@aws/nx-plugin 1.0.0-rc.87 → 1.0.0-rc.88

package/src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase } from '../../../utils/names.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\n\n/**\n * Terraform projects gained three fixes:\n *\n * - A `checkov` target carries the security scan, matching the name CDK\n *   infrastructure projects already use, so `nx run-many --target checkov` no\n *   longer skips Terraform projects. An existing `test` target is the user's,\n *   so it is left exactly as it is.\n * - A `checkov.yml` gives Terraform users the same central place to configure\n *   skips that the CDK app has, wired in via `--config-file`.\n * - `bootstrap-destroy` runs a script that resolves the region from the AWS SDK\n *   credential chain and passes it as `-var=aws_region`. The vended\n *   `aws_region` variable has no default, so the previous bare\n *   `terraform destroy` blocked forever on an input prompt in any non-TTY\n *   context.\n * - Both vended `providers.tf` declare `required_version = \">= 1.0\"`, matching\n *   every other `.tf` file the plugin vends, and the bootstrap one pins the AWS\n *   provider.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** The scan command, as the pre-fix generator vended it on `test`. */\nconst CHECKOV_COMMAND_PATTERN = /uvx --from checkov==/;\n\nconst divergedTargetsStep = (projectName: string) =>\n  `${projectName}: no 'test' target carrying the checkov scan was found, so no 'checkov' target was added - add one running checkov over the project so 'nx run-many --target checkov' includes this project.`;\n\nconst divergedProvidersStep = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. Add \\`required_version = \">= 1.0\"\\` to its \\`terraform\\` block to pin the minimum Terraform version.`;\n\nconst divergedBootstrapDestroyStep = (projectName: string) =>\n  `${projectName}: its 'bootstrap-destroy' target no longer matches the shape the generator produced - left untouched. Pass \\`-var=aws_region=<region>\\` to \\`terraform destroy\\`, otherwise it blocks on an input prompt when run without a TTY.`;\n\n/**\n * Add `required_version` to a `providers.tf` that omits it.\n *\n * The bootstrap copy has no `terraform` block at all, so it is created;\n * the src copy has one holding `required_providers`, so it is added to.\n */\nconst migrateRequiredVersion = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(filePath)) return;\n\n  // Already declared - nothing to do, whatever constraint the user chose.\n  if (await matchGritQL(tree, filePath, hcl('`required_version = $_`'))) {\n    return;\n  }\n\n  const hasRequiredProviders = await matchGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`terraform { $body }` where { $body <: contains `required_providers` }',\n    ),\n  );\n\n  if (hasRequiredProviders) {\n    await applyGritQL(\n      tree,\n      filePath,\n      hcl(\n        '`terraform { $body }` => `terraform {\\n  required_version = \">= 1.0\"\\n\\n  $body\\n}`',\n      ),\n    );\n    return;\n  }\n\n  // No `terraform` block: prepend one ahead of the aws provider block.\n  const providerBlock = hcl('`provider \"aws\" { $body }`');\n  if (!(await matchGritQL(tree, filePath, providerBlock))) {\n    nextSteps.push(divergedProvidersStep(filePath));\n    return;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`provider \"aws\" { $body }` => `terraform {\\n  required_version = \">= 1.0\"\\n}\\n\\nprovider \"aws\" {\\n  $body\\n}`',\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;\n\n    const targets = project.targets ?? {};\n    let changed = false;\n\n    // Add `checkov`, copying the scan from the `test` target the pre-fix\n    // generator put it on. `test` itself belongs to the user and is left as it\n    // is. Guarded on `checkov` being absent so a re-run is a no-op.\n    if (!targets.checkov) {\n      const command = targets.test?.options?.command;\n\n      if (\n        typeof command !== 'string' ||\n        !CHECKOV_COMMAND_PATTERN.test(command)\n      ) {\n        nextSteps.push(divergedTargetsStep(projectName));\n      } else {\n        // The config file is vended below, so wire it in at the same time.\n        const withConfigFile = command.includes('--config-file')\n          ? command\n          : command.replace(\n              'checkov --directory',\n              'checkov --config-file ../checkov.yml --directory',\n            );\n\n        targets.checkov = normalizeTargetKeyOrder({\n          ...targets.test,\n          options: { ...targets.test.options, command: withConfigFile },\n        });\n        changed = true;\n      }\n    }\n\n    // Point `bootstrap-destroy` at the vended script, which resolves the\n    // region rather than leaving terraform to prompt for it.\n    const bootstrapDestroy = targets['bootstrap-destroy'];\n    if (bootstrapDestroy) {\n      const scriptCommand = `tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}`;\n      const alreadyMigrated =\n        bootstrapDestroy.options?.commands?.[0] === scriptCommand;\n\n      if (!alreadyMigrated) {\n        const command = bootstrapDestroy.options?.command;\n        // Only rewrite the exact shape the generator produced.\n        const isVendedShape =\n          typeof command === 'string' &&\n          /^terraform destroy -state=\\S+bootstrap\\.tfstate$/.test(\n            command.trim(),\n          );\n\n        if (!isVendedShape) {\n          nextSteps.push(divergedBootstrapDestroyStep(projectName));\n        } else {\n          targets['bootstrap-destroy'] = normalizeTargetKeyOrder({\n            executor: bootstrapDestroy.executor,\n            options: {\n              forwardAllArgs: true,\n              commands: [scriptCommand],\n              cwd: '{workspaceRoot}',\n            },\n          });\n          changed = true;\n        }\n      }\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys(targets),\n      });\n    }\n\n    // Vend the checkov config and the bootstrap-destroy script. KeepExisting\n    // leaves a user's own copy alone and makes a re-run a no-op.\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        '../../../terraform/project/files/checkov',\n      ),\n      project.root,\n      {},\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n\n    // Only application projects have a bootstrap dir to destroy. The scripts\n    // dir is shared with the generator's templates, so `stateKeyPrefix` is\n    // resolved the same way it computes it; KeepExisting leaves the scripts\n    // that already exist untouched regardless.\n    if (tree.exists(joinPathFragments(project.root, 'bootstrap'))) {\n      generateFiles(\n        tree,\n        joinPathFragments(\n          import.meta.dirname,\n          '../../../terraform/project/files/application/scripts',\n        ),\n        joinPathFragments(project.root, 'scripts'),\n        { stateKeyPrefix: kebabCase(projectName) },\n        { overwriteStrategy: OverwriteStrategy.KeepExisting },\n      );\n    }\n\n    await migrateRequiredVersion(\n      tree,\n      joinPathFragments(project.root, 'src/providers.tf'),\n      nextSteps,\n    );\n    await migrateRequiredVersion(\n      tree,\n      joinPathFragments(project.root, 'bootstrap/providers.tf'),\n      nextSteps,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["generateFiles","getProjects","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","TERRAFORM_PROJECT_GENERATOR_INFO","applyGritQL","matchGritQL","formatFilesInSubtree","kebabCase","normalizeTargetKeyOrder","sortObjectKeys","hcl","pattern","CHECKOV_COMMAND_PATTERN","divergedTargetsStep","projectName","divergedProvidersStep","filePath","divergedBootstrapDestroyStep","migrateRequiredVersion","tree","nextSteps","exists","hasRequiredProviders","providerBlock","push","migration","project","generator","metadata","id","targets","changed","checkov","command","test","options","withConfigFile","includes","replace","bootstrapDestroy","scriptCommand","alreadyMigrated","commands","isVendedShape","trim","executor","forwardAllArgs","cwd","dirname","root","overwriteStrategy","KeepExisting","stateKeyPrefix"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,WAAW,EACXC,iBAAiB,EAEjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,QAAQ,0BAA0B;AACpD,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAE1D;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,oEAAoE,GACpE,MAAMC,0BAA0B;AAEhC,MAAMC,sBAAsB,CAACC,cAC3B,GAAGA,YAAY,4LAA4L,CAAC;AAE9M,MAAMC,wBAAwB,CAACC,WAC7B,GAAGA,SAAS,8JAA8J,CAAC;AAE7K,MAAMC,+BAA+B,CAACH,cACpC,GAAGA,YAAY,gOAAgO,CAAC;AAElP;;;;;CAKC,GACD,MAAMI,yBAAyB,OAC7BC,MACAH,UACAI;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACL,WAAW;IAE5B,wEAAwE;IACxE,IAAI,MAAMX,YAAYc,MAAMH,UAAUN,IAAI,6BAA6B;QACrE;IACF;IAEA,MAAMY,uBAAuB,MAAMjB,YACjCc,MACAH,UACAN,IACE;IAIJ,IAAIY,sBAAsB;QACxB,MAAMlB,YACJe,MACAH,UACAN,IACE;QAGJ;IACF;IAEA,qEAAqE;IACrE,MAAMa,gBAAgBb,IAAI;IAC1B,IAAI,CAAE,MAAML,YAAYc,MAAMH,UAAUO,gBAAiB;QACvDH,UAAUI,IAAI,CAACT,sBAAsBC;QACrC;IACF;IAEA,MAAMZ,YACJe,MACAH,UACAN,IACE;AAGN;AAEA,eAAe,eAAee,UAC5BN,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACN,aAAaY,QAAQ,IAAI3B,YAAYoB,MAAO;QACtD,MAAMQ,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcxB,iCAAiC0B,EAAE,EAAE;QAEvD,MAAMC,UAAUJ,QAAQI,OAAO,IAAI,CAAC;QACpC,IAAIC,UAAU;QAEd,qEAAqE;QACrE,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,CAACD,QAAQE,OAAO,EAAE;YACpB,MAAMC,UAAUH,QAAQI,IAAI,EAAEC,SAASF;YAEvC,IACE,OAAOA,YAAY,YACnB,CAACrB,wBAAwBsB,IAAI,CAACD,UAC9B;gBACAb,UAAUI,IAAI,CAACX,oBAAoBC;YACrC,OAAO;gBACL,mEAAmE;gBACnE,MAAMsB,iBAAiBH,QAAQI,QAAQ,CAAC,mBACpCJ,UACAA,QAAQK,OAAO,CACb,uBACA;gBAGNR,QAAQE,OAAO,GAAGxB,wBAAwB;oBACxC,GAAGsB,QAAQI,IAAI;oBACfC,SAAS;wBAAE,GAAGL,QAAQI,IAAI,CAACC,OAAO;wBAAEF,SAASG;oBAAe;gBAC9D;gBACAL,UAAU;YACZ;QACF;QAEA,qEAAqE;QACrE,yDAAyD;QACzD,MAAMQ,mBAAmBT,OAAO,CAAC,oBAAoB;QACrD,IAAIS,kBAAkB;YACpB,MAAMC,gBAAgB,CAAC,4DAA4D,CAAC;YACpF,MAAMC,kBACJF,iBAAiBJ,OAAO,EAAEO,UAAU,CAAC,EAAE,KAAKF;YAE9C,IAAI,CAACC,iBAAiB;gBACpB,MAAMR,UAAUM,iBAAiBJ,OAAO,EAAEF;gBAC1C,uDAAuD;gBACvD,MAAMU,gBACJ,OAAOV,YAAY,YACnB,mDAAmDC,IAAI,CACrDD,QAAQW,IAAI;gBAGhB,IAAI,CAACD,eAAe;oBAClBvB,UAAUI,IAAI,CAACP,6BAA6BH;gBAC9C,OAAO;oBACLgB,OAAO,CAAC,oBAAoB,GAAGtB,wBAAwB;wBACrDqC,UAAUN,iBAAiBM,QAAQ;wBACnCV,SAAS;4BACPW,gBAAgB;4BAChBJ,UAAU;gCAACF;6BAAc;4BACzBO,KAAK;wBACP;oBACF;oBACAhB,UAAU;gBACZ;YACF;QACF;QAEA,IAAIA,SAAS;YACX7B,2BAA2BiB,MAAML,aAAa;gBAC5C,GAAGY,OAAO;gBACVI,SAASrB,eAAeqB;YAC1B;QACF;QAEA,yEAAyE;QACzE,6DAA6D;QAC7DhC,cACEqB,MACAnB,kBACE,YAAYgD,OAAO,EACnB,6CAEFtB,QAAQuB,IAAI,EACZ,CAAC,GACD;YAAEC,mBAAmBjD,kBAAkBkD,YAAY;QAAC;QAGtD,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,2CAA2C;QAC3C,IAAIhC,KAAKE,MAAM,CAACrB,kBAAkB0B,QAAQuB,IAAI,EAAE,eAAe;YAC7DnD,cACEqB,MACAnB,kBACE,YAAYgD,OAAO,EACnB,yDAEFhD,kBAAkB0B,QAAQuB,IAAI,EAAE,YAChC;gBAAEG,gBAAgB7C,UAAUO;YAAa,GACzC;gBAAEoC,mBAAmBjD,kBAAkBkD,YAAY;YAAC;QAExD;QAEA,MAAMjC,uBACJC,MACAnB,kBAAkB0B,QAAQuB,IAAI,EAAE,qBAChC7B;QAEF,MAAMF,uBACJC,MACAnB,kBAAkB0B,QAAQuB,IAAI,EAAE,2BAChC7B;IAEJ;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/user-identity-configurable-mfa/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/user-identity-configurable-mfa/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Surface mfa and mfaSecondFactor on the vended UserIdentity construct/module\n *\n * CDK's `mfa` / `mfaSecondFactor` props default to what the construct already\n * hard-coded (`Mfa.REQUIRED` / `{ sms: true, otp: true }`), so this just makes\n * them overridable, matching the existing `enableWaf` prop pattern.\n *\n * Terraform has no equivalent of CloudFormation's `EnabledMfas` - SMS MFA is\n * inseparable from the `sms_configuration` block, which phone number\n * verification also relies on. So `mfa_second_factor_sms` gates\n * `sms_configuration` (and, with it, SMS phone verification) rather than only\n * MFA, unlike the CDK prop.\n *\n * CDK has the same underlying coupling for any non-OFF `mfa`: Cognito rejects\n * `SmsConfiguration` (which CDK emits whenever phone is auto-verified) unless\n * SMS is also an enabled MFA method. So `phoneVerificationEnabled` gates\n * `autoVerify`/`keepOriginal`'s `phone` flag on whether SMS is actually usable\n * as a second factor, and a `mfa: REQUIRED` with neither `sms` nor `otp`\n * enabled - a pool nobody could ever sign into - is rejected at synth time.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CDK_USER_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core/user-identity.ts`;\nconst TERRAFORM_IDENTITY_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/identity/identity.tf`;\nconst TERRAFORM_MAIN_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/user-identity/main.tf`;\n\nconst NEW_TERRAFORM_VARIABLES = `variable \"mfa\" {\n  description = \"Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all\"\n  type        = string\n  default     = \"ON\"\n\n  validation {\n    condition     = contains([\"OFF\", \"OPTIONAL\", \"ON\"], var.mfa)\n    error_message = \"mfa must be one of OFF, OPTIONAL, ON\"\n  }\n}\n\nvariable \"mfa_second_factor_otp\" {\n  description = \"Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method\"\n  type        = bool\n  default     = true\n}\n\nvariable \"mfa_second_factor_sms\" {\n  description = \"Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop\"\n  type        = bool\n  default     = true\n}`;\n\n// Guards each file: present only once it has been migrated.\nconst CDK_MIGRATED_PATTERN = '`mfa === Mfa.OFF || mfaSecondFactor.sms`';\nconst TERRAFORM_IDENTITY_MIGRATED_PATTERN =\n  'language hcl\\n`mfa_configuration = var.mfa`';\nconst TERRAFORM_MAIN_MIGRATED_PATTERN = 'language hcl\\n`mfa = var.mfa`';\n\n// Interface members don't parse as standalone snippets, so this anchors on the\n// whole interface body (preserved via $body) rather than the enableWaf member.\nconst CDK_INTERFACE_BODY_PATTERN =\n  '`export interface UserIdentityProps { $body }`';\n// A parameter's type annotation blocks matching the destructure sub-pattern in\n// isolation, so this anchors on the full constructor signature instead\n// (literal params so a customised signature is correctly seen as diverged).\nconst CDK_CONSTRUCTOR_PATTERN =\n  '`constructor(scope: Construct, id: string, { enableWaf = true }: UserIdentityProps = {}) { $body }`';\nconst CDK_CREATE_CALL_PATTERN = '`this.createUserPool()`';\nconst CDK_CREATE_SIGNATURE_PATTERN = '`private createUserPool = () => $body`';\n// Trailing commas block matching a bare object property in isolation; the\n// separator is outside the matched span either way, so it survives untouched.\nconst CDK_MFA_FIELD_PATTERN = '`mfa: Mfa.REQUIRED`';\nconst CDK_MFA_SECOND_FACTOR_FIELD_PATTERN =\n  '`mfaSecondFactor: { sms: true, otp: true }`';\nconst CDK_SUPER_CALL_PATTERN = '`super(scope, id);`';\n// $props preserves the whole (large) UserPool props object untouched while\n// inserting the new const declaration immediately before it.\nconst CDK_NEW_USER_POOL_PATTERN =\n  \"`const userPool = new UserPool(this, 'UserPool', { $props })`\";\n// Matches both the autoVerify.phone and keepOriginal.phone occurrences in one pass.\nconst CDK_PHONE_TRUE_PATTERN = '`phone: true`';\n\nconst CDK_EDITS: Array<[string, string]> = [\n  [\n    CDK_INTERFACE_BODY_PATTERN,\n    `${CDK_INTERFACE_BODY_PATTERN} => \\`export interface UserIdentityProps {\n  $body\n\n  /**\n   * Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all.\n   *\n   * @default Mfa.REQUIRED\n   */\n  readonly mfa?: Mfa;\n\n  /**\n   * The MFA methods available to users when MFA is not off.\n   *\n   * @default { sms: true, otp: true }\n   */\n  readonly mfaSecondFactor?: MfaSecondFactor;\n}\\``,\n  ],\n  [\n    CDK_CONSTRUCTOR_PATTERN,\n    `${CDK_CONSTRUCTOR_PATTERN} => \\`constructor(\n    scope: Construct,\n    id: string,\n    {\n      enableWaf = true,\n      mfa = Mfa.REQUIRED,\n      mfaSecondFactor = { sms: true, otp: true },\n    }: UserIdentityProps = {},\n  ) { $body }\\``,\n  ],\n  [\n    CDK_CREATE_CALL_PATTERN,\n    `${CDK_CREATE_CALL_PATTERN} => \\`this.createUserPool(mfa, mfaSecondFactor)\\``,\n  ],\n  [\n    CDK_CREATE_SIGNATURE_PATTERN,\n    `${CDK_CREATE_SIGNATURE_PATTERN} => \\`private createUserPool = (mfa: Mfa, mfaSecondFactor: MfaSecondFactor) => $body\\``,\n  ],\n  [CDK_MFA_FIELD_PATTERN, `${CDK_MFA_FIELD_PATTERN} => \\`mfa\\``],\n  [\n    CDK_MFA_SECOND_FACTOR_FIELD_PATTERN,\n    `${CDK_MFA_SECOND_FACTOR_FIELD_PATTERN} => \\`mfaSecondFactor\\``,\n  ],\n  [\n    CDK_SUPER_CALL_PATTERN,\n    `${CDK_SUPER_CALL_PATTERN} => \\`super(scope, id);\n\n    if (mfa === Mfa.REQUIRED && !mfaSecondFactor.sms && !mfaSecondFactor.otp) {\n      throw new Error(\n        'UserIdentity: mfa is REQUIRED but mfaSecondFactor has no methods enabled (sms and otp are both false)',\n      );\n    }\\``,\n  ],\n  [\n    CDK_NEW_USER_POOL_PATTERN,\n    `${CDK_NEW_USER_POOL_PATTERN} => \\`const phoneVerificationEnabled = mfa === Mfa.OFF || mfaSecondFactor.sms;\n\n    const userPool = new UserPool(this, 'UserPool', { $props })\\``,\n  ],\n  [\n    CDK_PHONE_TRUE_PATTERN,\n    `${CDK_PHONE_TRUE_PATTERN} => \\`phone: phoneVerificationEnabled\\``,\n  ],\n];\n\nconst TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR = [\n  'language hcl',\n  '`variable \"enable_waf\" {',\n  '  description = \"Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool\"',\n  '  type        = bool',\n  '  default     = true',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MFA_CONFIGURATION_PATTERN = [\n  'language hcl',\n  '`mfa_configuration = \"ON\"`',\n].join('\\n');\n\nconst TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN = [\n  'language hcl',\n  '`software_token_mfa_configuration {',\n  '    enabled = true',\n  '  }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_CONFIGURATION_PATTERN = [\n  'language hcl',\n  '`sms_configuration {',\n  '    external_id    = random_uuid.sms_external_id.result',\n  '    sns_caller_arn = aws_iam_role.cognito_sms_role.arn',\n  '    sns_region     = data.aws_region.current.region',\n  '  }`',\n].join('\\n');\n\nconst TERRAFORM_RANDOM_UUID_PATTERN = [\n  'language hcl',\n  '`resource \"random_uuid\" \"sms_external_id\" {}`',\n].join('\\n');\n\nconst TERRAFORM_SMS_ROLE_PATTERN = [\n  'language hcl',\n  '`resource \"aws_iam_role\" \"cognito_sms_role\" { $body }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_POLICY_PATTERN = [\n  'language hcl',\n  '`resource \"aws_iam_role_policy\" \"cognito_sms_policy\" { $body }`',\n].join('\\n');\n\nconst TERRAFORM_SMS_ROLE_ID_REF_PATTERN = [\n  'language hcl',\n  '`aws_iam_role.cognito_sms_role.id`',\n].join('\\n');\n\nconst TERRAFORM_EXTERNAL_ID_REF_PATTERN = [\n  'language hcl',\n  '`random_uuid.sms_external_id.result`',\n].join('\\n');\n\nconst TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN = [\n  'language hcl',\n  '`auto_verified_attributes = [\"email\", \"phone_number\"]`',\n].join('\\n');\n\nconst TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN = [\n  'language hcl',\n  '`attributes_require_verification_before_update = [\"email\", \"phone_number\"]`',\n].join('\\n');\n\nconst TERRAFORM_IDENTITY_EDITS: Array<[string, string]> = [\n  [\n    TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR,\n    `${TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR} => \\`variable \"enable_waf\" {\n  description = \"Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool\"\n  type        = bool\n  default     = true\n}\n\n${NEW_TERRAFORM_VARIABLES}\\``,\n  ],\n  [\n    TERRAFORM_RANDOM_UUID_PATTERN,\n    `${TERRAFORM_RANDOM_UUID_PATTERN} => \\`resource \"random_uuid\" \"sms_external_id\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n}\\``,\n  ],\n  [\n    TERRAFORM_SMS_ROLE_PATTERN,\n    `${TERRAFORM_SMS_ROLE_PATTERN} => \\`resource \"aws_iam_role\" \"cognito_sms_role\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n\n  $body\n}\\``,\n  ],\n  [\n    TERRAFORM_SMS_POLICY_PATTERN,\n    `${TERRAFORM_SMS_POLICY_PATTERN} => \\`resource \"aws_iam_role_policy\" \"cognito_sms_policy\" {\n  count = var.mfa_second_factor_sms ? 1 : 0\n\n  $body\n}\\``,\n  ],\n  [\n    TERRAFORM_MFA_CONFIGURATION_PATTERN,\n    `${TERRAFORM_MFA_CONFIGURATION_PATTERN} => \\`mfa_configuration = var.mfa\\``,\n  ],\n  [\n    TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN,\n    `${TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN} => \\`software_token_mfa_configuration {\n    enabled = var.mfa_second_factor_otp\n  }\\``,\n  ],\n  [\n    TERRAFORM_SMS_CONFIGURATION_PATTERN,\n    `${TERRAFORM_SMS_CONFIGURATION_PATTERN} => \\`# SMS MFA configuration. Due to a Terraform AWS provider limitation, this also gates\n  # SMS-based phone number verification below - see the mfa_second_factor_sms variable.\n  dynamic \"sms_configuration\" {\n    for_each = var.mfa_second_factor_sms ? [1] : []\n\n    content {\n      external_id    = random_uuid.sms_external_id[0].result\n      sns_caller_arn = aws_iam_role.cognito_sms_role[0].arn\n      sns_region     = data.aws_region.current.region\n    }\n  }\\``,\n  ],\n  [\n    TERRAFORM_SMS_ROLE_ID_REF_PATTERN,\n    `${TERRAFORM_SMS_ROLE_ID_REF_PATTERN} => \\`aws_iam_role.cognito_sms_role[0].id\\``,\n  ],\n  [\n    TERRAFORM_EXTERNAL_ID_REF_PATTERN,\n    `${TERRAFORM_EXTERNAL_ID_REF_PATTERN} => \\`random_uuid.sms_external_id[0].result\\``,\n  ],\n  [\n    TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN,\n    `${TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN} => \\`auto_verified_attributes = var.mfa_second_factor_sms ? [\"email\", \"phone_number\"] : [\"email\"]\\``,\n  ],\n  [\n    TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN,\n    `${TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN} => \\`attributes_require_verification_before_update = var.mfa_second_factor_sms ? [\"email\", \"phone_number\"] : [\"email\"]\\``,\n  ],\n];\n\nconst TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR = [\n  'language hcl',\n  '`variable \"enable_waf\" {',\n  '  description = \"Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool\"',\n  '  type        = bool',\n  '  default     = true',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MAIN_MODULE_PATTERN = [\n  'language hcl',\n  '`module \"identity\" {',\n  '  source = \"./identity\"',\n  '',\n  '  user_pool_domain_prefix = $prefix',\n  '  allow_signup = $allowSignup',\n  '  enable_waf = var.enable_waf',\n  '}`',\n].join('\\n');\n\nconst TERRAFORM_MAIN_EDITS: Array<[string, string]> = [\n  [\n    TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR,\n    `${TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR} => \\`variable \"enable_waf\" {\n  description = \"Whether to enable AWS WAFv2 with the default managed ruleset and associate it with the user pool\"\n  type        = bool\n  default     = true\n}\n\n${NEW_TERRAFORM_VARIABLES}\\``,\n  ],\n  [\n    TERRAFORM_MAIN_MODULE_PATTERN,\n    `${TERRAFORM_MAIN_MODULE_PATTERN} => \\`module \"identity\" {\n  source = \"./identity\"\n\n  user_pool_domain_prefix = $prefix\n  allow_signup = $allowSignup\n  enable_waf = var.enable_waf\n  mfa = var.mfa\n  mfa_second_factor_otp = var.mfa_second_factor_otp\n  mfa_second_factor_sms = var.mfa_second_factor_sms\n}\\``,\n  ],\n];\n\nconst divergedNextStep = (filePath: string) =>\n  `${filePath}: the UserIdentity construct/module has diverged from the generated shape - left untouched. To make MFA configurable, add mfa and mfaSecondFactor (CDK) / mfa, mfa_second_factor_otp and mfa_second_factor_sms (Terraform) yourself, following the same pattern as the existing enableWaf prop/variable.`;\n\nconst applyEdits = async (\n  tree: Tree,\n  filePath: string,\n  migratedPattern: string,\n  edits: Array<[string, string]>,\n  nextSteps: string[],\n  beforeApply?: () => Promise<void>,\n) => {\n  if (!tree.exists(filePath)) {\n    // This workspace doesn't use this IaC provider, or has no UserIdentity.\n    return;\n  }\n\n  if (await matchGritQL(tree, filePath, migratedPattern)) {\n    // Already migrated - silent skip keeps re-runs a no-op.\n    return;\n  }\n\n  // Confirm every edit site is present before writing any of them, so a file\n  // that only partly matches is left whole rather than half-edited.\n  const allSitesPresent = (\n    await Promise.all(\n      edits.map(([match]) => matchGritQL(tree, filePath, match)),\n    )\n  ).every(Boolean);\n\n  if (!allSitesPresent) {\n    nextSteps.push(divergedNextStep(filePath));\n    return;\n  }\n\n  await beforeApply?.();\n\n  for (const [, rewrite] of edits) {\n    await applyGritQL(tree, filePath, rewrite);\n  }\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  await applyEdits(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    CDK_MIGRATED_PATTERN,\n    CDK_EDITS,\n    nextSteps,\n    () =>\n      addDestructuredImport(\n        tree,\n        CDK_USER_IDENTITY_FILE,\n        ['type MfaSecondFactor'],\n        'aws-cdk-lib/aws-cognito',\n      ),\n  );\n\n  await applyEdits(\n    tree,\n    TERRAFORM_IDENTITY_FILE,\n    TERRAFORM_IDENTITY_MIGRATED_PATTERN,\n    TERRAFORM_IDENTITY_EDITS,\n    nextSteps,\n  );\n\n  await applyEdits(\n    tree,\n    TERRAFORM_MAIN_FILE,\n    TERRAFORM_MAIN_MIGRATED_PATTERN,\n    TERRAFORM_MAIN_EDITS,\n    nextSteps,\n  );\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["addDestructuredImport","applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_USER_IDENTITY_FILE","TERRAFORM_IDENTITY_FILE","TERRAFORM_MAIN_FILE","NEW_TERRAFORM_VARIABLES","CDK_MIGRATED_PATTERN","TERRAFORM_IDENTITY_MIGRATED_PATTERN","TERRAFORM_MAIN_MIGRATED_PATTERN","CDK_INTERFACE_BODY_PATTERN","CDK_CONSTRUCTOR_PATTERN","CDK_CREATE_CALL_PATTERN","CDK_CREATE_SIGNATURE_PATTERN","CDK_MFA_FIELD_PATTERN","CDK_MFA_SECOND_FACTOR_FIELD_PATTERN","CDK_SUPER_CALL_PATTERN","CDK_NEW_USER_POOL_PATTERN","CDK_PHONE_TRUE_PATTERN","CDK_EDITS","TERRAFORM_IDENTITY_ENABLE_WAF_VARIABLE_ANCHOR","join","TERRAFORM_MFA_CONFIGURATION_PATTERN","TERRAFORM_SOFTWARE_TOKEN_MFA_PATTERN","TERRAFORM_SMS_CONFIGURATION_PATTERN","TERRAFORM_RANDOM_UUID_PATTERN","TERRAFORM_SMS_ROLE_PATTERN","TERRAFORM_SMS_POLICY_PATTERN","TERRAFORM_SMS_ROLE_ID_REF_PATTERN","TERRAFORM_EXTERNAL_ID_REF_PATTERN","TERRAFORM_AUTO_VERIFIED_ATTRIBUTES_PATTERN","TERRAFORM_ATTRIBUTES_REQUIRE_VERIFICATION_PATTERN","TERRAFORM_IDENTITY_EDITS","TERRAFORM_MAIN_ENABLE_WAF_VARIABLE_ANCHOR","TERRAFORM_MAIN_MODULE_PATTERN","TERRAFORM_MAIN_EDITS","divergedNextStep","filePath","applyEdits","tree","migratedPattern","edits","nextSteps","beforeApply","exists","allSitesPresent","Promise","all","map","match","every","Boolean","push","rewrite","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,qBAAqB,EACrBC,WAAW,EACXC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GAED,MAAMC,yBAAyB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,0BAA0B,CAAC;AACnG,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,4CAA4C,CAAC;AACrH,MAAMG,sBAAsB,GAAGL,aAAa,CAAC,EAAEE,qBAAqB,+BAA+B,CAAC;AAEpG,MAAMI,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;CAqBhC,CAAC;AAEF,4DAA4D;AAC5D,MAAMC,uBAAuB;AAC7B,MAAMC,sCACJ;AACF,MAAMC,kCAAkC;AAExC,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAMC,6BACJ;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,4EAA4E;AAC5E,MAAMC,0BACJ;AACF,MAAMC,0BAA0B;AAChC,MAAMC,+BAA+B;AACrC,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAMC,wBAAwB;AAC9B,MAAMC,sCACJ;AACF,MAAMC,yBAAyB;AAC/B,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAMC,4BACJ;AACF,oFAAoF;AACpF,MAAMC,yBAAyB;AAE/B,MAAMC,YAAqC;IACzC;QACET;QACA,GAAGA,2BAA2B;;;;;;;;;;;;;;;;GAgB/B,CAAC;KACD;IACD;QACEC;QACA,GAAGA,wBAAwB;;;;;;;;eAQhB,CAAC;KACb;IACD;QACEC;QACA,GAAGA,wBAAwB,iDAAiD,CAAC;KAC9E;IACD;QACEC;QACA,GAAGA,6BAA6B,sFAAsF,CAAC;KACxH;IACD;QAACC;QAAuB,GAAGA,sBAAsB,WAAW,CAAC;KAAC;IAC9D;QACEC;QACA,GAAGA,oCAAoC,uBAAuB,CAAC;KAChE;IACD;QACEC;QACA,GAAGA,uBAAuB;;;;;;OAMvB,CAAC;KACL;IACD;QACEC;QACA,GAAGA,0BAA0B;;iEAEgC,CAAC;KAC/D;IACD;QACEC;QACA,GAAGA,uBAAuB,uCAAuC,CAAC;KACnE;CACF;AAED,MAAME,gDAAgD;IACpD;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,sCAAsC;IAC1C;IACA;CACD,CAACD,IAAI,CAAC;AAEP,MAAME,uCAAuC;IAC3C;IACA;IACA;IACA;CACD,CAACF,IAAI,CAAC;AAEP,MAAMG,sCAAsC;IAC1C;IACA;IACA;IACA;IACA;IACA;CACD,CAACH,IAAI,CAAC;AAEP,MAAMI,gCAAgC;IACpC;IACA;CACD,CAACJ,IAAI,CAAC;AAEP,MAAMK,6BAA6B;IACjC;IACA;CACD,CAACL,IAAI,CAAC;AAEP,MAAMM,+BAA+B;IACnC;IACA;CACD,CAACN,IAAI,CAAC;AAEP,MAAMO,oCAAoC;IACxC;IACA;CACD,CAACP,IAAI,CAAC;AAEP,MAAMQ,oCAAoC;IACxC;IACA;CACD,CAACR,IAAI,CAAC;AAEP,MAAMS,6CAA6C;IACjD;IACA;CACD,CAACT,IAAI,CAAC;AAEP,MAAMU,oDAAoD;IACxD;IACA;CACD,CAACV,IAAI,CAAC;AAEP,MAAMW,2BAAoD;IACxD;QACEZ;QACA,GAAGA,8CAA8C;;;;;;AAMrD,EAAEd,wBAAwB,EAAE,CAAC;KAC1B;IACD;QACEmB;QACA,GAAGA,8BAA8B;;GAElC,CAAC;KACD;IACD;QACEC;QACA,GAAGA,2BAA2B;;;;GAI/B,CAAC;KACD;IACD;QACEC;QACA,GAAGA,6BAA6B;;;;GAIjC,CAAC;KACD;IACD;QACEL;QACA,GAAGA,oCAAoC,mCAAmC,CAAC;KAC5E;IACD;QACEC;QACA,GAAGA,qCAAqC;;KAEvC,CAAC;KACH;IACD;QACEC;QACA,GAAGA,oCAAoC;;;;;;;;;;KAUtC,CAAC;KACH;IACD;QACEI;QACA,GAAGA,kCAAkC,2CAA2C,CAAC;KAClF;IACD;QACEC;QACA,GAAGA,kCAAkC,6CAA6C,CAAC;KACpF;IACD;QACEC;QACA,GAAGA,2CAA2C,oGAAoG,CAAC;KACpJ;IACD;QACEC;QACA,GAAGA,kDAAkD,yHAAyH,CAAC;KAChL;CACF;AAED,MAAME,4CAA4C;IAChD;IACA;IACA;IACA;IACA;IACA;CACD,CAACZ,IAAI,CAAC;AAEP,MAAMa,gCAAgC;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACb,IAAI,CAAC;AAEP,MAAMc,uBAAgD;IACpD;QACEF;QACA,GAAGA,0CAA0C;;;;;;AAMjD,EAAE3B,wBAAwB,EAAE,CAAC;KAC1B;IACD;QACE4B;QACA,GAAGA,8BAA8B;;;;;;;;;GASlC,CAAC;KACD;CACF;AAED,MAAME,mBAAmB,CAACC,WACxB,GAAGA,SAAS,wSAAwS,CAAC;AAEvT,MAAMC,aAAa,OACjBC,MACAF,UACAG,iBACAC,OACAC,WACAC;IAEA,IAAI,CAACJ,KAAKK,MAAM,CAACP,WAAW;QAC1B,wEAAwE;QACxE;IACF;IAEA,IAAI,MAAMvC,YAAYyC,MAAMF,UAAUG,kBAAkB;QACtD,wDAAwD;QACxD;IACF;IAEA,2EAA2E;IAC3E,kEAAkE;IAClE,MAAMK,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACfN,MAAMO,GAAG,CAAC,CAAC,CAACC,MAAM,GAAKnD,YAAYyC,MAAMF,UAAUY,QACrD,EACAC,KAAK,CAACC;IAER,IAAI,CAACN,iBAAiB;QACpBH,UAAUU,IAAI,CAAChB,iBAAiBC;QAChC;IACF;IAEA,MAAMM;IAEN,KAAK,MAAM,GAAGU,QAAQ,IAAIZ,MAAO;QAC/B,MAAM5C,YAAY0C,MAAMF,UAAUgB;IACpC;AACF;AAEA,eAAe,eAAeC,UAC5Bf,IAAU;IAEV,MAAMG,YAAsB,EAAE;IAE9B,MAAMJ,WACJC,MACApC,wBACAI,sBACAY,WACAuB,WACA,IACE9C,sBACE2C,MACApC,wBACA;YAAC;SAAuB,EACxB;IAIN,MAAMmC,WACJC,MACAnC,yBACAI,qCACAwB,0BACAU;IAGF,MAAMJ,WACJC,MACAlC,qBACAI,iCACA0B,sBACAO;IAGF,MAAM3C,qBAAqBwC;IAE3B,OAAO;QAAEG;IAAU;AACrB"}

package/src/migrations/latest/waf-log-group-cmk-encryption/migration.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/waf-log-group-cmk-encryption/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * WAF request logs carry full request metadata - URIs, headers and client IPs -\n * so the vended WAF log groups are encrypted with a customer-managed KMS key,\n * matching how the vended access log groups beside them already are. Three were\n * plaintext: the Terraform REST API and user-pool WAF log groups, the Terraform\n * AgentCore gateway WAF log group, and the CDK user-pool WAF log group. Each now\n * gets a key whose policy grants CloudWatch Logs use of it, scoped by\n * `kms:EncryptionContext:aws:logs:arn` to that log group alone.\n *\n * CloudWatch Logs cannot encrypt a log group that already exists in place, so\n * this only rewrites the vended templates. On the next deploy Terraform sets\n * `kms_key_id` on the existing group (an in-place update) and CloudFormation\n * replaces the CDK one, which the vended `RemovalPolicy.DESTROY` already allows.\n * Events written before then stay unencrypted; the `nextSteps` note says so.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\nconst TERRAFORM_SRC = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src`;\n\nconst CDK_USER_IDENTITY_FILE = `${CONSTRUCTS_SRC}/core/user-identity.ts`;\nconst TERRAFORM_REST_API_FILE = `${TERRAFORM_SRC}/core/api/rest-api/rest-api.tf`;\nconst TERRAFORM_USER_IDENTITY_FILE = `${TERRAFORM_SRC}/core/user-identity/identity/identity.tf`;\nconst TERRAFORM_GATEWAYS_DIR = `${TERRAFORM_SRC}/app/gateways`;\n\nconst divergedMessage = (file: string) =>\n  `${file}: the WAF log group has diverged from the generated shape - left untouched. Its request logs stay unencrypted. To encrypt them, add a customer-managed KMS key granting the \\`logs.<region>.amazonaws.com\\` service principal kms:Encrypt/Decrypt/ReEncrypt*/GenerateDataKey*/DescribeKey, conditioned on \\`kms:EncryptionContext:aws:logs:arn\\` matching the log group, and point the log group at it (see the vended WAF log group template).`;\n\nconst ALREADY_ENCRYPTED_TERRAFORM = 'aws_kms_key.';\n\n// Terraform (HCL) patterns are built from plain strings rather than JS template\n// literals, since the HCL text itself is full of `${...}` interpolations that\n// would otherwise be parsed as JS interpolation.\nconst hcl = (pattern: string) => 'language hcl\\n' + pattern;\n\n/** A vended Terraform WAF log group and the key this migration gives it. */\ninterface TerraformWafLogGroup {\n  /** The `aws_cloudwatch_log_group` resource label. */\n  readonly logGroupLabel: string;\n  /** The `aws_kms_key` / `aws_kms_alias` label to create. */\n  readonly keyLabel: string;\n  /** The `locals` entry the log group name moves into. */\n  readonly nameLocal: string;\n  /** The log group's name expression, which becomes the local's value. */\n  readonly nameExpression: string;\n  /** The KMS key description. */\n  readonly keyDescription: string;\n  /** The KMS alias name expression. */\n  readonly aliasName: string;\n  /** How the account id is referenced in this module. */\n  readonly accountId: string;\n  /** How the region is referenced in this module. */\n  readonly region: string;\n  /** Whether the module tags its resources. */\n  readonly tagged: boolean;\n}\n\nconst REST_API_LOG_GROUP: TerraformWafLogGroup = {\n  logGroupLabel: 'api_waf_logs',\n  keyLabel: 'waf_logs',\n  nameLocal: 'waf_log_group_name',\n  nameExpression:\n    'var.enable_waf ? \"aws-waf-logs-${var.api_name}-${random_id.waf_log_suffix[0].hex}\" : null',\n  keyDescription: '\"${var.api_name} API WAF log encryption\"',\n  aliasName:\n    '\"alias/${var.api_name}-${random_id.waf_log_suffix[0].hex}-waf-logs\"',\n  accountId: 'data.aws_caller_identity.current.account_id',\n  region: 'data.aws_region.current.region',\n  tagged: true,\n};\n\nconst USER_IDENTITY_LOG_GROUP: TerraformWafLogGroup = {\n  logGroupLabel: 'user_pool_waf_logs',\n  keyLabel: 'user_pool_waf_logs',\n  nameLocal: 'user_pool_waf_log_group_name',\n  nameExpression:\n    'var.enable_waf ? \"aws-waf-logs-UserPool-${random_id.unique_suffix.hex}\" : null',\n  keyDescription: '\"User pool WAF log encryption\"',\n  aliasName: '\"alias/user-pool-${random_id.unique_suffix.hex}-waf-logs\"',\n  accountId: 'data.aws_caller_identity.current.account_id',\n  region: 'data.aws_region.current.region',\n  tagged: false,\n};\n\nconst gatewayLogGroup = (nameKebabCase: string): TerraformWafLogGroup => ({\n  logGroupLabel: 'gateway_waf_logs',\n  keyLabel: 'gateway_waf_logs',\n  nameLocal: 'gateway_waf_log_group_name',\n  nameExpression: `var.enable_waf ? \"aws-waf-logs-${nameKebabCase}-\\${random_id.unique_suffix.hex}\" : null`,\n  keyDescription: `\"${nameKebabCase} gateway WAF log encryption\"`,\n  aliasName: `\"alias/${nameKebabCase}-\\${random_id.unique_suffix.hex}-waf-logs\"`,\n  accountId: 'local.aws_account_id',\n  region: 'local.aws_region',\n  tagged: false,\n});\n\n/** The KMS key and alias resources, as the templates now vend them. */\nconst keyResourcesText = (group: TerraformWafLogGroup): string =>\n  [\n    '# KMS key for encrypting WAF request logs at rest',\n    `resource \"aws_kms_key\" \"${group.keyLabel}\" {`,\n    '  count = var.enable_waf ? 1 : 0',\n    '',\n    `  description             = ${group.keyDescription}`,\n    '  deletion_window_in_days = 7',\n    '  enable_key_rotation     = true',\n    '',\n    '  policy = jsonencode({',\n    '    Version = \"2012-10-17\"',\n    '    Statement = [',\n    '      {',\n    '        Sid       = \"Enable IAM User Permissions\"',\n    '        Effect    = \"Allow\"',\n    `        Principal = { AWS = \"arn:aws:iam::\\${${group.accountId}}:root\" }`,\n    '        Action    = \"kms:*\"',\n    '        Resource  = \"*\"',\n    '      },',\n    '      {',\n    '        Sid       = \"Allow CloudWatch Logs\"',\n    '        Effect    = \"Allow\"',\n    `        Principal = { Service = \"logs.\\${${group.region}}.amazonaws.com\" }`,\n    '        Action = [',\n    '          \"kms:Encrypt\",',\n    '          \"kms:Decrypt\",',\n    '          \"kms:ReEncrypt*\",',\n    '          \"kms:GenerateDataKey*\",',\n    '          \"kms:DescribeKey\"',\n    '        ]',\n    '        Resource = \"*\"',\n    '        Condition = {',\n    '          ArnEquals = {',\n    `            \"kms:EncryptionContext:aws:logs:arn\" = \"arn:aws:logs:\\${${group.region}}:\\${${group.accountId}}:log-group:\\${local.${group.nameLocal}}\"`,\n    '          }',\n    '        }',\n    '      }',\n    '    ]',\n    '  })',\n    ...(group.tagged ? ['', '  tags = var.tags'] : []),\n    '}',\n    '',\n    `resource \"aws_kms_alias\" \"${group.keyLabel}\" {`,\n    '  count = var.enable_waf ? 1 : 0',\n    '',\n    `  name          = ${group.aliasName}`,\n    `  target_key_id = aws_kms_key.${group.keyLabel}[0].key_id`,\n    '}',\n  ].join('\\n');\n\nconst migrateTerraformLogGroup = async (\n  tree: Tree,\n  file: string,\n  group: TerraformWafLogGroup,\n  nextSteps: string[],\n): Promise<void> => {\n  const contents = tree.read(file, 'utf-8') ?? '';\n\n  // The WAF log group is only vended when WAF is enabled, so it may be absent.\n  if (\n    !contents.includes(`\"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\"`)\n  ) {\n    return;\n  }\n\n  const LOG_GROUP_BLOCK = hcl(\n    `\\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $body }\\``,\n  );\n  const NAME_LINE = hcl(\n    `\\`name = ${group.nameExpression.replace(/^var\\.enable_waf \\? /, '').replace(/ : null$/, '')}\\` as $line where {\\n` +\n      `  $line <: within \\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $_ }\\`\\n` +\n      '}',\n  );\n  const SUPPRESSION_LINE =\n    '#checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption';\n  const LOCALS_BLOCK = hcl('`locals { $body }`');\n\n  if (contents.includes(ALREADY_ENCRYPTED_TERRAFORM + group.keyLabel)) {\n    return; // Already migrated.\n  }\n\n  const ready =\n    (await matchGritQL(tree, file, LOG_GROUP_BLOCK)) &&\n    (await matchGritQL(tree, file, NAME_LINE)) &&\n    (await matchGritQL(tree, file, LOCALS_BLOCK)) &&\n    contents.includes(SUPPRESSION_LINE);\n\n  if (!ready) {\n    nextSteps.push(divergedMessage(file));\n    return;\n  }\n\n  // 1. Route the log group name through a local, so the key policy's encryption\n  //    context condition can name the same log group.\n  await insertViaGritQL(\n    tree,\n    file,\n    LOCALS_BLOCK +\n      ` as $l => \\`locals {\\n  $body\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\``,\n    `${group.nameLocal} = ${group.nameExpression}`,\n  );\n  await applyGritQL(\n    tree,\n    file,\n    NAME_LINE + ` => \\`name              = local.${group.nameLocal}\\``,\n  );\n\n  // 2. Point the log group at a new key, added after it so the log group keeps\n  //    the comment above it.\n  await insertViaGritQL(\n    tree,\n    file,\n    hcl(\n      `\\`name = local.${group.nameLocal}\\` as $line where {\\n` +\n        `  $line <: within \\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $_ }\\`\\n` +\n        '}',\n    ) + ` => \\`$line\\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n    `kms_key_id        = aws_kms_key.${group.keyLabel}[0].arn`,\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    LOG_GROUP_BLOCK + ` as $lg => \\`$lg\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    keyResourcesText(group),\n  );\n\n  // 3. Drop the suppression the encryption makes redundant.\n  const updated = (tree.read(file, 'utf-8') ?? '')\n    .split('\\n')\n    .filter((line) => line.trim() !== SUPPRESSION_LINE)\n    .join('\\n');\n  tree.write(file, updated);\n};\n\n/**\n * The vended CDK user-pool WAF log group gains an `encryptionKey`, matching the\n * eight sibling CDK WAF log groups which already pass one.\n */\nconst migrateCdkUserIdentity = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(CDK_USER_IDENTITY_FILE)) {\n    return; // This workspace has no CDK user identity construct.\n  }\n\n  const contents = tree.read(CDK_USER_IDENTITY_FILE, 'utf-8') ?? '';\n\n  // The WAF web ACL (and its log group) is optional, so it may be absent.\n  if (!contents.includes(`new LogGroup(this, 'WebAclLogs'`)) {\n    return;\n  }\n\n  if (contents.includes('WebAclLogsKey')) {\n    return; // Already migrated.\n  }\n\n  // Already encrypted, whether by this migration or by the user's own key.\n  if (\n    await matchGritQL(\n      tree,\n      CDK_USER_IDENTITY_FILE,\n      \"`new LogGroup(this, 'WebAclLogs', { $props })` where { $props <: contains `encryptionKey` }\",\n    )\n  ) {\n    return;\n  }\n\n  const LOG_GROUP =\n    \"`new LogGroup(this, 'WebAclLogs', { $props })` as $lg where { $props <: contains `logGroupName: $name` }\";\n  const SUPPRESS_CALL =\n    \"`suppressRules(wafLogGroup, ['CKV_AWS_158'], $reason)` as $call\";\n\n  const ready =\n    (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, LOG_GROUP)) &&\n    (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL));\n\n  if (!ready) {\n    nextSteps.push(divergedMessage(CDK_USER_IDENTITY_FILE));\n    return;\n  }\n\n  await addDestructuredImport(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    ['Key'],\n    'aws-cdk-lib/aws-kms',\n  );\n  await addDestructuredImport(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    ['Effect', 'PolicyStatement', 'ServicePrincipal'],\n    'aws-cdk-lib/aws-iam',\n  );\n\n  // Hoist the log group name into a const so the key policy's encryption context\n  // condition can name the same log group, then create the key above the group.\n  await insertViaGritQL(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    \"`const wafLogGroup = new LogGroup(this, 'WebAclLogs', { $props })` as $decl => \" +\n      `\\`${GRIT_INSERT_PLACEHOLDER}\\n\\n$decl\\``,\n    `const stack = Stack.of(this);\n    const wafLogGroupName = \\`aws-waf-logs-\\${id}-\\${this.node.addr.slice(-8)}\\`;\n\n    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs\n    const logsKey = new Key(this, 'WebAclLogsKey', {\n      enableKeyRotation: true,\n    });\n    logsKey.addToResourcePolicy(\n      new PolicyStatement({\n        effect: Effect.ALLOW,\n        principals: [new ServicePrincipal(\\`logs.\\${stack.region}.amazonaws.com\\`)],\n        actions: [\n          'kms:Encrypt',\n          'kms:Decrypt',\n          'kms:ReEncrypt*',\n          'kms:GenerateDataKey*',\n          'kms:DescribeKey',\n        ],\n        resources: ['*'],\n        conditions: {\n          ArnEquals: {\n            'kms:EncryptionContext:aws:logs:arn': \\`arn:aws:logs:\\${stack.region}:\\${stack.account}:log-group:\\${wafLogGroupName}\\`,\n          },\n        },\n      }),\n    );`,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    \"`logGroupName: $name` as $prop where { $prop <: within `new LogGroup(this, 'WebAclLogs', $_)` } => `logGroupName: wafLogGroupName,\\n      encryptionKey: logsKey`\",\n  );\n\n  // Drop the suppression the encryption makes redundant.\n  await applyGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL + ' => ``');\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists(TERRAFORM_REST_API_FILE)) {\n    await migrateTerraformLogGroup(\n      tree,\n      TERRAFORM_REST_API_FILE,\n      REST_API_LOG_GROUP,\n      nextSteps,\n    );\n  }\n  if (tree.exists(TERRAFORM_USER_IDENTITY_FILE)) {\n    await migrateTerraformLogGroup(\n      tree,\n      TERRAFORM_USER_IDENTITY_FILE,\n      USER_IDENTITY_LOG_GROUP,\n      nextSteps,\n    );\n  }\n  if (tree.exists(TERRAFORM_GATEWAYS_DIR)) {\n    for (const dirName of tree.children(TERRAFORM_GATEWAYS_DIR)) {\n      const file = joinPathFragments(\n        TERRAFORM_GATEWAYS_DIR,\n        dirName,\n        `${dirName}.tf`,\n      );\n      if (tree.exists(file)) {\n        await migrateTerraformLogGroup(\n          tree,\n          file,\n          gatewayLogGroup(dirName),\n          nextSteps,\n        );\n      }\n    }\n  }\n\n  await migrateCdkUserIdentity(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CONSTRUCTS_SRC","TERRAFORM_SRC","CDK_USER_IDENTITY_FILE","TERRAFORM_REST_API_FILE","TERRAFORM_USER_IDENTITY_FILE","TERRAFORM_GATEWAYS_DIR","divergedMessage","file","ALREADY_ENCRYPTED_TERRAFORM","hcl","pattern","REST_API_LOG_GROUP","logGroupLabel","keyLabel","nameLocal","nameExpression","keyDescription","aliasName","accountId","region","tagged","USER_IDENTITY_LOG_GROUP","gatewayLogGroup","nameKebabCase","keyResourcesText","group","join","migrateTerraformLogGroup","tree","nextSteps","contents","read","includes","LOG_GROUP_BLOCK","NAME_LINE","replace","SUPPRESSION_LINE","LOCALS_BLOCK","ready","push","updated","split","filter","line","trim","write","migrateCdkUserIdentity","exists","LOG_GROUP","SUPPRESS_CALL","migration","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,iBAAiB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AACrE,MAAMG,gBAAgB,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,IAAI,CAAC;AAEnE,MAAMG,yBAAyB,GAAGF,eAAe,sBAAsB,CAAC;AACxE,MAAMG,0BAA0B,GAAGF,cAAc,8BAA8B,CAAC;AAChF,MAAMG,+BAA+B,GAAGH,cAAc,wCAAwC,CAAC;AAC/F,MAAMI,yBAAyB,GAAGJ,cAAc,aAAa,CAAC;AAE9D,MAAMK,kBAAkB,CAACC,OACvB,GAAGA,KAAK,+aAA+a,CAAC;AAE1b,MAAMC,8BAA8B;AAEpC,gFAAgF;AAChF,8EAA8E;AAC9E,iDAAiD;AACjD,MAAMC,MAAM,CAACC,UAAoB,mBAAmBA;AAwBpD,MAAMC,qBAA2C;IAC/CC,eAAe;IACfC,UAAU;IACVC,WAAW;IACXC,gBACE;IACFC,gBAAgB;IAChBC,WACE;IACFC,WAAW;IACXC,QAAQ;IACRC,QAAQ;AACV;AAEA,MAAMC,0BAAgD;IACpDT,eAAe;IACfC,UAAU;IACVC,WAAW;IACXC,gBACE;IACFC,gBAAgB;IAChBC,WAAW;IACXC,WAAW;IACXC,QAAQ;IACRC,QAAQ;AACV;AAEA,MAAME,kBAAkB,CAACC,gBAAiD,CAAA;QACxEX,eAAe;QACfC,UAAU;QACVC,WAAW;QACXC,gBAAgB,CAAC,+BAA+B,EAAEQ,cAAc,wCAAwC,CAAC;QACzGP,gBAAgB,CAAC,CAAC,EAAEO,cAAc,4BAA4B,CAAC;QAC/DN,WAAW,CAAC,OAAO,EAAEM,cAAc,0CAA0C,CAAC;QAC9EL,WAAW;QACXC,QAAQ;QACRC,QAAQ;IACV,CAAA;AAEA,qEAAqE,GACrE,MAAMI,mBAAmB,CAACC,QACxB;QACE;QACA,CAAC,wBAAwB,EAAEA,MAAMZ,QAAQ,CAAC,GAAG,CAAC;QAC9C;QACA;QACA,CAAC,4BAA4B,EAAEY,MAAMT,cAAc,EAAE;QACrD;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,6CAA6C,EAAES,MAAMP,SAAS,CAAC,SAAS,CAAC;QAC1E;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,yCAAyC,EAAEO,MAAMN,MAAM,CAAC,kBAAkB,CAAC;QAC5E;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,oEAAoE,EAAEM,MAAMN,MAAM,CAAC,KAAK,EAAEM,MAAMP,SAAS,CAAC,qBAAqB,EAAEO,MAAMX,SAAS,CAAC,EAAE,CAAC;QACrJ;QACA;QACA;QACA;QACA;WACIW,MAAML,MAAM,GAAG;YAAC;YAAI;SAAoB,GAAG,EAAE;QACjD;QACA;QACA,CAAC,0BAA0B,EAAEK,MAAMZ,QAAQ,CAAC,GAAG,CAAC;QAChD;QACA;QACA,CAAC,kBAAkB,EAAEY,MAAMR,SAAS,EAAE;QACtC,CAAC,8BAA8B,EAAEQ,MAAMZ,QAAQ,CAAC,UAAU,CAAC;QAC3D;KACD,CAACa,IAAI,CAAC;AAET,MAAMC,2BAA2B,OAC/BC,MACArB,MACAkB,OACAI;IAEA,MAAMC,WAAWF,KAAKG,IAAI,CAACxB,MAAM,YAAY;IAE7C,6EAA6E;IAC7E,IACE,CAACuB,SAASE,QAAQ,CAAC,CAAC,4BAA4B,EAAEP,MAAMb,aAAa,CAAC,CAAC,CAAC,GACxE;QACA;IACF;IAEA,MAAMqB,kBAAkBxB,IACtB,CAAC,uCAAuC,EAAEgB,MAAMb,aAAa,CAAC,aAAa,CAAC;IAE9E,MAAMsB,YAAYzB,IAChB,CAAC,SAAS,EAAEgB,MAAMV,cAAc,CAACoB,OAAO,CAAC,wBAAwB,IAAIA,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,GACjH,CAAC,yDAAyD,EAAEV,MAAMb,aAAa,CAAC,YAAY,CAAC,GAC7F;IAEJ,MAAMwB,mBACJ;IACF,MAAMC,eAAe5B,IAAI;IAEzB,IAAIqB,SAASE,QAAQ,CAACxB,8BAA8BiB,MAAMZ,QAAQ,GAAG;QACnE,QAAQ,oBAAoB;IAC9B;IAEA,MAAMyB,QACJ,AAAC,MAAM3C,YAAYiC,MAAMrB,MAAM0B,oBAC9B,MAAMtC,YAAYiC,MAAMrB,MAAM2B,cAC9B,MAAMvC,YAAYiC,MAAMrB,MAAM8B,iBAC/BP,SAASE,QAAQ,CAACI;IAEpB,IAAI,CAACE,OAAO;QACVT,UAAUU,IAAI,CAACjC,gBAAgBC;QAC/B;IACF;IAEA,8EAA8E;IAC9E,oDAAoD;IACpD,MAAMb,gBACJkC,MACArB,MACA8B,eACE,CAAC,iCAAiC,EAAE5C,wBAAwB,KAAK,CAAC,EACpE,GAAGgC,MAAMX,SAAS,CAAC,GAAG,EAAEW,MAAMV,cAAc,EAAE;IAEhD,MAAMvB,YACJoC,MACArB,MACA2B,YAAY,CAAC,gCAAgC,EAAET,MAAMX,SAAS,CAAC,EAAE,CAAC;IAGpE,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAMpB,gBACJkC,MACArB,MACAE,IACE,CAAC,eAAe,EAAEgB,MAAMX,SAAS,CAAC,qBAAqB,CAAC,GACtD,CAAC,yDAAyD,EAAEW,MAAMb,aAAa,CAAC,YAAY,CAAC,GAC7F,OACA,CAAC,eAAe,EAAEnB,wBAAwB,EAAE,CAAC,EACjD,CAAC,gCAAgC,EAAEgC,MAAMZ,QAAQ,CAAC,OAAO,CAAC;IAE5D,MAAMnB,gBACJkC,MACArB,MACA0B,kBAAkB,CAAC,oBAAoB,EAAExC,wBAAwB,EAAE,CAAC,EACpE+B,iBAAiBC;IAGnB,0DAA0D;IAC1D,MAAMe,UAAU,AAACZ,CAAAA,KAAKG,IAAI,CAACxB,MAAM,YAAY,EAAC,EAC3CkC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,OAAOR,kBACjCV,IAAI,CAAC;IACRE,KAAKiB,KAAK,CAACtC,MAAMiC;AACnB;AAEA;;;CAGC,GACD,MAAMM,yBAAyB,OAC7BlB,MACAC;IAEA,IAAI,CAACD,KAAKmB,MAAM,CAAC7C,yBAAyB;QACxC,QAAQ,qDAAqD;IAC/D;IAEA,MAAM4B,WAAWF,KAAKG,IAAI,CAAC7B,wBAAwB,YAAY;IAE/D,wEAAwE;IACxE,IAAI,CAAC4B,SAASE,QAAQ,CAAC,CAAC,+BAA+B,CAAC,GAAG;QACzD;IACF;IAEA,IAAIF,SAASE,QAAQ,CAAC,kBAAkB;QACtC,QAAQ,oBAAoB;IAC9B;IAEA,yEAAyE;IACzE,IACE,MAAMrC,YACJiC,MACA1B,wBACA,gGAEF;QACA;IACF;IAEA,MAAM8C,YACJ;IACF,MAAMC,gBACJ;IAEF,MAAMX,QACJ,AAAC,MAAM3C,YAAYiC,MAAM1B,wBAAwB8C,cAChD,MAAMrD,YAAYiC,MAAM1B,wBAAwB+C;IAEnD,IAAI,CAACX,OAAO;QACVT,UAAUU,IAAI,CAACjC,gBAAgBJ;QAC/B;IACF;IAEA,MAAMX,sBACJqC,MACA1B,wBACA;QAAC;KAAM,EACP;IAEF,MAAMX,sBACJqC,MACA1B,wBACA;QAAC;QAAU;QAAmB;KAAmB,EACjD;IAGF,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAMR,gBACJkC,MACA1B,wBACA,oFACE,CAAC,EAAE,EAAET,wBAAwB,WAAW,CAAC,EAC3C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;MAyBC,CAAC;IAGL,MAAMD,YACJoC,MACA1B,wBACA;IAGF,uDAAuD;IACvD,MAAMV,YAAYoC,MAAM1B,wBAAwB+C,gBAAgB;AAClE;AAEA,eAAe,eAAeC,UAC5BtB,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAID,KAAKmB,MAAM,CAAC5C,0BAA0B;QACxC,MAAMwB,yBACJC,MACAzB,yBACAQ,oBACAkB;IAEJ;IACA,IAAID,KAAKmB,MAAM,CAAC3C,+BAA+B;QAC7C,MAAMuB,yBACJC,MACAxB,8BACAiB,yBACAQ;IAEJ;IACA,IAAID,KAAKmB,MAAM,CAAC1C,yBAAyB;QACvC,KAAK,MAAM8C,WAAWvB,KAAKwB,QAAQ,CAAC/C,wBAAyB;YAC3D,MAAME,OAAOjB,kBACXe,wBACA8C,SACA,GAAGA,QAAQ,GAAG,CAAC;YAEjB,IAAIvB,KAAKmB,MAAM,CAACxC,OAAO;gBACrB,MAAMoB,yBACJC,MACArB,MACAe,gBAAgB6B,UAChBtB;YAEJ;QACF;IACF;IAEA,MAAMiB,uBAAuBlB,MAAMC;IAEnC,MAAMjC,qBAAqBgC;IAE3B,OAAO;QAAEC;IAAU;AACrB"}