@svp-labs/talos 0.0.0 → 0.1.0

package/dist/central/channels.js

@@ -0,0 +1,204 @@
+import semver from 'semver';
+import { sameLogin } from '../github/identities.js';
+/**
+ * Which release each channel's org ruleset pins, decided from the Talos repository's tags, its
+ * trusted `regression` issues and the gate runs canary repositories had. Pure: the effects live
+ * in `channels-github.ts`.
+ */
+export const CHANNELS = ['evaluate', 'canary', 'stable'];
+const RELEASE_TAG = /^v(\d+\.\d+\.\d+)$/;
+/** Plain `vX.Y.Z` tags are releases; prereleases and other tags are not. Newest first. */
+export function releasesOf(tags) {
+    return tags
+        .flatMap((tag) => {
+        const version = RELEASE_TAG.exec(tag.name)?.[1];
+        return version === undefined || semver.valid(version) === null
+            ? []
+            : [{ tag: tag.name, version, sha: tag.sha, taggedAt: tag.taggedAt }];
+    })
+        .sort((a, b) => semver.compare(b.version, a.version));
+}
+export function releaseAt(releases, sha) {
+    return sha === undefined ? undefined : releases.find((release) => release.sha === sha);
+}
+export const REGRESSION_LABEL = 'regression';
+/**
+ * An issue counts when it carries the label and either a trusted actor opened it or a trusted
+ * actor put the label on. Logins compare without case, as GitHub's do.
+ */
+export function regressionOf(issue, trusted) {
+    if (!issue.labels.includes(REGRESSION_LABEL))
+        return undefined;
+    const isTrusted = (login) => trusted.some((t) => sameLogin(t, login));
+    const byAuthor = isTrusted(issue.author);
+    const times = issue.labelled
+        .filter((e) => e.label === REGRESSION_LABEL && (byAuthor || isTrusted(e.actor)))
+        .map((e) => e.at)
+        .sort((a, b) => a.localeCompare(b));
+    const reportedAt = times[0] ?? (byAuthor ? issue.createdAt : undefined);
+    if (reportedAt === undefined)
+        return undefined;
+    return {
+        number: issue.number,
+        open: issue.open,
+        dismissed: !issue.open && issue.stateReason === 'not_planned',
+        reportedAt,
+    };
+}
+/**
+ * The releases trusted regression reports hold back: for each report not dismissed, the newest
+ * release that existed when it was made. Holding them back rather than remembering a rollback
+ * keeps the decision stateless: the hourly run would otherwise move canary straight back to the
+ * newest tag, and closing the report when the fix merges, before its release is tagged, would do
+ * the same.
+ */
+export function heldBack(releases, regressions) {
+    const held = new Set();
+    for (const regression of regressions) {
+        if (regression.dismissed)
+            continue;
+        const reported = Date.parse(regression.reportedAt);
+        const culprit = releases.find((release) => Date.parse(release.taggedAt) <= reported);
+        if (culprit !== undefined)
+            held.add(culprit.tag);
+    }
+    return held;
+}
+/**
+ * Canary's release: the newest one no regression report holds back. `releases` holds only tags
+ * whose commit is an ancestor of `main`, newest first.
+ */
+export function canaryTarget(releases, regressions) {
+    const held = heldBack(releases, regressions);
+    return releases.find((release) => !held.has(release.tag));
+}
+/**
+ * The moves that need no gate run to decide: canary to its target, a channel that pins nothing
+ * yet seeded (the first release seeds every pin), and evaluate following stable.
+ */
+export function pinMoves(pins, releases, regressions) {
+    const target = canaryTarget(releases, regressions);
+    if (target === undefined)
+        return [];
+    const moves = [];
+    if (pins.canary !== target.sha)
+        moves.push({ channel: 'canary', from: pins.canary, to: target });
+    const stable = pins.stable === undefined ? target : releaseAt(releases, pins.stable);
+    if (pins.stable === undefined)
+        moves.push({ channel: 'stable', from: undefined, to: target });
+    if (stable !== undefined && pins.evaluate !== stable.sha) {
+        moves.push({ channel: 'evaluate', from: pins.evaluate, to: stable });
+    }
+    return moves;
+}
+/** The gate's job names carry the release, so a run is attributed to it without its logs. */
+export function gateJobNames(version) {
+    return { verdict: `verdict (talos ${version})`, engine: `engine (talos ${version})` };
+}
+/**
+ * A gate run counts once its verdict job finished, green or red: findings are normal. An engine
+ * error is the engine job failing, which happens only when the verdict could not be reached or
+ * reported one.
+ */
+export function tallyJobs(jobs, version) {
+    const names = gateJobNames(version);
+    const finished = new Set(['success', 'failure']);
+    let runs = 0;
+    let engineErrors = 0;
+    for (const job of jobs) {
+        if (job.name === names.verdict && finished.has(job.conclusion ?? ''))
+            runs += 1;
+        if (job.name === names.engine && job.conclusion === 'failure')
+            engineErrors += 1;
+    }
+    return { runs, engineErrors };
+}
+const PROMOTION_DAYS = 7;
+const PROMOTION_RUNS = 5;
+const DAY_MS = 24 * 60 * 60 * 1000;
+function hold(reason) {
+    return { promote: false, hold: reason };
+}
+/** What holds a promotion whatever its age and gate runs. */
+function releaseHold(input) {
+    const { canary, stable } = input;
+    if (canary === undefined)
+        return 'no-release';
+    if (stable !== undefined && semver.lte(canary.version, stable.version))
+        return 'not-newer';
+    return input.regressionOpen ? 'regression-open' : undefined;
+}
+/** The week's wait, which the urgent path skips. */
+function ageHold(input) {
+    if (input.urgent)
+        return undefined;
+    if (input.reachedAt === undefined || Number.isNaN(Date.parse(input.reachedAt))) {
+        return 'age-unknown';
+    }
+    const age = input.now.getTime() - Date.parse(input.reachedAt);
+    return age < PROMOTION_DAYS * DAY_MS ? 'too-young' : undefined;
+}
+/** What holds a promotion before any gate run is counted, or `undefined` when nothing does. */
+function cheapHold(input) {
+    return releaseHold(input) ?? ageHold(input);
+}
+/**
+ * Whether stable (and evaluate with it) moves to canary's release: seven days after it reached
+ * canary, with no engine error and at least five gate runs under it, and no trusted regression
+ * open; on the owner's urgent dispatch, after one clean gate run. Stable never moves back.
+ */
+export function promotion(input) {
+    const early = cheapHold(input);
+    if (early !== undefined)
+        return hold(early);
+    if (input.canary === undefined)
+        return hold('no-release');
+    if (input.tally === undefined)
+        return hold('tally-unknown');
+    if (input.tally.engineErrors > 0)
+        return hold('engine-error');
+    const needed = input.urgent ? 1 : PROMOTION_RUNS;
+    return input.tally.runs < needed
+        ? hold('too-few-runs')
+        : { promote: true, release: input.canary };
+}
+/** Whether reading when canary got its release could still lead to a promotion. */
+export function worthDating(input) {
+    return !input.urgent && releaseHold(input) === undefined;
+}
+/** Whether counting gate runs could still lead to a promotion. */
+export function worthCounting(input) {
+    return cheapHold(input) === undefined;
+}
+/** Stable's move and evaluate's with it. */
+export function promotionMoves(pins, release) {
+    return ['stable', 'evaluate']
+        .filter((channel) => pins[channel] !== release.sha)
+        .map((channel) => ({ channel, from: pins[channel], to: release }));
+}
+/**
+ * When canary's ruleset began pinning `sha`: the oldest of the newest unbroken run of ruleset
+ * versions that pin it. `versions` is newest first, as GitHub lists a ruleset's history.
+ */
+export function reachedAt(versions, sha) {
+    let at;
+    for (const version of versions) {
+        if (version.sha !== sha)
+            break;
+        at = version.at;
+    }
+    return at;
+}
+/** Only the owner may dispatch the urgent promotion, and only the owner may rerun one. */
+export function dispatchAllowed(actors, owner) {
+    const isOwner = (login) => sameLogin(login, owner);
+    return isOwner(actors.actor) && (actors.triggering === undefined || isOwner(actors.triggering));
+}
+/** The pins after the moves, in the order they apply. */
+export function afterMoves(pins, moves) {
+    const next = { ...pins };
+    for (const move of moves)
+        next[move.channel] = move.to.sha;
+    return next;
+}
+//# sourceMappingURL=channels.js.map

package/dist/central/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/central/channels.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD;;;;GAIG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAoBlE,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CACxB,IAA2F;IAE3F,OAAO,IAAI;SACR,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACf,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;YAC5D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,QAA4B,EAC5B,GAAuB;IAEvB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AA2B7C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAsB,EACtB,OAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAW,EAAE,CACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;SAC/E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,aAAa;QAC7D,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,QAA4B,EAC5B,WAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,SAAS;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC;QACrF,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA4B,EAC5B,WAAkC;IAElC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAU,EACV,QAA4B,EAC5B,WAAkC;IAElC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,GAAG,EAAE,MAAM,EAAE,iBAAiB,OAAO,GAAG,EAAE,CAAC;AACxF,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAwB,EAAE,OAAe;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;YAAE,IAAI,IAAI,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;YAAE,YAAY,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6BnC,SAAS,IAAI,CAAC,MAAqB;IACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW,CAAC,KAAqB;IACxC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IAC3F,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,oDAAoD;AACpD,SAAS,OAAO,CAAC,KAAqB;IACpC,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,GAAG,GAAG,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,KAAqB;IACtC,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACjD,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM;QAC9B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACtB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAAqB;IAC/C,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;AACxC,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,cAAc,CAAC,IAAU,EAAE,OAAgB;IACzD,OAAQ,CAAC,QAAQ,EAAE,UAAU,CAAW;SACrC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;SAClD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,QAA8E,EAC9E,GAAW;IAEX,IAAI,EAAsB,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,MAAM;QAC/B,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAC7B,MAAuF,EACvF,KAAa;IAEb,MAAM,OAAO,GAAG,CAAC,KAAyB,EAAW,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,KAAsB;IAC3D,MAAM,IAAI,GAAwC,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/central/drift-job.js

@@ -0,0 +1,132 @@
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import { channelsMismatch, readChannelsFile } from './channels-file.js';
+import { CALLER_PATH, CODEOWNERS_PATHS, differences, DRIFT_LABEL, driftIssue, GOVERNED_SETTINGS, MERGE_QUEUE_RULESET, OWNER_REVIEW_RULESET, reconcile, } from './drift.js';
+import { pinsOf, readChannelRulesets } from './org-rulesets.js';
+import { CentralError, closeIssue, isGoverned, openTalosIssues, soleRepository } from './repos.js';
+import { GitHubError } from '../github/api.js';
+import { readFileAt } from '../github/contents.js';
+import { getRepository, propertyOf } from '../github/repos.js';
+import { fileIssue } from '../jobs/talos-issues.js';
+import { assetsDir } from '../version/self.js';
+function parsedJson(text) {
+    return JSON.parse(text);
+}
+/** What `talos govern` writes, read from the assets this release ships. */
+export async function expectedFromAssets(owner, dir = assetsDir()) {
+    const text = (path) => readFile(new URL(path, dir), 'utf8');
+    const [caller, codeowners, mergeQueue, ownerReview] = await Promise.all([
+        text('workflows/talos.yml'),
+        text('codeowners'),
+        text('rulesets/merge-queue.json'),
+        text('rulesets/owner-review.json'),
+    ]);
+    return {
+        settings: GOVERNED_SETTINGS,
+        caller,
+        codeowners: codeowners.replaceAll('@OWNER', `@${owner}`),
+        mergeQueue: parsedJson(mergeQueue),
+        ownerReview: parsedJson(ownerReview),
+    };
+}
+/** Dependabot alerts: 204 when on, 404 when off; anything else leaves it unknown. */
+async function alertsOn(gh, repo) {
+    try {
+        await gh.request('GET', `repos/${repo}/vulnerability-alerts`);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof GitHubError && error.status === 404)
+            return false;
+        return undefined;
+    }
+}
+const summariesSchema = z.array(z.object({ id: z.number().int(), name: z.string() }));
+const OWN_RULESETS = new Set([MERGE_QUEUE_RULESET, OWNER_REVIEW_RULESET]);
+async function ownRulesets(gh, repo) {
+    const summaries = summariesSchema.parse(await gh.paginate(`repos/${repo}/rulesets?includes_parents=false`));
+    const found = {};
+    for (const summary of summaries.filter((s) => OWN_RULESETS.has(s.name))) {
+        found[summary.name] = await gh.request('GET', `repos/${repo}/rulesets/${summary.id}`);
+    }
+    return found;
+}
+async function codeownersText(gh, repo, ref) {
+    for (const path of CODEOWNERS_PATHS) {
+        const text = await readFileAt(gh, repo, path, ref);
+        if (text !== undefined)
+            return text;
+    }
+    return undefined;
+}
+async function readDriftState(deps, repository) {
+    const repo = repository.fullName;
+    const ref = repository.defaultBranch;
+    const [settings, alerts, caller, codeowners, rulesets] = await Promise.all([
+        deps.release.request('GET', `repos/${repo}`),
+        alertsOn(deps.release, repo),
+        readFileAt(deps.reviewer, repo, CALLER_PATH, ref),
+        codeownersText(deps.reviewer, repo, ref),
+        ownRulesets(deps.release, repo),
+    ]);
+    return {
+        settings: z.record(z.string(), z.unknown()).parse(settings),
+        alerts,
+        channel: propertyOf(repository, 'talos'),
+        caller,
+        codeowners,
+        rulesets,
+    };
+}
+/** Files what is new and closes what is gone; returns how many of each. */
+async function settle(scope, diffs) {
+    const open = await openTalosIssues(scope.gh, { repo: scope.repo, who: scope.who }, DRIFT_LABEL);
+    const plan = reconcile(diffs, open, scope.owns);
+    for (const diff of plan.file)
+        await fileIssue(scope.gh, scope.repo, driftIssue(diff));
+    for (const number of plan.close)
+        await closeIssue(scope.gh, scope.repo, number);
+    return { filed: plan.file.length, closed: plan.close.length };
+}
+const CHANNELS_KEY = 'channels-json:';
+/** One governed repository's drift report, filed in that repository. */
+export async function runDrift(deps) {
+    const repository = await soleRepository(deps.release);
+    const scoped = await soleRepository(deps.reviewer);
+    if (scoped.id !== repository.id) {
+        throw new CentralError('the two tokens reach different repositories');
+    }
+    if (!isGoverned(repository))
+        return { governed: 0, differences: 0, filed: 0, closed: 0 };
+    const diffs = differences(await readDriftState(deps, repository), deps.expected);
+    const settled = await settle({
+        gh: deps.reviewer,
+        repo: repository.fullName,
+        who: deps.who,
+        owns: (key) => !key.startsWith(CHANNELS_KEY),
+    }, diffs);
+    return { governed: 1, differences: diffs.length, ...settled };
+}
+function fileDifferences(mismatched, pins) {
+    return mismatched.map((channel) => ({
+        key: `${CHANNELS_KEY}${channel}`,
+        what: `\`channels.json\`'s ${channel} pin`,
+        expected: pins[channel] ?? 'no pin',
+        actual: 'a different commit, or none',
+    }));
+}
+/** In the `channels.json` lookup, whether the file still says what the rulesets pin. */
+export async function runChannelsFileDrift(deps) {
+    const talos = await getRepository(deps.release, deps.who.talosRepo);
+    const pins = pinsOf(await readChannelRulesets(deps.release, deps.who.org), talos.id);
+    const file = await readChannelsFile(deps.reviewer, deps.who.talosRepo);
+    const diffs = fileDifferences(channelsMismatch(file?.text, pins), pins);
+    const settled = await settle({
+        gh: deps.reviewer,
+        repo: deps.who.talosRepo,
+        who: deps.who,
+        owns: (key) => key.startsWith(CHANNELS_KEY),
+    }, diffs);
+    return { governed: 1, differences: diffs.length, ...settled };
+}
+//# sourceMappingURL=drift-job.js.map

package/dist/central/drift-job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-job.js","sourceRoot":"","sources":["../../src/central/drift-job.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAExE,OAAO,EACL,WAAW,EACX,gBAAgB,EAEhB,WAAW,EACX,WAAW,EACX,UAAU,EAGV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAe,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAmB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAmB/C,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAW,SAAS,EAAE;IAC5E,MAAM,IAAI,GAAG,CAAC,IAAY,EAAmB,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtE,IAAI,CAAC,qBAAqB,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC;QAClB,IAAI,CAAC,2BAA2B,CAAC;QACjC,IAAI,CAAC,4BAA4B,CAAC;KACnC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,iBAAiB;QAC3B,MAAM;QACN,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;QACxD,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;QAClC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,uBAAuB,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAE/F,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,IAAY;IACjD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CACrC,MAAM,EAAE,CAAC,QAAQ,CAAU,SAAS,IAAI,kCAAkC,CAAC,CAC5E,CAAC;IACF,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,aAAa,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,IAAY,EAAE,GAAW;IACjE,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,UAAsB;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;IACjC,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC;IACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC;QACjD,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;KAChC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3D,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC;QACxC,MAAM;QACN,UAAU;QACV,QAAQ;KACT,CAAC;AACJ,CAAC;AASD,2EAA2E;AAC3E,KAAK,UAAU,MAAM,CAAC,KAAY,EAAE,KAA4B;IAC9D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAe;IAC5C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CAAC,6CAA6C,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,MAAM,CAC1B;QACE,EAAE,EAAE,IAAI,CAAC,QAAQ;QACjB,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;KAC7C,EACD,KAAK,CACN,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AAChE,CAAC;AAUD,SAAS,eAAe,CAAC,UAA8B,EAAE,IAAU;IACjE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClC,GAAG,EAAE,GAAG,YAAY,GAAG,OAAO,EAAE;QAChC,IAAI,EAAE,uBAAuB,OAAO,MAAM;QAC1C,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ;QACnC,MAAM,EAAE,6BAA6B;KACtC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAsB;IAC/D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,MAAM,CAC1B;QACE,EAAE,EAAE,IAAI,CAAC,QAAQ;QACjB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;KAC5C,EACD,KAAK,CACN,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AAChE,CAAC"}

package/dist/central/drift.js

@@ -0,0 +1,195 @@
+import { markerFields } from '../status/markers.js';
+import { LABEL } from '../ticket/labels.js';
+/**
+ * The weekly drift report's decisions: what a governed repository should have, how it differs,
+ * and the one issue per difference. The expectations are written here from what `talos govern`
+ * sets (the caller and CODEOWNERS, the merge-queue and owner-review rulesets, the merge settings,
+ * the creation restriction, Dependabot alerts, the channel property); `govern` keeps its own
+ * copy, and the two must change together.
+ */
+export const CALLER_PATH = '.github/workflows/talos.yml';
+export const CODEOWNERS_PATHS = [
+    '.github/CODEOWNERS',
+    'CODEOWNERS',
+    'docs/CODEOWNERS',
+];
+export const MERGE_QUEUE_RULESET = 'talos-merge-queue';
+export const OWNER_REVIEW_RULESET = 'talos-owner-review';
+export const DRIFT_LABEL = 'drift';
+const DRIFT_MARKER = 'talos-drift/1';
+/** Rebase merges only, through auto-merge and the queue; PRs only from collaborators. */
+export const GOVERNED_SETTINGS = {
+    allow_rebase_merge: true,
+    allow_squash_merge: false,
+    allow_merge_commit: false,
+    allow_auto_merge: true,
+    delete_branch_on_merge: true,
+    pull_request_creation_policy: 'collaborators_only',
+};
+const isList = (value) => Array.isArray(value);
+/** A JSON object: not null, not an array. */
+const isObject = (value) => value !== null && typeof value === 'object' && !isList(value);
+/**
+ * Whether `actual` holds everything `wanted` says: GitHub's answers carry more than Talos sends
+ * (ids, links, defaults). Arrays match in any order and must be as long.
+ */
+export function holds(actual, wanted) {
+    if (isList(wanted)) {
+        if (!isList(actual) || actual.length !== wanted.length)
+            return false;
+        const left = [...actual];
+        return wanted.every((item) => {
+            const at = left.findIndex((candidate) => holds(candidate, item));
+            if (at === -1)
+                return false;
+            left.splice(at, 1);
+            return true;
+        });
+    }
+    if (isObject(wanted)) {
+        return isObject(actual) && Object.entries(wanted).every(([k, v]) => holds(actual[k], v));
+    }
+    return Object.is(actual, wanted);
+}
+function settingDifferences(state, expected) {
+    return Object.entries(expected.settings).flatMap(([name, value]) => {
+        const actual = state.settings[name];
+        if (actual === undefined || Object.is(actual, value))
+            return [];
+        const shown = typeof actual === 'string' || typeof actual === 'boolean' ? String(actual) : 'set';
+        return [
+            { key: `setting:${name}`, what: `\`${name}\``, expected: String(value), actual: shown },
+        ];
+    });
+}
+function fileDifference(key, what, text, want) {
+    if (text?.replaceAll('\r\n', '\n') === want)
+        return [];
+    return [
+        { key, what, expected: "Talos's copy", actual: text === undefined ? 'missing' : 'changed' },
+    ];
+}
+function rulesetDifferences(state, expected) {
+    const diffs = [];
+    const queue = state.rulesets[MERGE_QUEUE_RULESET];
+    if (queue === undefined || !holds(queue, expected.mergeQueue)) {
+        diffs.push({
+            key: `ruleset:${MERGE_QUEUE_RULESET}`,
+            what: `the \`${MERGE_QUEUE_RULESET}\` ruleset`,
+            expected: 'present, as Talos creates it',
+            actual: queue === undefined ? 'missing' : 'changed',
+        });
+    }
+    const wantsOwnerReview = state.channel === 'evaluate';
+    const review = state.rulesets[OWNER_REVIEW_RULESET];
+    const what = `the \`${OWNER_REVIEW_RULESET}\` ruleset`;
+    if (wantsOwnerReview !== (review !== undefined)) {
+        diffs.push({
+            key: `ruleset:${OWNER_REVIEW_RULESET}`,
+            what,
+            expected: wantsOwnerReview ? 'present while at evaluate' : 'gone once on a channel',
+            actual: review === undefined ? 'missing' : 'present',
+        });
+    }
+    else if (wantsOwnerReview && !holds(review, expected.ownerReview)) {
+        diffs.push({
+            key: `ruleset:${OWNER_REVIEW_RULESET}`,
+            what,
+            expected: 'present while at evaluate, as Talos creates it',
+            actual: 'changed',
+        });
+    }
+    return diffs;
+}
+/** Every way the repository differs from what `talos govern` sets. */
+export function differences(state, expected) {
+    const channels = new Set(['evaluate', 'canary', 'stable']);
+    return [
+        ...settingDifferences(state, expected),
+        ...(state.alerts === false
+            ? [{ key: 'alerts', what: 'Dependabot alerts', expected: 'on', actual: 'off' }]
+            : []),
+        ...(channels.has(state.channel ?? '')
+            ? []
+            : [
+                {
+                    key: 'property:talos',
+                    what: 'the `talos` property',
+                    expected: 'evaluate, canary or stable',
+                    actual: state.channel ?? 'unset',
+                },
+            ]),
+        ...fileDifference('file:caller', `\`${CALLER_PATH}\``, state.caller, expected.caller),
+        ...fileDifference('file:codeowners', '`CODEOWNERS`', state.codeowners, expected.codeowners),
+        ...rulesetDifferences(state, expected),
+    ];
+}
+/** A hidden first line that lets a later run find the issue again. */
+export function driftMarker(key) {
+    return `<!-- ${DRIFT_MARKER} key=${encodeURIComponent(key)} -->`;
+}
+/** The key of a body's drift marker, hidden or visible, or `undefined` without one. */
+export function driftKey(body) {
+    const key = markerFields(body, DRIFT_MARKER)?.key;
+    if (key === undefined || key === '')
+        return undefined;
+    try {
+        return decodeURIComponent(key);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The issue for one difference; the owner fixes it by running `talos govern` again. */
+export function driftIssue(diff) {
+    const body = [
+        driftMarker(diff.key),
+        '',
+        '### Goal',
+        '',
+        `Bring ${diff.what} back to what \`talos govern\` sets.`,
+        '',
+        '### Acceptance criteria',
+        '',
+        '- [ ] The weekly drift report finds no difference here (it closes this issue itself)',
+        '',
+        '### Out of scope',
+        '',
+        'Every other setting: each difference has an issue of its own.',
+        '',
+        '### Affected areas',
+        '',
+        `- ${diff.what}`,
+        '',
+        '### Difference',
+        '',
+        `Expected: ${diff.expected}. Actual: ${diff.actual}.`,
+        '',
+        "Settings need the owner's administration rights: `talos govern` applies them again, and " +
+            'prints the steps the API does not expose.',
+        '',
+    ].join('\n');
+    return {
+        title: `Drift: ${diff.what.replaceAll('`', '')} differs from what talos govern sets`,
+        body,
+        labels: [DRIFT_LABEL, LABEL.chore, LABEL.p2],
+    };
+}
+/**
+ * What to file and what to close: one open issue per difference, and an open issue whose
+ * difference is gone closed. `owns` limits the run to the keys it checks, so the channels-file
+ * check and the repository's own report leave each other's issues alone.
+ */
+export function reconcile(diffs, open, owns) {
+    const keyed = open.flatMap((issue) => {
+        const key = driftKey(issue.body);
+        return key !== undefined && owns(key) ? [{ number: issue.number, key }] : [];
+    });
+    const filed = new Set(keyed.map((issue) => issue.key));
+    const current = new Set(diffs.map((diff) => diff.key));
+    return {
+        file: diffs.filter((diff) => owns(diff.key) && !filed.has(diff.key)),
+        close: keyed.filter((issue) => !current.has(issue.key)).map((issue) => issue.number),
+    };
+}
+//# sourceMappingURL=drift.js.map

package/dist/central/drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.js","sourceRoot":"","sources":["../../src/central/drift.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,6BAA6B,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,oBAAoB;IACpB,YAAY;IACZ,iBAAiB;CAClB,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACzD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAA+C;IAC3E,kBAAkB,EAAE,IAAI;IACxB,kBAAkB,EAAE,KAAK;IACzB,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,IAAI;IACtB,sBAAsB,EAAE,IAAI;IAC5B,4BAA4B,EAAE,oBAAoB;CACnD,CAAC;AAgCF,MAAM,MAAM,GAAG,CAAC,KAAc,EAA+B,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAErF,6CAA6C;AAC7C,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,MAAe,EAAE,MAAe;IACpD,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACjE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAE,QAAkB;IAC/D,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,KAAK,GACT,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACrF,OAAO;YACL,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;SACxF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY,EAAE,IAAwB,EAAE,IAAY;IACvF,IAAI,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO;QACL,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;KAC5F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAE,QAAkB;IAC/D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC;YACT,GAAG,EAAE,WAAW,mBAAmB,EAAE;YACrC,IAAI,EAAE,SAAS,mBAAmB,YAAY;YAC9C,QAAQ,EAAE,8BAA8B;YACxC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,oBAAoB,YAAY,CAAC;IACvD,IAAI,gBAAgB,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC;YACT,GAAG,EAAE,WAAW,oBAAoB,EAAE;YACtC,IAAI;YACJ,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,wBAAwB;YACnF,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC;YACT,GAAG,EAAE,WAAW,oBAAoB,EAAE;YACtC,IAAI;YACJ,QAAQ,EAAE,gDAAgD;YAC1D,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,KAAiB,EAAE,QAAkB;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;YACxB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC/E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,gBAAgB;oBACrB,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ,EAAE,4BAA4B;oBACtC,MAAM,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO;iBACjC;aACF,CAAC;QACN,GAAG,cAAc,CAAC,aAAa,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;QACrF,GAAG,cAAc,CAAC,iBAAiB,EAAE,cAAc,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QAC3F,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,QAAQ,YAAY,QAAQ,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC;IAClD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,MAAM,IAAI,GAAG;QACX,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QACrB,EAAE;QACF,UAAU;QACV,EAAE;QACF,SAAS,IAAI,CAAC,IAAI,sCAAsC;QACxD,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,sFAAsF;QACtF,EAAE;QACF,kBAAkB;QAClB,EAAE;QACF,+DAA+D;QAC/D,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,KAAK,IAAI,CAAC,IAAI,EAAE;QAChB,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,aAAa,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,MAAM,GAAG;QACrD,EAAE;QACF,0FAA0F;YACxF,2CAA2C;QAC7C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACL,KAAK,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,sCAAsC;QACpF,IAAI;QACJ,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,KAA4B,EAC5B,IAA+B,EAC/B,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;KACrF,CAAC;AACJ,CAAC"}

package/dist/central/gate-runs.js

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+import { tallyJobs } from './channels.js';
+import { listRunJobs } from '../github/actions.js';
+import { listInstallationRepositories, propertyOf } from '../github/repos.js';
+/**
+ * Gate runs on canary repositories, read as `talos-release` with a token minted for them alone
+ * (actions: read). The gate is the organisation's required workflow, so its runs are listed
+ * among each repository's own; the gate's job names carry the release, which is how a run is told
+ * apart from the rest.
+ */
+const GATE_EVENTS = new Set(['pull_request', 'merge_group']);
+const MAX_RUNS = 300;
+const runSchema = z.object({ id: z.number().int(), event: z.string() });
+/** The repositories on the canary channel that the token reaches, archived ones left out. */
+export async function canaryRepositories(gh) {
+    const repos = await listInstallationRepositories(gh);
+    return repos
+        .filter((repo) => !repo.archived && propertyOf(repo, 'talos') === 'canary')
+        .map((repo) => repo.fullName);
+}
+async function gateRunIds(gh, repo, since) {
+    const created = encodeURIComponent(`>=${since}`);
+    const raw = await gh.paginate(`repos/${repo}/actions/runs?status=completed&created=${created}`, 'workflow_runs');
+    return z
+        .array(runSchema)
+        .parse(raw)
+        .filter((run) => GATE_EVENTS.has(run.event))
+        .slice(0, MAX_RUNS)
+        .map((run) => run.id);
+}
+/**
+ * Every gate run under `version` on the given repositories since `since` (the release's tag,
+ * before which no run can have used it). Stops early at the first engine error, which settles
+ * the question.
+ */
+export async function tallyGateRuns(gh, repos, version, since) {
+    let runs = 0;
+    for (const repo of repos) {
+        for (const id of await gateRunIds(gh, repo, since)) {
+            const tally = tallyJobs(await listRunJobs(gh, repo, id), version);
+            runs += tally.runs;
+            if (tally.engineErrors > 0)
+                return { runs, engineErrors: tally.engineErrors };
+        }
+    }
+    return { runs, engineErrors: 0 };
+}
+//# sourceMappingURL=gate-runs.js.map

package/dist/central/gate-runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-runs.js","sourceRoot":"","sources":["../../src/central/gate-runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE9E;;;;;GAKG;AAEH,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAClF,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAExE,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC;SAC1E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC3B,SAAS,IAAI,0CAA0C,OAAO,EAAE,EAChE,eAAe,CAChB,CAAC;IACF,OAAO,CAAC;SACL,KAAK,CAAC,SAAS,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAC3C,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;SAClB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,KAAwB,EACxB,OAAe,EACf,KAAa;IAEb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;YACnB,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AACnC,CAAC"}