export declare const waitFor: (host: string, port: number) => string;
 export declare const LINT = "yodel lint";
+/**
+ * The lint job's `yodel lint`, with its findings where the forge shows them
+ * (#129): workflow commands on GitHub and Forgejo, which annotate the
+ * migration files in the pull request; on GitLab the code quality report,
+ * which the job keeps as its `artifacts:reports:codequality`
+ * ({@link CODE_QUALITY_FILE}) and the merge request shows.
+ */
+export declare const lintCommand: (forge: Forge) => string;
 export declare const REPLAY = "yodel lint --replay replay --reset";
 /** yodel test (#54), after the replay check on the same throwaway server, its outcome as JUnit XML. */
 export declare const TEST = "yodel test --env replay --reset --junit yodel-test.xml";
@@ -212,6 +222,12 @@ export declare const REPORT_DIR = "yodel-report";
 export declare const reportCommand: (env: string, tc?: Toolchain) => string;
 /** The artifact a job keeps its report in. */
 export declare const reportArtifact: (job: string) => string;
+/**
+ * Forgejo's fork of upload-artifact v4. actions/upload-artifact@v4 (as the
+ * forgejo lexicon resolves it, from code.forgejo.org/actions) refuses any
+ * server but github.com's and fails the step, so the job, on Forgejo.
+ */
+export declare const FORGEJO_UPLOAD_ARTIFACT = "https://code.forgejo.org/forgejo/upload-artifact@v4";
 type Actions = "github" | "forgejo";
 export declare function actionsReview(forge: Actions, envs_: Environments): RenderedFile;
 export declare const GITLAB_WATCH_FILE = ".gitlab/yodel-watch.gitlab-ci.yml";