@quadnix/octo 0.0.30 → 0.1.0

package/dist/modes/validate.mode.d.ts

@@ -0,0 +1,162 @@
+import type { TerraformFolderOutput, TerraformResourceOutput } from '../app.type.js';
+import { type AggregatedResourceAction } from '../functions/diff/aggregate-resource-actions.js';
+import type { ModelTransactionResult } from './apply-transaction.js';
+/**
+ * One argument terraform plans to change on a resource, with the values on either side.
+ *
+ * Values are rendered, truncated strings rather than the raw payload: a report is read, not
+ * replayed, and the raw payload of a real resource is both enormous and a place secrets live.
+ */
+export interface ValidateFieldChange {
+    field: string;
+    /**
+     * The current value. Absent on a create. `(sensitive)` when terraform marked it so.
+     */
+    from?: string;
+    /**
+     * The planned value. `(known after apply)` when terraform cannot say yet.
+     */
+    to?: string;
+}
+/**
+ * One terraform address and the actions terraform plans on it (`create`, `update`, `delete`, …).
+ */
+export interface ValidateTerraformChange {
+    address: string;
+    /**
+     * Which arguments moved, for the changes where that is the whole question: an in-place `update`,
+     * and a `create`+`delete` where the point is *which* argument forced the replacement.
+     *
+     * Left empty on a plain create or delete, where the address and the action already say everything.
+     */
+    changedFields: ValidateFieldChange[];
+    tfActions: string[];
+}
+/**
+ * What `validate` saw, as a report rather than a verdict.
+ *
+ * Octo's diff and terraform's plan measure different things from different baselines: octo's diff is
+ * `desired graph − last committed graph`, terraform's plan is `desired HCL − real cloud state`. The
+ * report correlates the two and explains what it can. Only being unable to read a plan makes it
+ * unsuccessful — see {@link ValidateReport.failures}.
+ */
+export interface ValidateReport {
+    /**
+     * Terraform changes with no octo diff of their own that octo can explain: the resource references
+     * something whose identity moved, or the resource no longer renders that address.
+     */
+    attributedChanges: {
+        address: string;
+        causeKind: 'address-no-longer-rendered' | 'identity-changed';
+        causeResourceId: string;
+        moduleId: string;
+        tfActions: string[];
+    }[];
+    /**
+     * How far this report can be trusted, decided by whether intent changed.
+     *
+     * - `exact` — octo's diff is empty. Nothing is mocked and no dependency output moves, so every
+     *   folder's plan reflects reality and drift detection is reliable.
+     * - `approximate` — octo's diff is non-empty. Each folder is planned alone against the *last
+     *   applied* outputs of its dependencies, so a cross-folder consequence of this change is invisible
+     *   until apply, and a renamed producer's outputs come from `mock_outputs`. The report may both
+     *   understate what apply will do and overstate drift.
+     */
+    confidence: 'approximate' | 'exact';
+    /**
+     * Terraform changes nothing in octo explains: the infrastructure moved out from under intent.
+     */
+    drift: {
+        address: string;
+        moduleId: string;
+        tfActions: string[];
+    }[];
+    /**
+     * Folders terraform could not plan. The only unsuccessful outcome, because validate cannot report
+     * on a folder it was unable to read.
+     */
+    failures: {
+        message: string;
+        moduleId?: string;
+    }[];
+    /**
+     * Octo resources that changed, each with the terraform changes correlated to it. An empty
+     * `terraformChanges` means the intent change carries no infrastructure cost.
+     */
+    intentChanges: {
+        moduleId?: string;
+        octoAction: AggregatedResourceAction['action'];
+        reason?: string;
+        resourceContext: string;
+        resourceId: string;
+        terraformChanges: ValidateTerraformChange[];
+    }[];
+    /**
+     * Observations that judge nothing: a folder octo does not track, a delete it cannot correlate.
+     */
+    notes: {
+        message: string;
+        moduleId?: string;
+    }[];
+    /**
+     * Terraform changes planned against a value that may be a `mock_outputs` placeholder. Reported
+     * apart from {@link ValidateReport.drift}, and never as drift.
+     */
+    uncertain: {
+        address: string;
+        moduleId: string;
+        reason: string;
+        tfActions: string[];
+    }[];
+}
+/**
+ * One module's parsed terraform plan, i.e. the JSON produced by `terraform show -json <plan-file>`
+ * (run via terragrunt by the caller, so it is backend-agnostic). Only `resource_changes` is read.
+ */
+export interface TerraformPlan {
+    resource_changes?: {
+        address: string;
+        change?: {
+            actions?: string[];
+            after?: Record<string, unknown> | null;
+            after_sensitive?: Record<string, unknown> | boolean | null;
+            after_unknown?: Record<string, unknown> | boolean | null;
+            before?: Record<string, unknown> | null;
+            before_sensitive?: Record<string, unknown> | boolean | null;
+        };
+        mode?: string;
+    }[];
+}
+/**
+ * Read-only correlation of `terraform plan` against intent. Never writes state or folders.
+ *
+ * `plans` maps each module folder's id to its parsed terraform plan, and `planErrors` maps a folder
+ * terraform *failed* to plan to the reason why. The two are disjoint, and a folder in neither was
+ * never inspected.
+ *
+ * `persistedMappings` is the octo→terraform mapping captured by the last commit. It supplies the
+ * addresses of resources deleted since (absent from this boot's generated files), and identifies
+ * producers that have never been applied, whose outputs terragrunt can only supply as a mock.
+ *
+ * Plans are partitioned by the tracked set (intent ∪ the committed folder record,
+ * `previousFolders`): a plan for a module the sweep filled is demanded and correlated; a plan for a
+ * committed-then-deleted (emptied) folder is read when supplied; a plan for a folder octo does
+ * **not** track is noted and excluded from all correlation, and re-declaring its module in intent
+ * re-adopts it.
+ *
+ * `externalResourceStateIds` names every external resource a `run-action` published and no commit
+ * has recorded yet, from `StateManagementService.listExternalResourceStateIds()`. Each one is
+ * reported as a note.
+ *
+ * By-design limit: correlation is resource-level, not field-level.
+ *
+ * @internal
+ */
+export declare function validate({ externalResourceStateIds, persistedMappings, planErrors, plans, previousFolders, transaction, }: {
+    externalResourceStateIds?: string[];
+    persistedMappings: Map<string, TerraformResourceOutput>;
+    planErrors?: Map<string, string>;
+    plans: Map<string, TerraformPlan>;
+    previousFolders?: TerraformFolderOutput[];
+    transaction: ModelTransactionResult;
+}): Promise<ValidateReport>;

package/dist/modes/validate.mode.js

@@ -0,0 +1,480 @@
+import { Container } from '../functions/container/container.js';
+import { aggregateResourceActions, } from '../functions/diff/aggregate-resource-actions.js';
+import { DiffAction } from '../functions/diff/diff.js';
+import { ResourceDataRepository } from '../resources/resource-data.repository.js';
+import { TerraformService } from '../services/terraform/terraform.service.js';
+const MAX_RENDERED_VALUE_LENGTH = 80;
+const MAX_REPORTED_FIELDS = 12;
+/**
+ * Renders one terraform value as a short, readable string.
+ */
+function renderPlanValue(value) {
+    if (value === null || value === undefined) {
+        return '(none)';
+    }
+    const truncate = (rendered) => rendered.length > MAX_RENDERED_VALUE_LENGTH ? `${rendered.slice(0, MAX_RENDERED_VALUE_LENGTH)}…` : rendered;
+    if (Array.isArray(value)) {
+        if (value.length === 0) {
+            return 'none';
+        }
+        // Terraform's list-typed blocks (indexes, rules, listeners) are the ones worth naming: "2 items
+        // -> 1 item" does not answer *which* index went away, which is the whole question.
+        const names = value
+            .map((element) => typeof element === 'object' && element !== null
+            ? (element.name ?? element.index_name)
+            : element)
+            .filter((name) => typeof name === 'string' && name.length > 0);
+        return names.length === value.length ? truncate(names.join(', ')) : `${value.length} item(s)`;
+    }
+    return truncate(typeof value === 'string' ? value : JSON.stringify(value));
+}
+/**
+ * True when any leaf of a terraform sensitive/unknown mark is `true`.
+ *
+ * These maps mirror the *shape* of the value they describe, so a list of five blocks with nothing
+ * sensitive in it is `[{}, {}, {}, {}, {}]` — structure, not a signal. Only a literal `true`
+ * anywhere in that structure marks something, which is why "non-empty object" is the wrong test: it
+ * reported every list-typed argument on a DynamoDB table as sensitive.
+ */
+function hasMark(mark) {
+    if (mark === true) {
+        return true;
+    }
+    if (typeof mark !== 'object' || mark === null) {
+        return false;
+    }
+    return Object.values(mark).some(hasMark);
+}
+/**
+ * True when terraform's sensitive/unknown map marks `key`.
+ */
+function isMarked(marks, key) {
+    if (marks === true) {
+        return true;
+    }
+    if (!marks || typeof marks !== 'object') {
+        return false;
+    }
+    return hasMark(marks[key]);
+}
+/**
+ * The arguments that differ between `before` and `after`.
+ *
+ * Terraform already hands us both sides — `readPlan` parses the whole `show -json` payload — so this
+ * costs nothing but the comparison. Without it an added index and a removed index render as the
+ * same sentence: "1 update".
+ */
+function describeFieldChanges(change) {
+    const actions = new Set(change.actions ?? []);
+    // A plain create or delete needs no field list: the address and the action are the whole story.
+    const isUpdate = actions.has('update');
+    const isReplace = actions.has('create') && actions.has('delete');
+    if (!isUpdate && !isReplace) {
+        return [];
+    }
+    const before = (change.before ?? {});
+    const after = (change.after ?? {});
+    const fields = [];
+    for (const key of [...new Set([...Object.keys(before), ...Object.keys(after)])].sort()) {
+        const unknownAfter = isMarked(change.after_unknown, key);
+        if (!unknownAfter && JSON.stringify(before[key]) === JSON.stringify(after[key])) {
+            continue;
+        }
+        fields.push({
+            field: key,
+            from: isMarked(change.before_sensitive, key) ? '(sensitive)' : renderPlanValue(before[key]),
+            to: unknownAfter
+                ? '(known after apply)'
+                : isMarked(change.after_sensitive, key)
+                    ? '(sensitive)'
+                    : renderPlanValue(after[key]),
+        });
+        if (fields.length === MAX_REPORTED_FIELDS) {
+            break;
+        }
+    }
+    return fields;
+}
+/**
+ * Read-only correlation of `terraform plan` against intent. Never writes state or folders.
+ *
+ * `plans` maps each module folder's id to its parsed terraform plan, and `planErrors` maps a folder
+ * terraform *failed* to plan to the reason why. The two are disjoint, and a folder in neither was
+ * never inspected.
+ *
+ * `persistedMappings` is the octo→terraform mapping captured by the last commit. It supplies the
+ * addresses of resources deleted since (absent from this boot's generated files), and identifies
+ * producers that have never been applied, whose outputs terragrunt can only supply as a mock.
+ *
+ * Plans are partitioned by the tracked set (intent ∪ the committed folder record,
+ * `previousFolders`): a plan for a module the sweep filled is demanded and correlated; a plan for a
+ * committed-then-deleted (emptied) folder is read when supplied; a plan for a folder octo does
+ * **not** track is noted and excluded from all correlation, and re-declaring its module in intent
+ * re-adopts it.
+ *
+ * `externalResourceStateIds` names every external resource a `run-action` published and no commit
+ * has recorded yet, from `StateManagementService.listExternalResourceStateIds()`. Each one is
+ * reported as a note.
+ *
+ * By-design limit: correlation is resource-level, not field-level.
+ *
+ * @internal
+ */
+export async function validate({ externalResourceStateIds = [], persistedMappings, planErrors = new Map(), plans, previousFolders = [], transaction, }) {
+    const container = Container.getInstance();
+    const [resourceDataRepository, terraformService] = await Promise.all([
+        container.get(ResourceDataRepository),
+        container.get(TerraformService),
+    ]);
+    const allDiffs = transaction.resourceDiffs.flat();
+    const mappings = terraformService.getOctoTerraformResourceMappings();
+    const report = {
+        attributedChanges: [],
+        confidence: allDiffs.length === 0 ? 'exact' : 'approximate',
+        drift: [],
+        failures: [],
+        intentChanges: [],
+        notes: [],
+        uncertain: [],
+    };
+    // Report what an external resource published and no commit has recorded. Octo reaches that record
+    // only by the resource id terraform asks for, so one whose resource has left both graphs is
+    // published infrastructure nothing will ever ask about again - the only place a user can be told
+    // is here.
+    if (externalResourceStateIds.length > 0) {
+        const heldResourceIds = new Set([
+            ...resourceDataRepository.getNewResourcesByProperties(),
+            ...resourceDataRepository.getActualResourcesByProperties(),
+        ].map((resource) => resource.resourceId));
+        for (const resourceId of [...externalResourceStateIds].sort()) {
+            report.notes.push({
+                message: heldResourceIds.has(resourceId)
+                    ? `External resource "${resourceId}" is published but not recorded in octo state; the next successful ` +
+                        'commit records it.'
+                    : `External resource "${resourceId}" is published but not recorded in octo state, and neither intent nor ` +
+                        'the committed graph declares it any more, so octo will never delete it.',
+            });
+        }
+    }
+    // Aggregate octo diffs to one action per resource.
+    const octoActions = aggregateResourceActions(allDiffs);
+    const parsePlanChanges = (plan) => {
+        const changes = new Map();
+        for (const resourceChange of plan.resource_changes ?? []) {
+            if (resourceChange.mode === 'data') {
+                continue;
+            }
+            changes.set(resourceChange.address, {
+                changedFields: resourceChange.change ? describeFieldChanges(resourceChange.change) : [],
+                tfActions: resourceChange.change?.actions ?? [],
+            });
+        }
+        return changes;
+    };
+    const sweptModuleIds = new Set(terraformService.getModuleIds());
+    const trackedModuleIds = new Set([...sweptModuleIds, ...previousFolders.map((folder) => folder.moduleId)]);
+    const planChangesByModule = new Map();
+    const NO_PLAN_CHANGE = { changedFields: [], tfActions: [] };
+    // Every module the sweep filled must have a plan. `getModuleIds()` only lists modules that
+    // contributed a resource, so a missing plan means terraform ran on a real folder and failed.
+    for (const moduleId of sweptModuleIds) {
+        const plan = plans.get(moduleId);
+        if (!plan) {
+            const cause = planErrors.get(moduleId);
+            report.failures.push({
+                message: cause
+                    ? `Terraform failed to plan module "${moduleId}":\n${cause}`
+                    : `No terraform plan was supplied for module "${moduleId}", so octo cannot report on it.`,
+                moduleId,
+            });
+            continue;
+        }
+        planChangesByModule.set(moduleId, parsePlanChanges(plan));
+    }
+    // Remaining plans belong either to an emptied folder octo still tracks, or to a folder it does not
+    // own at all.
+    for (const [moduleId, plan] of plans.entries()) {
+        if (sweptModuleIds.has(moduleId)) {
+            continue;
+        }
+        if (trackedModuleIds.has(moduleId)) {
+            planChangesByModule.set(moduleId, parsePlanChanges(plan));
+        }
+        else {
+            report.notes.push({
+                message: `Terraform plan supplied for folder "${moduleId}", which octo does not track (not in intent or committed ` +
+                    'state); excluding it from this report. Re-declare its module in intent to re-adopt it.',
+                moduleId,
+            });
+        }
+    }
+    const isNoop = (actions) => actions.length === 0 || (actions.length === 1 && (actions[0] === 'no-op' || actions[0] === 'read'));
+    const claimedAddresses = new Map();
+    const claim = (moduleId, address) => {
+        if (!claimedAddresses.has(moduleId)) {
+            claimedAddresses.set(moduleId, new Set());
+        }
+        claimedAddresses.get(moduleId).add(address);
+    };
+    const referrers = terraformService.getResourceReferrers();
+    const mappingByResourceId = new Map(mappings.map((mapping) => [mapping.resourceId, mapping]));
+    // Terraform changes everything that transitively references a resource whose identity moved, while
+    // octo's diff carries only the moved resource itself. Walking the same reference graph terraform
+    // cascades along recovers the rest.
+    //
+    // An identity moves on REPLACE (force-new recreates the referrer too), and on ADD or DELETE of a
+    // resourceId — a referrer that kept its own id then renders a different terraform address. Renaming
+    // an execution, for instance, replaces `alb-target-group-<old>` with `alb-target-group-<new>`, and
+    // the untouched alb-listener's `default_action.forward.target_group.arn` moves with it.
+    const identityChangedResourceIds = new Set([...octoActions.values()]
+        .filter((a) => a.action === DiffAction.REPLACE || a.action === DiffAction.ADD || a.action === DiffAction.DELETE)
+        .map((a) => a.resourceId));
+    // Each affected referrer maps to the moved resource it references, so the report can name the cause.
+    const cascadeCauseByResourceId = new Map();
+    const cascadeQueue = [...identityChangedResourceIds];
+    while (cascadeQueue.length > 0) {
+        const referentId = cascadeQueue.shift();
+        for (const referrerId of referrers.get(referentId) ?? []) {
+            if (!cascadeCauseByResourceId.has(referrerId) && !identityChangedResourceIds.has(referrerId)) {
+                cascadeCauseByResourceId.set(referrerId, referentId);
+                cascadeQueue.push(referrerId);
+            }
+        }
+    }
+    // Resources that may have been planned against a `mock_outputs` placeholder rather than a real
+    // value. Terragrunt substitutes a mock for any output name the producer folder's state lacks, and
+    // that happens two ways: the producer has never been applied, so it has no outputs at all; or it
+    // has been applied and now declares an output it did not declare then, because its response gained
+    // a key. Same-module references use no dependency block and cannot be mocked.
+    //
+    // The second case is read off the committed graph rather than the persisted mapping, which records
+    // addresses and not output names. A commit demands every declared output resolve before it records
+    // a resource, so a key the committed response does not hold is an output that was not there.
+    const mockFedCauseByResourceId = new Map();
+    const mockQueue = [];
+    const markMockFed = (resourceId, cause) => {
+        if (!mockFedCauseByResourceId.has(resourceId)) {
+            mockFedCauseByResourceId.set(resourceId, cause);
+            mockQueue.push(resourceId);
+        }
+    };
+    /**
+     * Why a producer's outputs would be mocked, or `undefined` when every one of them is in state.
+     */
+    const describeProducerMocking = (referent) => {
+        if (!persistedMappings.has(referent.resourceContext)) {
+            return 'never-applied';
+        }
+        // An external resource publishes its whole response under one output name, so a response that
+        // gained a key adds no output name for terragrunt to miss.
+        if (referent.entireResponseOutput !== undefined) {
+            return undefined;
+        }
+        const committed = resourceDataRepository.getActualResourceByContext(referent.resourceContext);
+        if (!committed) {
+            return 'never-applied';
+        }
+        return referent.outputMappings.some(({ key }) => !(key in committed.response)) ? 'new-output' : undefined;
+    };
+    for (const [referentId, referrerIds] of referrers.entries()) {
+        const referent = mappingByResourceId.get(referentId);
+        if (!referent) {
+            continue;
+        }
+        const kind = describeProducerMocking(referent);
+        if (!kind) {
+            continue;
+        }
+        for (const referrerId of referrerIds) {
+            const referrer = mappingByResourceId.get(referrerId);
+            if (referrer && referrer.moduleId !== referent.moduleId) {
+                markMockFed(referrerId, { kind, resourceId: referentId });
+            }
+        }
+    }
+    // A mocked value propagates: anything reading it is planned on it too.
+    while (mockQueue.length > 0) {
+        const resourceId = mockQueue.shift();
+        const cause = mockFedCauseByResourceId.get(resourceId);
+        for (const referrerId of referrers.get(resourceId) ?? []) {
+            markMockFed(referrerId, cause);
+        }
+    }
+    const mockFedModuleIds = new Set([...mockFedCauseByResourceId.keys()]
+        .map((resourceId) => mappingByResourceId.get(resourceId)?.moduleId)
+        .filter((moduleId) => moduleId !== undefined));
+    const describeMockCause = (cause) => `planned against a "mock_outputs" placeholder: it consumes an output of "${cause.resourceId}", which has ` +
+        (cause.kind === 'never-applied' ? 'never been applied' : 'gained an output since it was last applied') +
+        ', so the value terraform compared against is not the value it will get';
+    /**
+     * Classifies a terraform change on a resource octo did not flag: attributed if octo explains it,
+     * uncertain if the plan itself may be wrong, drift otherwise.
+     */
+    const classifyChangeWithNoOctoDiff = (moduleId, resourceId, change) => {
+        const cascadeCause = cascadeCauseByResourceId.get(resourceId);
+        if (cascadeCause) {
+            report.attributedChanges.push({
+                address: change.address,
+                causeKind: 'identity-changed',
+                causeResourceId: cascadeCause,
+                moduleId,
+                tfActions: change.tfActions,
+            });
+            return;
+        }
+        const mockCause = mockFedCauseByResourceId.get(resourceId);
+        if (mockCause) {
+            report.uncertain.push({
+                address: change.address,
+                moduleId,
+                reason: describeMockCause(mockCause),
+                tfActions: change.tfActions,
+            });
+            return;
+        }
+        report.drift.push({ address: change.address, moduleId, tfActions: change.tfActions });
+    };
+    // Forward: correlate every address this sweep rendered with the plan.
+    for (const mapping of mappings) {
+        const octoAction = octoActions.get(mapping.resourceContext);
+        // The folder failed to plan and is already a `failure`. Reporting an empty terraform side here
+        // would read as "no infrastructure change" for a folder nobody could read.
+        const planChanges = planChangesByModule.get(mapping.moduleId);
+        if (!planChanges) {
+            continue;
+        }
+        const addressActions = mapping.terraformAddresses.map((address) => {
+            claim(mapping.moduleId, address);
+            const planChange = planChanges.get(address) ?? NO_PLAN_CHANGE;
+            return { address, changedFields: planChange.changedFields, tfActions: planChange.tfActions };
+        });
+        // A resource can render a variable number of addresses — one rule resource per security group
+        // rule, one object per s3 website file. When it survives but renders fewer, the dropped address
+        // is in no current mapping, so its destroy belongs to the resource that stopped rendering it.
+        const persisted = persistedMappings.get(mapping.resourceContext);
+        const currentAddresses = new Set(mapping.terraformAddresses);
+        for (const address of persisted?.terraformAddresses ?? []) {
+            if (currentAddresses.has(address)) {
+                continue;
+            }
+            claim(mapping.moduleId, address);
+            const { tfActions } = planChanges.get(address) ?? NO_PLAN_CHANGE;
+            if (!isNoop(tfActions)) {
+                report.attributedChanges.push({
+                    address,
+                    causeKind: 'address-no-longer-rendered',
+                    causeResourceId: mapping.resourceId,
+                    moduleId: mapping.moduleId,
+                    tfActions,
+                });
+            }
+        }
+        const changed = addressActions.filter((a) => !isNoop(a.tfActions));
+        // Record what octo said and what terraform said, without requiring the two to agree.
+        if (octoAction) {
+            report.intentChanges.push({
+                moduleId: mapping.moduleId,
+                octoAction: octoAction.action,
+                reason: octoAction.reason,
+                resourceContext: mapping.resourceContext,
+                resourceId: mapping.resourceId,
+                terraformChanges: changed,
+            });
+            continue;
+        }
+        for (const change of changed) {
+            classifyChangeWithNoOctoDiff(mapping.moduleId, mapping.resourceId, change);
+        }
+    }
+    // Deleted octo resources are absent from this boot's generated files, so their addresses come from
+    // the mapping persisted at the last commit.
+    let hasUnverifiableDelete = false;
+    for (const [context, octoAction] of octoActions.entries()) {
+        if (octoAction.action !== DiffAction.DELETE) {
+            continue;
+        }
+        // Never committed through the terraform flow, so its addresses were never recorded.
+        const persisted = persistedMappings.get(context);
+        if (!persisted) {
+            report.notes.push({
+                message: `Deleted resource "${octoAction.resourceId}" is not in the persisted terraform mapping ` +
+                    '(deleted before it was ever committed?); its terraform addresses are unknown.',
+            });
+            report.intentChanges.push({
+                octoAction: DiffAction.DELETE,
+                reason: octoAction.reason,
+                resourceContext: context,
+                resourceId: octoAction.resourceId,
+                terraformChanges: [],
+            });
+            hasUnverifiableDelete = true;
+            continue;
+        }
+        // The owning folder is emptied and no plan was supplied for it, so its destroys cannot be
+        // correlated.
+        const planChanges = planChangesByModule.get(persisted.moduleId);
+        if (!planChanges) {
+            report.notes.push({
+                message: `Deleted resource "${octoAction.resourceId}" lived in module "${persisted.moduleId}", whose ` +
+                    'plan was not supplied; its terraform deletes are not in this report.',
+                moduleId: persisted.moduleId,
+            });
+            report.intentChanges.push({
+                moduleId: persisted.moduleId,
+                octoAction: DiffAction.DELETE,
+                reason: octoAction.reason,
+                resourceContext: context,
+                resourceId: octoAction.resourceId,
+                terraformChanges: [],
+            });
+            continue;
+        }
+        const terraformChanges = [];
+        for (const address of persisted.terraformAddresses) {
+            const { changedFields, tfActions } = planChanges.get(address) ?? NO_PLAN_CHANGE;
+            claim(persisted.moduleId, address);
+            if (!isNoop(tfActions)) {
+                terraformChanges.push({ address, changedFields, tfActions });
+            }
+        }
+        // No terraform change means the resource is already gone from the cloud and intent has caught up.
+        report.intentChanges.push({
+            moduleId: persisted.moduleId,
+            octoAction: DiffAction.DELETE,
+            reason: octoAction.reason,
+            resourceContext: context,
+            resourceId: octoAction.resourceId,
+            terraformChanges,
+        });
+    }
+    // Reverse: whatever terraform plans that no octo resource has claimed.
+    for (const [moduleId, planChanges] of planChangesByModule.entries()) {
+        for (const [address, { tfActions }] of planChanges.entries()) {
+            if (claimedAddresses.get(moduleId)?.has(address) || isNoop(tfActions)) {
+                continue;
+            }
+            const joined = [...tfActions].sort().join(',');
+            if (joined === 'delete' && hasUnverifiableDelete) {
+                report.notes.push({
+                    message: `Terraform plans a delete on "${address}", which is unclaimed — an octo delete with no persisted ` +
+                        'mapping may own it.',
+                    moduleId,
+                });
+            }
+            else if (mockFedModuleIds.has(moduleId)) {
+                report.uncertain.push({
+                    address,
+                    moduleId,
+                    reason: 'no octo resource renders this address, and this folder was planned with at least one ' +
+                        '"mock_outputs" placeholder substituted',
+                    tfActions,
+                });
+            }
+            else {
+                report.drift.push({ address, moduleId, tfActions });
+            }
+        }
+    }
+    return report;
+}
+//# sourceMappingURL=validate.mode.js.map

package/dist/modes/validate.mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.mode.js","sourceRoot":"","sources":["../../src/modes/validate.mode.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAEL,wBAAwB,GACzB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAkJ9E,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;GAEG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC5C,QAAQ,CAAC,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,gGAAgG;QAChG,mFAAmF;QACnF,MAAM,KAAK,GAAG,KAAK;aAChB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAC7C,CAAC,CAAC,CAAE,OAAmC,CAAC,IAAI,IAAK,OAAmC,CAAC,UAAU,CAAC;YAChG,CAAC,CAAC,OAAO,CACZ;aACA,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEjF,OAAO,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,UAAU,CAAC;IAChG,CAAC;IAED,OAAO,QAAQ,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,IAAa;IAC5B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAA+B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,KAA2D,EAAE,GAAW;IACxF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,MAAqF;IAErF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IAC9D,MAAM,MAAM,GAA0B,EAAE,CAAC;IAEzC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3F,EAAE,EAAE,YAAY;gBACd,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC;oBACrC,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC1C,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAC7B,wBAAwB,GAAG,EAAE,EAC7B,iBAAiB,EACjB,UAAU,GAAG,IAAI,GAAG,EAAE,EACtB,KAAK,EACL,eAAe,GAAG,EAAE,EACpB,WAAW,GAQZ;IACC,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnE,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAChC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,gCAAgC,EAAE,CAAC;IAErE,MAAM,MAAM,GAAmB;QAC7B,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;QAC3D,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;QACjB,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,EAAE;KACd,CAAC;IAEF,kGAAkG;IAClG,4FAA4F;IAC5F,iGAAiG;IACjG,WAAW;IACX,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B;YACE,GAAG,sBAAsB,CAAC,2BAA2B,EAAE;YACvD,GAAG,sBAAsB,CAAC,8BAA8B,EAAE;SAC3D,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzC,CAAC;QAEF,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,wBAAwB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;oBACtC,CAAC,CAAC,sBAAsB,UAAU,qEAAqE;wBACrG,oBAAoB;oBACtB,CAAC,CAAC,sBAAsB,UAAU,wEAAwE;wBACxG,yEAAyE;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAEvD,MAAM,gBAAgB,GAAG,CAAC,IAAmB,EAA2B,EAAE;QACxE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;QAE9C,KAAK,MAAM,cAAc,IAAI,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YACzD,IAAI,cAAc,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE;gBAClC,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvF,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACvE,MAAM,cAAc,GAAe,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAExE,2FAA2F;IAC3F,6FAA6F;IAC7F,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;oBACZ,CAAC,CAAC,oCAAoC,QAAQ,OAAO,KAAK,EAAE;oBAC5D,CAAC,CAAC,8CAA8C,QAAQ,iCAAiC;gBAC3F,QAAQ;aACT,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,mGAAmG;IACnG,cAAc;IACd,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,OAAO,EACL,uCAAuC,QAAQ,2DAA2D;oBAC1G,wFAAwF;gBAC1F,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,OAAiB,EAAW,EAAE,CAC5C,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;IAEtG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAQ,EAAE;QACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,oBAAoB,EAAE,CAAC;IAC1D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9F,mGAAmG;IACnG,iGAAiG;IACjG,oCAAoC;IACpC,EAAE;IACF,iGAAiG;IACjG,oGAAoG;IACpG,mGAAmG;IACnG,wFAAwF;IACxF,MAAM,0BAA0B,GAAG,IAAI,GAAG,CACxC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC;SAC/G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAC5B,CAAC;IAEF,qGAAqG;IACrG,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3D,MAAM,YAAY,GAAG,CAAC,GAAG,0BAA0B,CAAC,CAAC;IAErD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAG,CAAC;QAEzC,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7F,wBAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBACrD,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,kGAAkG;IAClG,iGAAiG;IACjG,mGAAmG;IACnG,8EAA8E;IAC9E,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,6FAA6F;IAC7F,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,KAAgB,EAAQ,EAAE;QACjE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,wBAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF;;OAEG;IACH,MAAM,uBAAuB,GAAG,CAAC,QAAyB,EAAiC,EAAE;QAC3F,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACrD,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxD,WAAW,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAG,CAAC;QACtC,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QAExD,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;SAClE,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,CACpE,CAAC;IAEF,MAAM,iBAAiB,GAAG,CAAC,KAAgB,EAAU,EAAE,CACrD,2EAA2E,KAAK,CAAC,UAAU,eAAe;QAC1G,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,4CAA4C,CAAC;QACtG,wEAAwE,CAAC;IAE3E;;;OAGG;IACH,MAAM,4BAA4B,GAAG,CACnC,QAAgB,EAChB,UAAkB,EAClB,MAA+B,EACzB,EAAE;QACR,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,eAAe,EAAE,YAAY;gBAC7B,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ;gBACR,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC;gBACpC,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC;IAEF,sEAAsE;IACtE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE5D,+FAA+F;QAC/F,2EAA2E;QAC3E,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAChE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/F,CAAC,CAAC,CAAC;QAEH,8FAA8F;QAC9F,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAE7D,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,kBAAkB,IAAI,EAAE,EAAE,CAAC;YAC1D,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEjC,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAC5B,OAAO;oBACP,SAAS,EAAE,4BAA4B;oBACvC,eAAe,EAAE,OAAO,CAAC,UAAU;oBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAEnE,qFAAqF;QACrF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,4BAA4B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,4CAA4C;IAC5C,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAElC,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,oFAAoF;QACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,OAAO,EACL,qBAAqB,UAAU,CAAC,UAAU,8CAA8C;oBACxF,+EAA+E;aAClF,CAAC,CAAC;YACH,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;gBACxB,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,eAAe,EAAE,OAAO;gBACxB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,gBAAgB,EAAE,EAAE;aACrB,CAAC,CAAC;YAEH,qBAAqB,GAAG,IAAI,CAAC;YAC7B,SAAS;QACX,CAAC;QAED,0FAA0F;QAC1F,cAAc;QACd,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,OAAO,EACL,qBAAqB,UAAU,CAAC,UAAU,sBAAsB,SAAS,CAAC,QAAQ,WAAW;oBAC7F,sEAAsE;gBACxE,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC,CAAC;YACH,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;gBACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,eAAe,EAAE,OAAO;gBACxB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,gBAAgB,EAAE,EAAE;aACrB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,gBAAgB,GAA8B,EAAE,CAAC;QAEvD,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC;YAChF,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,gBAAgB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,kGAAkG;QAClG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;YACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,eAAe,EAAE,OAAO;YACxB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7D,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtE,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE/C,IAAI,MAAM,KAAK,QAAQ,IAAI,qBAAqB,EAAE,CAAC;gBACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;oBAChB,OAAO,EACL,gCAAgC,OAAO,2DAA2D;wBAClG,qBAAqB;oBACvB,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;oBACpB,OAAO;oBACP,QAAQ;oBACR,MAAM,EACJ,uFAAuF;wBACvF,wCAAwC;oBAC1C,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}