@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/aws-adapter.js

@@ -0,0 +1,416 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FixedAwsIamProvisionerAdapter = exports.FixedAwsIamAdapterError = exports.FIXED_WORKLOAD_ROLE_INLINE_POLICY_NAME = void 0;
+const node_crypto_1 = require("node:crypto");
+const convergence_js_1 = require("./convergence.js");
+const effective_policy_js_1 = require("./effective-policy.js");
+exports.FIXED_WORKLOAD_ROLE_INLINE_POLICY_NAME = 'ebk-effective-permissions';
+class FixedAwsIamAdapterError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'FixedAwsIamAdapterError';
+    }
+}
+exports.FixedAwsIamAdapterError = FixedAwsIamAdapterError;
+const serviceByTrustClass = {
+    appconfig: 'appconfig.amazonaws.com',
+    ec2: 'ec2.amazonaws.com',
+    'ecs-task': 'ecs-tasks.amazonaws.com',
+    lambda: 'lambda.amazonaws.com',
+    'step-functions': 'states.amazonaws.com',
+};
+const trustClassByService = new Map(Object.entries(serviceByTrustClass).map(([trustClass, service]) => [
+    service,
+    trustClass,
+]));
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseIamDocument(value, label) {
+    if (typeof value !== 'string') {
+        return value;
+    }
+    try {
+        const decoded = value.includes('%')
+            ? decodeURIComponent(value.replace(/\+/g, ' '))
+            : value;
+        return JSON.parse(decoded);
+    }
+    catch {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} is not valid IAM JSON.`);
+    }
+}
+function stringList(value, label) {
+    const list = typeof value === 'string' ? [value] : value;
+    if (!Array.isArray(list) ||
+        list.length === 0 ||
+        list.some((entry) => typeof entry !== 'string')) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} must be a non-empty string or string array.`);
+    }
+    return [...new Set(list)].sort(compareStrings);
+}
+function canonicalConditions(value, label) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isRecord(value) || Object.keys(value).length === 0) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} must be a non-empty object.`);
+    }
+    return Object.fromEntries(Object.keys(value)
+        .sort(compareStrings)
+        .map((operator) => {
+        const entries = value[operator];
+        if (!isRecord(entries) || Object.keys(entries).length === 0) {
+            throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label}.${operator} must be a non-empty object.`);
+        }
+        return [
+            operator,
+            Object.fromEntries(Object.keys(entries)
+                .sort(compareStrings)
+                .map((key) => {
+                const conditionValue = entries[key];
+                if (typeof conditionValue === 'string') {
+                    return [key, conditionValue];
+                }
+                return [
+                    key,
+                    stringList(conditionValue, `${label}.${operator}.${key}`),
+                ];
+            })),
+        ];
+    }));
+}
+function canonicalPermissionPolicy(value, label) {
+    const parsed = parseIamDocument(value, label);
+    if (!isRecord(parsed) ||
+        parsed.Version !== effective_policy_js_1.IAM_POLICY_VERSION ||
+        !Array.isArray(parsed.Statement) ||
+        parsed.Statement.length === 0) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} is not a supported IAM policy document.`);
+    }
+    if (Object.keys(parsed).some((property) => !['Statement', 'Version'].includes(property))) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} contains unsupported top-level policy fields.`);
+    }
+    const statements = parsed.Statement.map((entry, index) => {
+        if (!isRecord(entry) ||
+            (entry.Effect !== 'Allow' && entry.Effect !== 'Deny') ||
+            typeof entry.Sid !== 'string' ||
+            entry.Sid.length === 0) {
+            throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} statement ${index} is malformed.`);
+        }
+        if (Object.keys(entry).some((property) => !['Action', 'Condition', 'Effect', 'Resource', 'Sid'].includes(property))) {
+            throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} statement ${index} contains unsupported policy fields.`);
+        }
+        const conditions = canonicalConditions(entry.Condition, `${label}.Statement[${index}].Condition`);
+        return {
+            Action: stringList(entry.Action, `${label}.Statement[${index}].Action`),
+            ...(conditions ? { Condition: conditions } : {}),
+            Effect: entry.Effect,
+            Resource: stringList(entry.Resource, `${label}.Statement[${index}].Resource`),
+            Sid: entry.Sid,
+        };
+    }).sort((left, right) => compareStrings(left.Sid, right.Sid));
+    if (new Set(statements.map(({ Sid }) => Sid)).size !== statements.length) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `${label} contains duplicate statement identities.`);
+    }
+    return { Statement: statements, Version: effective_policy_js_1.IAM_POLICY_VERSION };
+}
+function permissionPolicyDigest(value, label) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(canonicalPermissionPolicy(value, label)), 'utf8')
+        .digest('hex');
+}
+function trustClassFromPolicy(value) {
+    const parsed = parseIamDocument(value, 'Observed role trust policy');
+    if (!isRecord(parsed) ||
+        parsed.Version !== '2012-10-17' ||
+        !Array.isArray(parsed.Statement) ||
+        parsed.Statement.length !== 1) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', 'Observed role trust policy is not one fixed service trust statement.');
+    }
+    if (Object.keys(parsed).some((property) => !['Statement', 'Version'].includes(property))) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', 'Observed role trust policy contains unsupported top-level fields.');
+    }
+    const statement = parsed.Statement[0];
+    if (!isRecord(statement) ||
+        statement.Action !== 'sts:AssumeRole' ||
+        statement.Effect !== 'Allow' ||
+        !isRecord(statement.Principal) ||
+        typeof statement.Principal.Service !== 'string' ||
+        Object.keys(statement).some((key) => !['Action', 'Effect', 'Principal'].includes(key)) ||
+        Object.keys(statement.Principal).some((key) => key !== 'Service')) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', 'Observed role trust policy contains an unsupported principal or condition.');
+    }
+    const trustClass = trustClassByService.get(statement.Principal.Service);
+    if (!trustClass) {
+        throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', 'Observed role trust policy does not name a supported AWS workload service.');
+    }
+    return trustClass;
+}
+function compositePermissionDigest(options) {
+    const value = {
+        attachedPolicyArns: [...options.attachedPolicyArns].sort(compareStrings),
+        inlinePolicies: options.inlinePolicies
+            .map(([name, policy]) => ({
+            name,
+            policy: canonicalPermissionPolicy(policy, `Observed inline policy ${name}`),
+        }))
+            .sort((left, right) => compareStrings(left.name, right.name)),
+        tags: Object.fromEntries(Object.keys(options.tags)
+            .filter((key) => !key.startsWith('aws:'))
+            .sort(compareStrings)
+            .map((key) => [key, options.tags[key]])),
+    };
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(value), 'utf8')
+        .digest('hex');
+}
+function expectedTags(mutation) {
+    return mutation.tags;
+}
+class FixedAwsIamProvisionerAdapter {
+    iam;
+    constructor(iam) {
+        this.iam = iam;
+    }
+    async observeExact(roleNames) {
+        const normalized = [...roleNames].sort(compareStrings);
+        if (normalized.length === 0 ||
+            new Set(normalized).size !== normalized.length ||
+            normalized.some((name) => !/^[A-Za-z0-9+=,.@_-]{1,64}$/.test(name))) {
+            throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', 'Exact IAM observation requires unique registered role names.');
+        }
+        const observed = [];
+        for (const roleName of normalized) {
+            const role = await this.iam.getRole(roleName);
+            if (!role) {
+                continue;
+            }
+            if (role.roleName !== roleName) {
+                throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `IAM returned a substituted role for ${roleName}.`);
+            }
+            const [inlinePolicyNames, attachedPolicyArns] = await Promise.all([
+                this.iam.listRolePolicyNames(roleName),
+                this.iam.listAttachedRolePolicyArns(roleName),
+            ]);
+            if (new Set(inlinePolicyNames).size !== inlinePolicyNames.length ||
+                new Set(attachedPolicyArns).size !== attachedPolicyArns.length) {
+                throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `IAM returned ambiguous policy observations for ${roleName}.`);
+            }
+            const inlinePolicies = [];
+            for (const policyName of [...inlinePolicyNames].sort(compareStrings)) {
+                const policy = await this.iam.getRolePolicy({
+                    policyName,
+                    roleName,
+                });
+                if (policy === undefined) {
+                    throw new FixedAwsIamAdapterError('aws-iam-observation-invalid', `IAM omitted observed inline policy ${policyName} for ${roleName}.`);
+                }
+                inlinePolicies.push([policyName, policy]);
+            }
+            const fixedPolicy = inlinePolicies.find(([name]) => name === exports.FIXED_WORKLOAD_ROLE_INLINE_POLICY_NAME)?.[1];
+            const tags = role.tags;
+            const expectedManagedTagKeys = [
+                'ebk:candidate',
+                'ebk:managed-by',
+                'ebk:manifest',
+                'ebk:project',
+                'ebk:resource',
+                'ebk:stage',
+            ].sort(compareStrings);
+            const userTagKeys = Object.keys(tags)
+                .filter((key) => !key.startsWith('aws:'))
+                .sort(compareStrings);
+            const exactFixedPolicySet = inlinePolicies.length === 1 &&
+                fixedPolicy !== undefined &&
+                attachedPolicyArns.length === 0 &&
+                JSON.stringify(userTagKeys) === JSON.stringify(expectedManagedTagKeys);
+            const trustClass = trustClassFromPolicy(role.assumeRolePolicyDocument);
+            observed.push({
+                boundaryArn: role.permissionsBoundaryArn,
+                ...(tags['ebk:candidate']
+                    ? { candidateIdentity: tags['ebk:candidate'] }
+                    : {}),
+                ...(tags['ebk:managed-by']
+                    ? { managedBy: tags['ebk:managed-by'] }
+                    : {}),
+                ...(tags['ebk:manifest']
+                    ? { manifestDigest: tags['ebk:manifest'] }
+                    : {}),
+                ...(tags['ebk:project'] && tags['ebk:resource']
+                    ? {
+                        ownership: {
+                            project: tags['ebk:project'],
+                            resource: tags['ebk:resource'],
+                        },
+                    }
+                    : {}),
+                passDestinations: [serviceByTrustClass[trustClass]],
+                permissionPolicyDigest: exactFixedPolicySet
+                    ? permissionPolicyDigest(fixedPolicy, `Observed inline policy ${exports.FIXED_WORKLOAD_ROLE_INLINE_POLICY_NAME}`)
+                    : compositePermissionDigest({
+                        attachedPolicyArns,
+                        inlinePolicies: inlinePolicies,
+                        tags,
+                    }),
+                roleArn: role.arn,
+                roleName,
+                ...(tags['ebk:stage'] ? { stage: tags['ebk:stage'] } : {}),
+                trustClass,
+            });
+        }
+        return observed;
+    }
+    async #assertUnchanged(roleName, before) {
+        const current = await this.observeExact([roleName]);
+        if (current.length !== 1 ||
+            !current[0] ||
+            (0, convergence_js_1.digestObservedWorkloadRole)(current[0]) !==
+                (0, convergence_js_1.digestObservedWorkloadRole)(before)) {
+            throw new FixedAwsIamAdapterError('aws-iam-state-race', `Workload role ${roleName} changed after exact observation.`);
+        }
+    }
+    async #replaceTags(mutation, current) {
+        const expected = expectedTags(mutation);
+        const stale = Object.keys(current)
+            .filter((key) => !key.startsWith('aws:') && !(key in expected))
+            .sort(compareStrings);
+        if (stale.length > 0) {
+            await this.iam.untagRole({
+                roleName: mutation.declaration.roleName,
+                tagKeys: stale,
+            });
+        }
+        await this.iam.tagRole({
+            roleName: mutation.declaration.roleName,
+            tags: expected,
+        });
+    }
+    async #convergeExisting(mutation, before) {
+        await this.#assertUnchanged(mutation.declaration.roleName, before);
+        const role = await this.iam.getRole(mutation.declaration.roleName);
+        if (!role) {
+            throw new FixedAwsIamAdapterError('aws-iam-state-race', `Workload role ${mutation.declaration.roleName} disappeared before convergence.`);
+        }
+        await this.iam.putRolePermissionsBoundary({
+            permissionsBoundaryArn: mutation.boundaryArn,
+            roleName: mutation.declaration.roleName,
+        });
+        await this.iam.putRolePolicy({
+            policyDocument: mutation.permissionPolicy,
+            policyName: exports.FIXED_WORKLOAD_ROLE_INLINE_POLICY_NAME,
+            roleName: mutation.declaration.roleName,
+        });
+        const inlinePolicies = await this.iam.listRolePolicyNames(mutation.declaration.roleName);
+        for (const policyName of inlinePolicies
+            .filter((name) => name !== exports.FIXED_WORKLOAD_ROLE_INLINE_POLICY_NAME)
+            .sort(compareStrings)) {
+            await this.iam.deleteRolePolicy({
+                policyName,
+                roleName: mutation.declaration.roleName,
+            });
+        }
+        const attachedPolicies = await this.iam.listAttachedRolePolicyArns(mutation.declaration.roleName);
+        for (const policyArn of [...attachedPolicies].sort(compareStrings)) {
+            await this.iam.detachRolePolicy({
+                policyArn,
+                roleName: mutation.declaration.roleName,
+            });
+        }
+        await this.#replaceTags(mutation, role.tags);
+        // Trust changes last, after the exact boundary and permission policy are
+        // attached and every prior permission grant has been removed.
+        await this.iam.updateAssumeRolePolicy({
+            assumeRolePolicyDocument: mutation.assumeRolePolicy,
+            roleName: mutation.declaration.roleName,
+        });
+    }
+    async create(mutation) {
+        if (await this.iam.getRole(mutation.declaration.roleName)) {
+            throw new FixedAwsIamAdapterError('aws-iam-create-collision', `Workload role ${mutation.declaration.roleName} already exists.`);
+        }
+        await this.iam.createRole({
+            assumeRolePolicyDocument: mutation.assumeRolePolicy,
+            permissionsBoundaryArn: mutation.boundaryArn,
+            roleName: mutation.declaration.roleName,
+            tags: expectedTags(mutation),
+        });
+        await this.iam.putRolePolicy({
+            policyDocument: mutation.permissionPolicy,
+            policyName: exports.FIXED_WORKLOAD_ROLE_INLINE_POLICY_NAME,
+            roleName: mutation.declaration.roleName,
+        });
+    }
+    async update(mutation, before) {
+        if (before.managedBy !== convergence_js_1.WORKLOAD_ROLE_PROVISIONER_OWNER) {
+            throw new FixedAwsIamAdapterError('aws-iam-state-race', 'Update requires an exact framework-owned v1 workload role.');
+        }
+        await this.#convergeExisting(mutation, before);
+    }
+    async remove(declaration, before) {
+        await this.#assertUnchanged(declaration.roleName, before);
+        if (declaration.surface === 'foundation-nat-instance') {
+            await this.removeNatInstanceProfile({
+                instanceProfileName: `${declaration.roleName}-profile`,
+                roleName: declaration.roleName,
+            });
+        }
+        const inlinePolicies = await this.iam.listRolePolicyNames(declaration.roleName);
+        for (const policyName of [...inlinePolicies].sort(compareStrings)) {
+            await this.iam.deleteRolePolicy({
+                policyName,
+                roleName: declaration.roleName,
+            });
+        }
+        const attachedPolicies = await this.iam.listAttachedRolePolicyArns(declaration.roleName);
+        for (const policyArn of [...attachedPolicies].sort(compareStrings)) {
+            await this.iam.detachRolePolicy({
+                policyArn,
+                roleName: declaration.roleName,
+            });
+        }
+        await this.iam.deleteRole({ roleName: declaration.roleName });
+    }
+    async ensureNatInstanceProfile(mutation) {
+        let profile = await this.iam.getInstanceProfile(mutation.instanceProfileName);
+        if (!profile) {
+            await this.iam.createInstanceProfile({
+                instanceProfileName: mutation.instanceProfileName,
+            });
+            profile = await this.iam.getInstanceProfile(mutation.instanceProfileName);
+        }
+        if (!profile ||
+            profile.instanceProfileName !== mutation.instanceProfileName ||
+            profile.roleNames.some((name) => name !== mutation.roleName) ||
+            profile.roleNames.length > 1) {
+            throw new FixedAwsIamAdapterError('aws-iam-nat-profile-substitution', `NAT instance profile ${mutation.instanceProfileName} is missing or contains another role.`);
+        }
+        if (profile.roleNames.length === 0) {
+            await this.iam.addRoleToInstanceProfile(mutation);
+        }
+    }
+    async removeNatInstanceProfile(mutation) {
+        const profile = await this.iam.getInstanceProfile(mutation.instanceProfileName);
+        if (!profile) {
+            return;
+        }
+        if (profile.instanceProfileName !== mutation.instanceProfileName ||
+            profile.roleNames.some((name) => name !== mutation.roleName) ||
+            profile.roleNames.length > 1) {
+            throw new FixedAwsIamAdapterError('aws-iam-nat-profile-substitution', `NAT instance profile ${mutation.instanceProfileName} contains an unregistered role.`);
+        }
+        if (profile.roleNames.length === 1) {
+            await this.iam.removeRoleFromInstanceProfile(mutation);
+        }
+        await this.iam.deleteInstanceProfile({
+            instanceProfileName: mutation.instanceProfileName,
+        });
+    }
+}
+exports.FixedAwsIamProvisionerAdapter = FixedAwsIamProvisionerAdapter;
+//# sourceMappingURL=aws-adapter.js.map

package/src/workload-roles/aws-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-adapter.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/aws-adapter.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AAEzC,qDAI0B;AAC1B,+DAI+B;AAYlB,QAAA,sCAAsC,GACjD,2BAAoC,CAAC;AAQvC,MAAa,uBAAwB,SAAQ,KAAK;IAErC;IADX,YACW,cAAuD,EAChE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAAyC;QAIhE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AARD,0DAQC;AA+ED,MAAM,mBAAmB,GAAqD;IAC5E,SAAS,EAAE,yBAAyB;IACpC,GAAG,EAAE,mBAAmB;IACxB,UAAU,EAAE,yBAAyB;IACrC,MAAM,EAAE,sBAAsB;IAC9B,gBAAgB,EAAE,sBAAsB;CACzC,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACjE,OAAO;IACP,UAAoC;CACrC,CAAC,CACH,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YACjC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC,CAAC,KAAK,CAAC;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,yBAAyB,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,8CAA8C,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,8BAA8B,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACf,IAAI,CAAC,cAAc,CAAC;SACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,IAAI,QAAQ,8BAA8B,CACnD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ;YACR,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;iBACjB,IAAI,CAAC,cAAc,CAAC;iBACpB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACX,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;oBACvC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAC/B,CAAC;gBACD,OAAO;oBACL,GAAG;oBACH,UAAU,CAAC,cAAc,EAAE,GAAG,KAAK,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;iBAC1D,CAAC;YACJ,CAAC,CAAC,CACL;SACF,CAAC;IACJ,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,KAAa;IAEb,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,IACE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjB,MAAM,CAAC,OAAO,KAAK,wCAAkB;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,0CAA0C,CACnD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,gDAAgD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAkC,MAAM,CAAC,SAAS,CAAC,GAAG,CACpE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACf,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChB,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;YACrD,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAC7B,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,cAAc,KAAK,gBAAgB,CAC5C,CAAC;QACJ,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,QAAQ,EAAE,EAAE,CACX,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,QAAQ,CAC5D,QAAQ,CACT,CACJ,EACD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,cAAc,KAAK,sCAAsC,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CACpC,KAAK,CAAC,SAAS,EACf,GAAG,KAAK,cAAc,KAAK,aAAa,CACzC,CAAC;QACF,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,cAAc,KAAK,UAAU,CAAC;YACvE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,EAAE,KAAK,CAAC,MAA0B;YACxC,QAAQ,EAAE,UAAU,CAClB,KAAK,CAAC,QAAQ,EACd,GAAG,KAAK,cAAc,KAAK,YAAY,CACxC;YACD,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC;IACJ,CAAC,CACF,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,GAAG,KAAK,2CAA2C,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,wCAAkB,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAa;IAC3D,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;SACvE,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACrE,IACE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjB,MAAM,CAAC,OAAO,KAAK,YAAY;QAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3D,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtC,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,MAAM,KAAK,gBAAgB;QACrC,SAAS,CAAC,MAAM,KAAK,OAAO;QAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QAC9B,OAAO,SAAS,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;QAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CACzB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC1D;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAIlC;IACC,MAAM,KAAK,GAAG;QACZ,kBAAkB,EAAE,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;QACxE,cAAc,EAAE,OAAO,CAAC,cAAc;aACnC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,IAAI;YACJ,MAAM,EAAE,yBAAyB,CAC/B,MAAM,EACN,0BAA0B,IAAI,EAAE,CACjC;SACF,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,EAAE,MAAM,CAAC,WAAW,CACtB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aACtB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aACxC,IAAI,CAAC,cAAc,CAAC;aACpB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1C;KACF,CAAC;IACF,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;SACrC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,QAAmC;IAEnC,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAa,6BAA6B;IACX;IAA7B,YAA6B,GAA4B;QAA5B,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAE7D,KAAK,CAAC,YAAY,CAChB,SAA4B;QAE5B,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvD,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;YACvB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;YAC9C,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACnE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,uCAAuC,QAAQ,GAAG,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC;gBACtC,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,QAAQ,CAAC;aAC9C,CAAC,CAAC;YACH,IACE,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM;gBAC5D,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAC9D,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,kDAAkD,QAAQ,GAAG,CAC9D,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAsC,EAAE,CAAC;YAC7D,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;oBAC1C,UAAU;oBACV,QAAQ;iBACT,CAAC,CAAC;gBACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,sCAAsC,UAAU,QAAQ,QAAQ,GAAG,CACpE,CAAC;gBACJ,CAAC;gBACD,cAAc,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CACrC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,8CAAsC,CAC5D,EAAE,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,sBAAsB,GAAG;gBAC7B,eAAe;gBACf,gBAAgB;gBAChB,cAAc;gBACd,aAAa;gBACb,cAAc;gBACd,WAAW;aACZ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBACxC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxB,MAAM,mBAAmB,GACvB,cAAc,CAAC,MAAM,KAAK,CAAC;gBAC3B,WAAW,KAAK,SAAS;gBACzB,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAC/B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,WAAW,EAAE,IAAI,CAAC,sBAAsB;gBACxC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;oBACvB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC;oBACxB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE;oBACvC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;oBACtB,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;oBAC1C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC;oBAC7C,CAAC,CAAC;wBACE,SAAS,EAAE;4BACT,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;4BAC5B,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC;yBAC/B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,gBAAgB,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;gBACnD,sBAAsB,EAAE,mBAAmB;oBACzC,CAAC,CAAC,sBAAsB,CACpB,WAAW,EACX,0BAA0B,8CAAsC,EAAE,CACnE;oBACH,CAAC,CAAC,yBAAyB,CAAC;wBACxB,kBAAkB;wBAClB,cAAc,EAAE,cAAqC;wBACrD,IAAI;qBACL,CAAC;gBACN,OAAO,EAAE,IAAI,CAAC,GAAG;gBACjB,QAAQ;gBACR,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,MAA4B;QAE5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,OAAO,CAAC,CAAC,CAAC;YACX,IAAA,2CAA0B,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAA,2CAA0B,EAAC,MAAM,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,iBAAiB,QAAQ,mCAAmC,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,QAAmC,EACnC,OAAyC;QAEzC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;aAC/B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC;aAC9D,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBACvB,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;gBACvC,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;YACvC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAmC,EACnC,MAA4B;QAE5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,iBAAiB,QAAQ,CAAC,WAAW,CAAC,QAAQ,kCAAkC,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACxC,sBAAsB,EAAE,QAAQ,CAAC,WAAW;YAC5C,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;SACxC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YAC3B,cAAc,EAAE,QAAQ,CAAC,gBAAgB;YACzC,UAAU,EAAE,8CAAsC;YAClD,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;SACxC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CACvD,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAC9B,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,cAAc;aACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,8CAAsC,CAAC;aACjE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC9B,UAAU;gBACV,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;aACxC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAChE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAC9B,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC9B,SAAS;gBACT,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;aACxC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACpC,wBAAwB,EAAE,QAAQ,CAAC,gBAAgB;YACnD,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;SACxC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmC;QAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,uBAAuB,CAC/B,0BAA0B,EAC1B,iBAAiB,QAAQ,CAAC,WAAW,CAAC,QAAQ,kBAAkB,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACxB,wBAAwB,EAAE,QAAQ,CAAC,gBAAgB;YACnD,sBAAsB,EAAE,QAAQ,CAAC,WAAW;YAC5C,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;YACvC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;SAC7B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YAC3B,cAAc,EAAE,QAAQ,CAAC,gBAAgB;YACzC,UAAU,EAAE,8CAAsC;YAClD,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;SACxC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,QAAmC,EACnC,MAA4B;QAE5B,IAAI,MAAM,CAAC,SAAS,KAAK,gDAA+B,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CACV,WAAoC,EACpC,MAA4B;QAE5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,WAAW,CAAC,OAAO,KAAK,yBAAyB,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,wBAAwB,CAAC;gBAClC,mBAAmB,EAAE,GAAG,WAAW,CAAC,QAAQ,UAAU;gBACtD,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CACvD,WAAW,CAAC,QAAQ,CACrB,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC9B,UAAU;gBACV,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAChE,WAAW,CAAC,QAAQ,CACrB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC9B,SAAS;gBACT,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,QAAyC;QAEzC,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAC7C,QAAQ,CAAC,mBAAmB,CAC7B,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;aAClD,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC5E,CAAC;QACD,IACE,CAAC,OAAO;YACR,OAAO,CAAC,mBAAmB,KAAK,QAAQ,CAAC,mBAAmB;YAC5D,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC;YAC5D,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,EAClC,wBAAwB,QAAQ,CAAC,mBAAmB,uCAAuC,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,QAAyC;QAEzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAC/C,QAAQ,CAAC,mBAAmB,CAC7B,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IACE,OAAO,CAAC,mBAAmB,KAAK,QAAQ,CAAC,mBAAmB;YAC5D,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC;YAC5D,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,EAClC,wBAAwB,QAAQ,CAAC,mBAAmB,iCAAiC,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;SAClD,CAAC,CAAC;IACL,CAAC;CACF;AAnUD,sEAmUC"}

package/src/workload-roles/aws-internal-handler.d.ts

@@ -0,0 +1,27 @@
+import { type FixedAwsIamControlPlane } from './aws-adapter.js';
+import { type AwsS3JsonControlPlane } from './aws-s3-state.js';
+import { type FixedWorkloadRoleProvisionerHandlerResult } from './handler.js';
+export interface AwsInternalWorkloadRoleProvisionerHandlerOptions {
+    bucketName: string;
+    /** @internal Test-only exact IAM command seam. */
+    iam?: FixedAwsIamControlPlane;
+    manifestDigest: string;
+    project: string;
+    provisionerFunctionArn: string;
+    /** @internal Test-only exact S3 JSON seam. */
+    s3?: AwsS3JsonControlPlane;
+    stage: string;
+}
+/**
+ * The qualified function granted to ordinary deployment is converge-only.
+ * Whole-project removal, if introduced later, requires a distinct protected
+ * function/alias and authority path.
+ */
+export declare function createConvergeOnlyWorkloadRoleProvisionerHandler(handler: (request: unknown) => Promise<FixedWorkloadRoleProvisionerHandlerResult>): (request: unknown) => Promise<FixedWorkloadRoleProvisionerHandlerResult>;
+/**
+ * Complete on-demand AWS-internal handler composition. Production supplies
+ * only baseline-fixed storage, candidate digest, stage, and project values;
+ * IAM and S3 clients are created internally and invocation input cannot
+ * replace them.
+ */
+export declare function createAwsInternalWorkloadRoleProvisionerHandler(options: AwsInternalWorkloadRoleProvisionerHandlerOptions): Promise<(request: unknown) => Promise<FixedWorkloadRoleProvisionerHandlerResult>>;

package/src/workload-roles/aws-internal-handler.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConvergeOnlyWorkloadRoleProvisionerHandler = createConvergeOnlyWorkloadRoleProvisionerHandler;
+exports.createAwsInternalWorkloadRoleProvisionerHandler = createAwsInternalWorkloadRoleProvisionerHandler;
+const aws_adapter_js_1 = require("./aws-adapter.js");
+const aws_sdk_control_plane_js_1 = require("./aws-sdk-control-plane.js");
+const aws_s3_state_js_1 = require("./aws-s3-state.js");
+const handler_js_1 = require("./handler.js");
+const provisioner_js_1 = require("./provisioner.js");
+function isConvergeRequest(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        'operation' in value &&
+        value.operation === 'converge');
+}
+/**
+ * The qualified function granted to ordinary deployment is converge-only.
+ * Whole-project removal, if introduced later, requires a distinct protected
+ * function/alias and authority path.
+ */
+function createConvergeOnlyWorkloadRoleProvisionerHandler(handler) {
+    return async (request) => {
+        if (!isConvergeRequest(request)) {
+            return {
+                classification: 'registered-request-invalid',
+                ok: false,
+                protocolVersion: provisioner_js_1.FIXED_WORKLOAD_ROLE_PROVISIONER_PROTOCOL_VERSION,
+                resultSchemaVersion: handler_js_1.FIXED_WORKLOAD_ROLE_PROVISIONER_RESULT_SCHEMA_VERSION,
+            };
+        }
+        return handler(request);
+    };
+}
+/**
+ * Complete on-demand AWS-internal handler composition. Production supplies
+ * only baseline-fixed storage, candidate digest, stage, and project values;
+ * IAM and S3 clients are created internally and invocation input cannot
+ * replace them.
+ */
+async function createAwsInternalWorkloadRoleProvisionerHandler(options) {
+    const iam = options.iam ?? (await (0, aws_sdk_control_plane_js_1.createAwsSdkV3IamControlPlane)());
+    const s3 = options.s3 ?? (await (0, aws_s3_state_js_1.createAwsSdkV3S3JsonControlPlane)());
+    const state = new aws_s3_state_js_1.AwsS3FixedWorkloadRoleStore({
+        bucketName: options.bucketName,
+        client: s3,
+        manifestDigest: options.manifestDigest,
+        project: options.project,
+        provisionerFunctionArn: options.provisionerFunctionArn,
+        stage: options.stage,
+    });
+    return createConvergeOnlyWorkloadRoleProvisionerHandler((0, handler_js_1.createFixedWorkloadRoleProvisionerHandler)({
+        adapter: new aws_adapter_js_1.FixedAwsIamProvisionerAdapter(iam),
+        source: state,
+        state,
+    }));
+}
+//# sourceMappingURL=aws-internal-handler.js.map

package/src/workload-roles/aws-internal-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-internal-handler.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/aws-internal-handler.ts"],"names":[],"mappings":";;AA4CA,4GAiBC;AAQD,0GAsBC;AA3FD,qDAG0B;AAC1B,yEAA2E;AAC3E,uDAI2B;AAC3B,6CAIsB;AACtB,qDAAoF;AAcpF,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,WAAW,IAAI,KAAK;QACpB,KAAK,CAAC,SAAS,KAAK,UAAU,CAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,gDAAgD,CAC9D,OAEuD;IAEvD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO;gBACL,cAAc,EAAE,4BAA4B;gBAC5C,EAAE,EAAE,KAAK;gBACT,eAAe,EAAE,iEAAgD;gBACjE,mBAAmB,EACjB,kEAAqD;aACxD,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,+CAA+C,CACnE,OAAyD;IAIzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAA,wDAA6B,GAAE,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,IAAA,kDAAgC,GAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,6CAA2B,CAAC;QAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,EAAE;QACV,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,OAAO,gDAAgD,CACrD,IAAA,sDAAyC,EAAC;QACxC,OAAO,EAAE,IAAI,8CAA6B,CAAC,GAAG,CAAC;QAC/C,MAAM,EAAE,KAAK;QACb,KAAK;KACN,CAAC,CACH,CAAC;AACJ,CAAC"}

package/src/workload-roles/aws-s3-state.d.ts

@@ -0,0 +1,52 @@
+import type { FixedWorkloadRoleProvisionerStateStore } from './handler.js';
+import type { WorkloadRoleHistory } from './history.js';
+import { type FixedRegisteredManifestSource, type ProvisionedWorkloadRoleRegistrationDocument } from './registration.js';
+export interface AwsS3JsonControlPlane {
+    deleteObject(input: {
+        bucketName: string;
+        key: string;
+    }): Promise<void>;
+    getJson(input: {
+        bucketName: string;
+        key: string;
+    }): Promise<unknown | undefined>;
+    putJson(input: {
+        bucketName: string;
+        key: string;
+        value: unknown;
+    }): Promise<void>;
+}
+/**
+ * Fixed AWS SDK v3 S3 JSON transport. The caller passes only bucket/key values
+ * already derived by the store; provisioner invocation input never reaches
+ * this layer.
+ */
+export declare function createAwsSdkV3S3JsonControlPlane(options?: {
+    clientConfiguration?: Readonly<Record<string, unknown>>;
+    /** @internal Test-only module seam. */
+    loadModule?: () => Promise<unknown>;
+}): Promise<AwsS3JsonControlPlane>;
+/**
+ * S3-backed fixed provisioner source/state. S3 avoids Parameter Store's 4 KB
+ * standard and 8 KB advanced limits; candidate-digest keys make manifest and
+ * provisioned results exact and collision-resistant.
+ */
+export declare class AwsS3FixedWorkloadRoleStore implements FixedRegisteredManifestSource, FixedWorkloadRoleProvisionerStateStore {
+    #private;
+    readonly bucketName: string;
+    readonly historyKey: string;
+    readonly provisionedRegistrationKey: string;
+    readonly registeredManifestKey: string;
+    constructor(options: {
+        bucketName: string;
+        client: AwsS3JsonControlPlane;
+        manifestDigest: string;
+        project: string;
+        provisionerFunctionArn: string;
+        stage: string;
+    });
+    load(): Promise<unknown>;
+    loadHistory(): Promise<unknown | undefined>;
+    saveHistory(history: WorkloadRoleHistory): Promise<void>;
+    saveProvisionedRegistration(document: ProvisionedWorkloadRoleRegistrationDocument | undefined): Promise<void>;
+}