@aws-amplify/cli-internal-gen2-migration-experimental-alpha 0.6.0 → 0.7.0

package/lib/commands/gen2-migration/generate/amplify/function/function.generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"function.generator.d.ts","sourceRoot":"","sources":["../../../../../../src/commands/gen2-migration/generate/amplify/function/function.generator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsCtD,UAAU,wBAAwB;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAaD,qBAAa,iBAAkB,YAAW,OAAO;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2B;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;gBAEzB,OAAO,EAAE,wBAAwB;IAe7C,gBAAgB,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IASpD,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI;IASxC,IAAI,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YA6B3C,OAAO;YAuDP,gBAAgB;IA2B9B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,qBAAqB;YAef,uBAAuB;IAuCrC,OAAO,CAAC,wBAAwB;YA6BlB,kBAAkB;YAyBlB,yBAAyB;IAyBvC,OAAO,CAAC,qBAAqB;IAkD7B,OAAO,CAAC,0BAA0B;IAiDlC,OAAO,CAAC,uBAAuB;IAkD/B,OAAO,CAAC,qBAAqB;IA0D7B,OAAO,CAAC,4BAA4B;YAuCtB,yBAAyB;IA4BvC,OAAO,CAAC,uBAAuB;CAiGhC"}

package/lib/commands/gen2-migration/generate/amplify/function/function.generator.js

@@ -0,0 +1,626 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FunctionGenerator = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const promises_1 = __importDefault(require("node:fs/promises"));
+const typescript_1 = __importDefault(require("typescript"));
+const amplify_cli_core_1 = require("@aws-amplify/amplify-cli-core");
+const ts_1 = require("../../_infra/ts");
+const function_renderer_1 = require("./function.renderer");
+const factory = typescript_1.default.factory;
+class FunctionGenerator {
+    constructor(options) {
+        this.gen1App = options.gen1App;
+        this.backendGenerator = options.backendGenerator;
+        this.packageJsonGenerator = options.packageJsonGenerator;
+        this.outputDir = options.outputDir;
+        this.resource = options.resource;
+        this.category = options.category;
+        this.renderer = new function_renderer_1.FunctionRenderer(options.gen1App.appId, options.gen1App.envName);
+    }
+    setAuthGenerator(authGenerator) {
+        this.authGenerator = authGenerator;
+    }
+    setS3Generator(s3Generator) {
+        this.s3Generator = s3Generator;
+    }
+    async plan() {
+        const func = await this.resolve();
+        await this.mergeFunctionDependencies(func);
+        const triggerModels = await this.detectDynamoTriggerModels(func);
+        this.contributeAuthAccess(func);
+        this.contributeAuthTrigger();
+        await this.contributeStorageAccess(this.category);
+        this.contributeStorageTrigger();
+        return [
+            {
+                resource: this.resource,
+                validate: () => undefined,
+                describe: async () => [`Generate amplify/${this.category}/${func.resourceName}/resource.ts`],
+                execute: async () => {
+                    await this.generateResource(func);
+                    this.contributeOverrides(func);
+                    this.contributeGrants(func);
+                    if (triggerModels.length > 0) {
+                        this.contributeDynamoTrigger(func.resourceName, triggerModels);
+                    }
+                },
+            },
+        ];
+    }
+    async resolve() {
+        var _a, _b, _c;
+        const functionCategory = this.gen1App.meta('function');
+        if (!functionCategory || !functionCategory[this.resource.resourceName]) {
+            throw new Error(`Function '${this.resource.resourceName}' not found in amplify-meta.json`);
+        }
+        const resourceMeta = functionCategory[this.resource.resourceName];
+        const output = resourceMeta.output;
+        const deployedName = output === null || output === void 0 ? void 0 : output.Name;
+        if (!deployedName) {
+            throw new Error(`Function '${this.resource.resourceName}' has no deployed name in amplify-meta.json output`);
+        }
+        const config = await this.gen1App.aws.fetchFunctionConfig(deployedName);
+        if (!config) {
+            throw new Error(`Lambda function '${deployedName}' not found`);
+        }
+        const runtime = config.Runtime;
+        if (runtime && !runtime.startsWith('nodejs')) {
+            throw new Error(`Function '${deployedName}' uses unsupported runtime '${runtime}'. Gen 2 migration only supports Node.js functions.`);
+        }
+        const schedule = await this.gen1App.aws.fetchFunctionSchedule(deployedName);
+        const entry = ts_1.TS.extractFilePathFromHandler((_a = config.Handler) !== null && _a !== void 0 ? _a : 'index.js');
+        const { retained, escapeHatches } = classifyEnvVars((_c = (_b = config.Environment) === null || _b === void 0 ? void 0 : _b.Variables) !== null && _c !== void 0 ? _c : {});
+        const { dynamoActions, kinesisActions, graphqlApiPermissions, authAccess } = this.extractCfnPermissions();
+        return {
+            resourceName: this.resource.resourceName,
+            category: this.category,
+            entry,
+            deployedName,
+            timeoutSeconds: config.Timeout,
+            memoryMB: config.MemorySize,
+            runtime,
+            schedule,
+            environment: Object.keys(retained).length > 0 ? retained : undefined,
+            escapeHatches,
+            dynamoActions,
+            kinesisActions,
+            graphqlApiPermissions,
+            authAccess,
+        };
+    }
+    async generateResource(func) {
+        const dirPath = node_path_1.default.join(this.outputDir, 'amplify', this.category, func.resourceName);
+        const renderOpts = {
+            resourceName: func.resourceName,
+            entry: func.entry,
+            name: func.deployedName,
+            timeoutSeconds: func.timeoutSeconds,
+            memoryMB: func.memoryMB,
+            runtime: func.runtime,
+            schedule: func.schedule,
+            environment: func.environment,
+        };
+        const nodes = this.renderer.render(renderOpts);
+        const content = ts_1.TS.printNodes(nodes);
+        await promises_1.default.mkdir(dirPath, { recursive: true });
+        await promises_1.default.writeFile(node_path_1.default.join(dirPath, 'resource.ts'), content, 'utf-8');
+        await this.copyFunctionSource(func.resourceName, dirPath);
+        this.backendGenerator.addImport(`./${this.category}/${func.resourceName}/resource`, [func.resourceName]);
+        this.backendGenerator.addDefineBackendProperty(factory.createShorthandPropertyAssignment(factory.createIdentifier(func.resourceName)));
+    }
+    contributeOverrides(func) {
+        this.backendGenerator.ensureBranchName();
+        this.backendGenerator.addStatement(createFunctionNameOverride(func.resourceName));
+        for (const hatch of func.escapeHatches) {
+            this.backendGenerator.addStatement(createAddEnvironmentCall(func.resourceName, hatch));
+        }
+    }
+    contributeGrants(func) {
+        this.contributeTableGrants(func);
+        this.contributeStorageTableGrants(func);
+        this.contributeGraphqlApiGrants(func);
+        this.contributeKinesisGrants(func);
+    }
+    contributeAuthAccess(func) {
+        if (!this.authGenerator)
+            return;
+        if (Object.keys(func.authAccess).length > 0) {
+            this.authGenerator.addFunctionAuthAccess({ resourceName: this.resource.resourceName, permissions: func.authAccess });
+        }
+    }
+    contributeAuthTrigger() {
+        if (!this.authGenerator || this.category !== 'auth')
+            return;
+        const authResourceName = this.gen1App.singleResourceName('auth', 'Cognito');
+        if (!this.resource.resourceName.startsWith(authResourceName))
+            return;
+        const suffix = this.resource.resourceName.slice(authResourceName.length);
+        const event = TRIGGER_SUFFIX_TO_EVENT[suffix];
+        if (event) {
+            this.authGenerator.addTrigger({ event, resourceName: this.resource.resourceName });
+        }
+    }
+    async contributeStorageAccess(category) {
+        var _a, _b, _c, _d;
+        if (!this.s3Generator)
+            return;
+        const S3_ACTION_TO_PERMISSION = {
+            's3:GetObject': 'read',
+            's3:PutObject': 'write',
+            's3:DeleteObject': 'delete',
+            's3:ListBucket': 'read',
+        };
+        const templatePath = `function/${this.resource.resourceName}/${this.resource.resourceName}-cloudformation-template.json`;
+        const template = this.gen1App.json(templatePath);
+        const policy = (_a = template.Resources) === null || _a === void 0 ? void 0 : _a.AmplifyResourcesPolicy;
+        if (!policy || policy.Type !== 'AWS::IAM::Policy')
+            return;
+        const statements = (_d = (_c = (_b = policy.Properties) === null || _b === void 0 ? void 0 : _b.PolicyDocument) === null || _c === void 0 ? void 0 : _c.Statement) !== null && _d !== void 0 ? _d : [];
+        const permissions = new Set();
+        for (const stmt of Array.isArray(statements) ? statements : [statements]) {
+            if (stmt.Effect !== 'Allow')
+                continue;
+            const actions = Array.isArray(stmt.Action) ? stmt.Action : [stmt.Action];
+            for (const action of actions) {
+                if (typeof action === 'string' && S3_ACTION_TO_PERMISSION[action]) {
+                    permissions.add(S3_ACTION_TO_PERMISSION[action]);
+                }
+            }
+        }
+        if (permissions.size > 0) {
+            this.s3Generator.addFunctionStorageAccess(this.resource.resourceName, category, Array.from(permissions));
+        }
+    }
+    contributeStorageTrigger() {
+        var _a, _b, _c, _d, _e, _f;
+        if (!this.s3Generator || this.category !== 'storage')
+            return;
+        const storageCategory = this.gen1App.meta('storage');
+        if (!storageCategory)
+            return;
+        const s3Entry = Object.entries(storageCategory).find(([, value]) => value.service === 'S3');
+        if (!s3Entry)
+            return;
+        const [storageName] = s3Entry;
+        const templatePath = `storage/${storageName}/build/cloudformation-template.json`;
+        const template = this.gen1App.json(templatePath);
+        const lambdaConfigs = (_e = (_d = (_c = (_b = (_a = template === null || template === void 0 ? void 0 : template.Resources) === null || _a === void 0 ? void 0 : _a.S3Bucket) === null || _b === void 0 ? void 0 : _b.Properties) === null || _c === void 0 ? void 0 : _c.NotificationConfiguration) === null || _d === void 0 ? void 0 : _d.LambdaConfigurations) !== null && _e !== void 0 ? _e : [];
+        for (const config of lambdaConfigs) {
+            const functionRef = (_f = config === null || config === void 0 ? void 0 : config.Function) === null || _f === void 0 ? void 0 : _f.Ref;
+            if (!functionRef || !functionRef.includes(this.resource.resourceName))
+                continue;
+            const event = config.Event;
+            if (event === null || event === void 0 ? void 0 : event.includes('ObjectCreated')) {
+                this.s3Generator.addTrigger('onUpload', this.resource.resourceName);
+            }
+            else if (event === null || event === void 0 ? void 0 : event.includes('ObjectRemoved')) {
+                this.s3Generator.addTrigger('onDelete', this.resource.resourceName);
+            }
+        }
+    }
+    async copyFunctionSource(resourceName, destDir) {
+        const srcDir = node_path_1.default.join('amplify', 'backend', 'function', resourceName, 'src');
+        try {
+            await promises_1.default.cp(srcDir, destDir, {
+                recursive: true,
+                filter: (src) => {
+                    const basename = node_path_1.default.basename(src);
+                    return (basename !== 'node_modules' &&
+                        basename !== '.yarn' &&
+                        basename !== 'package.json' &&
+                        basename !== 'package-lock.json' &&
+                        basename !== 'yarn.lock' &&
+                        basename !== 'pnpm-lock.yaml');
+                },
+            });
+        }
+        catch (e) {
+            throw new Error(`Failed to copy source files for function '${this.resource.resourceName}': ${e}`);
+        }
+    }
+    async mergeFunctionDependencies(func) {
+        const packageJsonPath = node_path_1.default.join('amplify', 'backend', 'function', func.resourceName, 'src', 'package.json');
+        try {
+            const pkg = amplify_cli_core_1.JSONUtilities.readJson(packageJsonPath);
+            if (pkg === null || pkg === void 0 ? void 0 : pkg.dependencies) {
+                for (const [name, version] of Object.entries(pkg.dependencies)) {
+                    this.packageJsonGenerator.addDependency(name, version);
+                }
+            }
+            if (pkg === null || pkg === void 0 ? void 0 : pkg.devDependencies) {
+                for (const [name, version] of Object.entries(pkg.devDependencies)) {
+                    this.packageJsonGenerator.addDevDependency(name, version);
+                }
+            }
+        }
+        catch (e) {
+            throw new Error(`Failed to read package.json for function '${this.resource.resourceName}': ${e}`);
+        }
+    }
+    contributeTableGrants(func) {
+        if (func.dynamoActions.length === 0)
+            return;
+        const tableNames = new Set();
+        for (const hatch of func.escapeHatches) {
+            if (hatch.name.startsWith('API_') && hatch.name.includes('TABLE_')) {
+                const tableName = extractTableName(hatch.name);
+                if (tableName)
+                    tableNames.add(tableName);
+            }
+        }
+        if (tableNames.size === 0)
+            return;
+        for (const tableName of tableNames) {
+            const grantCall = factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(factory.createElementAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier('data')), factory.createIdentifier('resources')), factory.createIdentifier('tables')), factory.createStringLiteral(tableName)), factory.createIdentifier('grant')), undefined, [
+                factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier(func.resourceName)), factory.createIdentifier('resources')), factory.createIdentifier('lambda')),
+                ...func.dynamoActions.map((action) => factory.createStringLiteral(action)),
+            ]));
+            this.backendGenerator.addStatement(grantCall);
+        }
+    }
+    contributeGraphqlApiGrants(func) {
+        const { hasMutation, hasQuery } = func.graphqlApiPermissions;
+        if (!hasMutation && !hasQuery)
+            return;
+        const lambdaRef = factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier(func.resourceName)), factory.createIdentifier('resources')), factory.createIdentifier('lambda'));
+        const graphqlApi = factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier('data')), factory.createIdentifier('resources')), factory.createIdentifier('graphqlApi'));
+        if (hasMutation) {
+            this.backendGenerator.addStatement(factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(graphqlApi, factory.createIdentifier('grantMutation')), undefined, [lambdaRef])));
+        }
+        if (hasQuery) {
+            this.backendGenerator.addStatement(factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(graphqlApi, factory.createIdentifier('grantQuery')), undefined, [lambdaRef])));
+        }
+    }
+    contributeKinesisGrants(func) {
+        if (func.kinesisActions.length === 0)
+            return;
+        this.backendGenerator.addImport('aws-cdk-lib', ['aws_iam']);
+        const lambdaRef = factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier(func.resourceName)), factory.createIdentifier('resources')), factory.createIdentifier('lambda'));
+        const policyStatement = factory.createNewExpression(factory.createPropertyAccessExpression(factory.createIdentifier('aws_iam'), factory.createIdentifier('PolicyStatement')), undefined, [
+            factory.createObjectLiteralExpression([
+                factory.createPropertyAssignment('actions', factory.createArrayLiteralExpression(func.kinesisActions.map((action) => factory.createStringLiteral(action)))),
+                factory.createPropertyAssignment('resources', factory.createArrayLiteralExpression([
+                    factory.createPropertyAccessExpression(factory.createIdentifier('analytics'), factory.createIdentifier('kinesisStreamArn')),
+                ])),
+            ], true),
+        ]);
+        this.backendGenerator.addStatement(factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(lambdaRef, factory.createIdentifier('addToRolePolicy')), undefined, [policyStatement])));
+    }
+    extractCfnPermissions() {
+        var _a, _b, _c, _d;
+        const templatePath = `function/${this.resource.resourceName}/${this.resource.resourceName}-cloudformation-template.json`;
+        const template = this.gen1App.json(templatePath);
+        const policy = (_a = template.Resources) === null || _a === void 0 ? void 0 : _a.AmplifyResourcesPolicy;
+        if (!policy || policy.Type !== 'AWS::IAM::Policy') {
+            return { dynamoActions: [], kinesisActions: [], graphqlApiPermissions: { hasMutation: false, hasQuery: false }, authAccess: {} };
+        }
+        const statements = (_d = (_c = (_b = policy.Properties) === null || _b === void 0 ? void 0 : _b.PolicyDocument) === null || _c === void 0 ? void 0 : _c.Statement) !== null && _d !== void 0 ? _d : [];
+        const dynamoActions = [];
+        const kinesisActions = [];
+        const cognitoActions = [];
+        let hasMutation = false;
+        let hasQuery = false;
+        for (const stmt of statements) {
+            const stmtActions = Array.isArray(stmt.Action) ? stmt.Action : [stmt.Action];
+            for (const action of stmtActions) {
+                if (typeof action !== 'string')
+                    continue;
+                if (action.startsWith('dynamodb:'))
+                    dynamoActions.push(action);
+                if (action.startsWith('kinesis:') && !kinesisActions.includes(action))
+                    kinesisActions.push(action);
+                if (action.startsWith('cognito-idp:')) {
+                    if (action === 'cognito-idp:AdminList*') {
+                        for (const a of ['cognito-idp:AdminListDevices', 'cognito-idp:AdminListGroupsForUser']) {
+                            if (!cognitoActions.includes(a))
+                                cognitoActions.push(a);
+                        }
+                    }
+                    else if (action === 'cognito-idp:List*') {
+                        for (const a of ['cognito-idp:ListUsers', 'cognito-idp:ListUsersInGroup', 'cognito-idp:ListGroups']) {
+                            if (!cognitoActions.includes(a))
+                                cognitoActions.push(a);
+                        }
+                    }
+                    else if (!cognitoActions.includes(action)) {
+                        cognitoActions.push(action);
+                    }
+                }
+            }
+            const resources = Array.isArray(stmt.Resource) ? stmt.Resource : [stmt.Resource];
+            for (const resource of resources) {
+                const resourceStr = JSON.stringify(resource);
+                if (resourceStr.includes('/types/Mutation/'))
+                    hasMutation = true;
+                if (resourceStr.includes('/types/Query/'))
+                    hasQuery = true;
+            }
+        }
+        const authAccess = resolveAuthAccess(cognitoActions);
+        return { dynamoActions, kinesisActions, graphqlApiPermissions: { hasMutation, hasQuery }, authAccess };
+    }
+    contributeStorageTableGrants(func) {
+        if (func.dynamoActions.length === 0)
+            return;
+        const tableNames = new Set();
+        for (const hatch of func.escapeHatches) {
+            if (!hatch.name.startsWith('STORAGE_') || hatch.name.endsWith('BUCKETNAME'))
+                continue;
+            const match = hatch.name.match(/STORAGE_(.+?)_(ARN|NAME|STREAMARN)$/);
+            if (match) {
+                tableNames.add(match[1].toLowerCase());
+            }
+        }
+        if (tableNames.size === 0)
+            return;
+        for (const tableName of tableNames) {
+            const grantCall = factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(factory.createIdentifier(tableName), factory.createIdentifier('grant')), undefined, [
+                factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier(func.resourceName)), factory.createIdentifier('resources')), factory.createIdentifier('lambda')),
+                ...func.dynamoActions.map((action) => factory.createStringLiteral(action)),
+            ]));
+            this.backendGenerator.addStatement(grantCall);
+        }
+    }
+    async detectDynamoTriggerModels(func) {
+        var _a;
+        const templatePath = `function/${func.resourceName}/${func.resourceName}-cloudformation-template.json`;
+        const template = this.gen1App.json(templatePath);
+        const models = [];
+        for (const resource of Object.values((_a = template.Resources) !== null && _a !== void 0 ? _a : {})) {
+            const res = resource;
+            if (res.Type !== 'AWS::Lambda::EventSourceMapping')
+                continue;
+            const props = res.Properties;
+            const eventSourceArn = props === null || props === void 0 ? void 0 : props.EventSourceArn;
+            const fnImportValue = eventSourceArn === null || eventSourceArn === void 0 ? void 0 : eventSourceArn['Fn::ImportValue'];
+            const fnSub = fnImportValue === null || fnImportValue === void 0 ? void 0 : fnImportValue['Fn::Sub'];
+            if (!fnSub)
+                continue;
+            const match = fnSub.match(/:GetAtt:(\w+)Table:StreamArn/);
+            if (match) {
+                models.push(match[1]);
+            }
+        }
+        return models;
+    }
+    contributeDynamoTrigger(functionName, models) {
+        this.backendGenerator.addImport('aws-cdk-lib/aws-lambda-event-sources', ['DynamoEventSource']);
+        this.backendGenerator.addImport('aws-cdk-lib/aws-lambda', ['StartingPosition']);
+        const forStatement = factory.createForOfStatement(undefined, factory.createVariableDeclarationList([factory.createVariableDeclaration('model', undefined, undefined, undefined)], typescript_1.default.NodeFlags.Const), factory.createArrayLiteralExpression(models.map((model) => factory.createStringLiteral(model))), factory.createBlock([
+            factory.createVariableStatement([], factory.createVariableDeclarationList([
+                factory.createVariableDeclaration('table', undefined, undefined, factory.createElementAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend.data.resources'), factory.createIdentifier('tables')), factory.createIdentifier('model'))),
+            ], typescript_1.default.NodeFlags.Const)),
+            factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier(`backend.${functionName}.resources`), factory.createIdentifier('lambda')), factory.createIdentifier('addEventSource')), undefined, [
+                factory.createNewExpression(factory.createIdentifier('DynamoEventSource'), undefined, [
+                    factory.createIdentifier('table'),
+                    factory.createObjectLiteralExpression([
+                        factory.createPropertyAssignment('startingPosition', factory.createPropertyAccessExpression(factory.createIdentifier('StartingPosition'), factory.createIdentifier('LATEST'))),
+                    ]),
+                ]),
+            ])),
+            factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(factory.createIdentifier('table'), factory.createIdentifier('grantStreamRead')), undefined, [
+                factory.createNonNullExpression(factory.createPropertyAccessExpression(factory.createIdentifier(`backend.${functionName}.resources.lambda`), factory.createIdentifier('role'))),
+            ])),
+            factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(factory.createIdentifier('table'), factory.createIdentifier('grantTableListStreams')), undefined, [
+                factory.createNonNullExpression(factory.createPropertyAccessExpression(factory.createIdentifier(`backend.${functionName}.resources.lambda`), factory.createIdentifier('role'))),
+            ])),
+        ], true));
+        this.backendGenerator.addStatement(forStatement);
+    }
+}
+exports.FunctionGenerator = FunctionGenerator;
+function classifyEnvVars(variables) {
+    const retained = {};
+    const escapeHatches = [];
+    const suffixGroups = [
+        {
+            prefix: 'API_',
+            suffixes: [
+                { suffix: '_GRAPHQLAPIKEYOUTPUT', build: () => nonNull(backendPath('data', 'apiKey')) },
+                { suffix: '_GRAPHQLAPIENDPOINTOUTPUT', build: () => backendPath('data', 'graphqlUrl') },
+                { suffix: '_GRAPHQLAPIIDOUTPUT', build: () => backendPath('data', 'apiId') },
+                {
+                    suffix: 'TABLE_ARN',
+                    build: (envVar) => { var _a; return backendTableProp((_a = extractTableName(envVar)) !== null && _a !== void 0 ? _a : 'unknown', 'tableArn'); },
+                },
+                {
+                    suffix: 'TABLE_NAME',
+                    build: (envVar) => { var _a; return backendTableProp((_a = extractTableName(envVar)) !== null && _a !== void 0 ? _a : 'unknown', 'tableName'); },
+                },
+            ],
+        },
+        {
+            prefix: 'STORAGE_',
+            suffixes: [
+                { suffix: '_STREAMARN', build: (envVar) => nonNull(directProp(extractStorageVarName(envVar), 'tableStreamArn')) },
+                { suffix: '_BUCKETNAME', build: () => backendPath('storage', 'resources', 'bucket', 'bucketName') },
+                { suffix: '_ARN', build: (envVar) => directProp(extractStorageVarName(envVar), 'tableArn') },
+                { suffix: '_NAME', build: (envVar) => directProp(extractStorageVarName(envVar), 'tableName') },
+            ],
+        },
+        {
+            prefix: 'AUTH_',
+            suffixes: [{ suffix: '_USERPOOLID', build: () => backendPath('auth', 'resources', 'userPool', 'userPoolId') }],
+        },
+        {
+            prefix: 'FUNCTION_',
+            suffixes: [
+                {
+                    suffix: '_NAME',
+                    build: (envVar) => {
+                        const match = envVar.match(/FUNCTION_(.+?)_NAME/);
+                        const funcName = match ? match[1].toLowerCase() : 'unknown';
+                        return backendPath(funcName, 'resources', 'lambda', 'functionName');
+                    },
+                },
+            ],
+        },
+        {
+            prefix: 'ANALYTICS_',
+            suffixes: [
+                {
+                    suffix: '_KINESISSTREAMARN',
+                    build: () => directProp('analytics', 'kinesisStreamArn'),
+                },
+            ],
+        },
+    ];
+    const classified = new Set();
+    for (const { prefix, suffixes } of suffixGroups) {
+        for (const { suffix, build } of suffixes) {
+            for (const envVar of Object.keys(variables)) {
+                if (envVar.startsWith(prefix) && envVar.endsWith(suffix) && !classified.has(envVar)) {
+                    escapeHatches.push({ name: envVar, expression: build(envVar) });
+                    classified.add(envVar);
+                }
+            }
+        }
+    }
+    for (const [key, value] of Object.entries(variables)) {
+        if (!classified.has(key)) {
+            retained[key] = value;
+        }
+    }
+    return { retained, escapeHatches };
+}
+function createAddEnvironmentCall(functionName, hatch) {
+    return factory.createExpressionStatement(factory.createCallExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier(functionName)), factory.createIdentifier('addEnvironment')), undefined, [factory.createStringLiteral(hatch.name), hatch.expression]));
+}
+function backendPath(...segments) {
+    return ts_1.TS.propAccess('backend', ...segments);
+}
+function backendTableProp(tableName, property) {
+    const tables = factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier('data')), factory.createIdentifier('resources')), factory.createIdentifier('tables'));
+    const indexed = factory.createElementAccessExpression(tables, factory.createStringLiteral(tableName));
+    return factory.createPropertyAccessExpression(indexed, factory.createIdentifier(property));
+}
+function directProp(varName, property) {
+    return ts_1.TS.propAccess(varName, property);
+}
+function nonNull(expr) {
+    return factory.createNonNullExpression(expr);
+}
+function extractTableName(envVar) {
+    const match = envVar.match(/API_.*_(.+?)TABLE_/);
+    if (!match)
+        return undefined;
+    const raw = match[1];
+    return raw.charAt(0).toUpperCase() + raw.slice(1).toLowerCase();
+}
+function extractStorageVarName(envVar) {
+    const tableMatch = envVar.match(/STORAGE_(.+?)TABLE_/);
+    if (tableMatch)
+        return tableMatch[1].toLowerCase();
+    const fallbackMatch = envVar.match(/STORAGE_(.+?)_/);
+    if (fallbackMatch)
+        return fallbackMatch[1].toLowerCase();
+    return 'unknown';
+}
+function createFunctionNameOverride(funcName) {
+    const lhs = factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createPropertyAccessExpression(factory.createIdentifier('backend'), factory.createIdentifier(funcName)), factory.createIdentifier('resources')), factory.createIdentifier('cfnResources')), factory.createIdentifier('cfnFunction')), factory.createIdentifier('functionName'));
+    const rhs = factory.createTemplateExpression(factory.createTemplateHead(`${funcName}-`), [
+        factory.createTemplateSpan(factory.createIdentifier('branchName'), factory.createTemplateTail('')),
+    ]);
+    return factory.createExpressionStatement(factory.createAssignment(lhs, rhs));
+}
+const GROUPED_AUTH_PERMISSIONS = {
+    manageUsers: [
+        'cognito-idp:AdminConfirmSignUp',
+        'cognito-idp:AdminCreateUser',
+        'cognito-idp:AdminDeleteUser',
+        'cognito-idp:AdminDeleteUserAttributes',
+        'cognito-idp:AdminDisableUser',
+        'cognito-idp:AdminEnableUser',
+        'cognito-idp:AdminGetUser',
+        'cognito-idp:AdminListGroupsForUser',
+        'cognito-idp:AdminRespondToAuthChallenge',
+        'cognito-idp:AdminSetUserMFAPreference',
+        'cognito-idp:AdminSetUserSettings',
+        'cognito-idp:AdminUpdateUserAttributes',
+        'cognito-idp:AdminUserGlobalSignOut',
+    ],
+    manageGroupMembership: ['cognito-idp:AdminAddUserToGroup', 'cognito-idp:AdminRemoveUserFromGroup'],
+    manageGroups: [
+        'cognito-idp:GetGroup',
+        'cognito-idp:ListGroups',
+        'cognito-idp:CreateGroup',
+        'cognito-idp:DeleteGroup',
+        'cognito-idp:UpdateGroup',
+    ],
+    manageUserDevices: [
+        'cognito-idp:AdminForgetDevice',
+        'cognito-idp:AdminGetDevice',
+        'cognito-idp:AdminListDevices',
+        'cognito-idp:AdminUpdateDeviceStatus',
+    ],
+    managePasswordRecovery: ['cognito-idp:AdminResetUserPassword', 'cognito-idp:AdminSetUserPassword'],
+};
+const AUTH_ACTION_MAPPING = {
+    'cognito-idp:AdminAddUserToGroup': 'addUserToGroup',
+    'cognito-idp:AdminCreateUser': 'createUser',
+    'cognito-idp:AdminDeleteUser': 'deleteUser',
+    'cognito-idp:AdminDeleteUserAttributes': 'deleteUserAttributes',
+    'cognito-idp:AdminDisableUser': 'disableUser',
+    'cognito-idp:AdminEnableUser': 'enableUser',
+    'cognito-idp:AdminForgetDevice': 'forgetDevice',
+    'cognito-idp:AdminGetDevice': 'getDevice',
+    'cognito-idp:AdminGetUser': 'getUser',
+    'cognito-idp:AdminListDevices': 'listDevices',
+    'cognito-idp:AdminListGroupsForUser': 'listGroupsForUser',
+    'cognito-idp:AdminRemoveUserFromGroup': 'removeUserFromGroup',
+    'cognito-idp:AdminResetUserPassword': 'resetUserPassword',
+    'cognito-idp:AdminSetUserMFAPreference': 'setUserMfaPreference',
+    'cognito-idp:AdminSetUserPassword': 'setUserPassword',
+    'cognito-idp:AdminSetUserSettings': 'setUserSettings',
+    'cognito-idp:AdminUpdateDeviceStatus': 'updateDeviceStatus',
+    'cognito-idp:AdminUpdateUserAttributes': 'updateUserAttributes',
+    'cognito-idp:ListUsers': 'listUsers',
+    'cognito-idp:ListUsersInGroup': 'listUsersInGroup',
+    'cognito-idp:ListGroups': 'listGroups',
+    'cognito-idp:AdminConfirmSignUp': 'manageUsers',
+    'cognito-idp:AdminRespondToAuthChallenge': 'manageUsers',
+    'cognito-idp:AdminUserGlobalSignOut': 'manageUsers',
+    'cognito-idp:AdminInitiateAuth': 'manageUsers',
+    'cognito-idp:AdminUpdateAuthEventFeedback': 'manageUsers',
+    'cognito-idp:ForgetDevice': 'forgetDevice',
+    'cognito-idp:VerifyUserAttribute': 'updateUserAttributes',
+    'cognito-idp:UpdateUserAttributes': 'updateUserAttributes',
+    'cognito-idp:SetUserMFAPreference': 'setUserMfaPreference',
+    'cognito-idp:SetUserSettings': 'setUserSettings',
+};
+function resolveAuthAccess(cognitoActions) {
+    if (cognitoActions.length === 0)
+        return {};
+    const result = {};
+    const covered = new Set();
+    for (const [group, required] of Object.entries(GROUPED_AUTH_PERMISSIONS)) {
+        if (required.every((a) => cognitoActions.includes(a))) {
+            result[group] = true;
+            for (const a of required)
+                covered.add(a);
+        }
+    }
+    for (const action of cognitoActions) {
+        if (!covered.has(action) && AUTH_ACTION_MAPPING[action]) {
+            result[AUTH_ACTION_MAPPING[action]] = true;
+        }
+    }
+    return result;
+}
+const TRIGGER_SUFFIX_TO_EVENT = {
+    PreSignup: 'preSignUp',
+    CustomMessage: 'customMessage',
+    UserMigration: 'userMigration',
+    PostConfirmation: 'postConfirmation',
+    PreAuthentication: 'preAuthentication',
+    PostAuthentication: 'postAuthentication',
+    PreTokenGeneration: 'preTokenGeneration',
+    DefineAuthChallenge: 'defineAuthChallenge',
+    CreateAuthChallenge: 'createAuthChallenge',
+    VerifyAuthChallengeResponse: 'verifyAuthChallengeResponse',
+};
+//# sourceMappingURL=function.generator.js.map