@stackwright-services/compiler 0.0.1

package/dist/index.mjs

@@ -0,0 +1,1945 @@
+// src/validate.ts
+import {
+  scanDataSources as defaultScanDataSources
+} from "@stackwright-services/runtime";
+import {
+  FlowDefinition,
+  WorkflowDefinition
+} from "@stackwright-services/types";
+import { parse as parseYaml } from "yaml";
+function detectDefinitionType(obj) {
+  if (typeof obj !== "object" || obj === null) return "unknown";
+  const record = obj;
+  if ("steps" in record && "trigger" in record) return "flow";
+  if ("states" in record && "initial" in record) return "workflow";
+  return "unknown";
+}
+function validate(yamlContent, registry, options) {
+  let parsed;
+  try {
+    parsed = parseYaml(yamlContent);
+  } catch (err) {
+    return {
+      success: false,
+      errors: [{ code: "YAML_PARSE_ERROR", message: `Invalid YAML: ${err.message}` }],
+      warnings: []
+    };
+  }
+  if (parsed === null || parsed === void 0) {
+    return {
+      success: false,
+      errors: [{ code: "EMPTY_DOCUMENT", message: "YAML document is empty" }],
+      warnings: []
+    };
+  }
+  const defType = detectDefinitionType(parsed);
+  if (defType === "flow") {
+    return validateFlow(parsed, registry, options);
+  } else if (defType === "workflow") {
+    return validateWorkflow(parsed, registry);
+  } else {
+    return {
+      success: false,
+      errors: [
+        {
+          code: "UNKNOWN_DEFINITION_TYPE",
+          message: "Could not detect definition type. Expected a flow (with trigger + steps) or workflow (with states + initial)."
+        }
+      ],
+      warnings: []
+    };
+  }
+}
+function validateFlow(parsed, registry, options) {
+  const result = FlowDefinition.safeParse(parsed);
+  if (!result.success) {
+    const errors2 = result.error.issues.map((issue) => ({
+      code: "SCHEMA_VALIDATION_ERROR",
+      message: issue.message,
+      path: issue.path.join(".")
+    }));
+    return { success: false, errors: errors2, warnings: [] };
+  }
+  const flow = result.data;
+  const errors = [];
+  const warnings = [];
+  if (registry) {
+    for (const step of flow.steps) {
+      if (!registry.has(step.use)) {
+        errors.push({
+          code: "UNKNOWN_CAPABILITY",
+          message: `Step "${step.name}" references unknown capability "${step.use}"`,
+          path: `steps.${step.name}.use`
+        });
+      }
+    }
+  }
+  const stepNames = flow.steps.map((s) => s.name);
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of stepNames) {
+    if (seen.has(name)) {
+      warnings.push({
+        code: "DUPLICATE_STEP_NAME",
+        message: `Duplicate step name "${name}" -- step names should be unique for observability`,
+        path: `steps.${name}`
+      });
+    }
+    seen.add(name);
+  }
+  const sourceRefs = [];
+  for (const step of flow.steps) {
+    const sourceVal = step.with?.["source"];
+    if (typeof sourceVal === "string" && (sourceVal.startsWith("openapi:") || sourceVal.startsWith("pulse:"))) {
+      sourceRefs.push({ ref: sourceVal, stepName: step.name });
+    }
+  }
+  if (sourceRefs.length > 0) {
+    const doScan = options?.scanDataSources ?? defaultScanDataSources;
+    const scanResult = doScan();
+    for (const { ref, stepName } of sourceRefs) {
+      const sourceId = ref.slice(ref.indexOf(":") + 1);
+      if (scanResult.detectedProviders.length === 0) {
+        warnings.push({
+          code: "SOURCE_UNVERIFIABLE",
+          message: `source '${ref}' cannot be verified: no DataSourceProvider is installed`,
+          path: `steps.${stepName}.with.source`
+        });
+      } else if (!scanResult.sources.some((s) => s.id === sourceId)) {
+        warnings.push({
+          code: "SOURCE_NOT_REGISTERED",
+          message: `source '${ref}' is not registered by any installed provider`,
+          path: `steps.${stepName}.with.source`
+        });
+      }
+    }
+  }
+  return {
+    success: errors.length === 0,
+    data: flow,
+    errors,
+    warnings
+  };
+}
+function validateWorkflow(parsed, registry) {
+  const result = WorkflowDefinition.safeParse(parsed);
+  if (!result.success) {
+    const errors2 = result.error.issues.map((issue) => ({
+      code: "SCHEMA_VALIDATION_ERROR",
+      message: issue.message,
+      path: issue.path.join(".")
+    }));
+    return { success: false, errors: errors2, warnings: [] };
+  }
+  const workflow = result.data;
+  const errors = [];
+  const warnings = [];
+  const stateNames = Object.keys(workflow.states);
+  if (!stateNames.includes(workflow.initial)) {
+    errors.push({
+      code: "INITIAL_STATE_NOT_FOUND",
+      message: `Initial state "${workflow.initial}" does not exist in states map`,
+      path: "initial"
+    });
+  }
+  for (const [stateName, state] of Object.entries(workflow.states)) {
+    if (state.transitions) {
+      for (const transition of state.transitions) {
+        if (!stateNames.includes(transition.to)) {
+          errors.push({
+            code: "TRANSITION_TARGET_NOT_FOUND",
+            message: `State "${stateName}" has transition to unknown state "${transition.to}"`,
+            path: `states.${stateName}.transitions`
+          });
+        }
+      }
+    }
+    if (registry && state.on_enter) {
+      if (!registry.has(state.on_enter.use)) {
+        errors.push({
+          code: "UNKNOWN_CAPABILITY",
+          message: `State "${stateName}" on_enter references unknown capability "${state.on_enter.use}"`,
+          path: `states.${stateName}.on_enter.use`
+        });
+      }
+    }
+  }
+  const terminalStates = stateNames.filter((name) => workflow.states[name]?.type === "terminal");
+  if (terminalStates.length === 0 && stateNames.length > 0) {
+    errors.push({
+      code: "NO_TERMINAL_STATE",
+      message: "Workflow has no terminal state -- workflows must have at least one terminal state"
+    });
+  }
+  for (const [stateName, state] of Object.entries(workflow.states)) {
+    if (state.type !== "terminal" && (!state.transitions || state.transitions.length === 0)) {
+      errors.push({
+        code: "DEADLOCK_STATE",
+        message: `State "${stateName}" is not terminal but has no transitions \u2014 workflow will deadlock here`,
+        path: `states.${stateName}`
+      });
+    }
+  }
+  if (stateNames.includes(workflow.initial)) {
+    const reachable = /* @__PURE__ */ new Set();
+    const queue = [workflow.initial];
+    while (queue.length > 0) {
+      const current = queue.shift();
+      if (reachable.has(current)) continue;
+      reachable.add(current);
+      const state = workflow.states[current];
+      if (state?.transitions) {
+        for (const transition of state.transitions) {
+          if (!reachable.has(transition.to)) {
+            queue.push(transition.to);
+          }
+        }
+      }
+    }
+    for (const stateName of stateNames) {
+      if (!reachable.has(stateName)) {
+        warnings.push({
+          code: "UNREACHABLE_STATE",
+          message: `State "${stateName}" is not reachable from initial state "${workflow.initial}"`,
+          path: `states.${stateName}`
+        });
+      }
+    }
+  }
+  if (terminalStates.length > 0) {
+    const canReachTerminal = new Set(terminalStates);
+    const reverseQueue = [...terminalStates];
+    const reverseAdj = /* @__PURE__ */ new Map();
+    for (const name of stateNames) {
+      reverseAdj.set(name, []);
+    }
+    for (const [stateName, state] of Object.entries(workflow.states)) {
+      if (state.transitions) {
+        for (const transition of state.transitions) {
+          reverseAdj.get(transition.to)?.push(stateName);
+        }
+      }
+    }
+    while (reverseQueue.length > 0) {
+      const current = reverseQueue.shift();
+      for (const predecessor of reverseAdj.get(current) ?? []) {
+        if (!canReachTerminal.has(predecessor)) {
+          canReachTerminal.add(predecessor);
+          reverseQueue.push(predecessor);
+        }
+      }
+    }
+    for (const stateName of stateNames) {
+      if (workflow.states[stateName]?.type !== "terminal" && !canReachTerminal.has(stateName)) {
+        warnings.push({
+          code: "NO_PATH_TO_TERMINAL",
+          message: `State "${stateName}" has no path to any terminal state`,
+          path: `states.${stateName}`
+        });
+      }
+    }
+  }
+  if (workflow.signals) {
+    const declaredSignals = new Set(workflow.signals.map((s) => s.name));
+    const usedSignals = /* @__PURE__ */ new Set();
+    for (const [stateName, state] of Object.entries(workflow.states)) {
+      if (state.transitions) {
+        for (const transition of state.transitions) {
+          usedSignals.add(transition.on);
+          if (!declaredSignals.has(transition.on)) {
+            warnings.push({
+              code: "UNKNOWN_SIGNAL",
+              message: `Transition in state "${stateName}" uses signal "${transition.on}" which is not declared in workflow signals`,
+              path: `states.${stateName}.transitions`
+            });
+          }
+        }
+      }
+    }
+    for (const signal of workflow.signals) {
+      if (!usedSignals.has(signal.name)) {
+        warnings.push({
+          code: "UNUSED_SIGNAL",
+          message: `Signal "${signal.name}" is declared but never used by any transition`,
+          path: "signals"
+        });
+      }
+    }
+  }
+  for (const [stateName, state] of Object.entries(workflow.states)) {
+    if (state.transitions) {
+      const unguardedSignals = /* @__PURE__ */ new Set();
+      for (const transition of state.transitions) {
+        if (!transition.when) {
+          if (unguardedSignals.has(transition.on)) {
+            warnings.push({
+              code: "AMBIGUOUS_TRANSITION",
+              message: `State "${stateName}" has multiple unguarded transitions for signal "${transition.on}" \u2014 only the first will match`,
+              path: `states.${stateName}.transitions`
+            });
+          }
+          unguardedSignals.add(transition.on);
+        }
+      }
+    }
+  }
+  if (registry && workflow.timeouts?.on_timeout) {
+    if (!registry.has(workflow.timeouts.on_timeout.use)) {
+      errors.push({
+        code: "UNKNOWN_CAPABILITY",
+        message: `Timeout on_timeout references unknown capability "${workflow.timeouts.on_timeout.use}"`,
+        path: "timeouts.on_timeout.use"
+      });
+    }
+  }
+  return {
+    success: errors.length === 0,
+    data: workflow,
+    errors,
+    warnings
+  };
+}
+
+// src/permissions.ts
+function resolvePermissionVariables(permission, stepParams) {
+  if (!stepParams) return permission;
+  let { resource } = permission;
+  const variablePattern = /\$([a-zA-Z_][a-zA-Z0-9_]*)/g;
+  resource = resource.replace(variablePattern, (_match, varName) => {
+    const value = stepParams[varName];
+    if (typeof value === "string") return value;
+    if (typeof value === "number" || typeof value === "boolean") return String(value);
+    return _match;
+  });
+  return { ...permission, resource };
+}
+function deriveFlowPermissions(flow, registry) {
+  const sources = [];
+  for (const step of flow.steps) {
+    const capability = registry.lookup(step.use);
+    if (!capability) continue;
+    if (capability.definition.kind === "effect") {
+      for (const perm of capability.definition.requiredPermissions) {
+        const resolved = resolvePermissionVariables(perm, step.with);
+        sources.push({
+          permission: resolved,
+          capabilityName: step.use,
+          location: `steps.${step.name}`
+        });
+      }
+    }
+  }
+  return {
+    permissions: deduplicatePermissions(sources.map((s) => s.permission)),
+    sources
+  };
+}
+function deriveWorkflowPermissions(workflow, registry) {
+  const sources = [];
+  for (const [stateName, state] of Object.entries(workflow.states)) {
+    if (state.on_enter) {
+      const capability = registry.lookup(state.on_enter.use);
+      if (!capability) continue;
+      if (capability.definition.kind === "effect") {
+        for (const perm of capability.definition.requiredPermissions) {
+          sources.push({
+            permission: perm,
+            capabilityName: state.on_enter.use,
+            location: `states.${stateName}.on_enter`
+          });
+        }
+      }
+    }
+  }
+  if (workflow.timeouts?.on_timeout) {
+    const capability = registry.lookup(workflow.timeouts.on_timeout.use);
+    if (capability && capability.definition.kind === "effect") {
+      for (const perm of capability.definition.requiredPermissions) {
+        sources.push({
+          permission: perm,
+          capabilityName: workflow.timeouts.on_timeout.use,
+          location: "timeouts.on_timeout"
+        });
+      }
+    }
+  }
+  return {
+    permissions: deduplicatePermissions(sources.map((s) => s.permission)),
+    sources
+  };
+}
+function deduplicatePermissions(permissions) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const perm of permissions) {
+    const key = `${perm.resource}:${perm.action}:${perm.scope ?? ""}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      unique.push(perm);
+    }
+  }
+  return unique;
+}
+function toIamPolicy(derived) {
+  if (derived.permissions.length === 0) {
+    return {
+      Version: "2012-10-17",
+      Statement: []
+    };
+  }
+  return {
+    Version: "2012-10-17",
+    Statement: derived.permissions.map((perm) => ({
+      Effect: "Allow",
+      Action: `stackwright:${perm.action}`,
+      Resource: perm.resource,
+      ...perm.scope ? { Condition: { StringEquals: { "stackwright:scope": perm.scope } } } : {}
+    }))
+  };
+}
+function toStepFunctionsIamPolicy(workflow, derived) {
+  const statements = [];
+  const statesWithActions = Object.entries(workflow.states).filter(([, state]) => state.on_enter !== void 0).map(([name]) => name);
+  if (statesWithActions.length > 0) {
+    statements.push({
+      Sid: "InvokeStateLambdas",
+      Effect: "Allow",
+      Action: ["lambda:InvokeFunction"],
+      Resource: statesWithActions.map(
+        (name) => `arn:aws:lambda:*:*:function:${workflow.id}-${name}`
+      )
+    });
+  }
+  if (derived.permissions.length > 0) {
+    statements.push(
+      ...derived.permissions.map((perm) => ({
+        Effect: "Allow",
+        Action: `stackwright:${perm.action}`,
+        Resource: perm.resource,
+        ...perm.scope ? { Condition: { StringEquals: { "stackwright:scope": perm.scope } } } : {}
+      }))
+    );
+  }
+  if (workflow.timeouts?.pending_after || workflow.timeouts?.absolute) {
+    statements.push({
+      Sid: "TimeoutScheduling",
+      Effect: "Allow",
+      Action: ["events:PutRule", "events:PutTargets", "events:DeleteRule", "events:RemoveTargets"],
+      Resource: `arn:aws:events:*:*:rule/${workflow.id}-timeout-*`
+    });
+  }
+  statements.push({
+    Sid: "ExecutionLogging",
+    Effect: "Allow",
+    Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+    Resource: `arn:aws:logs:*:*:log-group:/aws/stepfunctions/${workflow.id}:*`
+  });
+  return {
+    Version: "2012-10-17",
+    Statement: statements
+  };
+}
+function toRbacRules(derived) {
+  if (derived.permissions.length === 0) return [];
+  const grouped = /* @__PURE__ */ new Map();
+  for (const perm of derived.permissions) {
+    const verbs = grouped.get(perm.resource) ?? [];
+    if (!verbs.includes(perm.action)) {
+      verbs.push(perm.action);
+    }
+    grouped.set(perm.resource, verbs);
+  }
+  return Array.from(grouped.entries()).map(([resource, verbs]) => ({
+    apiGroups: ["stackwright.io"],
+    resources: [resource],
+    verbs
+  }));
+}
+
+// src/observability.ts
+function generateFlowInstrumentation(flow) {
+  return flow.steps.map((step) => ({
+    stepName: step.name,
+    capabilityName: step.use,
+    flowId: flow.id,
+    metrics: {
+      latency: "flow.step.latency",
+      invocations: "flow.step.invocations",
+      errors: "flow.step.errors"
+    }
+  }));
+}
+function sanitizeIdentifier(name) {
+  return name.replace(/[^a-zA-Z0-9]/g, "_");
+}
+function generateInstrumentedStepCode(instrumentation) {
+  const { stepName, capabilityName, flowId, metrics } = instrumentation;
+  const fnName = sanitizeIdentifier(stepName);
+  return [
+    `async function executeStep_${fnName}(`,
+    "  input: unknown,",
+    "  context: CapabilityContext,",
+    "  provider: ObservabilityProvider,",
+    "  auditProvider: AuditProvider,",
+    "  handler: CapabilityHandler,",
+    "): Promise<unknown> {",
+    `  const span = provider.startSpan('step.${stepName}', {`,
+    `    'capability.name': '${capabilityName}',`,
+    `    'flow.id': '${flowId}',`,
+    `    'step.name': '${stepName}',`,
+    "  });",
+    "  const startTime = Date.now();",
+    "",
+    "  try {",
+    "    const result = await handler(input, context);",
+    `    provider.recordMetric('${metrics.invocations}', 1, { step: '${stepName}', capability: '${capabilityName}', status: 'success' });`,
+    "    auditProvider.record({",
+    "      type: 'capability_invocation',",
+    "      traceId: context.traceId,",
+    "      timestamp: new Date().toISOString(),",
+    `      flowId: '${flowId}',`,
+    `      stepName: '${stepName}',`,
+    `      capabilityName: '${capabilityName}',`,
+    "      inputHash: auditHash(input),",
+    "      outputHash: auditHash(result),",
+    "      durationMs: Date.now() - startTime,",
+    "      status: 'success',",
+    "    });",
+    "    return result;",
+    "  } catch (error) {",
+    "    span.setError(error instanceof Error ? error : new Error(String(error)));",
+    `    provider.recordMetric('${metrics.errors}', 1, { step: '${stepName}', capability: '${capabilityName}' });`,
+    "    auditProvider.record({",
+    "      type: 'capability_invocation',",
+    "      traceId: context.traceId,",
+    "      timestamp: new Date().toISOString(),",
+    `      flowId: '${flowId}',`,
+    `      stepName: '${stepName}',`,
+    `      capabilityName: '${capabilityName}',`,
+    "      inputHash: auditHash(input),",
+    "      outputHash: '',",
+    "      durationMs: Date.now() - startTime,",
+    "      status: 'error',",
+    "      error: error instanceof Error ? error.message : String(error),",
+    "    });",
+    "    throw error;",
+    "  } finally {",
+    "    const duration = Date.now() - startTime;",
+    `    provider.recordMetric('${metrics.latency}', duration, { step: '${stepName}', capability: '${capabilityName}' });`,
+    "    span.end();",
+    "  }",
+    "}"
+  ].join("\n");
+}
+function generateInstrumentedFlowCode(flow) {
+  const instrumentations = generateFlowInstrumentation(flow);
+  const stepFunctions = instrumentations.map(generateInstrumentedStepCode);
+  const stepCalls = instrumentations.map(
+    (inst) => `    stepResult = await executeStep_${sanitizeIdentifier(inst.stepName)}(stepResult, context, provider, auditProvider, registry.get('${inst.capabilityName}').handler);`
+  ).join("\n");
+  const header = [
+    "// Auto-generated by @stackwright-services/compiler",
+    `// Flow: ${flow.id}`,
+    `// Description: ${flow.description}`,
+    "//",
+    "// DO NOT EDIT -- regenerate from the source YAML.",
+    "",
+    "import type { CapabilityContext, CapabilityHandler } from '@stackwright-services/capabilities';",
+    "import type { ObservabilityProvider } from '@stackwright-services/compiler';",
+    "import type { AuditProvider, AuditEvent } from '@stackwright-services/runtime';",
+    "import { auditHash } from '@stackwright-services/runtime';",
+    ""
+  ].join("\n");
+  const executeFlow = [
+    "export async function executeFlow(",
+    "  input: unknown,",
+    "  context: CapabilityContext,",
+    "  provider: ObservabilityProvider,",
+    "  auditProvider: AuditProvider,",
+    "  registry: { get(name: string): { handler: CapabilityHandler } },",
+    "): Promise<unknown> {",
+    "  auditProvider.record({",
+    "    type: 'flow_start',",
+    "    traceId: context.traceId,",
+    "    timestamp: new Date().toISOString(),",
+    `    flowId: '${flow.id}',`,
+    "    stepName: '',",
+    "    capabilityName: '',",
+    "    inputHash: auditHash(input),",
+    "    outputHash: '',",
+    "    durationMs: 0,",
+    "    status: 'success',",
+    "  });",
+    `  const flowSpan = provider.startSpan('flow.${flow.id}', {`,
+    `    'flow.id': '${flow.id}',`,
+    `    'flow.steps': ${flow.steps.length},`,
+    "  });",
+    "  const flowStart = Date.now();",
+    "",
+    "  try {",
+    "    let stepResult: unknown = input;",
+    stepCalls,
+    "    auditProvider.record({",
+    "      type: 'flow_end',",
+    "      traceId: context.traceId,",
+    "      timestamp: new Date().toISOString(),",
+    `      flowId: '${flow.id}',`,
+    "      stepName: '',",
+    "      capabilityName: '',",
+    "      inputHash: auditHash(input),",
+    "      outputHash: auditHash(stepResult),",
+    "      durationMs: Date.now() - flowStart,",
+    "      status: 'success',",
+    "    });",
+    `    provider.recordMetric('flow.invocations', 1, { flow: '${flow.id}', status: 'success' });`,
+    "    return stepResult;",
+    "  } catch (error) {",
+    "    flowSpan.setError(error instanceof Error ? error : new Error(String(error)));",
+    `    provider.recordMetric('flow.errors', 1, { flow: '${flow.id}' });`,
+    "    auditProvider.record({",
+    "      type: 'flow_end',",
+    "      traceId: context.traceId,",
+    "      timestamp: new Date().toISOString(),",
+    `      flowId: '${flow.id}',`,
+    "      stepName: '',",
+    "      capabilityName: '',",
+    "      inputHash: auditHash(input),",
+    "      outputHash: '',",
+    "      durationMs: Date.now() - flowStart,",
+    "      status: 'error',",
+    "      error: error instanceof Error ? error.message : String(error),",
+    "    });",
+    "    throw error;",
+    "  } finally {",
+    `    provider.recordMetric('flow.latency', Date.now() - flowStart, { flow: '${flow.id}' });`,
+    "    flowSpan.end();",
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+  return header + stepFunctions.join("\n\n") + "\n\n" + executeFlow;
+}
+
+// src/workflow-observability.ts
+function generateWorkflowInstrumentation(workflow) {
+  return Object.entries(workflow.states).filter(([, state]) => !!state.on_enter).map(([stateName, state]) => ({
+    stateName,
+    // filter above guarantees on_enter exists; fallback silences linter.
+    capabilityName: state.on_enter?.use ?? "unknown",
+    workflowId: workflow.id,
+    isTerminal: state.type === "terminal",
+    metrics: {
+      invocations: "workflow.state.invocations",
+      errors: "workflow.state.errors",
+      latency: "workflow.state.latency",
+      transitions: "workflow.state.transitions"
+    }
+  }));
+}
+function generateInstrumentedStateHandlerCode(instrumentation, capabilityParams) {
+  const { stateName, capabilityName, workflowId, metrics } = instrumentation;
+  const paramsJson = JSON.stringify(capabilityParams);
+  const header = [
+    "// Generated by @stackwright-services/compiler \u2014 DO NOT EDIT",
+    `// Workflow: ${workflowId}, State: ${stateName}`,
+    `// Capability: ${capabilityName}`,
+    "//",
+    "// DO NOT EDIT \u2014 regenerate from the source YAML.",
+    "",
+    "import type { Context } from 'aws-lambda';",
+    "import type { ObservabilityProvider } from '@stackwright-services/compiler';",
+    "import type { AuditProvider } from '@stackwright-services/runtime';",
+    "import { auditHash, noopAuditProvider } from '@stackwright-services/runtime';",
+    "",
+    "// Noop observability \u2014 replace with real implementation in production bootstrap.",
+    "const noopProvider: ObservabilityProvider = {",
+    "  startSpan: () => ({ setAttribute: () => {}, setError: () => {}, end: () => {} }),",
+    "  recordMetric: () => {},",
+    "};",
+    ""
+  ].join("\n");
+  const handlerLines = [
+    "export async function handler(event: unknown, _context: Context): Promise<unknown> {",
+    "  // TODO: Replace noop providers with real implementations via DI bootstrap.",
+    "  const provider: ObservabilityProvider = noopProvider;",
+    "  const auditProvider: AuditProvider = noopAuditProvider;",
+    `  // Capability params: ${paramsJson}`,
+    "",
+    `  const span = provider.startSpan('workflow.state.${stateName}', {`,
+    `    'workflow.id': '${workflowId}',`,
+    `    'state.name': '${stateName}',`,
+    `    'capability.name': '${capabilityName}',`,
+    "  });",
+    "  const startTime = Date.now();",
+    "",
+    "  // Transition count \u2014 which signal drove entry to this state.",
+    "  const incomingSignal = (event as Record<string, unknown>)?.['signal'] as string | undefined;",
+    `  provider.recordMetric('${metrics.transitions}', 1, {`,
+    `    workflow: '${workflowId}',`,
+    `    state: '${stateName}',`,
+    "    signal: incomingSignal ?? 'initial',",
+    "  });",
+    "",
+    "  try {",
+    `    // TODO: Wire capability invocation for '${capabilityName}'.`,
+    "    const result = {",
+    "      ...(event as Record<string, unknown>),",
+    `      __state: '${stateName}',`,
+    `      __capability: '${capabilityName}',`,
+    "      __timestamp: new Date().toISOString(),",
+    "    };",
+    "",
+    `    provider.recordMetric('${metrics.invocations}', 1, {`,
+    `      workflow: '${workflowId}',`,
+    `      state: '${stateName}',`,
+    `      capability: '${capabilityName}',`,
+    "      status: 'success',",
+    "    });",
+    "    auditProvider.record({",
+    "      type: 'capability_invocation',",
+    "      traceId: _context.awsRequestId,",
+    "      timestamp: new Date().toISOString(),",
+    `      flowId: '${workflowId}',`,
+    `      stepName: '${stateName}',`,
+    `      capabilityName: '${capabilityName}',`,
+    "      inputHash: auditHash(event),",
+    "      outputHash: auditHash(result),",
+    "      durationMs: Date.now() - startTime,",
+    "      status: 'success',",
+    "    });",
+    "    return result;",
+    "  } catch (error) {",
+    "    span.setError(error instanceof Error ? error : new Error(String(error)));",
+    `    provider.recordMetric('${metrics.errors}', 1, {`,
+    `      workflow: '${workflowId}',`,
+    `      state: '${stateName}',`,
+    "    });",
+    "    auditProvider.record({",
+    "      type: 'capability_invocation',",
+    "      traceId: _context.awsRequestId,",
+    "      timestamp: new Date().toISOString(),",
+    `      flowId: '${workflowId}',`,
+    `      stepName: '${stateName}',`,
+    `      capabilityName: '${capabilityName}',`,
+    "      inputHash: auditHash(event),",
+    "      outputHash: '',",
+    "      durationMs: Date.now() - startTime,",
+    "      status: 'error',",
+    "      error: error instanceof Error ? error.message : String(error),",
+    "    });",
+    "    throw error;",
+    "  } finally {",
+    "    const duration = Date.now() - startTime;",
+    `    provider.recordMetric('${metrics.latency}', duration, {`,
+    `      workflow: '${workflowId}',`,
+    `      state: '${stateName}',`,
+    "    });",
+    "    span.end();",
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+  return header + handlerLines;
+}
+
+// src/targets/lambda.ts
+function compileLambdaTarget(flow, permissions, instrumentedCode) {
+  const files = {};
+  files["handler.ts"] = generateHandlerTs(flow);
+  files["flow.ts"] = instrumentedCode;
+  files["Dockerfile"] = generateDockerfile(flow);
+  files["iam-policy.json"] = generateIamPolicy(flow.trigger, permissions);
+  files["package.json"] = generatePackageJson(flow);
+  const triggerFiles = generateTriggerFiles(flow);
+  for (const [path, content] of Object.entries(triggerFiles)) {
+    files[path] = content;
+  }
+  return { files };
+}
+function generateHandlerTs(flow) {
+  const trigger = flow.trigger;
+  let routeSetup;
+  if (trigger.type === "http") {
+    const method = trigger.method.toLowerCase();
+    const inputExpr = trigger.method === "GET" ? "c.req.query()" : "await c.req.json()";
+    routeSetup = `
+app.${method}('${trigger.path}', async (c) => {
+  const input = ${inputExpr};
+  const context = createContext(c);
+  const provider = getObservabilityProvider();
+
+  try {
+    const result = await executeFlow(input, context, provider, registry);
+    return c.json(result);
+  } catch (error) {
+    context.logger.error('Flow execution failed', { error: String(error) });
+    return c.json({ error: 'Internal server error' }, 500);
+  }
+});`;
+  } else {
+    routeSetup = `
+// Non-HTTP trigger: ${trigger.type}
+// This handler expects to be invoked by the trigger adapter
+app.post('/_invoke', async (c) => {
+  const input = await c.req.json();
+  const context = createContext(c);
+  const provider = getObservabilityProvider();
+
+  try {
+    const result = await executeFlow(input, context, provider, registry);
+    return c.json(result);
+  } catch (error) {
+    context.logger.error('Flow execution failed', { error: String(error) });
+    return c.json({ error: 'Internal server error' }, 500);
+  }
+});`;
+  }
+  return `// Auto-generated Lambda handler for flow: ${flow.id}
+// DO NOT EDIT -- regenerate from source YAML.
+
+import { Hono } from 'hono';
+import { executeFlow } from './flow';
+import { CapabilityRegistry, registerAllCapabilities } from '@stackwright-services/capabilities';
+import type { CapabilityContext } from '@stackwright-services/capabilities';
+
+// Initialize registry with all built-in capabilities
+const registry = new CapabilityRegistry();
+registerAllCapabilities(registry);
+
+const app = new Hono();
+
+// Health check
+app.get('/health', (c) => c.json({ status: 'ok', flow: '${flow.id}' }));
+${routeSetup}
+
+function createContext(c: any): CapabilityContext {
+  return {
+    traceId: c.req.header('x-trace-id') ?? crypto.randomUUID(),
+    logger: {
+      debug: (msg: string, data?: Record<string, unknown>) => console.debug(JSON.stringify({ level: 'debug', msg, ...data })),
+      info: (msg: string, data?: Record<string, unknown>) => console.info(JSON.stringify({ level: 'info', msg, ...data })),
+      warn: (msg: string, data?: Record<string, unknown>) => console.warn(JSON.stringify({ level: 'warn', msg, ...data })),
+      error: (msg: string, data?: Record<string, unknown>) => console.error(JSON.stringify({ level: 'error', msg, ...data })),
+    },
+  };
+}
+
+function getObservabilityProvider() {
+  // No-op provider by default -- swap with OTel provider when configured
+  return {
+    startSpan: () => ({
+      setAttribute: () => {},
+      setError: () => {},
+      end: () => {},
+    }),
+    recordMetric: () => {},
+  };
+}
+
+export default app;
+`;
+}
+function generateDockerfile(flow) {
+  return `# Auto-generated Dockerfile for flow: ${flow.id}
+# Uses AWS Lambda Web Adapter for Hono compatibility
+# DO NOT EDIT -- regenerate from source YAML.
+
+FROM public.ecr.aws/docker/library/node:22-slim AS builder
+
+WORKDIR /app
+COPY package.json ./
+RUN npm install --production=false
+COPY . .
+RUN npm run build
+
+FROM public.ecr.aws/docker/library/node:22-slim AS runner
+
+# Install AWS Lambda Web Adapter
+COPY --from=public.ecr.aws/awsguru/aws-lambda-web-adapter:0.8.4 /lambda-adapter /opt/extensions/lambda-adapter
+
+WORKDIR /app
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./
+
+ENV PORT=8080
+ENV AWS_LWA_PORT=8080
+ENV NODE_ENV=production
+
+CMD ["node", "dist/handler.js"]
+`;
+}
+function generatePackageJson(flow) {
+  return JSON.stringify(
+    {
+      name: `${flow.id}-lambda`,
+      version: "0.0.1",
+      private: true,
+      scripts: {
+        build: "tsc",
+        start: "node dist/handler.js"
+      },
+      dependencies: {
+        hono: "^4",
+        "@stackwright-services/capabilities": "workspace:*"
+      },
+      devDependencies: {
+        typescript: "^6"
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function getTriggerPermissions(trigger) {
+  switch (trigger.type) {
+    case "event":
+      return [
+        {
+          Effect: "Allow",
+          Action: ["sns:Subscribe", "sns:Unsubscribe"],
+          Resource: "${TOPIC_ARN}"
+        }
+      ];
+    case "schedule":
+      return [
+        {
+          Effect: "Allow",
+          Action: ["events:PutRule", "events:PutTargets", "events:DeleteRule"],
+          Resource: "*"
+        }
+      ];
+    case "queue":
+      return [
+        {
+          Effect: "Allow",
+          Action: ["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"],
+          Resource: "${QUEUE_ARN}"
+        }
+      ];
+    case "http":
+    default:
+      return [];
+  }
+}
+function generateIamPolicy(trigger, permissions) {
+  const base = toIamPolicy(permissions);
+  const triggerStatements = getTriggerPermissions(trigger);
+  base.Statement = [...base.Statement, ...triggerStatements];
+  return JSON.stringify(base, null, 2) + "\n";
+}
+function generateTriggerFiles(flow) {
+  const trigger = flow.trigger;
+  switch (trigger.type) {
+    case "event": {
+      const source = trigger.source.replace(/^bus:/, "");
+      return {
+        "sns-subscription.json": JSON.stringify(
+          {
+            _comment: `Auto-generated SNS subscription for flow: ${flow.id}. Bind TOPIC_ARN and FUNCTION_ARN at deploy time.`,
+            TopicArn: "${TOPIC_ARN}",
+            Protocol: "lambda",
+            Endpoint: "${FUNCTION_ARN}",
+            Attributes: {
+              RawMessageDelivery: "true"
+            },
+            source
+          },
+          null,
+          2
+        ) + "\n"
+      };
+    }
+    case "schedule":
+      return {
+        "eventbridge-rule.json": JSON.stringify(
+          {
+            _comment: `Auto-generated EventBridge rule for flow: ${flow.id}. Bind FUNCTION_ARN at deploy time.`,
+            Name: `${flow.id}-schedule`,
+            ScheduleExpression: `cron(${trigger.cron})`,
+            State: "ENABLED",
+            Targets: [
+              {
+                Id: `${flow.id}-target`,
+                Arn: "${FUNCTION_ARN}"
+              }
+            ]
+          },
+          null,
+          2
+        ) + "\n"
+      };
+    case "queue":
+      return {
+        "sqs-event-source-mapping.json": JSON.stringify(
+          {
+            _comment: `Auto-generated SQS event source mapping for flow: ${flow.id}. Bind QUEUE_ARN and FUNCTION_ARN at deploy time.`,
+            EventSourceArn: "${QUEUE_ARN}",
+            FunctionName: "${FUNCTION_ARN}",
+            BatchSize: 10,
+            Enabled: true,
+            queueName: trigger.name
+          },
+          null,
+          2
+        ) + "\n"
+      };
+    case "http":
+    default:
+      return {};
+  }
+}
+
+// src/targets/helm.ts
+function compileHelmTarget(flow, permissions) {
+  const files = {};
+  const chartName = sanitizeChartName(flow.id);
+  const trigger = flow.trigger;
+  files["Chart.yaml"] = generateChartYaml(chartName, flow);
+  files["values.yaml"] = generateValuesYaml(chartName, flow);
+  files["templates/service.yaml"] = generateServiceYaml(chartName);
+  files["templates/serviceaccount.yaml"] = generateServiceAccountYaml(chartName);
+  files["templates/_helpers.tpl"] = generateHelpersTpl(chartName);
+  if (trigger.type === "schedule") {
+    files["templates/cronjob.yaml"] = generateCronJobYaml(chartName, trigger.cron);
+  } else {
+    files["templates/deployment.yaml"] = generateDeploymentYaml(chartName, trigger);
+    if (trigger.type === "http") {
+      files["templates/ingress.yaml"] = generateIngressYaml(chartName);
+    }
+  }
+  if (trigger.type === "event") {
+    files["templates/bus-subscription.yaml"] = generateBusConfigYaml(chartName, trigger.source);
+  }
+  if (trigger.type === "queue") {
+    files["templates/queue-config.yaml"] = generateQueueConfigYaml(chartName, trigger.name);
+  }
+  if (permissions.permissions.length > 0) {
+    files["templates/rbac.yaml"] = generateRbacYaml(chartName, permissions);
+  }
+  return { files };
+}
+function sanitizeChartName(name) {
+  return name.replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function generateChartYaml(chartName, flow) {
+  return `# Auto-generated Helm chart for flow: ${flow.id}
+# Defense Unicorns compatible
+# DO NOT EDIT -- regenerate from source YAML.
+apiVersion: v2
+name: ${chartName}
+description: ${flow.description}
+type: application
+version: 0.1.0
+appVersion: "0.0.1"
+`;
+}
+function generateValuesYaml(chartName, flow) {
+  const trigger = flow.trigger;
+  let triggerValues = "";
+  if (trigger.type === "event") {
+    const topic = trigger.source.replace(/^bus:/, "").toUpperCase().replace(/-/g, "_");
+    triggerValues = `
+# Event trigger configuration
+trigger:
+  type: "event"
+  busTopicArn: "\${BUS_TOPIC_${topic}_ARN}"
+`;
+  } else if (trigger.type === "schedule") {
+    triggerValues = `
+# Schedule trigger configuration
+trigger:
+  type: "schedule"
+  schedule: "${trigger.cron}"
+`;
+  } else if (trigger.type === "queue") {
+    const queueKey = trigger.name.toUpperCase().replace(/-/g, "_");
+    triggerValues = `
+# Queue trigger configuration
+trigger:
+  type: "queue"
+  queueUrl: "\${BUS_QUEUE_${queueKey}_URL}"
+`;
+  }
+  const ingressSection = trigger.type === "http" ? `
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: ${chartName}.local
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls: []
+` : "";
+  return `# Default values for ${chartName}
+# DO NOT EDIT -- regenerate from source YAML.
+
+replicaCount: 1
+
+image:
+  repository: ""
+  tag: "latest"
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+serviceAccount:
+  create: true
+  name: ""
+  annotations: {}
+
+service:
+  type: ClusterIP
+  port: 8080
+${ingressSection}
+resources:
+  limits:
+    cpu: 500m
+    memory: 256Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+env: []
+
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+# Flow metadata
+flow:
+  id: "${flow.id}"
+  description: "${flow.description}"
+${triggerValues}`;
+}
+function generateDeploymentYaml(chartName, trigger) {
+  let annotations = "";
+  if (trigger.type === "event") {
+    annotations = `  annotations:
+    stackwright.io/trigger-type: event
+    stackwright.io/bus-topic: "${trigger.source.replace(/^bus:/, "")}"
+`;
+  } else if (trigger.type === "queue") {
+    annotations = `  annotations:
+    stackwright.io/trigger-type: queue
+    stackwright.io/queue-name: "${trigger.name}"
+`;
+  }
+  return `# Auto-generated Deployment for ${chartName}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "${chartName}.fullname" . }}
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+${annotations}spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "${chartName}.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "${chartName}.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "${chartName}.serviceAccountName" . }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          env:
+            - name: PORT
+              value: "8080"
+            - name: NODE_ENV
+              value: "production"
+            - name: FLOW_ID
+              value: {{ .Values.flow.id | quote }}
+            {{- with .Values.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+`;
+}
+function generateServiceYaml(chartName) {
+  return `# Auto-generated Service for ${chartName}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "${chartName}.fullname" . }}
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "${chartName}.selectorLabels" . | nindent 4 }}
+`;
+}
+function generateIngressYaml(chartName) {
+  return `# Auto-generated Ingress for ${chartName}
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "${chartName}.fullname" . }}
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "${chartName}.fullname" $ }}
+                port:
+                  name: http
+          {{- end }}
+    {{- end }}
+{{- end }}
+`;
+}
+function generateServiceAccountYaml(chartName) {
+  return `# Auto-generated ServiceAccount for ${chartName}
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "${chartName}.serviceAccountName" . }}
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+`;
+}
+function generateHelpersTpl(chartName) {
+  return `{{/*
+Auto-generated helpers for ${chartName}
+*/}}
+
+{{- define "${chartName}.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "${chartName}.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "${chartName}.labels" -}}
+helm.sh/chart: {{ include "${chartName}.name" . }}-{{ .Chart.Version | replace "+" "_" }}
+{{ include "${chartName}.selectorLabels" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/part-of: stackwright-services
+{{- end }}
+
+{{- define "${chartName}.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "${chartName}.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{- define "${chartName}.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "${chartName}.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+`;
+}
+function generateCronJobYaml(chartName, cron) {
+  return `# Auto-generated CronJob for ${chartName}
+# DO NOT EDIT -- regenerate from source YAML.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "${chartName}.fullname" . }}
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+spec:
+  schedule: "${cron}"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            {{- include "${chartName}.selectorLabels" . | nindent 12 }}
+        spec:
+          serviceAccountName: {{ include "${chartName}.serviceAccountName" . }}
+          containers:
+            - name: {{ .Chart.Name }}
+              image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+              imagePullPolicy: {{ .Values.image.pullPolicy }}
+              env:
+                - name: PORT
+                  value: "8080"
+                - name: NODE_ENV
+                  value: "production"
+                - name: TRIGGER_MODE
+                  value: "schedule"
+                - name: FLOW_ID
+                  value: {{ .Values.flow.id | quote }}
+                {{- with .Values.env }}
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
+              resources:
+                {{- toYaml .Values.resources | nindent 16 }}
+          restartPolicy: OnFailure
+`;
+}
+function generateBusConfigYaml(chartName, source) {
+  const topic = source.replace(/^bus:/, "");
+  return `# Auto-generated bus subscription config for ${chartName}
+# The concrete subscription mechanism depends on the cluster's message bus operator.
+# DO NOT EDIT -- regenerate from source YAML.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "${chartName}.fullname" . }}-bus-config
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+data:
+  trigger-type: "event"
+  bus-topic: "${topic}"
+  source: "${source}"
+`;
+}
+function generateQueueConfigYaml(chartName, queueName) {
+  return `# Auto-generated queue config for ${chartName}
+# The concrete queue binding depends on the cluster's message bus operator.
+# DO NOT EDIT -- regenerate from source YAML.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "${chartName}.fullname" . }}-queue-config
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+data:
+  trigger-type: "queue"
+  queue-name: "${queueName}"
+`;
+}
+function generateRbacYaml(chartName, permissions) {
+  const rules = toRbacRules(permissions);
+  const rulesYaml = rules.map(
+    (r) => `  - apiGroups: [${r.apiGroups.map((g) => `"${g}"`).join(", ")}]
+    resources: [${r.resources.map((res) => `"${res}"`).join(", ")}]
+    verbs: [${r.verbs.map((v) => `"${v}"`).join(", ")}]`
+  ).join("\n");
+  return `# Auto-generated RBAC for ${chartName}
+# Derived from least-privilege permission analysis
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "${chartName}.fullname" . }}
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+rules:
+${rulesYaml}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "${chartName}.fullname" . }}
+  labels:
+    {{- include "${chartName}.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "${chartName}.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "${chartName}.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+`;
+}
+
+// src/targets/stepfunctions.ts
+function compileStepFunctionsTarget(workflow, permissions) {
+  const files = {};
+  const asl = generateAslDefinition(workflow);
+  files["asl-definition.json"] = JSON.stringify(asl, null, 2);
+  files["iam-execution-role.json"] = JSON.stringify(
+    toStepFunctionsIamPolicy(workflow, permissions),
+    null,
+    2
+  );
+  for (const inst of generateWorkflowInstrumentation(workflow)) {
+    const params = workflow.states[inst.stateName]?.on_enter?.with ?? {};
+    files[`handlers/${inst.stateName}.ts`] = generateInstrumentedStateHandlerCode(inst, params);
+  }
+  files["package.json"] = generatePackageJson2(workflow);
+  return { files };
+}
+function generateAslDefinition(workflow) {
+  const states = {};
+  for (const [name, state] of Object.entries(workflow.states)) {
+    Object.assign(states, generateAslStates(name, state, workflow));
+  }
+  const definition = {
+    Comment: `Stackwright workflow: ${workflow.description}`,
+    StartAt: workflow.initial,
+    States: states
+  };
+  if (workflow.timeouts?.absolute) {
+    definition["TimeoutSeconds"] = iso8601ToSeconds(workflow.timeouts.absolute);
+  }
+  return definition;
+}
+function generateAslStates(name, state, workflow) {
+  const isTerminal = state.type === "terminal";
+  const hasOnEnter = !!state.on_enter;
+  const transitions = state.transitions ?? [];
+  if (isTerminal && hasOnEnter) {
+    const succeedName = `${name}__succeed`;
+    return {
+      [name]: buildTaskState(workflow.id, name, succeedName),
+      [succeedName]: { Type: "Succeed" }
+    };
+  }
+  if (isTerminal) {
+    return { [name]: { Type: "Succeed" } };
+  }
+  if (transitions.length === 0) {
+    return hasOnEnter ? { [name]: buildTaskState(workflow.id, name) } : { [name]: { Type: "Pass", End: true } };
+  }
+  const first = transitions[0];
+  if (transitions.length === 1 && first && !first.when) {
+    return hasOnEnter ? { [name]: buildTaskState(workflow.id, name, first.to) } : { [name]: { Type: "Pass", Next: first.to } };
+  }
+  if (hasOnEnter) {
+    const choiceName = `${name}__choice`;
+    return {
+      [name]: buildTaskState(workflow.id, name, choiceName),
+      [choiceName]: buildChoiceState(transitions)
+    };
+  }
+  return { [name]: buildChoiceState(transitions) };
+}
+function buildTaskState(workflowId, stateName, next) {
+  const task = {
+    Type: "Task",
+    Resource: "arn:aws:states:::lambda:invoke",
+    Parameters: {
+      FunctionName: `${workflowId}-${stateName}`,
+      "Payload.$": "$"
+    }
+  };
+  if (next) {
+    task["Next"] = next;
+  } else {
+    task["End"] = true;
+  }
+  return task;
+}
+function buildChoiceState(transitions) {
+  const choices = [];
+  let defaultTarget;
+  const lastNoWhenIdx = findLastIndex(transitions, (t) => !t.when);
+  for (const [i, t] of transitions.entries()) {
+    if (i === lastNoWhenIdx) {
+      defaultTarget = t.to;
+      continue;
+    }
+    choices.push(transitionToChoiceRule(t));
+  }
+  const choiceState = {
+    Type: "Choice",
+    Choices: choices
+  };
+  if (defaultTarget) {
+    choiceState["Default"] = defaultTarget;
+  }
+  return choiceState;
+}
+function transitionToChoiceRule(transition) {
+  const signalCheck = { Variable: "$.signal", StringEquals: transition.on };
+  if (!transition.when || transition.when.length === 0) {
+    return { ...signalCheck, Next: transition.to };
+  }
+  return {
+    And: [signalCheck, ...transition.when.map(predicateToChoiceRule)],
+    Next: transition.to
+  };
+}
+function predicateToChoiceRule(predicate) {
+  const variable = `$.${predicate.field}`;
+  switch (predicate.op) {
+    case "equals":
+      return buildEqualsRule(variable, predicate.value);
+    case "not_equals":
+      return { Not: buildEqualsRule(variable, predicate.value) };
+    case "less_than":
+      return { Variable: variable, NumericLessThan: predicate.value };
+    case "greater_than":
+      return { Variable: variable, NumericGreaterThan: predicate.value };
+    case "less_than_or_equal":
+      return { Variable: variable, NumericLessThanEquals: predicate.value };
+    case "greater_than_or_equal":
+      return { Variable: variable, NumericGreaterThanEquals: predicate.value };
+    case "matches_prefix":
+      return { Variable: variable, StringMatches: `${String(predicate.value)}*` };
+    case "contains":
+      return { Variable: variable, StringMatches: `*${String(predicate.value)}*` };
+    case "in":
+      return buildInRule(variable, predicate.value);
+    case "not_in":
+      return { Not: buildInRule(variable, predicate.value) };
+    case "less_than_field":
+    case "greater_than_field":
+    case "equals_field":
+      return { Variable: variable, StringEquals: `__UNSUPPORTED_FIELD_OP_${predicate.op}__` };
+  }
+}
+function buildEqualsRule(variable, value) {
+  if (typeof value === "string") return { Variable: variable, StringEquals: value };
+  if (typeof value === "number") return { Variable: variable, NumericEquals: value };
+  if (typeof value === "boolean") return { Variable: variable, BooleanEquals: value };
+  return { Variable: variable, StringEquals: String(value) };
+}
+function buildInRule(variable, value) {
+  if (!Array.isArray(value)) return buildEqualsRule(variable, value);
+  return { Or: value.map((v) => buildEqualsRule(variable, v)) };
+}
+function iso8601ToSeconds(duration) {
+  const match = duration.match(
+    /^P(?:(\d+)Y)?(?:(\d+)M)?(?:(\d+)W)?(?:(\d+)D)?(?:T(?:(\d+)H)?(?:(\d+)M)?(?:(\d+)S)?)?$/
+  );
+  if (!match) {
+    throw new Error(`Invalid ISO 8601 duration: ${duration}`);
+  }
+  const [, years, months, weeks, days, hours, minutes, seconds] = match;
+  let total = 0;
+  if (years) total += parseInt(years, 10) * 365 * 86400;
+  if (months) total += parseInt(months, 10) * 30 * 86400;
+  if (weeks) total += parseInt(weeks, 10) * 7 * 86400;
+  if (days) total += parseInt(days, 10) * 86400;
+  if (hours) total += parseInt(hours, 10) * 3600;
+  if (minutes) total += parseInt(minutes, 10) * 60;
+  if (seconds) total += parseInt(seconds, 10);
+  return total;
+}
+function generatePackageJson2(workflow) {
+  return JSON.stringify(
+    {
+      name: `${workflow.id}-stepfunctions`,
+      version: "0.0.1",
+      private: true,
+      scripts: {
+        build: "tsc"
+      },
+      dependencies: {
+        "@stackwright-services/capabilities": "workspace:*"
+      },
+      devDependencies: {
+        "@types/aws-lambda": "^8",
+        typescript: "^6"
+      }
+    },
+    null,
+    2
+  ) + "\n";
+}
+function findLastIndex(arr, predicate) {
+  for (let i = arr.length - 1; i >= 0; i--) {
+    if (predicate(arr[i])) return i;
+  }
+  return -1;
+}
+
+// src/targets/openapi.ts
+function compileOpenApiTarget(flow, options = {}) {
+  if (flow.trigger.type !== "http") {
+    return { files: {} };
+  }
+  const trigger = flow.trigger;
+  const version = options.version ?? "0.0.1";
+  const spec = buildOpenApiSpec(flow, trigger, version, options);
+  return {
+    files: {
+      "openapi.yaml": serializeYaml(spec)
+    }
+  };
+}
+function buildOpenApiSpec(flow, trigger, version, options) {
+  const operationId = generateOperationId(flow.id, trigger.method);
+  const spec = {
+    openapi: "3.1.0",
+    info: {
+      title: flow.id,
+      description: flow.description,
+      version
+    },
+    paths: {
+      [trigger.path]: {
+        [trigger.method.toLowerCase()]: {
+          operationId,
+          summary: flow.description,
+          ...trigger.method === "GET" ? { parameters: buildQueryParameters(trigger) } : { requestBody: buildRequestBody(trigger) },
+          responses: buildResponses(trigger)
+        }
+      }
+    }
+  };
+  if (options.serverUrl) {
+    spec.servers = [{ url: options.serverUrl }];
+  }
+  if (options.buildKey) {
+    spec.components = {
+      ...spec.components,
+      securitySchemes: {
+        buildKey: {
+          type: "apiKey",
+          in: "header",
+          name: "x-stackwright-build-key",
+          description: "Build-coherence key. Auto-generated at compile time. Ensures frontend/backend version match."
+        }
+      }
+    };
+    spec.security = [{ buildKey: [] }];
+    spec["x-stackwright-build-key"] = options.buildKey;
+  }
+  spec.components = {
+    ...spec.components,
+    schemas: {
+      [trigger.input_schema]: {
+        type: "object",
+        description: `Input schema: ${trigger.input_schema} (resolve from Zod schema at build time)`
+      },
+      [trigger.output_schema]: {
+        type: "object",
+        description: `Output schema: ${trigger.output_schema} (resolve from Zod schema at build time)`
+      }
+    }
+  };
+  return spec;
+}
+function generateOperationId(flowId, method) {
+  const camelCase = flowId.replace(/[^a-zA-Z0-9]+(.)/g, (_, ch) => ch.toUpperCase()).replace(/^[A-Z]/, (ch) => ch.toLowerCase());
+  const prefix = method.toLowerCase();
+  return `${prefix}${camelCase.charAt(0).toUpperCase()}${camelCase.slice(1)}`;
+}
+function buildQueryParameters(trigger) {
+  return [
+    {
+      name: trigger.input_schema,
+      in: "query",
+      description: `Query parameters per ${trigger.input_schema} schema`,
+      required: false,
+      schema: { $ref: `#/components/schemas/${trigger.input_schema}` }
+    }
+  ];
+}
+function buildRequestBody(trigger) {
+  return {
+    required: true,
+    content: {
+      "application/json": {
+        schema: { $ref: `#/components/schemas/${trigger.input_schema}` }
+      }
+    }
+  };
+}
+function buildResponses(trigger) {
+  return {
+    "200": {
+      description: "Successful response",
+      content: {
+        "application/json": {
+          schema: { $ref: `#/components/schemas/${trigger.output_schema}` }
+        }
+      }
+    },
+    "400": {
+      description: "Validation error",
+      content: {
+        "application/json": {
+          schema: {
+            type: "object",
+            properties: {
+              error: { type: "string" },
+              code: { type: "string" },
+              details: { type: "object" }
+            }
+          }
+        }
+      }
+    },
+    "500": {
+      description: "Internal server error",
+      content: {
+        "application/json": {
+          schema: {
+            type: "object",
+            properties: {
+              error: { type: "string" },
+              code: { type: "string" }
+            }
+          }
+        }
+      }
+    }
+  };
+}
+function serializeYaml(obj, indent = 0) {
+  const pad = "  ".repeat(indent);
+  if (obj === null || obj === void 0) return "null";
+  if (typeof obj === "string") {
+    if (needsQuoting(obj)) {
+      return `'${obj.replace(/'/g, "''")}'`;
+    }
+    return obj;
+  }
+  if (typeof obj === "number" || typeof obj === "boolean") return String(obj);
+  if (Array.isArray(obj)) {
+    if (obj.length === 0) return "[]";
+    return obj.map((item) => {
+      if (typeof item === "object" && item !== null) {
+        const inner = serializeYaml(item, indent + 1);
+        const lines = inner.split("\n");
+        const firstLine = lines[0] ?? "";
+        return `${pad}- ${firstLine.trimStart()}
+${lines.slice(1).join("\n")}`.trimEnd();
+      }
+      return `${pad}- ${serializeYaml(item)}`;
+    }).join("\n");
+  }
+  if (typeof obj === "object") {
+    const entries = Object.entries(obj);
+    if (entries.length === 0) return "{}";
+    return entries.map(([key, val]) => {
+      const safeKey = keyNeedsQuoting(key) ? `'${key}'` : key;
+      if (typeof val === "object" && val !== null && !Array.isArray(val) && Object.keys(val).length > 0) {
+        return `${pad}${safeKey}:
+${serializeYaml(val, indent + 1)}`;
+      }
+      if (Array.isArray(val)) {
+        if (val.length === 0) return `${pad}${safeKey}: []`;
+        return `${pad}${safeKey}:
+${serializeYaml(val, indent + 1)}`;
+      }
+      return `${pad}${safeKey}: ${serializeYaml(val)}`;
+    }).join("\n");
+  }
+  return String(obj);
+}
+function needsQuoting(str) {
+  return /[:{},&*#?|<>=!%@`\n[\]]/.test(str) || str === "" || str === "true" || str === "false";
+}
+function keyNeedsQuoting(key) {
+  return /^\d+$/.test(key) || key === "true" || key === "false" || key === "null" || key === "";
+}
+
+// src/auth-permissions.ts
+function deriveFlowAuthRequirements(flow) {
+  void flow;
+  return {
+    requiresAuth: false,
+    requiredRoles: [],
+    sources: []
+  };
+}
+function deriveWorkflowAuthRequirements(workflow) {
+  const sources = [];
+  for (const [stateName, state] of Object.entries(workflow.states)) {
+    if (state.transitions) {
+      for (const transition of state.transitions) {
+        if (transition.guard_role) {
+          sources.push({
+            role: transition.guard_role,
+            location: `states.${stateName}.transitions[on=${transition.on}].guard_role`
+          });
+        }
+      }
+    }
+  }
+  const uniqueRoles = [...new Set(sources.map((s) => s.role))];
+  return {
+    requiresAuth: sources.length > 0,
+    requiredRoles: uniqueRoles,
+    sources
+  };
+}
+function toLambdaAuthorizerConfig(auth) {
+  if (!auth.requiresAuth) return null;
+  return {
+    type: "REQUEST",
+    identitySource: "method.request.header.Authorization",
+    authorizerResultTtlInSeconds: 300,
+    // The actual authorizer Lambda is provisioned separately —
+    // this config tells API Gateway to require it
+    requiredRoles: auth.requiredRoles
+  };
+}
+function toHelmAuthAnnotations(auth) {
+  if (!auth.requiresAuth) return {};
+  return {
+    "stackwright.io/auth-required": "true",
+    "stackwright.io/auth-roles": auth.requiredRoles.join(","),
+    "stackwright.io/auth-provider": "oidc"
+    // default, overridable via values.yaml
+  };
+}
+
+// src/build-coherence.ts
+import { createHash } from "crypto";
+function deriveBuildCoherence(flow, options = {}) {
+  const enabled = options.enabled ?? true;
+  const buildTimestamp = options.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+  const contentHash = createHash("sha256").update(JSON.stringify(flow)).digest("hex").slice(0, 16);
+  const buildKey = createHash("sha256").update(`${contentHash}:${buildTimestamp}`).digest("hex").slice(0, 32);
+  return {
+    enabled,
+    buildKey,
+    contentHash,
+    buildTimestamp
+  };
+}
+function toBuildKeyMiddleware(config) {
+  if (!config.enabled) return "";
+  return `
+// \u2500\u2500\u2500 Build Coherence \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// Auto-generated by the Stackwright Services compiler.
+// Ensures this backend matches the frontend that was compiled with it.
+// NOT authentication \u2014 that's AuthProvider's job.
+const STACKWRIGHT_BUILD_KEY = process.env.STACKWRIGHT_BUILD_KEY ?? '${config.buildKey}';
+const STACKWRIGHT_CONTENT_HASH = '${config.contentHash}';
+
+app.use('*', async (c, next) => {
+  // Skip health check
+  if (c.req.path === '/health') return next();
+
+  const clientKey = c.req.header('x-stackwright-build-key');
+  if (!clientKey) {
+    return c.json({
+      error: 'Missing build-coherence key',
+      code: 'BUILD_KEY_MISSING',
+      hint: 'Include x-stackwright-build-key header. This is auto-set by the generated client.',
+    }, 403);
+  }
+  if (clientKey !== STACKWRIGHT_BUILD_KEY) {
+    return c.json({
+      error: 'Build mismatch \u2014 frontend and backend were compiled from different builds',
+      code: 'BUILD_COHERENCE_FAILURE',
+      expected: STACKWRIGHT_BUILD_KEY.slice(0, 8) + '\u2026',
+      received: clientKey.slice(0, 8) + '\u2026',
+      contentHash: STACKWRIGHT_CONTENT_HASH,
+    }, 403);
+  }
+  await next();
+});
+`;
+}
+function toBuildKeyEnv(config) {
+  if (!config.enabled) return {};
+  return {
+    STACKWRIGHT_BUILD_KEY: config.buildKey,
+    STACKWRIGHT_CONTENT_HASH: config.contentHash,
+    STACKWRIGHT_BUILD_TIMESTAMP: config.buildTimestamp
+  };
+}
+export {
+  compileHelmTarget,
+  compileLambdaTarget,
+  compileOpenApiTarget,
+  compileStepFunctionsTarget,
+  deriveBuildCoherence,
+  deriveFlowAuthRequirements,
+  deriveFlowPermissions,
+  deriveWorkflowAuthRequirements,
+  deriveWorkflowPermissions,
+  detectDefinitionType,
+  generateFlowInstrumentation,
+  generateInstrumentedFlowCode,
+  generateInstrumentedStateHandlerCode,
+  generateInstrumentedStepCode,
+  generateWorkflowInstrumentation,
+  getTriggerPermissions,
+  iso8601ToSeconds,
+  sanitizeChartName,
+  sanitizeIdentifier,
+  toBuildKeyEnv,
+  toBuildKeyMiddleware,
+  toHelmAuthAnnotations,
+  toIamPolicy,
+  toLambdaAuthorizerConfig,
+  toRbacRules,
+  toStepFunctionsIamPolicy,
+  validate,
+  validateFlow,
+  validateWorkflow
+};
+//# sourceMappingURL=index.mjs.map