platformforge 0.1.0__py3-none-any.whl

platformforge/live/envelope.py

@@ -0,0 +1,85 @@
+"""Envelope validation + serialization — schema contract boundary.
+
+Every envelope crossing into the platform is validated against
+contracts/observation.schema.json and redacted before persistence
+(cycle §207). Redaction receipts are attached under `hashes.redaction`.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+import jsonschema
+
+from platformforge.core.redaction import redact_obj, redact_text_report
+from platformforge.live.models import SCHEMA, CollectorReceipt, ObservationEnvelope
+
+_CONTRACT_DIR = Path(__file__).resolve().parents[2] / "contracts"
+
+
+def _schema(name: str) -> dict[str, Any]:
+    p = _CONTRACT_DIR / name
+    if not p.exists():
+        return {}
+    return json.loads(p.read_text())
+
+
+def validate_envelope(doc: dict[str, Any]) -> list[str]:
+    """Schema + semantic validation. Returns error list (empty = ok)."""
+    errors: list[str] = []
+    schema = _schema("observation.schema.json")
+    if schema:
+        for e in jsonschema.Draft202012Validator(schema).iter_errors(doc):
+            errors.append(f"schema: {e.json_path or '/'} {e.message}")
+    if doc.get("schema") != SCHEMA:
+        errors.append(f"schema must be {SCHEMA}")
+    cov = (doc.get("coverage") or {}).get("status", "unknown")
+    from platformforge.live.models import COVERAGE_STATUSES
+    if cov not in COVERAGE_STATUSES:
+        errors.append(f"invalid coverage.status: {cov}")
+    for i, o in enumerate(doc.get("objects", [])):
+        if not isinstance(o, dict) or not o.get("resource_id"):
+            errors.append(f"objects[{i}] missing resource_id")
+    return errors
+
+
+def redact_envelope(env: ObservationEnvelope) -> tuple[ObservationEnvelope, dict[str, int]]:
+    """§207 — boundary redaction before anything is persisted/emitted.
+
+    Returns (redacted_envelope, redaction_counts). Objects' attributes and
+    receipt text are deep-redacted; counts become the redaction receipt.
+    """
+    counts: dict[str, int] = {}
+    redacted_objects = []
+    for o in env.objects:
+        ro = dict(o)
+        txt = json.dumps(ro.get("attributes", {}), default=str)
+        _r, c = redact_text_report(txt)
+        for k, v in c.items():
+            counts[k] = counts.get(k, 0) + v
+        ro["attributes"] = redact_obj(ro.get("attributes", {}))
+        redacted_objects.append(ro)
+    env.objects = redacted_objects
+    if env.receipt:
+        env.receipt = redact_obj(env.receipt)
+    if env.errors:
+        env.errors = [redact_obj(e) for e in env.errors]
+    return env, counts
+
+
+def envelope_hash(env: ObservationEnvelope) -> str:
+    return env.signature()
+
+
+def loads(text: str) -> ObservationEnvelope:
+    return ObservationEnvelope.from_dict(json.loads(text))
+
+
+def dumps(env: ObservationEnvelope) -> str:
+    return json.dumps(env.to_dict(), indent=2, sort_keys=True, default=str)
+
+
+def receipt_dict(r: CollectorReceipt) -> dict[str, Any]:
+    return r.to_dict()

platformforge/live/federation.py

@@ -0,0 +1,113 @@
+"""Multi-cluster federation (cycle §126–§131).
+
+- ClusterRegistry: declared fleet inventory under
+  `.platformforge/clusters/registry.json` — cluster_id, provider,
+  account, region, context, environment. Registry entries are declared
+  intent; coverage is earned by observations.
+- federate(): merges per-cluster graphs into one federated graph.
+  Same node_id → merged (evidence unions); cluster origin is stamped
+  on every node/edge attr so provenance survives the merge.
+- coverage report: which registered clusters actually contributed —
+  a registered cluster with no observation is a declared gap, not an
+  implicit failure.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import asdict, dataclass, field
+from pathlib import Path
+from typing import Any
+
+from platformforge.graph.model import Edge, Graph, Node
+from platformforge.live.models import now_iso
+
+REGISTRY = ".platformforge/clusters/registry.json"
+
+
+@dataclass
+class Cluster:
+    cluster_id: str
+    provider: str = ""                  # eks|gke|kind|…
+    account: str = ""
+    region: str = ""
+    context: str = ""                   # kube context
+    environment: str = ""
+    labels: dict[str, str] = field(default_factory=dict)
+    registered_at: str = ""
+
+    def to_dict(self) -> dict[str, Any]:
+        return {k: v for k, v in asdict(self).items() if v not in ("", {})}
+
+
+class ClusterRegistry:
+    def __init__(self, root: str | Path):
+        self.path = Path(root) / REGISTRY
+
+    def _load(self) -> dict[str, Any]:
+        if not self.path.exists():
+            return {"clusters": {}}
+        return json.loads(self.path.read_text())
+
+    def _save(self, doc: dict[str, Any]) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps(doc, indent=2, sort_keys=True)
+                             + "\n")
+
+    def register(self, cluster: Cluster) -> dict[str, Any]:
+        doc = self._load()
+        c = cluster.to_dict()
+        c.setdefault("registered_at", now_iso())
+        doc["clusters"][cluster.cluster_id] = c
+        self._save(doc)
+        return c
+
+    def get(self, cluster_id: str) -> dict[str, Any] | None:
+        return self._load()["clusters"].get(cluster_id)
+
+    def list(self) -> list[dict[str, Any]]:
+        return [self._load()["clusters"][k]
+                for k in sorted(self._load()["clusters"])]
+
+    def unregister(self, cluster_id: str) -> bool:
+        doc = self._load()
+        if doc["clusters"].pop(cluster_id, None) is not None:
+            self._save(doc)
+            return True
+        return False
+
+
+def federate(graphs: dict[str, Graph]) -> Graph:
+    """Merge {cluster_id: Graph} → federated graph. Deterministic:
+    sorted iteration, evidence unions, cluster stamped on attrs."""
+    out = Graph()
+    for cluster_id in sorted(graphs):
+        g = graphs[cluster_id]
+        for nid in sorted(g.nodes):
+            n = g.nodes[nid]
+            attrs = dict(n.attrs)
+            attrs["cluster"] = attrs.get("cluster") or cluster_id
+            out.add_node(Node(nid, n.kind, n.label, attrs,
+                              n.source_fact_ids))
+        for eid in sorted(g.edges):
+            e = g.edges[eid]
+            attrs = dict(e.attrs)
+            attrs["cluster"] = attrs.get("cluster") or cluster_id
+            out.add_edge(Edge(e.src, e.dst, e.kind, e.provenance,
+                              e.confidence, e.source_fact_ids, attrs,
+                              e.evidence, dict(e.temporal)))
+    return out
+
+
+def federation_coverage(registry: ClusterRegistry,
+                        contributing: list[str]) -> dict[str, Any]:
+    """Registered vs contributing clusters — explicit partial coverage."""
+    reg = {c["cluster_id"] for c in registry.list()}
+    seen = set(contributing)
+    missing = sorted(reg - seen)
+    unknown = sorted(seen - reg)
+    status = ("complete" if not missing else
+              "partial" if seen else "unknown")
+    return {"status": status, "registered": sorted(reg),
+            "contributing": sorted(seen), "missing": missing,
+            "unregistered": unknown}

platformforge/live/fixtures.py

@@ -0,0 +1,168 @@
+"""Fixture transports — deterministic offline replay for collectors
+(cycle §258 "collector fixtures").
+
+A fixture dir mirrors the transport contract so collectors run their
+real code path end-to-end with zero network:
+
+    fixture/kubectl/
+      get_deployments.json           # `kubectl get deployments …`
+      get_deployments.cont.json      # continuation page (--continue)
+      get_secrets.denied.txt         # rc=1 Forbidden stderr
+      auth_can-i_get.txt             # "yes"/"no"
+      config_current-context.txt     # "kind-lab"
+    fixture/aws/
+      sts_get-caller-identity.json
+      ec2_describe-vpcs.json                 # any region
+      ec2_describe-vpcs__us-east-1.json      # region-scoped wins
+      iam_list-users.denied.txt              # rc=1 AccessDenied
+
+Missing fixture → rc=2 "no fixture" (never silently empty).
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+
+def k8s_fixture_transport(fixture_dir: str | Path):
+    """Replay kubectl responses from fixture_dir/kubectl/."""
+    root = Path(fixture_dir) / "kubectl"
+    calls: list[str] = []
+    pages: dict[str, int] = {}
+
+    _VALUE_FLAGS = {"-o", "--output", "-n", "--namespace",
+                    "--context", "--chunk-size", "-l", "--selector",
+                    "--continue", "--sort-by", "--field-selector"}
+
+    def _slug(args: list[str]) -> str:
+        words: list[str] = []
+        skip_next = False
+        for a in args:
+            if skip_next:
+                skip_next = False
+                continue
+            if a in _VALUE_FLAGS:
+                skip_next = True
+                continue
+            if a.startswith("-"):
+                continue
+            words.append(a)
+        if "auth" in words and "can-i" in words:
+            verb = words[words.index("can-i") + 1] \
+                if len(words) > words.index("can-i") + 1 else ""
+            return f"auth_can-i_{verb}"
+        if "config" in words:
+            sub = words[words.index("config") + 1] \
+                if len(words) > words.index("config") + 1 else ""
+            return f"config_{sub}"
+        if words and words[0] == "version":
+            return "version"
+        if words and words[0] == "get" and len(words) > 1:
+            return f"get_{words[1]}"
+        return "_".join(words) or "empty"
+
+    def transport(args: list[str]) -> tuple[int, str, str]:
+        slug = _slug(args)
+        calls.append(slug)
+        n = pages.get(slug, 0)
+        pages[slug] = n + 1
+        base = root / f"{slug}.cont{n}.json" if n else root / slug
+        denied = root / f"{slug}.denied.txt"
+        if denied.exists():
+            return 1, "", denied.read_text().strip()
+        cand = [base.with_suffix(".json")] if base.suffix != ".json" \
+            else [base]
+        cand += [root / f"{slug}.cont{n}.json",
+                 root / f"{slug}.json",
+                 root / f"{slug}.txt"]
+        for f in cand:
+            if f.exists():
+                return 0, f.read_text(), ""
+        return 2, "", f"no fixture for kubectl {slug}"
+
+    transport.calls = calls  # type: ignore[attr-defined]
+    return transport
+
+
+def aws_fixture_transport(fixture_dir: str | Path):
+    """Replay aws CLI responses from fixture_dir/aws/."""
+    root = Path(fixture_dir) / "aws"
+    calls: list[str] = []
+
+    def transport(service: str, operation: str,
+                  params: dict | None = None) -> tuple[int, Any]:
+        region = (params or {}).get("region", "")
+        calls.append(f"{service}.{operation}@{region}")
+        for slug in ([f"{service}_{operation}__{region}"] if region
+                     else []) + [f"{service}_{operation}"]:
+            denied = root / f"{slug}.denied.txt"
+            if denied.exists():
+                return 1, denied.read_text().strip()
+            f = root / f"{slug}.json"
+            if f.exists():
+                return 0, json.loads(f.read_text())
+        return 2, {"error": f"no fixture for {service} {operation}"}
+
+    transport.calls = calls  # type: ignore[attr-defined]
+    return transport
+
+
+def collect_fixture(provider: str, fixture_dir: str | Path,
+                    **collector_kw) -> Any:
+    """Run the real collector over a fixture dir → ObservationEnvelope."""
+    from platformforge.live.models import ObservationScope
+    scope = collector_kw.pop("scope", None) or ObservationScope(
+        provider=provider)
+    if provider == "kubernetes":
+        from platformforge.live.collectors.k8s import K8sCollector
+        return K8sCollector(
+            transport=k8s_fixture_transport(fixture_dir),
+            **collector_kw).collect(scope)
+    if provider == "aws":
+        from platformforge.live.collectors.aws import AwsCollector
+        c = AwsCollector(transport=aws_fixture_transport(fixture_dir),
+                         **collector_kw)
+        c.preflight()
+        return c.collect(scope)
+    raise ValueError(f"unknown fixture provider {provider}")
+
+
+def fixture_facts(provider: str, fixture_dir: str | Path) -> dict[str, Any]:
+    """Lab-analyzer shape: run the collector over fixtures → facts.
+
+    Emits one `live.observation` fact per envelope plus one
+    `live.object` fact per observed resource — rule-evaluable and
+    honest about coverage (envelope attrs carry the coverage dict)."""
+    from platformforge.models.base import stable_id
+    env = collect_fixture(provider, fixture_dir)
+    facts = [{
+        "fact_id": stable_id("PF-LIVE", env.observation_id),
+        "kind": "live.observation", "source": f"fixture:{provider}",
+        "location": str(fixture_dir), "tier": 0,
+        "attrs": {"observation_id": env.observation_id,
+                  "provider": env.provider,
+                  "coverage": env.coverage,
+                  "objects": len(env.objects),
+                  "errors": env.errors}}]
+    for o in env.objects:
+        facts.append({
+            "fact_id": stable_id("PF-LIVE", env.observation_id,
+                                 o.get("resource_id", "?")),
+            "kind": "live.object", "source": f"fixture:{provider}",
+            "location": o.get("resource_id", ""),
+            "tier": 0,
+            "attrs": {k: o.get(k) for k in
+                      ("resource_id", "resource_type", "lifecycle",
+                       "namespace", "cluster", "account", "region")
+                      if o.get(k)}})
+    return {"facts": facts, "envelope": env.to_dict()}
+
+
+def collect_fixture_k8s(fixture_dir: str | Path) -> dict[str, Any]:
+    return fixture_facts("kubernetes", fixture_dir)
+
+
+def collect_fixture_aws(fixture_dir: str | Path) -> dict[str, Any]:
+    return fixture_facts("aws", fixture_dir)

platformforge/live/identity.py

@@ -0,0 +1,258 @@
+"""Identity resolution (cycle §42–§49).
+
+A ResourceIdentity is a UNION over strong identifiers — ARN, k8s UID,
+immutable provider id. Weak names (name+kind+namespace) never merge
+identities on their own; they produce `weak_candidates` for review.
+
+Every link carries {confidence, provenance, fact_ids, reason}.
+Contradictions are surfaced as IdentityConflict — never silently
+resolved (e.g. SA annotation → role A while EKS Pod Identity → role B).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+STRONG_ID_KINDS = ("arn", "uid", "canonical_id", "provider_id",
+                   "tf_address", "config_id")
+LINK_CONFIDENCE = {"exact-arn": 1.0, "exact-uid": 1.0,
+                   "tf-address": 0.95, "pod-identity": 0.95,
+                   "irsa-annotation": 0.9, "config-record": 0.9,
+                   "name-only": 0.4}
+
+IRSA_ANNOTATION = "eks.amazonaws.com/role-arn"
+
+
+@dataclass
+class IdentityLink:
+    a: str
+    b: str
+    reason: str                       # e.g. exact-arn, pod-identity
+    confidence: float
+    provenance: str = "observed"
+    fact_ids: list[str] = field(default_factory=list)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {"a": self.a, "b": self.b, "reason": self.reason,
+                "confidence": self.confidence,
+                "provenance": self.provenance,
+                "fact_ids": sorted(self.fact_ids)}
+
+
+@dataclass
+class IdentityConflict:
+    kind: str                         # e.g. sa-role-conflict
+    resource: str
+    claim_a: dict[str, Any]
+    claim_b: dict[str, Any]
+    detail: str = ""
+
+    def to_dict(self) -> dict[str, Any]:
+        return {"kind": self.kind, "resource": self.resource,
+                "claim_a": self.claim_a, "claim_b": self.claim_b,
+                "detail": self.detail}
+
+
+@dataclass
+class ResourceIdentity:
+    canonical_id: str
+    provider_ids: dict[str, str] = field(default_factory=dict)
+    graph_nodes: list[str] = field(default_factory=list)
+    aliases: list[str] = field(default_factory=list)
+    evidence: list[dict[str, Any]] = field(default_factory=list)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {"canonical_id": self.canonical_id,
+                "provider_ids": dict(sorted(self.provider_ids.items())),
+                "graph_nodes": sorted(self.graph_nodes),
+                "aliases": sorted(self.aliases),
+                "evidence": self.evidence}
+
+
+class _UnionFind:
+    def __init__(self):
+        self.p: dict[str, str] = {}
+
+    def find(self, x: str) -> str:
+        self.p.setdefault(x, x)
+        while self.p[x] != x:
+            self.p[x] = self.p[self.p[x]]
+            x = self.p[x]
+        return x
+
+    def union(self, a: str, b: str) -> None:
+        ra, rb = self.find(a), self.find(b)
+        if ra != rb:
+            self.p[rb] = ra
+
+
+def strong_ids_of(obj: dict[str, Any]) -> dict[str, str]:
+    """Extract strong identifiers from an observed object or fact."""
+    ids: dict[str, str] = {}
+    attrs = obj.get("attributes") or obj.get("attrs") or {}
+    if attrs.get("arn"):
+        ids["arn"] = attrs["arn"]
+    rid = obj.get("resource_id", "")
+    if rid.startswith("arn:"):
+        ids["arn"] = rid
+    if obj.get("uid"):
+        ids["uid"] = obj["uid"]
+    if rid.startswith(("k8s://", "aws://")) and "#" in rid:
+        ids["uid"] = rid.rsplit("#", 1)[-1]
+    if rid:
+        ids["canonical_id"] = rid
+    if attrs.get("terraform_address") or obj.get("terraform_address"):
+        ids["tf_address"] = attrs.get("terraform_address") or \
+            obj.get("terraform_address")
+    return ids
+
+
+def sa_role_claims(objects: list[dict[str, Any]]) -> list[IdentityConflict]:
+    """§47 — ServiceAccount role resolution conflict detector.
+
+    IRSA annotation (k8s object) vs EKS Pod Identity association (aws
+    object): different role → explicit conflict.
+    """
+    sa_annotated: dict[tuple[str, str], dict[str, Any]] = {}
+    pod_id: dict[tuple[str, str], dict[str, Any]] = {}
+    for o in objects:
+        a = o.get("attributes", {})
+        rt = o.get("resource_type", "")
+        if rt == "k8s:ServiceAccount":
+            role = (a.get("annotations") or {}).get(IRSA_ANNOTATION)
+            if role:
+                sa_annotated[(o.get("cluster", ""), o.get("namespace", ""),
+                              o.get("name", ""))] = \
+                    {"role_arn": role, "source": "irsa-annotation",
+                     "object": o.get("resource_id", "")}
+        elif rt == "aws:eks/pod_identity_association":
+            pod_id[(o.get("cluster", ""), a.get("namespace", ""),
+                    a.get("service_account", ""))] = \
+                {"role_arn": a.get("role_arn", ""),
+                 "source": "pod-identity",
+                 "object": o.get("resource_id", "")}
+    conflicts = []
+    for key, sa in sorted(sa_annotated.items()):
+        pi = pod_id.get(key)
+        if pi and pi["role_arn"] != sa["role_arn"]:
+            conflicts.append(IdentityConflict(
+                kind="sa-role-conflict", resource=key[2],
+                claim_a=sa, claim_b=pi,
+                detail=f"namespace={key[1]} cluster={key[0]}: IRSA "
+                       f"annotation={sa['role_arn']} vs "
+                       f"PodIdentity={pi['role_arn']}"))
+    return conflicts
+
+
+class IdentityResolver:
+    """Ingests objects/facts, unions strong ids, emits identities +
+    links + conflicts + unresolved weak candidates."""
+
+    def __init__(self):
+        self._uf = _UnionFind()
+        self._records: dict[str, dict[str, Any]] = {}
+        self._links: list[IdentityLink] = []
+        self._weak: dict[str, dict[str, Any]] = {}
+        self._conflicts: list[IdentityConflict] = []
+        self._objects: list[dict[str, Any]] = []
+
+    def ingest_object(self, obj: dict[str, Any]) -> None:
+        self._objects.append(obj)
+        ids = strong_ids_of(obj)
+        rid = obj.get("resource_id", "")
+        anchors = [f"{k}:{v}" for k, v in ids.items() if v]
+        if not anchors:
+            # weak-only shape: record for review, never auto-merge
+            key = (f"weak:{obj.get('resource_type')}:"
+                   f"{obj.get('namespace')}:{obj.get('name')}")
+            self._weak.setdefault(key, obj)
+            return
+        if not rid:
+            return
+        self._records[rid] = obj
+        for anchor in anchors[1:]:
+            self._uf.union(anchors[0], anchor)
+        self._uf.union(f"rid:{rid}", anchors[0])
+        for kind, val in ids.items():
+            self._records.setdefault(f"{kind}:{val}", {})
+
+    def ingest_fact(self, fact: dict[str, Any]) -> None:
+        attrs = fact.get("attrs", {}) or {}
+        pseudo = {"resource_id": attrs.get("arn") or fact.get("location", ""),
+                  "resource_type": fact.get("kind", ""),
+                  "attributes": attrs}
+        ids = strong_ids_of(pseudo)
+        if ids:
+            self.ingest_object({**pseudo, "resource_id":
+                                pseudo["resource_id"] or
+                                f"fact:{fact.get('fact_id','?')}",
+                                "_fact": fact.get("fact_id", "")})
+
+    def ingest_terraform(self, tf_address: str, arn_or_id: str,
+                         fact_id: str = "") -> None:
+        """§45 — terraform address ↔ provider id link (T3 declared ↔
+        T1 observed)."""
+        if not arn_or_id:
+            return
+        self._uf.union(f"tf_address:{tf_address}",
+                       (f"arn:{arn_or_id}" if arn_or_id.startswith("arn:")
+                        else f"canonical_id:{arn_or_id}"))
+        self._links.append(IdentityLink(
+            a=tf_address, b=arn_or_id, reason="tf-address",
+            confidence=LINK_CONFIDENCE["tf-address"],
+            provenance="declared",
+            fact_ids=[fact_id] if fact_id else []))
+
+    def ingest_pod_identity(self, *, cluster: str, namespace: str,
+                            service_account: str, role_arn: str,
+                            sa_uid: str = "",
+                            fact_id: str = "") -> None:
+        """§46 — EKS Pod Identity / IRSA: SA ↔ IAM role link."""
+        sa_key = f"k8s-sa:{cluster}/{namespace}/{service_account}"
+        self._uf.union(sa_key, f"arn:{role_arn}")
+        self._links.append(IdentityLink(
+            a=f"{namespace}/{service_account}", b=role_arn,
+            reason="pod-identity",
+            confidence=LINK_CONFIDENCE["pod-identity"],
+            fact_ids=[fact_id] if fact_id else []))
+        if sa_uid:
+            self._uf.union(sa_key, f"uid:{sa_uid}")
+
+    def resolve(self) -> dict[str, Any]:
+        self._conflicts = sa_role_claims(self._objects)
+        groups: dict[str, dict[str, Any]] = {}
+        for key in self._uf.p:
+            root = self._uf.find(key)
+            g = groups.setdefault(root, {"ids": {}, "rids": set(),
+                                         "facts": set()})
+            kind, _, val = key.partition(":")
+            if kind == "rid":
+                g["rids"].add(val)
+            elif kind == "k8s-sa":
+                g["ids"]["service_account"] = val
+            else:
+                g["ids"][kind] = val
+        identities: list[ResourceIdentity] = []
+        for g in groups.values():
+            ids = g["ids"]
+            canonical = (ids.get("arn") or ids.get("uid")
+                         or (min(g["rids"]) if g["rids"]
+                             else next(iter(ids.values()), "")))
+            ident = ResourceIdentity(
+                canonical_id=canonical,
+                provider_ids={k: v for k, v in ids.items()
+                              if k in STRONG_ID_KINDS or k == "service_account"},
+                graph_nodes=sorted(g["rids"]),
+                aliases=sorted(set(ids.values()) - {canonical}))
+            identities.append(ident)
+        return {
+            "identities": [i.to_dict() for i in sorted(
+                identities, key=lambda i: i.canonical_id)],
+            "links": [l.to_dict() for l in self._links],
+            "conflicts": [c.to_dict() for c in self._conflicts],
+            "weak_candidates": sorted(self._weak),
+            "counts": {"identities": len(identities),
+                       "links": len(self._links),
+                       "conflicts": len(self._conflicts),
+                       "weak": len(self._weak)}}