@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/workload-roles/injection.d.ts

@@ -0,0 +1,119 @@
+import { type WorkloadRoleManifest, type WorkloadRoleOwnership, type WorkloadRoleSurface, type WorkloadRoleTrustClass } from './manifest.js';
+export declare const WORKLOAD_ROLE_INJECTION_SST_VERSION: "4.17.1";
+export type WorkloadRoleInjectionFailureClassification = 'injection-kind-mismatch' | 'role-registration-ambiguous' | 'role-registration-incomplete' | 'role-registration-substitution';
+export declare class WorkloadRoleInjectionContractError extends Error {
+    readonly classification: WorkloadRoleInjectionFailureClassification;
+    constructor(classification: WorkloadRoleInjectionFailureClassification, message: string);
+}
+export interface ProvisionedWorkloadRole {
+    boundaryArn: string;
+    id: string;
+    ownership: WorkloadRoleOwnership;
+    passDestinations: string[];
+    permissionPolicyDigest: string;
+    roleArn: string;
+    roleName: string;
+    surface: WorkloadRoleSurface;
+    trustClass: WorkloadRoleTrustClass;
+}
+export interface ProvisionedWorkloadRoleRegistration {
+    candidateIdentity: string;
+    manifestDigest: string;
+    provisionerFunctionArn: string;
+    roles: ProvisionedWorkloadRole[];
+    stage: string;
+}
+export type WorkloadRoleInjectionKind = 'pulumi-appconfig-monitor-role-arn' | 'sst-function-role-arn' | 'sst-fargate-execution-role-name' | 'sst-fargate-task-role-name' | 'sst-vpc-nat-role-name' | 'pulumi-state-machine-role-arn';
+export interface WorkloadRoleInjectionDisposition {
+    fallbackRoleSynthesis: 'forbidden';
+    kind: WorkloadRoleInjectionKind;
+    target: string;
+}
+export declare const WORKLOAD_ROLE_INJECTION_DISPOSITIONS: Readonly<Record<WorkloadRoleSurface, WorkloadRoleInjectionDisposition>>;
+export declare class ExactProvisionedWorkloadRoleRegistry {
+    #private;
+    readonly candidateIdentity: string;
+    readonly manifest: WorkloadRoleManifest;
+    readonly manifestDigest: string;
+    readonly provisionerFunctionArn: string;
+    readonly stage: string;
+    constructor(manifestValue: unknown, registration: ProvisionedWorkloadRoleRegistration);
+    resolve(roleId: string): ProvisionedWorkloadRole;
+}
+export declare function createSstFunctionRoleInput(registry: ExactProvisionedWorkloadRoleRegistry, roleId: string): {
+    role: string;
+};
+export declare function createSstFargateRoleInput(registry: ExactProvisionedWorkloadRoleRegistry, options: {
+    executionRoleId: string;
+    taskRoleId: string;
+}): {
+    executionRole: string;
+    taskRole: string;
+};
+export declare function createSstVpcNatRoleInput(registry: ExactProvisionedWorkloadRoleRegistry, roleId: string): {
+    nat: {
+        ec2: {
+            instance: 't4g.nano';
+            role: string;
+        };
+        type: 'ec2';
+    };
+};
+export interface RawStepFunctionsRoleInput {
+    implementation: 'aws.sfn.StateMachine';
+    roleArn: string;
+    sstRoleFallback: 'forbidden';
+}
+export interface RawAppConfigMonitorRoleInput {
+    implementation: 'aws.appconfig.Environment';
+    roleArn: string;
+    pulumiRoleFallback: 'forbidden';
+}
+export declare function createRawAppConfigMonitorRoleInput(registry: ExactProvisionedWorkloadRoleRegistry, roleId: string): RawAppConfigMonitorRoleInput;
+export declare function createRawStepFunctionsRoleInput(registry: ExactProvisionedWorkloadRoleRegistry, roleId: string): RawStepFunctionsRoleInput;
+export interface RawEcsRunTaskInvocation {
+    assignPublicIp: boolean;
+    clusterArn: string;
+    securityGroupIds: string[];
+    subnetIds: string[];
+    taskDefinitionArn: string;
+}
+export interface RawEcsTaskTokenInvocation extends RawEcsRunTaskInvocation {
+    containerName: string;
+}
+export interface RawStateMachineArgs {
+    definition: string;
+    loggingConfiguration: {
+        includeExecutionData: false;
+        level: 'ERROR';
+        logDestination: string;
+    };
+    roleArn: string;
+    type: 'STANDARD';
+}
+export interface RawStateMachine extends RawStepFunctionsRoleInput {
+    stateMachineArgs: RawStateMachineArgs;
+}
+/**
+ * Bounded replacement for the current
+ * BootstrapDatabase -> RunDatabaseMigration -> Succeed SST graph.
+ * A later generator integration can replace literal values with Pulumi Inputs
+ * through $jsonStringify without changing this fixed ASL topology.
+ */
+export declare function createRawDatabaseMigrationStateMachine(registry: ExactProvisionedWorkloadRoleRegistry, options: {
+    bootstrap: RawEcsRunTaskInvocation;
+    logDestination: string;
+    migration: RawEcsRunTaskInvocation;
+    roleId: string;
+}): RawStateMachine;
+/**
+ * Bounded retirement callback graph. Only the exact retirement container
+ * receives the Step Functions token. Its verified SendTaskSuccess payload
+ * flows through the Succeed state as execution output, preserving absence and
+ * sibling-database evidence for the protected caller.
+ */
+export declare function createRawDatabaseRetirementStateMachine(registry: ExactProvisionedWorkloadRoleRegistry, options: {
+    logDestination: string;
+    retirement: RawEcsTaskTokenInvocation;
+    roleId: string;
+}): RawStateMachine;

package/src/workload-roles/injection.js

@@ -0,0 +1,495 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExactProvisionedWorkloadRoleRegistry = exports.WORKLOAD_ROLE_INJECTION_DISPOSITIONS = exports.WorkloadRoleInjectionContractError = exports.WORKLOAD_ROLE_INJECTION_SST_VERSION = void 0;
+exports.createSstFunctionRoleInput = createSstFunctionRoleInput;
+exports.createSstFargateRoleInput = createSstFargateRoleInput;
+exports.createSstVpcNatRoleInput = createSstVpcNatRoleInput;
+exports.createRawAppConfigMonitorRoleInput = createRawAppConfigMonitorRoleInput;
+exports.createRawStepFunctionsRoleInput = createRawStepFunctionsRoleInput;
+exports.createRawDatabaseMigrationStateMachine = createRawDatabaseMigrationStateMachine;
+exports.createRawDatabaseRetirementStateMachine = createRawDatabaseRetirementStateMachine;
+const manifest_js_1 = require("./manifest.js");
+const tool_versions_js_1 = require("../generators/preset/tool-versions.js");
+exports.WORKLOAD_ROLE_INJECTION_SST_VERSION = tool_versions_js_1.WORKSPACE_SST_VERSION;
+class WorkloadRoleInjectionContractError extends Error {
+    classification;
+    constructor(classification, message) {
+        super(message);
+        this.classification = classification;
+        this.name = 'WorkloadRoleInjectionContractError';
+    }
+}
+exports.WorkloadRoleInjectionContractError = WorkloadRoleInjectionContractError;
+exports.WORKLOAD_ROLE_INJECTION_DISPOSITIONS = {
+    'appconfig-monitor': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'pulumi-appconfig-monitor-role-arn',
+        target: 'aws.appconfig.Environment.monitors.alarmRoleArn',
+    },
+    'api-route': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-function-role-arn',
+        target: 'sst.aws.ApiGatewayV2.transform.route.handler.role',
+    },
+    'bootstrap-execution': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-execution-role-name',
+        target: 'sst.aws.Task.executionRole',
+    },
+    'bootstrap-task': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-task-role-name',
+        target: 'sst.aws.Task.taskRole',
+    },
+    'foundation-nat-instance': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-vpc-nat-role-name',
+        target: 'sst.aws.Vpc.nat.ec2.role',
+    },
+    'job-execution': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-execution-role-name',
+        target: 'sst.aws.Task.executionRole',
+    },
+    'job-orchestration': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'pulumi-state-machine-role-arn',
+        target: 'aws.sfn.StateMachine.roleArn',
+    },
+    'job-task': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-task-role-name',
+        target: 'sst.aws.Task.taskRole',
+    },
+    'lambda-function': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-function-role-arn',
+        target: 'sst.aws.Function.role',
+    },
+    'migration-execution': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-execution-role-name',
+        target: 'sst.aws.Task.executionRole',
+    },
+    'migration-orchestration': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'pulumi-state-machine-role-arn',
+        target: 'aws.sfn.StateMachine.roleArn',
+    },
+    'migration-task': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-task-role-name',
+        target: 'sst.aws.Task.taskRole',
+    },
+    'next-image-optimizer': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-function-role-arn',
+        target: 'sst.aws.Nextjs.transform.imageOptimizer.role',
+    },
+    'next-revalidation-seeder': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-function-role-arn',
+        target: 'sst.aws.Nextjs.transform.revalidationSeeder.role',
+    },
+    'next-revalidation-subscriber': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-function-role-arn',
+        target: 'sst.aws.Nextjs.transform.revalidationEventsSubscriber.role',
+    },
+    'next-server': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-function-role-arn',
+        target: 'sst.aws.Nextjs.transform.server.role',
+    },
+    'queue-consumer': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-function-role-arn',
+        target: 'sst.aws.Queue.subscribe.transform.function.role',
+    },
+    'retirement-execution': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-execution-role-name',
+        target: 'sst.aws.Task.executionRole',
+    },
+    'retirement-orchestration': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'pulumi-state-machine-role-arn',
+        target: 'aws.sfn.StateMachine.roleArn',
+    },
+    'retirement-task': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-task-role-name',
+        target: 'sst.aws.Task.taskRole',
+    },
+    'service-execution': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-execution-role-name',
+        target: 'sst.aws.Service.executionRole',
+    },
+    'service-task': {
+        fallbackRoleSynthesis: 'forbidden',
+        kind: 'sst-fargate-task-role-name',
+        target: 'sst.aws.Service.taskRole',
+    },
+};
+const FARGATE_EXECUTION_SURFACE_BY_TASK = {
+    'bootstrap-task': 'bootstrap-execution',
+    'job-task': 'job-execution',
+    'migration-task': 'migration-execution',
+    'retirement-task': 'retirement-execution',
+    'service-task': 'service-execution',
+};
+const roleArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::(\d{12}):role\/([A-Za-z0-9+=,.@_-]{1,64})$/;
+const boundaryArnPattern = /^arn:(aws|aws-us-gov|aws-cn):iam::(\d{12}):policy\/[A-Za-z0-9+=,.@_/-]+$/;
+const qualifiedLambdaArnPattern = /^arn:(aws|aws-us-gov|aws-cn):lambda:[a-z0-9-]+:(\d{12}):function:[A-Za-z0-9-_]+:[A-Za-z0-9-_]+$/;
+function sameStringArray(left, right) {
+    return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
+}
+function sameOwnership(left, right) {
+    return left.project === right.project && left.resource === right.resource;
+}
+function assertRoleArn(registration, declaration) {
+    const roleMatch = roleArnPattern.exec(registration.roleArn);
+    const boundaryMatch = boundaryArnPattern.exec(declaration.boundaryArn);
+    if (!roleMatch ||
+        !boundaryMatch ||
+        roleMatch[1] !== boundaryMatch[1] ||
+        roleMatch[2] !== boundaryMatch[2] ||
+        roleMatch[3] !== declaration.roleName) {
+        throw new WorkloadRoleInjectionContractError('role-registration-substitution', `Registered role ARN ${registration.roleArn} is not the exact account, partition, and name declared for ${declaration.id}.`);
+    }
+}
+function assertExactRegistration(registration, declaration) {
+    assertRoleArn(registration, declaration);
+    if (registration.id !== declaration.id ||
+        registration.roleName !== declaration.roleName ||
+        registration.surface !== declaration.surface ||
+        registration.trustClass !== declaration.trustClass ||
+        registration.boundaryArn !== declaration.boundaryArn ||
+        registration.permissionPolicyDigest !==
+            declaration.permissionPolicyDigest ||
+        !sameOwnership(registration.ownership, declaration.ownership) ||
+        !sameStringArray(registration.passDestinations, declaration.passDestinations)) {
+        throw new WorkloadRoleInjectionContractError('role-registration-substitution', `Provisioned role ${registration.id} does not exactly match its registered manifest declaration.`);
+    }
+}
+class ExactProvisionedWorkloadRoleRegistry {
+    candidateIdentity;
+    manifest;
+    manifestDigest;
+    provisionerFunctionArn;
+    stage;
+    #roles;
+    constructor(manifestValue, registration) {
+        const manifest = (0, manifest_js_1.canonicalizeWorkloadRoleManifest)(manifestValue);
+        const manifestDigest = (0, manifest_js_1.digestWorkloadRoleManifest)(manifest);
+        if (registration.candidateIdentity !== manifest.candidate.identity ||
+            registration.stage !== manifest.candidate.stage ||
+            registration.manifestDigest !== manifestDigest) {
+            throw new WorkloadRoleInjectionContractError('role-registration-substitution', 'The provisioned-role registration does not match the exact manifest candidate, stage, and digest.');
+        }
+        const boundaryMatch = boundaryArnPattern.exec(manifest.roles[0]?.boundaryArn ?? '');
+        const provisionerMatch = qualifiedLambdaArnPattern.exec(registration.provisionerFunctionArn);
+        if (!boundaryMatch ||
+            !provisionerMatch ||
+            boundaryMatch[1] !== provisionerMatch[1] ||
+            boundaryMatch[2] !== provisionerMatch[2]) {
+            throw new WorkloadRoleInjectionContractError('role-registration-substitution', 'The fixed qualified provisioner function must use the registered workload-role account and partition.');
+        }
+        const declarationsById = new Map(manifest.roles.map((declaration) => [declaration.id, declaration]));
+        const roles = new Map();
+        for (const role of registration.roles) {
+            if (roles.has(role.id)) {
+                throw new WorkloadRoleInjectionContractError('role-registration-ambiguous', `Provisioned role ${role.id} is registered more than once.`);
+            }
+            const declaration = declarationsById.get(role.id);
+            if (!declaration) {
+                throw new WorkloadRoleInjectionContractError('role-registration-substitution', `Provisioned role ${role.id} is not declared by the registered manifest.`);
+            }
+            assertExactRegistration(role, declaration);
+            roles.set(role.id, freezeProvisionedRole(role));
+        }
+        const missing = manifest.roles
+            .filter(({ id }) => !roles.has(id))
+            .map(({ id }) => id);
+        if (missing.length > 0) {
+            throw new WorkloadRoleInjectionContractError('role-registration-incomplete', `Provisioned-role registration is missing: ${missing.join(', ')}.`);
+        }
+        this.candidateIdentity = manifest.candidate.identity;
+        this.manifest = freezeManifest(manifest);
+        this.manifestDigest = manifestDigest;
+        this.provisionerFunctionArn = registration.provisionerFunctionArn;
+        this.stage = manifest.candidate.stage;
+        this.#roles = roles;
+    }
+    resolve(roleId) {
+        const role = this.#roles.get(roleId);
+        if (!role) {
+            throw new WorkloadRoleInjectionContractError('role-registration-incomplete', `No exact provisioned role is registered for ${roleId}; fallback synthesis is forbidden.`);
+        }
+        return role;
+    }
+}
+exports.ExactProvisionedWorkloadRoleRegistry = ExactProvisionedWorkloadRoleRegistry;
+function freezeManifest(manifest) {
+    const roles = manifest.roles.map((role) => Object.freeze({
+        ...role,
+        ownership: Object.freeze({ ...role.ownership }),
+        passDestinations: Object.freeze([
+            ...role.passDestinations,
+        ]),
+    }));
+    return Object.freeze({
+        candidate: Object.freeze({ ...manifest.candidate }),
+        schemaVersion: manifest.schemaVersion,
+        roles: Object.freeze(roles),
+    });
+}
+function freezeProvisionedRole(role) {
+    return Object.freeze({
+        ...role,
+        ownership: Object.freeze({ ...role.ownership }),
+        passDestinations: Object.freeze([
+            ...role.passDestinations,
+        ]),
+    });
+}
+function requireInjectionKind(registry, roleId, expectedKind) {
+    const role = registry.resolve(roleId);
+    const disposition = exports.WORKLOAD_ROLE_INJECTION_DISPOSITIONS[role.surface];
+    if (disposition.kind !== expectedKind) {
+        throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', `Role ${roleId} uses ${disposition.kind}, not ${expectedKind}.`);
+    }
+    return role;
+}
+function createSstFunctionRoleInput(registry, roleId) {
+    return {
+        role: requireInjectionKind(registry, roleId, 'sst-function-role-arn')
+            .roleArn,
+    };
+}
+function createSstFargateRoleInput(registry, options) {
+    const taskRole = requireInjectionKind(registry, options.taskRoleId, 'sst-fargate-task-role-name');
+    const executionRole = requireInjectionKind(registry, options.executionRoleId, 'sst-fargate-execution-role-name');
+    const expectedExecutionSurface = FARGATE_EXECUTION_SURFACE_BY_TASK[taskRole.surface];
+    if (executionRole.surface !== expectedExecutionSurface ||
+        taskRole.ownership.project !== executionRole.ownership.project ||
+        taskRole.ownership.resource !== executionRole.ownership.resource) {
+        throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', 'Fargate task and execution roles must be the exact paired surfaces for one manifest resource.');
+    }
+    return {
+        executionRole: executionRole.roleName,
+        taskRole: taskRole.roleName,
+    };
+}
+function createSstVpcNatRoleInput(registry, roleId) {
+    const role = requireInjectionKind(registry, roleId, 'sst-vpc-nat-role-name');
+    return {
+        nat: {
+            ec2: { instance: 't4g.nano', role: role.roleName },
+            type: 'ec2',
+        },
+    };
+}
+function createRawAppConfigMonitorRoleInput(registry, roleId) {
+    const role = requireInjectionKind(registry, roleId, 'pulumi-appconfig-monitor-role-arn');
+    return {
+        implementation: 'aws.appconfig.Environment',
+        pulumiRoleFallback: 'forbidden',
+        roleArn: role.roleArn,
+    };
+}
+function createRawStepFunctionsRoleInput(registry, roleId) {
+    const role = requireInjectionKind(registry, roleId, 'pulumi-state-machine-role-arn');
+    return {
+        implementation: 'aws.sfn.StateMachine',
+        roleArn: role.roleArn,
+        sstRoleFallback: 'forbidden',
+    };
+}
+const RAW_TASK_STATE_FIELDS = new Set([
+    'Arguments',
+    'Next',
+    'QueryLanguage',
+    'Resource',
+    'TimeoutSeconds',
+    'Type',
+]);
+const RAW_SUCCEED_STATE_FIELDS = new Set(['QueryLanguage', 'Type']);
+const ECS_CLUSTER_ARN_PATTERN = /^arn:(aws|aws-us-gov|aws-cn):ecs:[a-z0-9-]+:\d{12}:cluster\/[A-Za-z0-9+=,.@_/-]+$/;
+const ECS_TASK_DEFINITION_ARN_PATTERN = /^arn:(aws|aws-us-gov|aws-cn):ecs:[a-z0-9-]+:\d{12}:task-definition\/[A-Za-z0-9_-]{1,255}:\d+$/;
+const LOG_DESTINATION_ARN_PATTERN = /^arn:(aws|aws-us-gov|aws-cn):logs:[a-z0-9-]+:\d{12}:log-group:[A-Za-z0-9_./#-]+:\*$/;
+const SECURITY_GROUP_ID_PATTERN = /^sg-[a-f0-9]{8,17}$/;
+const SUBNET_ID_PATTERN = /^subnet-[a-f0-9]{8,17}$/;
+const ECS_CONTAINER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,255}$/;
+const JSONATA_DELIMITER_PATTERN = /{%|%}/;
+const ECS_RUN_TASK_SYNC_RESOURCE = 'arn:aws:states:::ecs:runTask.sync';
+const ECS_RUN_TASK_CALLBACK_RESOURCE = 'arn:aws:states:::ecs:runTask.waitForTaskToken';
+const DATABASE_LIFECYCLE_CORRELATION_EXPRESSION = '{% $states.input.databaseLifecycleCorrelationId %}';
+const TASK_TOKEN_EXPRESSION = '{% $states.context.Task.Token %}';
+/**
+ * Validates only the two bounded raw graphs emitted by the v1 generator. This is
+ * intentionally not a general ASL validator. AWS names the static Task timeout
+ * field `TimeoutSeconds`, including for JSONata states.
+ */
+function assertBoundedRawStateMachineDefinition(definition) {
+    if (definition.StartAt.trim() === '' ||
+        !(definition.StartAt in definition.States)) {
+        throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', 'Raw Step Functions definition must start at one of its named states.');
+    }
+    for (const [name, state] of Object.entries(definition.States)) {
+        const fields = state.Type === 'Task'
+            ? RAW_TASK_STATE_FIELDS
+            : state.Type === 'Succeed'
+                ? RAW_SUCCEED_STATE_FIELDS
+                : undefined;
+        if (!fields || Object.keys(state).some((field) => !fields.has(field))) {
+            throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', `Raw Step Functions state ${name} contains an unsupported ASL field or type.`);
+        }
+        if (state.QueryLanguage !== 'JSONata') {
+            throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', `Raw Step Functions state ${name} must use JSONata.`);
+        }
+        if (state.Type === 'Task') {
+            if ((state.Resource !== ECS_RUN_TASK_SYNC_RESOURCE &&
+                state.Resource !== ECS_RUN_TASK_CALLBACK_RESOURCE) ||
+                !Number.isSafeInteger(state.TimeoutSeconds) ||
+                state.TimeoutSeconds <= 0 ||
+                typeof state.Next !== 'string' ||
+                !(state.Next in definition.States) ||
+                typeof state.Arguments !== 'object' ||
+                state.Arguments === null ||
+                Array.isArray(state.Arguments)) {
+                throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', `Raw Step Functions Task state ${name} is not a bounded ECS task.`);
+            }
+        }
+    }
+}
+function requireNonEmpty(value, label) {
+    if (value.trim() === '') {
+        throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', `${label} must be a non-empty exact resource identifier.`);
+    }
+    return value;
+}
+function requireExactResource(value, label, pattern) {
+    const exact = requireNonEmpty(value, label);
+    if (JSONATA_DELIMITER_PATTERN.test(exact) || !pattern.test(exact)) {
+        throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', `${label} must be a literal exact resource identifier with the supported format.`);
+    }
+    return exact;
+}
+function createRawEcsRunTaskState(invocation, next) {
+    return {
+        Arguments: createRawEcsRunTaskArguments(invocation),
+        Next: next,
+        QueryLanguage: 'JSONata',
+        Resource: ECS_RUN_TASK_SYNC_RESOURCE,
+        TimeoutSeconds: 45 * 60,
+        Type: 'Task',
+    };
+}
+function createRawEcsRunTaskArguments(invocation) {
+    if (invocation.securityGroupIds.length === 0 ||
+        invocation.subnetIds.length === 0) {
+        throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', 'Raw ECS Step Functions tasks require exact non-empty security-group and subnet sets.');
+    }
+    return {
+        Cluster: requireExactResource(invocation.clusterArn, 'clusterArn', ECS_CLUSTER_ARN_PATTERN),
+        LaunchType: 'FARGATE',
+        NetworkConfiguration: {
+            AwsvpcConfiguration: {
+                AssignPublicIp: invocation.assignPublicIp ? 'ENABLED' : 'DISABLED',
+                SecurityGroups: invocation.securityGroupIds.map((id) => requireExactResource(id, 'securityGroupId', SECURITY_GROUP_ID_PATTERN)),
+                Subnets: invocation.subnetIds.map((id) => requireExactResource(id, 'subnetId', SUBNET_ID_PATTERN)),
+            },
+        },
+        TaskDefinition: requireExactResource(invocation.taskDefinitionArn, 'taskDefinitionArn', ECS_TASK_DEFINITION_ARN_PATTERN),
+    };
+}
+function createRawEcsTaskTokenState(invocation, next) {
+    if (JSONATA_DELIMITER_PATTERN.test(invocation.containerName) ||
+        !ECS_CONTAINER_NAME_PATTERN.test(invocation.containerName)) {
+        throw new WorkloadRoleInjectionContractError('injection-kind-mismatch', 'A raw ECS callback task requires one exact callback container name.');
+    }
+    return {
+        Arguments: {
+            ...createRawEcsRunTaskArguments(invocation),
+            Overrides: {
+                ContainerOverrides: [
+                    {
+                        Environment: [
+                            {
+                                Name: 'EBK_DATABASE_LIFECYCLE_CORRELATION_ID',
+                                Value: DATABASE_LIFECYCLE_CORRELATION_EXPRESSION,
+                            },
+                            {
+                                Name: 'EBK_STEP_FUNCTIONS_TASK_TOKEN',
+                                Value: TASK_TOKEN_EXPRESSION,
+                            },
+                        ],
+                        Name: invocation.containerName,
+                    },
+                ],
+            },
+        },
+        Next: next,
+        QueryLanguage: 'JSONata',
+        Resource: ECS_RUN_TASK_CALLBACK_RESOURCE,
+        TimeoutSeconds: 45 * 60,
+        Type: 'Task',
+    };
+}
+function createRawStateMachine(registry, roleId, definition, logDestination) {
+    const binding = createRawStepFunctionsRoleInput(registry, roleId);
+    assertBoundedRawStateMachineDefinition(definition);
+    return {
+        ...binding,
+        stateMachineArgs: {
+            definition: JSON.stringify(definition),
+            loggingConfiguration: {
+                includeExecutionData: false,
+                level: 'ERROR',
+                logDestination: requireExactResource(logDestination, 'logDestination', LOG_DESTINATION_ARN_PATTERN),
+            },
+            roleArn: binding.roleArn,
+            type: 'STANDARD',
+        },
+    };
+}
+/**
+ * Bounded replacement for the current
+ * BootstrapDatabase -> RunDatabaseMigration -> Succeed SST graph.
+ * A later generator integration can replace literal values with Pulumi Inputs
+ * through $jsonStringify without changing this fixed ASL topology.
+ */
+function createRawDatabaseMigrationStateMachine(registry, options) {
+    return createRawStateMachine(registry, options.roleId, {
+        StartAt: 'BootstrapDatabase',
+        States: {
+            BootstrapDatabase: createRawEcsRunTaskState(options.bootstrap, 'RunDatabaseMigration'),
+            DatabaseMigrationSucceeded: {
+                QueryLanguage: 'JSONata',
+                Type: 'Succeed',
+            },
+            RunDatabaseMigration: createRawEcsRunTaskState(options.migration, 'DatabaseMigrationSucceeded'),
+        },
+    }, options.logDestination);
+}
+/**
+ * Bounded retirement callback graph. Only the exact retirement container
+ * receives the Step Functions token. Its verified SendTaskSuccess payload
+ * flows through the Succeed state as execution output, preserving absence and
+ * sibling-database evidence for the protected caller.
+ */
+function createRawDatabaseRetirementStateMachine(registry, options) {
+    return createRawStateMachine(registry, options.roleId, {
+        StartAt: 'RetireDatabase',
+        States: {
+            DatabaseRetirementSucceeded: {
+                QueryLanguage: 'JSONata',
+                Type: 'Succeed',
+            },
+            RetireDatabase: createRawEcsTaskTokenState(options.retirement, 'DatabaseRetirementSucceeded'),
+        },
+    }, options.logDestination);
+}
+//# sourceMappingURL=injection.js.map

package/src/workload-roles/injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workload-roles/injection.ts"],"names":[],"mappings":";;;AA0YA,gEAQC;AAED,8DA8BC;AAED,4DAgBC;AAcD,gFAcC;AAED,0EAcC;AAkRD,wFA+BC;AAQD,0FA0BC;AAn0BD,+CAQuB;AACvB,4EAA8E;AAEjE,QAAA,mCAAmC,GAAG,wCAAqB,CAAC;AAQzE,MAAa,kCAAmC,SAAQ,KAAK;IAEhD;IADX,YACW,cAA0D,EACnE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,mBAAc,GAAd,cAAc,CAA4C;QAInE,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AARD,gFAQC;AAoCY,QAAA,oCAAoC,GAE7C;IACF,mBAAmB,EAAE;QACnB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,iDAAiD;KAC1D;IACD,WAAW,EAAE;QACX,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,mDAAmD;KAC5D;IACD,qBAAqB,EAAE;QACrB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,4BAA4B;KACrC;IACD,gBAAgB,EAAE;QAChB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,uBAAuB;KAChC;IACD,yBAAyB,EAAE;QACzB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,0BAA0B;KACnC;IACD,eAAe,EAAE;QACf,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,4BAA4B;KACrC;IACD,mBAAmB,EAAE;QACnB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,8BAA8B;KACvC;IACD,UAAU,EAAE;QACV,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,uBAAuB;KAChC;IACD,iBAAiB,EAAE;QACjB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,uBAAuB;KAChC;IACD,qBAAqB,EAAE;QACrB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,4BAA4B;KACrC;IACD,yBAAyB,EAAE;QACzB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,8BAA8B;KACvC;IACD,gBAAgB,EAAE;QAChB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,uBAAuB;KAChC;IACD,sBAAsB,EAAE;QACtB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,8CAA8C;KACvD;IACD,0BAA0B,EAAE;QAC1B,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,kDAAkD;KAC3D;IACD,8BAA8B,EAAE;QAC9B,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,4DAA4D;KACrE;IACD,aAAa,EAAE;QACb,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,sCAAsC;KAC/C;IACD,gBAAgB,EAAE;QAChB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,iDAAiD;KAC1D;IACD,sBAAsB,EAAE;QACtB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,4BAA4B;KACrC;IACD,0BAA0B,EAAE;QAC1B,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,8BAA8B;KACvC;IACD,iBAAiB,EAAE;QACjB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,uBAAuB;KAChC;IACD,mBAAmB,EAAE;QACnB,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,+BAA+B;KACxC;IACD,cAAc,EAAE;QACd,qBAAqB,EAAE,WAAW;QAClC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,0BAA0B;KACnC;CACF,CAAC;AAEF,MAAM,iCAAiC,GAEnC;IACF,gBAAgB,EAAE,qBAAqB;IACvC,UAAU,EAAE,eAAe;IAC3B,gBAAgB,EAAE,qBAAqB;IACvC,iBAAiB,EAAE,sBAAsB;IACzC,cAAc,EAAE,mBAAmB;CACpC,CAAC;AAEF,MAAM,cAAc,GAClB,8EAA8E,CAAC;AACjF,MAAM,kBAAkB,GACtB,0EAA0E,CAAC;AAC7E,MAAM,yBAAyB,GAC7B,iGAAiG,CAAC;AAEpG,SAAS,eAAe,CACtB,IAAuB,EACvB,KAAwB;IAExB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CACpB,IAA2B,EAC3B,KAA4B;IAE5B,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CACpB,YAAqC,EACrC,WAAoC;IAEpC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACvE,IACE,CAAC,SAAS;QACV,CAAC,aAAa;QACd,SAAS,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;QACjC,SAAS,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;QACjC,SAAS,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,EACrC,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,gCAAgC,EAChC,uBAAuB,YAAY,CAAC,OAAO,+DAA+D,WAAW,CAAC,EAAE,GAAG,CAC5H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,YAAqC,EACrC,WAAoC;IAEpC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACzC,IACE,YAAY,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE;QAClC,YAAY,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;QAC9C,YAAY,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO;QAC5C,YAAY,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU;QAClD,YAAY,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW;QACpD,YAAY,CAAC,sBAAsB;YACjC,WAAW,CAAC,sBAAsB;QACpC,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC;QAC7D,CAAC,eAAe,CACd,YAAY,CAAC,gBAAgB,EAC7B,WAAW,CAAC,gBAAgB,CAC7B,EACD,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,gCAAgC,EAChC,oBAAoB,YAAY,CAAC,EAAE,8DAA8D,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAa,oCAAoC;IACtC,iBAAiB,CAAS;IAC1B,QAAQ,CAAuB;IAC/B,cAAc,CAAS;IACvB,sBAAsB,CAAS;IAC/B,KAAK,CAAS;IAEd,MAAM,CAA+C;IAE9D,YACE,aAAsB,EACtB,YAAiD;QAEjD,MAAM,QAAQ,GAAG,IAAA,8CAAgC,EAAC,aAAa,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,IAAA,wCAA0B,EAAC,QAAQ,CAAC,CAAC;QAC5D,IACE,YAAY,CAAC,iBAAiB,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;YAC9D,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,SAAS,CAAC,KAAK;YAC/C,YAAY,CAAC,cAAc,KAAK,cAAc,EAC9C,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,gCAAgC,EAChC,mGAAmG,CACpG,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAC3C,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CACrC,CAAC;QACF,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,IAAI,CACrD,YAAY,CAAC,sBAAsB,CACpC,CAAC;QACF,IACE,CAAC,aAAa;YACd,CAAC,gBAAgB;YACjB,aAAa,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACxC,aAAa,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,gCAAgC,EAChC,uGAAuG,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CACnE,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,kCAAkC,CAC1C,6BAA6B,EAC7B,oBAAoB,IAAI,CAAC,EAAE,gCAAgC,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,kCAAkC,CAC1C,gCAAgC,EAChC,oBAAoB,IAAI,CAAC,EAAE,8CAA8C,CAC1E,CAAC;YACJ,CAAC;YACD,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK;aAC3B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAClC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,kCAAkC,CAC1C,8BAA8B,EAC9B,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,sBAAsB,GAAG,YAAY,CAAC,sBAAsB,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,kCAAkC,CAC1C,8BAA8B,EAC9B,+CAA+C,MAAM,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA5FD,oFA4FC;AAED,SAAS,cAAc,CAAC,QAA8B;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,MAAM,CAAC,MAAM,CAAC;QACZ,GAAG,IAAI;QACP,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;YAC9B,GAAG,IAAI,CAAC,gBAAgB;SACzB,CAAwB;KAC1B,CAAC,CACH,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;QACnD,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAyC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6B;IAE7B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;YAC9B,GAAG,IAAI,CAAC,gBAAgB;SACzB,CAAwB;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAA8C,EAC9C,MAAc,EACd,YAAuC;IAEvC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,4CAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,WAAW,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,QAAQ,MAAM,SAAS,WAAW,CAAC,IAAI,SAAS,YAAY,GAAG,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,0BAA0B,CACxC,QAA8C,EAC9C,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,uBAAuB,CAAC;aAClE,OAAO;KACX,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CACvC,QAA8C,EAC9C,OAAwD;IAExD,MAAM,QAAQ,GAAG,oBAAoB,CACnC,QAAQ,EACR,OAAO,CAAC,UAAU,EAClB,4BAA4B,CAC7B,CAAC;IACF,MAAM,aAAa,GAAG,oBAAoB,CACxC,QAAQ,EACR,OAAO,CAAC,eAAe,EACvB,iCAAiC,CAClC,CAAC;IACF,MAAM,wBAAwB,GAC5B,iCAAiC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,IACE,aAAa,CAAC,OAAO,KAAK,wBAAwB;QAClD,QAAQ,CAAC,SAAS,CAAC,OAAO,KAAK,aAAa,CAAC,SAAS,CAAC,OAAO;QAC9D,QAAQ,CAAC,SAAS,CAAC,QAAQ,KAAK,aAAa,CAAC,SAAS,CAAC,QAAQ,EAChE,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,aAAa,CAAC,QAAQ;QACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,QAA8C,EAC9C,MAAc;IAOd,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC7E,OAAO;QACL,GAAG,EAAE;YACH,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YAClD,IAAI,EAAE,KAAK;SACZ;KACF,CAAC;AACJ,CAAC;AAcD,SAAgB,kCAAkC,CAChD,QAA8C,EAC9C,MAAc;IAEd,MAAM,IAAI,GAAG,oBAAoB,CAC/B,QAAQ,EACR,MAAM,EACN,mCAAmC,CACpC,CAAC;IACF,OAAO;QACL,cAAc,EAAE,2BAA2B;QAC3C,kBAAkB,EAAE,WAAW;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,QAA8C,EAC9C,MAAc;IAEd,MAAM,IAAI,GAAG,oBAAoB,CAC/B,QAAQ,EACR,MAAM,EACN,+BAA+B,CAChC,CAAC;IACF,OAAO;QACL,cAAc,EAAE,sBAAsB;QACtC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,WAAW;KAC7B,CAAC;AACJ,CAAC;AAkCD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,WAAW;IACX,MAAM;IACN,eAAe;IACf,UAAU;IACV,gBAAgB;IAChB,MAAM;CACP,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,MAAM,uBAAuB,GAC3B,mFAAmF,CAAC;AACtF,MAAM,+BAA+B,GACnC,+FAA+F,CAAC;AAClG,MAAM,2BAA2B,GAC/B,qFAAqF,CAAC;AACxF,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AACxD,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAC5D,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAC1C,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AACvE,MAAM,8BAA8B,GAClC,+CAA+C,CAAC;AAClD,MAAM,yCAAyC,GAC7C,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AAEjE;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,UAAqC;IAErC,IACE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAChC,CAAC,CAAC,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,MAAM;YACnB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,4BAA4B,IAAI,6CAA6C,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,4BAA4B,IAAI,oBAAoB,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IACE,CAAC,KAAK,CAAC,QAAQ,KAAK,0BAA0B;gBAC5C,KAAK,CAAC,QAAQ,KAAK,8BAA8B,CAAC;gBACpD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC1C,KAAK,CAAC,cAAyB,IAAI,CAAC;gBACrC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC;gBAClC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACnC,KAAK,CAAC,SAAS,KAAK,IAAI;gBACxB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,iCAAiC,IAAI,6BAA6B,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,GAAG,KAAK,iDAAiD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa,EACb,KAAa,EACb,OAAe;IAEf,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,GAAG,KAAK,yEAAyE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAAmC,EACnC,IAAY;IAEZ,OAAO;QACL,SAAS,EAAE,4BAA4B,CAAC,UAAU,CAAC;QACnD,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,SAAS;QACxB,QAAQ,EAAE,0BAA0B;QACpC,cAAc,EAAE,EAAE,GAAG,EAAE;QACvB,IAAI,EAAE,MAAM;KACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAmC;IAEnC,IACE,UAAU,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QACxC,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,oBAAoB,CAC3B,UAAU,CAAC,UAAU,EACrB,YAAY,EACZ,uBAAuB,CACxB;QACD,UAAU,EAAE,SAAS;QACrB,oBAAoB,EAAE;YACpB,mBAAmB,EAAE;gBACnB,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;gBAClE,cAAc,EAAE,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACrD,oBAAoB,CAClB,EAAE,EACF,iBAAiB,EACjB,yBAAyB,CAC1B,CACF;gBACD,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACvC,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CACxD;aACF;SACF;QACD,cAAc,EAAE,oBAAoB,CAClC,UAAU,CAAC,iBAAiB,EAC5B,mBAAmB,EACnB,+BAA+B,CAChC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAqC,EACrC,IAAY;IAEZ,IACE,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QACxD,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,yBAAyB,EACzB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE;YACT,GAAG,4BAA4B,CAAC,UAAU,CAAC;YAC3C,SAAS,EAAE;gBACT,kBAAkB,EAAE;oBAClB;wBACE,WAAW,EAAE;4BACX;gCACE,IAAI,EAAE,uCAAuC;gCAC7C,KAAK,EAAE,yCAAyC;6BACjD;4BACD;gCACE,IAAI,EAAE,+BAA+B;gCACrC,KAAK,EAAE,qBAAqB;6BAC7B;yBACF;wBACD,IAAI,EAAE,UAAU,CAAC,aAAa;qBAC/B;iBACF;aACF;SACF;QACD,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,SAAS;QACxB,QAAQ,EAAE,8BAA8B;QACxC,cAAc,EAAE,EAAE,GAAG,EAAE;QACvB,IAAI,EAAE,MAAM;KACb,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA8C,EAC9C,MAAc,EACd,UAAqC,EACrC,cAAsB;IAEtB,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClE,sCAAsC,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO;QACL,GAAG,OAAO;QACV,gBAAgB,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YACtC,oBAAoB,EAAE;gBACpB,oBAAoB,EAAE,KAAK;gBAC3B,KAAK,EAAE,OAAO;gBACd,cAAc,EAAE,oBAAoB,CAClC,cAAc,EACd,gBAAgB,EAChB,2BAA2B,CAC5B;aACF;YACD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,UAAU;SACjB;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sCAAsC,CACpD,QAA8C,EAC9C,OAKC;IAED,OAAO,qBAAqB,CAC1B,QAAQ,EACR,OAAO,CAAC,MAAM,EACd;QACE,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE;YACN,iBAAiB,EAAE,wBAAwB,CACzC,OAAO,CAAC,SAAS,EACjB,sBAAsB,CACvB;YACD,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,IAAI,EAAE,SAAS;aAChB;YACD,oBAAoB,EAAE,wBAAwB,CAC5C,OAAO,CAAC,SAAS,EACjB,4BAA4B,CAC7B;SACF;KACF,EACD,OAAO,CAAC,cAAc,CACvB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uCAAuC,CACrD,QAA8C,EAC9C,OAIC;IAED,OAAO,qBAAqB,CAC1B,QAAQ,EACR,OAAO,CAAC,MAAM,EACd;QACE,OAAO,EAAE,gBAAgB;QACzB,MAAM,EAAE;YACN,2BAA2B,EAAE;gBAC3B,aAAa,EAAE,SAAS;gBACxB,IAAI,EAAE,SAAS;aAChB;YACD,cAAc,EAAE,0BAA0B,CACxC,OAAO,CAAC,UAAU,EAClB,6BAA6B,CAC9B;SACF;KACF,EACD,OAAO,CAAC,cAAc,CACvB,CAAC;AACJ,CAAC"}