@izara_project/izara-core-generate-service-code 1.0.90 → 1.0.92

package/src/emit/resource/emitResourceArtifacts.js

@@ -1,95 +1,19 @@
-import ejsLib from 'ejs';
-import { readFile } from 'node:fs/promises';
-
+import { normalizeYaml } from './resourceTemplate.js';
+import { createResourceState } from './resourceState.js';
 import {
-  customFlowRoleName,
-  flowDsqSteps,
-  flowExtTopicSteps,
-  generatedDsqFlows,
-  generatedOwnTopicFlows,
-  supportedCustomFlows,
-  flowHasRbac
-} from '../custom/customFlows.js';
-import { hasSystemWebSocket } from '../system/emitSystemWebSocketArtifacts.js';
-import { rbacFlowTag } from '../rbac/rbacFlowTag.js';
-import { CRUD_ACTIONS, createCrudActionPlans } from '../crud/crudActionPlan.js';
+  renderCrudInSqs,
+  renderRelationshipInSqs,
+  renderRbacInSqs,
+  renderCustomFlowInSqs,
+  renderSystemInSqs,
+  renderOut
+} from './sqsResourceArtifacts.js';
+import { renderDynamo } from './dynamoResourceArtifacts.js';
+import { renderIam, renderLambdaRoleConfig } from './iamResourceArtifacts.js';
+import { renderS3 } from './s3ResourceArtifacts.js';
 
-const TEMPLATE_URL = new URL('./templates/', import.meta.url);
 const RESOURCE_ROOT = 'resource/sls_yaml/generatedCode/source';
 const APP_ROOT = 'app/sls_yaml/generatedCode/source';
-const INITIAL_SETUP_ROOT = 'app/initial_setup/generatedCode/source';
-const RELATIONSHIP_ACTIONS = [
-  'CreateRelationship',
-  'UpdateRelationship',
-  'DeleteRelationship',
-  'GetRelationship',
-  'ChangeRelationship',
-  'MoveRelationship'
-];
-const RBAC_ACTIONS = [
-  'CreateTargetRole',
-  'UpdateTargetRole',
-  'DeleteTargetRole',
-  'GetTargetRole',
-  'ListTargetRole',
-  'CreateRolePermissions',
-  'ListRolePermissions',
-  'DeleteRolePermissions',
-  'CreateUserRole',
-  'ListUserInRoles',
-  'DeleteUserFromRole',
-  'GetMyPermissions',
-  'ValidatorRbac',
-  'ReservedDynamicUsage',
-  'ConfirmUsage',
-  'CancelUsage'
-];
-const SYSTEM_TABLES = [
-  'WebSocketTask',
-  'UserUploadRecords',
-  'RegisterRecords',
-  'AwaitingMultipleSteps',
-  'AwaitingMultipleStepByPending',
-  'FindDataMain',
-  'LogicalResultsMain',
-  'LogicalResultsData',
-  'AwaitingStep'
-];
-const RBAC_TABLES = [
-  'Roles',
-  'TargetRoles',
-  'RolePermissions',
-  'RoleUsers',
-  'UserRoles',
-  'RbacPermissionCaches',
-  'RunningTotalUsage',
-  'RunningTotalReservedUsage',
-  'WebSocketTask'
-];
-const LEGACY_PROCESS_QUEUES = [
-  'FindDataHdrSqs',
-  'ProcessLogicalHdrSqs',
-  'PaginateProcessLogicalHdrDsq',
-  'PaginateProcessLogicalHdrSqs'
-];
-const DYNAMO_ACTIONS = [
-  'dynamodb:DeleteItem',
-  'dynamodb:GetItem',
-  'dynamodb:PutItem',
-  'dynamodb:Query',
-  'dynamodb:UpdateItem'
-];
-const SQS_CONSUMER_ACTIONS = [
-  'sqs:DeleteMessage',
-  'sqs:GetQueueAttributes',
-  'sqs:ReceiveMessage'
-];
-const SQS_DLQ_ACTIONS = [
-  'sqs:DeleteMessage',
-  'sqs:GetQueueAttributes',
-  'sqs:ReceiveMessage',
-  'sqs:SendMessage'
-];
 
 export async function emitResourceArtifacts({
   objects,
@@ -201,1154 +125,7 @@ export const resourceArtifactPaths = [
   `${APP_ROOT}/cors.yml`
 ];
 
-function createResourceState({ objects, relationships, flows }) {
-  const crud = objects.some(isCrudObject);
-  const selfRbac = objects.some(hasSelfRbacAddOn);
-  const rbac = objects.some((obj) => hasRbacAddOn(obj, objects));
-  const crudActionPlans = createCrudActionPlans(objects, flows);
-
-  const crudOwnTopics = crud ? [...CRUD_ACTIONS] : [];
-  const crudSqsQueues = [];
-  if (crud) {
-    for (const action of ['Create', 'Update', 'Delete']) {
-      const plan = crudActionPlans[action];
-      if (plan.hasCreateNodeCallback) {
-        crudSqsQueues.push(`${action}NodeCallbackHdrSqs`);
-      }
-      if (plan.hasBeforeHookCallback) {
-        crudSqsQueues.push(`${action}BeforeHookCallbackHdrSqs`);
-      }
-      if (plan.hasAfterHookCallback) {
-        crudSqsQueues.push(`${action}AfterHookCallbackHdrSqs`);
-      }
-      if (plan.hasComplete) {
-        crudSqsQueues.push(`${action}CompleteHdrSqs`);
-      }
-    }
-  }
-
-  const relationshipOwnTopics =
-    relationships.length > 0 ? [...RELATIONSHIP_ACTIONS] : [];
-  const relationshipSqsQueues =
-    relationships.length > 0
-      ? RELATIONSHIP_ACTIONS.map((action) => `${action}CompleteHdrSqs`)
-      : [];
-  const relationshipDsqQueues =
-    relationships.length > 0 ? ['GetRelationshipHdrDsq'] : [];
-
-  const rbacOwnTopics = [];
-  const rbacSqsQueues = [];
-  if (selfRbac) {
-    for (const action of RBAC_ACTIONS) {
-      rbacOwnTopics.push(action);
-      rbacSqsQueues.push(`Process${action}HdrSqs`);
-    }
-  }
-  if (selfRbac) {
-    const flowTags = [
-      ...new Set(objects.filter(hasSelfRbacAddOn).map(rbacFlowTag))
-    ];
-    for (const flowTag of flowTags) {
-      rbacOwnTopics.push(flowTag);
-    }
-  }
-  if (crud) {
-    for (const action of ['Create', 'Update', 'Delete']) {
-      const plan = crudActionPlans[action];
-      if (plan.hasRbacCallback) {
-        rbacSqsQueues.push(`${action}RbacCallbackHdrSqs`);
-      }
-    }
-  }
-
-  const customOwnTopics = flows
-    .filter((flow) => includesEvent(flow, 'ownTopic'))
-    .map((flow) => upperFirst(flow.flowTag));
-
-  const customSqsQueues = [
-    ...flows
-      .filter((flow) => includesEvent(flow, 'extTopic'))
-      .map((flow) => `Process${upperFirst(flow.flowTag)}HdrSqs`),
-    ...flows
-      .filter(
-        (flow) =>
-          flow?.outputTopic &&
-          !flow?.generatedCodeConfig &&
-          upperFirst(flow.flowTag)
-      )
-      .map((flow) => `${upperFirst(flow.flowTag)}CompleteHdrSqs`)
-  ];
-  for (const { flowTag, stepName } of flowExtTopicSteps(flows)) {
-    customSqsQueues.push(`${flowTag}${stepName}HdrSqs`);
-  }
-  for (const flow of flows) {
-    if (flowHasRbac(flow, objects)) {
-      const tag = upperFirst(flow.flowTag);
-      customSqsQueues.push(`${tag}RbacCallbackHdrSqs`);
-    }
-  }
-  for (const flow of flows.filter((flow) => includesEvent(flow, 's3'))) {
-    const tag = upperFirst(flow.flowTag);
-    customSqsQueues.push(`${tag}CreatePreSignUrlHdrSqs`);
-    customSqsQueues.push(`${tag}ReservedLimitHdrSqs`);
-    customSqsQueues.push(`${tag}ConfirmAfterUploadHdrSqs`);
-  }
-
-  const customDsqQueues = flows
-    .filter((flow) => includesEvent(flow, 'dsq'))
-    .map((flow) => `${upperFirst(flow.flowTag)}HdrDsq`);
-  for (const { flowTag, stepName } of flowDsqSteps(flows)) {
-    customDsqQueues.push(`${flowTag}${stepName}HdrDsq`);
-  }
-
-  const websocket = hasSystemWebSocket(flows, {
-    includeRelationshipOwnTopic: true,
-    objects,
-    relationships
-  });
-
-  const systemOwnTopics = ['ProcessLogical', 'FindData'];
-  const systemSqsQueues = [
-    'PaginateProcessLogicalHdrSqs',
-    ...(websocket ? ['WebSocketCompleteHdrSqs', 'RegisterCompleteHdrSqs'] : [])
-  ];
-  const systemDsqQueues = ['PaginateProcessLogicalHdrDsq'];
-
-  const ownTopics = new Set([
-    ...systemOwnTopics,
-    ...crudOwnTopics,
-    ...relationshipOwnTopics,
-    ...rbacOwnTopics,
-    ...customOwnTopics
-  ]);
-  const sqsQueues = new Set([
-    ...systemSqsQueues,
-    ...crudSqsQueues,
-    ...relationshipSqsQueues,
-    ...rbacSqsQueues,
-    ...customSqsQueues
-  ]);
-  const dsqQueues = new Set([
-    ...systemDsqQueues,
-    ...relationshipDsqQueues,
-    ...customDsqQueues
-  ]);
-
-  const customRoles = [
-    ...new Set([
-      ...supportedCustomFlows(flows).map((flow) =>
-        customFlowRoleName(flow.flowTag)
-      ),
-      ...generatedOwnTopicFlows(flows).map((flow) =>
-        customFlowRoleName(flow.flowTag)
-      ),
-      ...generatedDsqFlows(flows).map((flow) =>
-        customFlowRoleName(flow.flowTag)
-      ),
-      ...flowExtTopicSteps(flows).map(({ flow }) =>
-        customFlowRoleName(flow.flowTag)
-      ),
-      ...flowDsqSteps(flows).map(({ flow }) => customFlowRoleName(flow.flowTag))
-    ])
-  ];
-  const webSocketRoles = new Set();
-  if (websocket) {
-    webSocketRoles.add('WebSocketMainRole');
-    webSocketRoles.add('RegisterRole');
-  }
-  if (crud) webSocketRoles.add('FlowObjectsRole');
-  if (relationships.length > 0) webSocketRoles.add('FlowRelationshipRole');
-  if (rbac) webSocketRoles.add('FlowRbacRole');
-  const filteredWsFlows = [
-    ...supportedCustomFlows(flows),
-    ...generatedOwnTopicFlows(flows)
-  ].filter(
-    (flow) => includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3')
-  );
-  for (const flow of filteredWsFlows) {
-    webSocketRoles.add(customFlowRoleName(flow.flowTag));
-  }
-  const outTopics = new Set([
-    ...ownTopics,
-    ...flows
-      .filter((flow) => flow?.outputTopic && upperFirst(flow.flowTag))
-      .map((flow) => upperFirst(flow.flowTag))
-  ]);
-  const objectTableNames = [...collectTables(objects).keys()];
-  const relationshipTableNames = [...collectTables(relationships).keys()];
-  const tableMap = new Map([
-    ...collectTables(objects),
-    ...collectTables(relationships),
-    ...collectTables(flows)
-  ]);
-  const externalDynamoTables = objects.flatMap(
-    (object) => object.externalDynamoResources ?? []
-  );
-  const s3Buckets = flows
-    .filter((flow) => includesEvent(flow, 's3') && flow.createBucket === true)
-    .map((flow) => flow.bucketName)
-    .filter(Boolean);
-  const s3FlowTags = flows
-    .filter((flow) => includesEvent(flow, 's3'))
-    .map((flow) => upperFirst(flow.flowTag));
-  const s3Subscriptions = flows
-    .filter((flow) => includesEvent(flow, 's3'))
-    .map((flow) => {
-      const tag = upperFirst(flow.flowTag);
-      const outputTopicStr =
-        typeof flow.outputTopic === 'string' ? flow.outputTopic : null;
-      const topicName = outputTopicStr
-        ? outputTopicStr.startsWith('Out')
-          ? outputTopicStr
-          : `Out${upperFirst(outputTopicStr)}`
-        : flow.s3Subscription?.topicName || 'OutCreate';
-      const queueName =
-        flow.s3Subscription?.queueName || `${tag}ReservedLimitHdrSqs`;
-      const subscriptionName =
-        flow.s3Subscription?.subscriptionName ||
-        `Subscription${topicName}To${queueName}`;
-      return { subscriptionName, topicName, queueName };
-    });
-  const systemTables = [...SYSTEM_TABLES];
-  if (rbac) {
-    systemTables.push(
-      'Roles',
-      'TargetRoles',
-      'RolePermissions',
-      'RoleUsers',
-      'UserRoles',
-      'RbacPermissionCaches',
-      'RunningTotalUsage',
-      'RunningTotalReservedUsage'
-    );
-  }
-  if (s3FlowTags.length > 0) {
-    systemTables.push('ReservedDataMain');
-  }
-  const hasHttpApi =
-    crud ||
-    relationships.length > 0 ||
-    rbac ||
-    flows.some((flow) => includesEvent(flow, 'lambdaSyncApi'));
-  return {
-    crud,
-    rbac,
-    selfRbac,
-    crudActionPlans,
-    crudOwnTopics: [...new Set(crudOwnTopics)].filter(Boolean).sort(),
-    crudSqsQueues: [...new Set(crudSqsQueues)].filter(Boolean).sort(),
-    relationshipOwnTopics: [...new Set(relationshipOwnTopics)]
-      .filter(Boolean)
-      .sort(),
-    relationshipSqsQueues: [...new Set(relationshipSqsQueues)]
-      .filter(Boolean)
-      .sort(),
-    relationshipDsqQueues: [...new Set(relationshipDsqQueues)]
-      .filter(Boolean)
-      .sort(),
-    rbacOwnTopics: [...new Set(rbacOwnTopics)].filter(Boolean).sort(),
-    rbacSqsQueues: [...new Set(rbacSqsQueues)].filter(Boolean).sort(),
-    customOwnTopics: [...new Set(customOwnTopics)].filter(Boolean).sort(),
-    customSqsQueues: [...new Set(customSqsQueues)].filter(Boolean).sort(),
-    customDsqQueues: [...new Set(customDsqQueues)].filter(Boolean).sort(),
-    systemOwnTopics: [...new Set(systemOwnTopics)].filter(Boolean).sort(),
-    systemSqsQueues: [...new Set(systemSqsQueues)].filter(Boolean).sort(),
-    systemDsqQueues: [...new Set(systemDsqQueues)].filter(Boolean).sort(),
-    s3Subscriptions,
-    s3FlowTags,
-    hasHttpApi,
-    relationships: relationships.length > 0,
-    ownTopics: [...ownTopics].filter(Boolean).sort(),
-    sqsQueues: [...sqsQueues].filter(Boolean).sort(),
-    dsqQueues: [...dsqQueues].filter(Boolean).sort(),
-    customRoles,
-    websocket,
-    webSocketRoles,
-    webSocketSubscriptions: websocket
-      ? [...outTopics]
-          .filter(
-            (topic) =>
-              flows.some(
-                (flow) =>
-                  (flow?.outputTopic ||
-                    (includesEvent(flow, 'ownTopic') &&
-                      (flow.initiateBy === 'user' ||
-                        flow.initiateBy === 'systemWithUser'))) &&
-                  upperFirst(flow.flowTag) === topic
-              ) ||
-              (objects.length > 0 &&
-                topic !== 'Get' &&
-                CRUD_ACTIONS.includes(topic)) ||
-              (relationships.length > 0 &&
-                topic !== 'GetRelationship' &&
-                RELATIONSHIP_ACTIONS.includes(topic))
-          )
-          .sort()
-      : [],
-    outTopics: [...outTopics].filter(Boolean).sort(),
-    tables: [...tableMap.entries()].map(([tableName, keys]) => ({
-      tableName,
-      ...keys
-    })),
-    allTableNames: [...new Set([...systemTables, ...tableMap.keys()])].sort(),
-    objectTableNames,
-    relationshipTableNames,
-    externalDynamoTables,
-    objectTablesByType: new Map(
-      objects
-        .map((object) => [
-          object.objectType,
-          Object.values(object.storageResources ?? {}).find(
-            (resource) =>
-              resource?.storageType === 'dynamo' ||
-              resource?.storageType === 'dynamoDB' ||
-              !resource?.storageType
-          )?.tableName
-        ])
-        .filter(([, tableName]) => tableName)
-    ),
-    s3Buckets,
-    flows,
-    objects
-  };
-}
-
-function indentYaml(content, spaces = 2) {
-  const prefix = ' '.repeat(spaces);
-  return content
-    .split('\n')
-    .map((line) => {
-      if (line.trim()) {
-        return `${prefix}${line}`;
-      }
-      return '';
-    })
-    .join('\n');
-}
-
-async function renderS3(state) {
-  if (state.s3Buckets.length === 0) return 'Resources:\n';
-  const template = await readFile(
-    new URL('S3Bucket_Yaml.ejs', TEMPLATE_URL),
-    'utf8'
-  );
-  const chunks = await Promise.all(
-    state.s3Buckets.map((bucketName) => ejsLib.render(template, { bucketName }))
-  );
-  return `Resources:\n${indentYaml(chunks.join('\n'), 2)}`;
-}
-
-async function renderResourceGroup({
-  ownTopics = [],
-  sqsQueues = [],
-  dsqQueues = [],
-  webSocketSubscriptions = [],
-  s3Subscriptions = []
-}) {
-  const hasResources =
-    ownTopics.length > 0 ||
-    sqsQueues.length > 0 ||
-    dsqQueues.length > 0 ||
-    webSocketSubscriptions.length > 0 ||
-    s3Subscriptions.length > 0;
-  if (!hasResources) return '';
-
-  const chunks = await Promise.all([
-    ...ownTopics.map((queueName) => render('ResourceYaml.ejs', { queueName })),
-    ...sqsQueues.map((queueName) =>
-      render('ResourceSqsYaml.ejs', { queueName })
-    ),
-    ...dsqQueues.map((queueName) =>
-      render('ResourceSqsYaml.ejs', { queueName })
-    )
-  ]);
-  const wsSubs = await Promise.all(
-    webSocketSubscriptions.map((topicName) =>
-      renderWebSocketSubscription(topicName)
-    )
-  );
-  const s3Subs = await Promise.all(
-    s3Subscriptions.map(({ subscriptionName, topicName, queueName }) =>
-      render('S3Subscription_Yaml.ejs', {
-        subscriptionName,
-        topicName,
-        queueName
-      })
-    )
-  );
-  const parts = [chunks.join('\n')];
-  if (wsSubs.length > 0) parts.push(wsSubs.join('\n'));
-  if (s3Subs.length > 0) parts.push(s3Subs.join('\n'));
-  const body = parts.filter(Boolean).join('\n');
-  if (!body.trim()) return '';
-  return `Resources:\n${indentYaml(body, 2)}`;
-}
-
-async function renderCrudInSqs(state) {
-  return renderResourceGroup({
-    ownTopics: state.crudOwnTopics,
-    sqsQueues: state.crudSqsQueues
-  });
-}
-
-async function renderRelationshipInSqs(state) {
-  return renderResourceGroup({
-    ownTopics: state.relationshipOwnTopics,
-    sqsQueues: state.relationshipSqsQueues,
-    dsqQueues: state.relationshipDsqQueues
-  });
-}
-
-async function renderRbacInSqs(state) {
-  return renderResourceGroup({
-    ownTopics: state.rbacOwnTopics,
-    sqsQueues: state.rbacSqsQueues
-  });
-}
-
-async function renderCustomFlowInSqs(state) {
-  return renderResourceGroup({
-    ownTopics: state.customOwnTopics,
-    sqsQueues: state.customSqsQueues,
-    dsqQueues: state.customDsqQueues,
-    s3Subscriptions: state.s3Subscriptions
-  });
-}
-
-async function renderSystemInSqs(state) {
-  return renderResourceGroup({
-    ownTopics: state.systemOwnTopics,
-    sqsQueues: state.systemSqsQueues,
-    dsqQueues: state.systemDsqQueues,
-    webSocketSubscriptions: state.webSocketSubscriptions
-  });
-}
-
-async function renderOut(state) {
-  const body = (
-    await Promise.all(
-      state.outTopics.map((topicName) =>
-        render('FlowOut_Yaml.ejs', { topicName })
-      )
-    )
-  ).join('\n');
-  return `Resources:\n${indentYaml(body, 2)}`;
-}
-
-async function renderDynamo(state) {
-  const [system, ...tables] = await Promise.all([
-    render('SystemDynamoDB_Yaml.ejs', {
-      hasS3: state.s3FlowTags.length > 0,
-      hasRbac: state.selfRbac
-    }),
-    ...state.tables.map((table) => render('DynamoDBTable_Yaml.ejs', table))
-  ]);
-  const indentedTables = tables.map((t) => indentYaml(t, 2)).join('\n');
-  return indentedTables ? `${system}\n${indentedTables}` : `${system}`;
-}
-
-async function renderIam(state) {
-  const roles = ['ProcFindDataRole', 'RegisterRole'];
-  if (state.crud) roles.push('FlowObjectsRole');
-  if (state.relationships) roles.push('FlowRelationshipRole');
-  if (state.selfRbac) roles.push('FlowRbacRole');
-  if (state.websocket) roles.push('WebSocketMainRole');
-  roles.push(...state.customRoles);
-  const sortedRoles = roles.sort();
-  return {
-    iamContent: await render('SharedResource_Yaml.ejs', {
-      roles: sortedRoles.map((roleName) => ({
-        roleName,
-        statements: roleStatements(state, roleName)
-      }))
-    }),
-    roleNameConfigContent: renderRoleNameConfigYaml(sortedRoles)
-  };
-}
-
-function getRbacValidatorServiceTags(state) {
-  const tags = new Set();
-  for (const obj of state.objects || []) {
-    const targets = obj?.belongTo
-      ? Array.isArray(obj.belongTo)
-        ? obj.belongTo
-        : [obj.belongTo]
-      : [];
-    for (const target of targets) {
-      if (target?.serviceTag && target.serviceTag !== 'Rbac') {
-        tags.add(target.serviceTag);
-      }
-    }
-    if (
-      obj.belongToSchema?.serviceTag &&
-      obj.belongToSchema.serviceTag !== 'Rbac'
-    ) {
-      tags.add(obj.belongToSchema.serviceTag);
-    }
-  }
-  return Array.from(tags).sort();
-}
-
-async function renderLambdaRoleConfig(state) {
-  const s3Flows = state.flows
-    .filter((flow) => includesEvent(flow, 's3'))
-    .map((flow) => ({
-      roleName: upperFirst(flow.flowTag)
-    }));
-  const rbacValidatorServiceTags = getRbacValidatorServiceTags(state);
-  return render('GeneratedLambdaRoleServiceConfig.ejs', {
-    crud: state.crud,
-    relationships: state.relationships,
-    rbac: state.rbac,
-    rbacValidatorServiceTags,
-    objectGraphServiceTags: state.objectGraphServiceTags,
-    s3Flows
-  });
-}
-
-function roleStatements(state, roleName) {
-  const statements = [];
-  if (roleNeedsSchemaRead(state, roleName)) {
-    statements.push({
-      action: ['s3:GetObject'],
-      resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/*']
-    });
-    statements.push({
-      action: ['s3:ListBucket'],
-      resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}']
-    });
-  }
-  addStatement(statements, dynamoActionsForRole(roleName), [
-    ...dynamoArns(roleTableNames(state, roleName)),
-    ...externalDynamoArns(roleExternalDynamoTables(state, roleName))
-  ]);
-  addStatement(
-    statements,
-    SQS_CONSUMER_ACTIONS,
-    queueArns(roleQueueNames(state, roleName))
-  );
-  addStatement(
-    statements,
-    SQS_DLQ_ACTIONS,
-    queueArns(roleDlqQueueNames(state, roleName))
-  );
-  addStatement(
-    statements,
-    ['sns:Publish'],
-    [
-      ...topicArns(roleTopicNames(state, roleName)),
-      ...roleExternalTopicArns(state, roleName)
-    ]
-  );
-  addStatement(
-    statements,
-    ['lambda:InvokeFunction'],
-    [
-      ...roleExternalLambdaArns(state, roleName),
-      ...roleHookLambdaArns(state, roleName)
-    ]
-  );
-  if (state.webSocketRoles.has(roleName)) {
-    statements.push({
-      action: ['execute-api:ManageConnections'],
-      resource: [
-        'arn:aws:execute-api:${self:custom.iz_region}:${self:custom.iz_accountId}:*/*'
-      ]
-    });
-  }
-  return statements;
-}
-
-function addStatement(statements, action, resource) {
-  if (resource.length > 0) statements.push({ action, resource });
-}
-
-function roleNeedsSchemaRead(state, roleName) {
-  if (!roleName.endsWith('Role') || !roleName) return false;
-  return roleName !== 'FlowRbacRole' || state.selfRbac;
-}
-
-function roleTableNames(state, roleName) {
-  if (roleName === 'RegisterRole') {
-    if (state.websocket) return ['WebSocketTask', 'RegisterRecords'];
-    return [];
-  }
-  if (roleName === 'WebSocketMainRole')
-    return ['UserUploadRecords', 'WebSocketTask'];
-  if (roleName === 'FlowObjectsRole')
-    return [
-      ...state.objectTableNames,
-      'AwaitingMultipleSteps',
-      'AwaitingMultipleStepByPending',
-      'WebSocketTask',
-      ...(state.selfRbac
-        ? [
-            'Roles',
-            'TargetRoles',
-            'RolePermissions',
-            'RoleUsers',
-            'UserRoles',
-            'RunningTotalUsage',
-            'RunningTotalReservedUsage'
-          ]
-        : [])
-    ];
-  if (roleName === 'FlowRelationshipRole')
-    return [
-      ...state.objectTableNames,
-      ...state.relationshipTableNames,
-      'AwaitingMultipleSteps',
-      'AwaitingMultipleStepByPending',
-      'WebSocketTask'
-    ];
-  if (roleName === 'FlowRbacRole') return RBAC_TABLES;
-  if (roleName === 'ProcFindDataRole')
-    return [
-      ...state.objectTableNames,
-      ...state.relationshipTableNames,
-      'FindDataMain',
-      'LogicalResultsMain',
-      'LogicalResultsData'
-    ];
-  const flow = state.flows.find(
-    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
-  );
-  if (!flow) return [];
-  const tables = [];
-  if (includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3'))
-    tables.push('WebSocketTask');
-  if (includesEvent(flow, 's3'))
-    tables.push('UserUploadRecords', 'ReservedDataMain');
-  if (flow.statusType === 'storedCache') {
-    const object = state.objectTablesByType.get(flow.objType?.objectType);
-    if (object) tables.push(object);
-  }
-  return [...new Set(tables)];
-}
-
-function dynamoActionsForRole(roleName) {
-  if (roleName === 'ProcFindDataRole')
-    return [
-      'dynamodb:GetItem',
-      'dynamodb:PutItem',
-      'dynamodb:Query',
-      'dynamodb:UpdateItem'
-    ];
-  if (roleName === 'WebSocketMainRole')
-    return ['dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:Query'];
-  if (roleName === 'FlowRbacRole' || roleName === 'FlowObjectsRole')
-    return [...DYNAMO_ACTIONS, 'dynamodb:TransactWriteItems'];
-  return DYNAMO_ACTIONS;
-}
-
-function roleQueueNames(state, roleName) {
-  if (roleName === 'ProcFindDataRole') {
-    return LEGACY_PROCESS_QUEUES;
-  }
-  if (roleName === 'WebSocketMainRole') {
-    if (state.websocket) {
-      return ['WebSocketCompleteHdrSqs'];
-    }
-    return [];
-  }
-  if (roleName === 'RegisterRole') {
-    if (state.websocket) {
-      return ['RegisterCompleteHdrSqs'];
-    }
-    return [];
-  }
-  if (roleName === 'FlowObjectsRole') {
-    return CRUD_ACTIONS.flatMap((action) => {
-      const plan = state.crudActionPlans[action];
-      if (!plan.outputTopic) return [];
-      return [
-        `${action}HdrSqs`,
-        ...(plan.hasCreateNodeCallback ? [`${action}NodeCallbackHdrSqs`] : []),
-        ...(plan.hasBeforeHookCallback ? [`${action}BeforeHookCallbackHdrSqs`] : []),
-        ...(plan.hasAfterHookCallback ? [`${action}AfterHookCallbackHdrSqs`] : []),
-        ...(plan.hasRbacCallback ? [`${action}RbacCallbackHdrSqs`] : []),
-        ...(plan.hasComplete ? [`${action}CompleteHdrSqs`] : [])
-      ];
-    });
-  }
-  if (roleName === 'FlowRelationshipRole') {
-    return [
-      ...RELATIONSHIP_ACTIONS.flatMap((action) => [
-        `${action}HdrSqs`,
-        `${action}CompleteHdrSqs`
-      ]),
-      'GetRelationshipHdrDsq'
-    ];
-  }
-  if (roleName === 'FlowRbacRole') {
-    return [
-      ...RBAC_ACTIONS.map((action) => `${action}HdrSqs`),
-      ...rbacFlowQueueNames(state)
-    ];
-  }
-  const flow = state.flows.find(
-    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
-  );
-  if (!flow) {
-    return [];
-  }
-  const tag = upperFirst(flow.flowTag);
-  const queueList = [];
-  if (includesEvent(flow, 'extTopic')) {
-    queueList.push(`${tag}HdrSqs`);
-  }
-  if (includesEvent(flow, 'ownTopic')) {
-    queueList.push(`${tag}HdrSqs`);
-  }
-  if (includesEvent(flow, 'dsq')) {
-    queueList.push(`${tag}HdrDsq`);
-  }
-  if (flowHasRbac(flow, state.objects)) {
-    queueList.push(`${tag}RbacCallbackHdrSqs`);
-  }
-  queueList.push(
-    ...flowExtTopicSteps([flow]).map(
-      ({ flowTag, stepName }) => `${flowTag}${stepName}HdrSqs`
-    )
-  );
-  queueList.push(
-    ...flowDsqSteps([flow]).map(
-      ({ flowTag, stepName }) => `${flowTag}${stepName}HdrDsq`
-    )
-  );
-  queueList.push(
-    ...state.sqsQueues.filter(
-      (queueName) => includesEvent(flow, 's3') && queueName.startsWith(tag)
-    )
-  );
-  if (flow.outputTopic) {
-    queueList.push(`${tag}CompleteHdrSqs`);
-  }
-  return queueList;
-}
-
-function roleDlqQueueNames(state, roleName) {
-  const queues = roleQueueNames(state, roleName);
-  if (!Array.isArray(queues) || queues.length === 0) {
-    return [];
-  }
-  return queues.map((q) => (q.endsWith('DLQ') ? q : `${q}DLQ`));
-}
-
-function roleTopicNames(state, roleName) {
-  if (roleName === 'ProcFindDataRole')
-    return state.outTopics
-      .filter((topic) => topic === 'FindData')
-      .map((t) => `${t}_Out`);
-  if (roleName === 'FlowObjectsRole') {
-    const actions = state.outTopics.filter((topic) =>
-      CRUD_ACTIONS.includes(topic)
-    );
-    const topics = [];
-    for (const action of actions) {
-      if (action === 'Get') {
-        topics.push(`${action}_Out`);
-      } else {
-        topics.push(`${action}_In`, `${action}_Out`);
-      }
-    }
-    if (state.rbac) {
-      topics.push('ValidatorRbac_In');
-    }
-    for (const action of ['Create', 'Update', 'Delete']) {
-      const plan = state.crudActionPlans?.[action];
-      if (plan?.hasBeforeHookAsync) {
-        for (const hook of plan.beforeHooks) {
-          if (hook?.generatedCodeConfig?.invocationType === 'ownTopic') {
-            topics.push(`${upperFirst(hook.flowTag)}_In`);
-          }
-        }
-      }
-      if (plan?.hasAfterHookAsync) {
-        for (const hook of plan.afterHooks) {
-          if (hook?.generatedCodeConfig?.invocationType === 'ownTopic') {
-            topics.push(`${upperFirst(hook.flowTag)}_In`);
-          }
-        }
-      }
-    }
-    return [...new Set(topics)];
-  }
-  if (roleName === 'FlowRelationshipRole') {
-    const actions = state.outTopics.filter((topic) =>
-      RELATIONSHIP_ACTIONS.includes(topic)
-    );
-    const topics = [];
-    for (const action of actions) {
-      if (action === 'GetRelationship') {
-        topics.push(`${action}_Out`);
-      } else {
-        topics.push(`${action}_In`, `${action}_Out`);
-      }
-    }
-    if (state.rbac) {
-      topics.push('ValidatorRbac_In');
-    }
-    return topics;
-  }
-  if (roleName === 'FlowRbacRole') {
-    const actions = state.outTopics.filter((topic) =>
-      RBAC_ACTIONS.includes(topic)
-    );
-    const topics = [];
-    for (const action of actions) {
-      if (action.startsWith('List')) {
-        topics.push(`${action}_Out`);
-      } else {
-        topics.push(`${action}_In`, `${action}_Out`);
-      }
-    }
-    return topics;
-  }
-  const flow = state.flows.find(
-    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
-  );
-  if (flow && flow.flowTag) {
-    const name = upperFirst(flow.flowTag);
-    const topics = [];
-    if (state.outTopics.includes(name)) {
-      topics.push(`${name}_Out`);
-    }
-    if (includesEvent(flow, 'ownTopic')) {
-      topics.push(`${name}_In`);
-    }
-    return topics;
-  }
-  return [];
-}
-
-function dynamoArns(tableNames) {
-  return [...new Set(tableNames)]
-    .sort()
-    .map(
-      (tableName) =>
-        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${'${self:custom.iz_resourcePrefix}'}${tableName}`
-    );
-}
-
-/**
- * Generates DynamoDB ARNs for tables that belong to a parent service
- * (via extendObjType). Uses the parent serviceTag instead of the
- * current service's resourcePrefix, because those tables are owned
- * by a different CloudFormation stack.
- *
- * ARN format:
- *   ...table/{parentServiceTag}_{iz_stage}_{tableName}
- */
-function externalDynamoArns(externalTables) {
-  const seen = new Set();
-  const unique = [];
-  for (const table of externalTables) {
-    const dedupeKey = `${table.serviceTag}::${table.tableName}`;
-    if (!seen.has(dedupeKey)) {
-      seen.add(dedupeKey);
-      unique.push(table);
-    }
-  }
-  return unique
-    .sort((a, b) =>
-      `${a.serviceTag}_${a.tableName}`.localeCompare(
-        `${b.serviceTag}_${b.tableName}`
-      )
-    )
-    .map(
-      ({ serviceTag, tableName }) =>
-        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${serviceTag}${'${self:custom.iz_stage}'}${tableName}`
-    );
-}
-
-/**
- * Returns the external DynamoDB table references (cross-service)
- * that should be accessible from a given IAM role.
- */
-function roleExternalDynamoTables(state, roleName) {
-  if (
-    roleName === 'FlowObjectsRole' ||
-    roleName === 'FlowRelationshipRole' ||
-    roleName === 'ProcFindDataRole'
-  ) {
-    return state.externalDynamoTables;
-  }
-  return [];
-}
-
-function roleExternalTopicArns(state, roleName) {
-  if (!state.rbac) {
-    return [];
-  }
-  const extraTags = getRbacValidatorServiceTags(state).filter(
-    (tag) => tag && tag !== 'Rbac'
-  );
-  const extraTopics = extraTags.map(
-    (tag) =>
-      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ValidatorRbac_In`
-  );
-  if (roleName === 'FlowObjectsRole') {
-    return [
-      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
-      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ConfirmUsage_In`,
-      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_CancelUsage_In`,
-      ...extraTopics
-    ];
-  }
-  if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {
-    return [
-      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
-      ...extraTopics
-    ];
-  }
-  return [];
-}
-
-function roleExternalLambdaArns(state, roleName) {
-  if (!state.rbac) {
-    return [];
-  }
-  const extraTags = getRbacValidatorServiceTags(state).filter(
-    (tag) => tag && tag !== 'Rbac'
-  );
-  const extraLambdas = extraTags.map(
-    (tag) =>
-      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`
-  );
-  if (roleName === 'FlowObjectsRole') {
-    return [
-      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
-      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ConfirmUsageHdrInv`,
-      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}CancelUsageHdrInv`,
-      ...extraLambdas
-    ];
-  }
-  if (
-    roleName === 'FlowRbacRole' ||
-    roleName === 'FlowRelationshipRole'
-  ) {
-    return [
-      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
-      ...extraLambdas
-    ];
-  }
-  return [];
-}
-
-function roleHookLambdaArns(state, roleName) {
-  if (roleName !== 'FlowObjectsRole') {
-    return [];
-  }
-  const hookLambdas = [];
-  for (const action of ['Create', 'Update', 'Delete']) {
-    const plan = state.crudActionPlans?.[action];
-    if (plan?.hasBeforeHookSync) {
-      for (const hook of plan.beforeHooks) {
-        if (hook?.generatedCodeConfig?.invocationType === 'lambdaSyncInv') {
-          const hookTag = upperFirst(hook.flowTag);
-          hookLambdas.push(
-            `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:\${self:custom.iz_resourcePrefix}${hookTag}*`
-          );
-        }
-      }
-    }
-    if (plan?.hasAfterHookSync) {
-      for (const hook of plan.afterHooks) {
-        if (hook?.generatedCodeConfig?.invocationType === 'lambdaSyncInv') {
-          const hookTag = upperFirst(hook.flowTag);
-          hookLambdas.push(
-            `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:\${self:custom.iz_resourcePrefix}${hookTag}*`
-          );
-        }
-      }
-    }
-  }
-  return [...new Set(hookLambdas)];
-}
-
-function queueArns(queueNames) {
-  return [...new Set(queueNames)]
-    .sort()
-    .map(
-      (queueName) =>
-        `arn:aws:sqs:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_resourcePrefix}'}${queueName}`
-    );
-}
-
-function topicArns(topicNames) {
-  return [...new Set(topicNames)]
-    .sort()
-    .map(
-      (topic) =>
-        `arn:aws:sns:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_serviceTag}'}_${'${self:custom.iz_stage}'}_${topic}`
-    );
-}
-
-function renderWebSocketSubscription(topicName) {
-  return render('WebSocketSubscription_Yaml.ejs', { topicName });
-}
-
-function collectTables(schemas) {
-  const tables = new Map();
-  for (const schema of schemas) {
-    if (!schema?.storageResources) continue;
-    const identifiers = Array.isArray(schema.identifiers)
-      ? schema.identifiers
-      : [];
-    const pkIdentifier = identifiers.find(
-      (identifier) =>
-        identifier.type === 'partitionKey' || identifier.type === 'identifier'
-    );
-    const skIdentifier = identifiers.find(
-      (identifier) => identifier.type === 'sortKey'
-    );
-    const pk = keyName(pkIdentifier) ?? 'PK';
-    const sk = keyName(skIdentifier);
-    const pkType = keyAttributeType(pkIdentifier, schema);
-    const skType = keyAttributeType(skIdentifier, schema);
-    for (const resource of Object.values(schema.storageResources)) {
-      if (
-        (resource?.storageType === 'dynamo' ||
-          resource?.storageType === 'dynamoDB' ||
-          !resource?.storageType) &&
-        resource.tableName &&
-        !tables.has(resource.tableName)
-      )
-        tables.set(resource.tableName, { pk, sk, pkType, skType });
-    }
-  }
-  return tables;
-}
-
-function keyAttributeType(identifier, schema) {
-  if (!identifier) return 'S';
-  if (identifier.attributeType) {
-    return identifier.attributeType;
-  }
-  if (identifier.dataType) {
-    return mapTypeToAttributeType(identifier.dataType);
-  }
-  if (identifier.fieldType) {
-    return mapTypeToAttributeType(identifier.fieldType);
-  }
-  const fieldName = identifier.fieldName ?? identifier.name;
-  if (fieldName && schema) {
-    let fieldDef =
-      schema.fieldNames?.[fieldName] ?? schema.properties?.[fieldName];
-    if (!fieldDef && Array.isArray(schema.addOnDataStructure)) {
-      for (const addOn of schema.addOnDataStructure) {
-        if (addOn?.fieldNames?.[fieldName]) {
-          fieldDef = addOn.fieldNames[fieldName];
-          break;
-        }
-      }
-    }
-    if (fieldDef?.attributeType) {
-      return fieldDef.attributeType;
-    }
-    const type = fieldDef?.type ?? fieldDef?.dataType;
-    if (type) {
-      return mapTypeToAttributeType(type);
-    }
-  }
-  return 'S';
-}
-
-function mapTypeToAttributeType(type) {
-  if (typeof type !== 'string') return 'S';
-  const lower = type.toLowerCase();
-  if (
-    lower === 'number' ||
-    lower === 'numeric' ||
-    lower === 'integer' ||
-    lower === 'float' ||
-    lower === 'int' ||
-    lower === 'double' ||
-    lower === 'n'
-  ) {
-    return 'N';
-  }
-  if (lower === 'binary' || lower === 'b') {
-    return 'B';
-  }
-  return 'S';
-}
-
-function keyName(identifier) {
-  if (!identifier) return null;
-  return (
-    identifier.name ??
-    identifier.fieldName ??
-    (Array.isArray(identifier.fieldNames)
-      ? identifier.fieldNames.join(identifier.deliminator ?? '_')
-      : null)
-  );
-}
-
-const VALID_CRUD_GENERATED_BY = new Set([
-  'user',
-  'systemWithUser',
-  'systemNoUser'
-]);
-
-function isCrudObject(object) {
-  return VALID_CRUD_GENERATED_BY.has(object?.generatedBy);
-}
-function hasSelfRbacAddOn(object) {
-  return (
-    Array.isArray(object?.addOnDataStructure) &&
-    object.addOnDataStructure.some((addOn) => addOn?.type === 'rbac')
-  );
-}
-
-function hasRbacAddOn(object, objects = []) {
-  const selfHasRbac = hasSelfRbacAddOn(object);
-  const belongToTargets = object?.belongTo
-    ? Array.isArray(object.belongTo)
-      ? object.belongTo
-      : [object.belongTo]
-    : [];
-  const belongToHasRbac =
-    (Array.isArray(object?.belongToSchema?.addOnDataStructure) &&
-      object.belongToSchema.addOnDataStructure.some(
-        (addOn) => addOn?.type === 'rbac'
-      )) ||
-    belongToTargets.some((target) => {
-      if (target?.serviceTag === 'UserAccount') return true;
-      const matched = objects.find(
-        (candidate) =>
-          candidate?.serviceTag === target?.serviceTag &&
-          candidate?.objectType === target?.objectType
-      );
-      return hasSelfRbacAddOn(matched);
-    });
-  return selfHasRbac || belongToHasRbac;
-}
-
-/**
- * Returns the per-object RBAC flow queues (e.g. UserRbacFlowHdrSqs)
- * created for objects with an 'rbac' add-on. These are consumed by the
- * UserRbacFlow SQS functions emitted in emitRbacApplicationArtifacts.
- */
-function rbacFlowQueueNames(state) {
-  const flowTags = [
-    ...new Set((state.objects ?? []).filter(hasSelfRbacAddOn).map(rbacFlowTag))
-  ];
-  return flowTags.map((flowTag) => `${flowTag}HdrSqs`);
-}
-function includesEvent(flow, event) {
-  return Array.isArray(flow?.event) && flow.event.includes(event);
-}
-function upperFirst(value) {
-  return typeof value === 'string' && value
-    ? value[0].toUpperCase() + value.slice(1)
-    : '';
-}
-function normalizeYaml(content) {
-  return `${content.trimEnd()}\n`;
-}
-function renderCorsYaml() {
+export function renderCorsYaml() {
   return `allowedOrigins:
   - '*'
 allowedHeaders:
@@ -1366,18 +143,3 @@ maxAge: 0
 allowCredentials: false
 `;
 }
-function renderRoleNameConfigYaml(roles) {
-  return [
-    '# for createIamRole',
-    ...roles.map(
-      (roleName) =>
-        `- arn:aws:iam::\${self:custom.iz_accountId}:role/\${self:custom.iz_resourcePrefix}${roleName}`
-    )
-  ].join('\n');
-}
-async function render(templateName, data) {
-  return ejsLib.render(
-    await readFile(new URL(templateName, TEMPLATE_URL), 'utf8'),
-    { resourceQueueName: data.queueName, ...data }
-  );
-}