npm - @stackwright-services/compiler - Versions diffs - 0.4.0 → 0.5.1 - Mend

@stackwright-services/compiler 0.4.0 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/index.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/validate.ts","../src/permissions.ts","../src/observability.ts","../src/workflow-observability.ts","../src/targets/lambda.ts","../src/targets/helm.ts","../src/targets/stepfunctions.ts","../src/targets/openapi.ts","../src/auth-permissions.ts","../src/build-coherence.ts"],"sourcesContent":["import type { CapabilityRegistry } from '@stackwright-services/capabilities';\nimport {\n scanDataSources as defaultScanDataSources,\n type DataSourceScanResult,\n} from '@stackwright-services/runtime';\nimport {\n FlowDefinition,\n WorkflowDefinition,\n type FlowDefinition as FlowDefinitionType,\n type WorkflowDefinition as WorkflowDefinitionType,\n} from '@stackwright-services/types';\nimport { parse as parseYaml } from 'yaml';\n\n/*\n Validation result -- either success with parsed data, or failure with errors.\n /\nexport interface ValidationResult<T = unknown> {\n success: boolean;\n data?: T;\n errors: ValidationError[];\n warnings: ValidationWarning[];\n}\n\nexport interface ValidationError {\n code: string;\n message: string;\n path?: string;\n}\n\nexport interface ValidationWarning {\n code: string;\n message: string;\n path?: string;\n}\n\n/\n Options for validation — injectable for testing.\n /\nexport interface ValidateOptions {\n /\n Injectable scanDataSources function — defaults to the real runtime scan.\n * Pass a mock in tests to avoid depending on installed packages.\n /\n scanDataSources?: () => DataSourceScanResult;\n}\n\n/\n Detect whether a parsed YAML object is a flow or workflow.\n /\nexport function detectDefinitionType(obj: unknown): 'flow' \| 'workflow' \| 'unknown' {\n if (typeof obj !== 'object' \|\| obj === null) return 'unknown';\n const record = obj as Record<string, unknown>;\n if ('steps' in record && 'trigger' in record) return 'flow';\n if ('states' in record && 'initial' in record) return 'workflow';\n return 'unknown';\n}\n\n/\n Validate a YAML string as a flow or workflow definition.\n \n Pass 1: Schema validation (Zod parse)\n * Pass 2: Semantic validation (capability refs, state graph, etc.)\n \n @param yamlContent - Raw YAML string\n * @param registry - Capability registry for ref validation (optional)\n /\nexport function validate(\n yamlContent: string,\n registry?: CapabilityRegistry,\n options?: ValidateOptions,\n): ValidationResult {\n let parsed: unknown;\n try {\n parsed = parseYaml(yamlContent);\n } catch (err) {\n return {\n success: false,\n errors: [{ code: 'YAML_PARSE_ERROR', message: `Invalid YAML: ${(err as Error).message}` }],\n warnings: [],\n };\n }\n\n if (parsed === null \|\| parsed === undefined) {\n return {\n success: false,\n errors: [{ code: 'EMPTY_DOCUMENT', message: 'YAML document is empty' }],\n warnings: [],\n };\n }\n\n const defType = detectDefinitionType(parsed);\n\n if (defType === 'flow') {\n return validateFlow(parsed, registry, options);\n } else if (defType === 'workflow') {\n return validateWorkflow(parsed, registry);\n } else {\n return {\n success: false,\n errors: [\n {\n code: 'UNKNOWN_DEFINITION_TYPE',\n message:\n 'Could not detect definition type. Expected a flow (with trigger + steps) or workflow (with states + initial).',\n },\n ],\n warnings: [],\n };\n }\n}\n\n/\n Validate a flow definition (two-pass).\n /\nexport function validateFlow(\n parsed: unknown,\n registry?: CapabilityRegistry,\n options?: ValidateOptions,\n): ValidationResult<FlowDefinitionType> {\n // Pass 1: Schema validation\n const result = FlowDefinition.safeParse(parsed);\n\n if (!result.success) {\n const errors: ValidationError[] = result.error.issues.map((issue) => ({\n code: 'SCHEMA_VALIDATION_ERROR',\n message: issue.message,\n path: issue.path.join('.'),\n }));\n return { success: false, errors, warnings: [] };\n }\n\n const flow = result.data;\n const errors: ValidationError[] = [];\n const warnings: ValidationWarning[] = [];\n\n // Pass 2: Semantic validation\n\n // Check capability references exist in registry\n if (registry) {\n for (const step of flow.steps) {\n if (!registry.has(step.use)) {\n errors.push({\n code: 'UNKNOWN_CAPABILITY',\n message: `Step \"${step.name}\" references unknown capability \"${step.use}\"`,\n path: `steps.${step.name}.use`,\n });\n }\n }\n }\n\n // Check for duplicate step names\n const stepNames = flow.steps.map((s) => s.name);\n const seen = new Set<string>();\n for (const name of stepNames) {\n if (seen.has(name)) {\n warnings.push({\n code: 'DUPLICATE_STEP_NAME',\n message: `Duplicate step name \"${name}\" -- step names should be unique for observability`,\n path: `steps.${name}`,\n });\n }\n seen.add(name);\n }\n\n // Check source: references (best-effort static hint — warnings only, never errors).\n // Providers may be installed at deploy time even if absent at build time.\n const sourceRefs: Array<{ ref: string; stepName: string }> = [];\n for (const step of flow.steps) {\n const sourceVal = step.with?.['source'];\n if (\n typeof sourceVal === 'string' &&\n (sourceVal.startsWith('openapi:') \|\| sourceVal.startsWith('pulse:'))\n ) {\n sourceRefs.push({ ref: sourceVal, stepName: step.name });\n }\n }\n\n if (sourceRefs.length > 0) {\n const doScan = options?.scanDataSources ?? defaultScanDataSources;\n const scanResult = doScan();\n\n for (const { ref, stepName } of sourceRefs) {\n const sourceId = ref.slice(ref.indexOf(':') + 1);\n\n if (scanResult.detectedProviders.length === 0) {\n warnings.push({\n code: 'SOURCE_UNVERIFIABLE',\n message: `source '${ref}' cannot be verified: no DataSourceProvider is installed`,\n path: `steps.${stepName}.with.source`,\n });\n } else if (!scanResult.sources.some((s) => s.id === sourceId)) {\n warnings.push({\n code: 'SOURCE_NOT_REGISTERED',\n message: `source '${ref}' is not registered by any installed provider`,\n path: `steps.${stepName}.with.source`,\n });\n }\n // source found — no warning\n }\n }\n\n return {\n success: errors.length === 0,\n data: flow,\n errors,\n warnings,\n };\n}\n\n/\n Validate a workflow definition (two-pass).\n /\nexport function validateWorkflow(\n parsed: unknown,\n registry?: CapabilityRegistry,\n): ValidationResult<WorkflowDefinitionType> {\n // Pass 1: Schema validation\n const result = WorkflowDefinition.safeParse(parsed);\n\n if (!result.success) {\n const errors: ValidationError[] = result.error.issues.map((issue) => ({\n code: 'SCHEMA_VALIDATION_ERROR',\n message: issue.message,\n path: issue.path.join('.'),\n }));\n return { success: false, errors, warnings: [] };\n }\n\n const workflow = result.data;\n const errors: ValidationError[] = [];\n const warnings: ValidationWarning[] = [];\n const stateNames = Object.keys(workflow.states);\n\n // Check initial state exists\n if (!stateNames.includes(workflow.initial)) {\n errors.push({\n code: 'INITIAL_STATE_NOT_FOUND',\n message: `Initial state \"${workflow.initial}\" does not exist in states map`,\n path: 'initial',\n });\n }\n\n // Check all transition targets exist\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n if (!stateNames.includes(transition.to)) {\n errors.push({\n code: 'TRANSITION_TARGET_NOT_FOUND',\n message: `State \"${stateName}\" has transition to unknown state \"${transition.to}\"`,\n path: `states.${stateName}.transitions`,\n });\n }\n }\n }\n\n // Check on_enter capability refs\n if (registry && state.on_enter) {\n if (!registry.has(state.on_enter.use)) {\n errors.push({\n code: 'UNKNOWN_CAPABILITY',\n message: `State \"${stateName}\" on_enter references unknown capability \"${state.on_enter.use}\"`,\n path: `states.${stateName}.on_enter.use`,\n });\n }\n }\n }\n\n // Check at least one terminal state exists\n const terminalStates = stateNames.filter((name) => workflow.states[name]?.type === 'terminal');\n if (terminalStates.length === 0 && stateNames.length > 0) {\n errors.push({\n code: 'NO_TERMINAL_STATE',\n message: 'Workflow has no terminal state -- workflows must have at least one terminal state',\n });\n }\n\n // Deadlock detection: non-terminal states with no transitions\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.type !== 'terminal' && (!state.transitions \|\| state.transitions.length === 0)) {\n errors.push({\n code: 'DEADLOCK_STATE',\n message: `State \"${stateName}\" is not terminal but has no transitions — workflow will deadlock here`,\n path: `states.${stateName}`,\n });\n }\n }\n\n // Reachability: BFS from initial state\n if (stateNames.includes(workflow.initial)) {\n const reachable = new Set<string>();\n const queue = [workflow.initial];\n\n while (queue.length > 0) {\n const current = queue.shift()!; // eslint-disable-line @typescript-eslint/no-non-null-assertion\n if (reachable.has(current)) continue;\n reachable.add(current);\n\n const state = workflow.states[current];\n if (state?.transitions) {\n for (const transition of state.transitions) {\n if (!reachable.has(transition.to)) {\n queue.push(transition.to);\n }\n }\n }\n }\n\n for (const stateName of stateNames) {\n if (!reachable.has(stateName)) {\n warnings.push({\n code: 'UNREACHABLE_STATE',\n message: `State \"${stateName}\" is not reachable from initial state \"${workflow.initial}\"`,\n path: `states.${stateName}`,\n });\n }\n }\n }\n\n // Terminal state reachability: reverse BFS from terminal states\n if (terminalStates.length > 0) {\n const canReachTerminal = new Set<string>(terminalStates);\n const reverseQueue = [...terminalStates];\n\n // Build reverse adjacency: for each state, which states transition TO it?\n const reverseAdj = new Map<string, string[]>();\n for (const name of stateNames) {\n reverseAdj.set(name, []);\n }\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n reverseAdj.get(transition.to)?.push(stateName);\n }\n }\n }\n\n // BFS backward from terminal states\n while (reverseQueue.length > 0) {\n const current = reverseQueue.shift()!; // eslint-disable-line @typescript-eslint/no-non-null-assertion\n for (const predecessor of reverseAdj.get(current) ?? []) {\n if (!canReachTerminal.has(predecessor)) {\n canReachTerminal.add(predecessor);\n reverseQueue.push(predecessor);\n }\n }\n }\n\n for (const stateName of stateNames) {\n if (workflow.states[stateName]?.type !== 'terminal' && !canReachTerminal.has(stateName)) {\n warnings.push({\n code: 'NO_PATH_TO_TERMINAL',\n message: `State \"${stateName}\" has no path to any terminal state`,\n path: `states.${stateName}`,\n });\n }\n }\n }\n\n // Signal consistency: validate transition signals against declared signals\n if (workflow.signals) {\n const declaredSignals = new Set(workflow.signals.map((s) => s.name));\n const usedSignals = new Set<string>();\n\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n usedSignals.add(transition.on);\n if (!declaredSignals.has(transition.on)) {\n warnings.push({\n code: 'UNKNOWN_SIGNAL',\n message: `Transition in state \"${stateName}\" uses signal \"${transition.on}\" which is not declared in workflow signals`,\n path: `states.${stateName}.transitions`,\n });\n }\n }\n }\n }\n\n for (const signal of workflow.signals) {\n if (!usedSignals.has(signal.name)) {\n warnings.push({\n code: 'UNUSED_SIGNAL',\n message: `Signal \"${signal.name}\" is declared but never used by any transition`,\n path: 'signals',\n });\n }\n }\n }\n\n // Ambiguous transitions: duplicate unguarded transitions for same signal in a state\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n const unguardedSignals = new Set<string>();\n for (const transition of state.transitions) {\n if (!transition.when) {\n if (unguardedSignals.has(transition.on)) {\n warnings.push({\n code: 'AMBIGUOUS_TRANSITION',\n message: `State \"${stateName}\" has multiple unguarded transitions for signal \"${transition.on}\" — only the first will match`,\n path: `states.${stateName}.transitions`,\n });\n }\n unguardedSignals.add(transition.on);\n }\n }\n }\n }\n\n // on_timeout capability validation\n if (registry && workflow.timeouts?.on_timeout) {\n if (!registry.has(workflow.timeouts.on_timeout.use)) {\n errors.push({\n code: 'UNKNOWN_CAPABILITY',\n message: `Timeout on_timeout references unknown capability \"${workflow.timeouts.on_timeout.use}\"`,\n path: 'timeouts.on_timeout.use',\n });\n }\n }\n\n return {\n success: errors.length === 0,\n data: workflow,\n errors,\n warnings,\n };\n}\n","import type { CapabilityRegistry } from '@stackwright-services/capabilities';\nimport type {\n FlowDefinition,\n RequiredPermission,\n WorkflowDefinition,\n} from '@stackwright-services/types';\n\n/\n A derived permission set -- the minimal set of permissions a service needs.\n * Computed by walking all capability invocations and collecting their requiredPermissions.\n /\nexport interface DerivedPermissions {\n /* All required permissions, deduplicated /\n permissions: RequiredPermission[];\n /* Which capabilities contributed each permission (for audit trail) /\n sources: PermissionSource[];\n}\n\nexport interface PermissionSource {\n /* The permission /\n permission: RequiredPermission;\n /* The capability that requires it /\n capabilityName: string;\n /* Where in the definition it's invoked /\n location: string;\n}\n\n/\n Resolve permission variable placeholders ($-prefixed) from step parameters.\n \n Permission resources may contain `$field` placeholders (e.g. `webhook:$url`)\n * that are resolved at compile time against the step's `with` block.\n * Unresolvable placeholders are left as-is (they'll be runtime-resolved or\n * represent wildcards).\n /\nfunction resolvePermissionVariables(\n permission: RequiredPermission,\n stepParams: Record<string, unknown> \| undefined,\n): RequiredPermission {\n if (!stepParams) return permission;\n\n let { resource } = permission;\n const variablePattern = /\\$([a-zA-Z_][a-zA-Z0-9_])/g;\n\n resource = resource.replace(variablePattern, (_match, varName: string) => {\n const value = stepParams[varName];\n if (typeof value === 'string') return value;\n if (typeof value === 'number' \|\| typeof value === 'boolean') return String(value);\n return _match; // Leave unresolved if not a primitive\n });\n\n return { ...permission, resource };\n}\n\n/*\n Derive the minimal permission set from a flow definition.\n \n Walks all steps, looks up each capability in the registry,\n * collects requiredPermissions from Effect capabilities.\n * Transform capabilities contribute no permissions (they're pure).\n \n Permission variables (e.g. `$url`) are resolved from step parameters\n * at compile time for static permission derivation.\n \n @security-critical -- This is least-privilege derivation.\n * The output of this function determines the IAM policy / RBAC manifest.\n /\nexport function deriveFlowPermissions(\n flow: FlowDefinition,\n registry: CapabilityRegistry,\n): DerivedPermissions {\n const sources: PermissionSource[] = [];\n\n for (const step of flow.steps) {\n const capability = registry.lookup(step.use);\n if (!capability) continue;\n\n if (capability.definition.kind === 'effect') {\n for (const perm of capability.definition.requiredPermissions) {\n const resolved = resolvePermissionVariables(perm, step.with);\n sources.push({\n permission: resolved,\n capabilityName: step.use,\n location: `steps.${step.name}`,\n });\n }\n }\n }\n\n return {\n permissions: deduplicatePermissions(sources.map((s) => s.permission)),\n sources,\n };\n}\n\n/\n Derive the minimal permission set from a workflow definition.\n \n Walks all states' on_enter actions, collects requiredPermissions\n * from Effect capabilities.\n /\nexport function deriveWorkflowPermissions(\n workflow: WorkflowDefinition,\n registry: CapabilityRegistry,\n): DerivedPermissions {\n const sources: PermissionSource[] = [];\n\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.on_enter) {\n const capability = registry.lookup(state.on_enter.use);\n if (!capability) continue;\n\n if (capability.definition.kind === 'effect') {\n for (const perm of capability.definition.requiredPermissions) {\n sources.push({\n permission: perm,\n capabilityName: state.on_enter.use,\n location: `states.${stateName}.on_enter`,\n });\n }\n }\n }\n }\n\n // Collect permissions from timeout escalation action\n if (workflow.timeouts?.on_timeout) {\n const capability = registry.lookup(workflow.timeouts.on_timeout.use);\n if (capability && capability.definition.kind === 'effect') {\n for (const perm of capability.definition.requiredPermissions) {\n sources.push({\n permission: perm,\n capabilityName: workflow.timeouts.on_timeout.use,\n location: 'timeouts.on_timeout',\n });\n }\n }\n }\n\n return {\n permissions: deduplicatePermissions(sources.map((s) => s.permission)),\n sources,\n };\n}\n\n/\n Deduplicate permissions by resource + action + scope.\n /\nfunction deduplicatePermissions(permissions: RequiredPermission[]): RequiredPermission[] {\n const seen = new Set<string>();\n const unique: RequiredPermission[] = [];\n\n for (const perm of permissions) {\n const key = `${perm.resource}:${perm.action}:${perm.scope ?? ''}`;\n if (!seen.has(key)) {\n seen.add(key);\n unique.push(perm);\n }\n }\n\n return unique;\n}\n\n/\n Generate an AWS IAM policy document from derived permissions.\n * Used by the Lambda compile target.\n /\nexport function toIamPolicy(derived: DerivedPermissions): object {\n if (derived.permissions.length === 0) {\n return {\n Version: '2012-10-17',\n Statement: [],\n };\n }\n\n return {\n Version: '2012-10-17',\n Statement: derived.permissions.map((perm) => ({\n Effect: 'Allow',\n Action: `stackwright:${perm.action}`,\n Resource: perm.resource,\n ...(perm.scope ? { Condition: { StringEquals: { 'stackwright:scope': perm.scope } } } : {}),\n })),\n };\n}\n\n/\n Generate an IAM policy for a Step Functions execution role.\n \n Includes:\n * - Lambda invoke permissions for each state's on_enter handler\n * - Capability-derived permissions (from deriveWorkflowPermissions)\n * - EventBridge permissions if timeouts are configured\n * - CloudWatch Logs for execution logging\n \n @security-critical\n /\nexport function toStepFunctionsIamPolicy(\n workflow: WorkflowDefinition,\n derived: DerivedPermissions,\n): object {\n const statements: object[] = [];\n\n // 1. Lambda invoke for each state with on_enter\n const statesWithActions = Object.entries(workflow.states)\n .filter(([, state]) => state.on_enter !== undefined)\n .map(([name]) => name);\n\n if (statesWithActions.length > 0) {\n statements.push({\n Sid: 'InvokeStateLambdas',\n Effect: 'Allow',\n Action: ['lambda:InvokeFunction'],\n Resource: statesWithActions.map(\n (name) => `arn:aws:lambda:::function:${workflow.id}-${name}`,\n ),\n });\n }\n\n // 2. Capability-derived permissions\n if (derived.permissions.length > 0) {\n statements.push(\n ...derived.permissions.map((perm) => ({\n Effect: 'Allow',\n Action: `stackwright:${perm.action}`,\n Resource: perm.resource,\n ...(perm.scope ? { Condition: { StringEquals: { 'stackwright:scope': perm.scope } } } : {}),\n })),\n );\n }\n\n // 3. EventBridge for timeouts\n if (workflow.timeouts?.pending_after \|\| workflow.timeouts?.absolute) {\n statements.push({\n Sid: 'TimeoutScheduling',\n Effect: 'Allow',\n Action: ['events:PutRule', 'events:PutTargets', 'events:DeleteRule', 'events:RemoveTargets'],\n Resource: `arn:aws:events:::rule/${workflow.id}-timeout-`,\n });\n }\n\n // 4. CloudWatch Logs\n statements.push({\n Sid: 'ExecutionLogging',\n Effect: 'Allow',\n Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],\n Resource: `arn:aws:logs:::log-group:/aws/stepfunctions/${workflow.id}:`,\n });\n\n return {\n Version: '2012-10-17',\n Statement: statements,\n };\n}\n\n/\n Generate a Kubernetes RBAC rule set from derived permissions.\n * Used by the Helm compile target.\n /\nexport function toRbacRules(derived: DerivedPermissions): object[] {\n if (derived.permissions.length === 0) return [];\n\n // Group by resource for cleaner RBAC\n const grouped = new Map<string, string[]>();\n for (const perm of derived.permissions) {\n const verbs = grouped.get(perm.resource) ?? [];\n if (!verbs.includes(perm.action)) {\n verbs.push(perm.action);\n }\n grouped.set(perm.resource, verbs);\n }\n\n return Array.from(grouped.entries()).map(([resource, verbs]) => ({\n apiGroups: ['stackwright.io'],\n resources: [resource],\n verbs,\n }));\n}\n","import type { FlowDefinition } from '@stackwright-services/types';\n\n/\n The ObservabilityProvider interface -- what the generated code calls.\n * This is defined here for code generation; the runtime package implements it.\n /\nexport interface ObservabilityProvider {\n /* Start a span for a capability invocation /\n startSpan(name: string, attributes?: Record<string, string \| number \| boolean>): SpanHandle;\n /* Record a metric /\n recordMetric(name: string, value: number, tags?: Record<string, string>): void;\n}\n\nexport interface SpanHandle {\n /* Set attributes on the span /\n setAttribute(key: string, value: string \| number \| boolean): void;\n /* Mark the span as errored /\n setError(error: Error): void;\n /* End the span /\n end(): void;\n}\n\n/\n Instrumentation metadata for a single step.\n /\nexport interface StepInstrumentation {\n /* Step name (used as span name) /\n stepName: string;\n /* Capability name (span attribute) /\n capabilityName: string;\n /* Flow ID (span attribute) /\n flowId: string;\n /* Metric names /\n metrics: {\n latency: string;\n invocations: string;\n errors: string;\n };\n}\n\n/\n Generate instrumentation metadata for all steps in a flow.\n /\nexport function generateFlowInstrumentation(flow: FlowDefinition): StepInstrumentation[] {\n return flow.steps.map((step) => ({\n stepName: step.name,\n capabilityName: step.use,\n flowId: flow.id,\n metrics: {\n latency: 'flow.step.latency',\n invocations: 'flow.step.invocations',\n errors: 'flow.step.errors',\n },\n }));\n}\n\n/\n Sanitize a string to be a valid TypeScript identifier.\n /\nexport function sanitizeIdentifier(name: string): string {\n return name.replace(/[^a-zA-Z0-9]/g, '_');\n}\n\n/\n Generate the TypeScript code for an instrumented step handler.\n \n This is what the compiler emits into the generated handler file.\n * Each step becomes an async function wrapped with observability AND audit.\n /\nexport function generateInstrumentedStepCode(instrumentation: StepInstrumentation): string {\n const { stepName, capabilityName, flowId, metrics } = instrumentation;\n const fnName = sanitizeIdentifier(stepName);\n\n return [\n `async function executeStep_${fnName}(`,\n ' input: unknown,',\n ' context: CapabilityContext,',\n ' provider: ObservabilityProvider,',\n ' auditProvider: AuditProvider,',\n ' handler: CapabilityHandler,',\n '): Promise<unknown> {',\n ` const span = provider.startSpan('step.${stepName}', {`,\n ` 'capability.name': '${capabilityName}',`,\n ` 'flow.id': '${flowId}',`,\n ` 'step.name': '${stepName}',`,\n ' });',\n ' const startTime = Date.now();',\n '',\n ' try {',\n ' const result = await handler(input, context);',\n ` provider.recordMetric('${metrics.invocations}', 1, { step: '${stepName}', capability: '${capabilityName}', status: 'success' });`,\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flowId}',`,\n ` stepName: '${stepName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(input),',\n ' outputHash: auditHash(result),',\n ' durationMs: Date.now() - startTime,',\n \" status: 'success',\",\n ' });',\n ' return result;',\n ' } catch (error) {',\n ' span.setError(error instanceof Error ? error : new Error(String(error)));',\n ` provider.recordMetric('${metrics.errors}', 1, { step: '${stepName}', capability: '${capabilityName}' });`,\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flowId}',`,\n ` stepName: '${stepName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(input),',\n \" outputHash: '',\",\n ' durationMs: Date.now() - startTime,',\n \" status: 'error',\",\n ' error: error instanceof Error ? error.message : String(error),',\n ' });',\n ' throw error;',\n ' } finally {',\n ' const duration = Date.now() - startTime;',\n ` provider.recordMetric('${metrics.latency}', duration, { step: '${stepName}', capability: '${capabilityName}' });`,\n ' span.end();',\n ' }',\n '}',\n ].join('\\n');\n}\n\n/\n Generate the full instrumented handler code for a flow.\n * Returns the complete TypeScript source for the compiled handler.\n /\nexport function generateInstrumentedFlowCode(flow: FlowDefinition): string {\n const instrumentations = generateFlowInstrumentation(flow);\n const stepFunctions = instrumentations.map(generateInstrumentedStepCode);\n\n const stepCalls = instrumentations\n .map(\n (inst) =>\n ` stepResult = await executeStep_${sanitizeIdentifier(inst.stepName)}(stepResult, context, provider, auditProvider, registry.get('${inst.capabilityName}').handler);`,\n )\n .join('\\n');\n\n const header = [\n '// Auto-generated by @stackwright-services/compiler',\n `// Flow: ${flow.id}`,\n `// Description: ${flow.description}`,\n '//',\n '// DO NOT EDIT -- regenerate from the source YAML.',\n '',\n \"import type { CapabilityContext, CapabilityHandler } from '@stackwright-services/capabilities';\",\n \"import type { ObservabilityProvider } from '@stackwright-services/compiler';\",\n \"import type { AuditProvider, AuditEvent } from '@stackwright-services/runtime';\",\n \"import { auditHash } from '@stackwright-services/runtime';\",\n '',\n ].join('\\n');\n\n const executeFlow = [\n 'export async function executeFlow(',\n ' input: unknown,',\n ' context: CapabilityContext,',\n ' provider: ObservabilityProvider,',\n ' auditProvider: AuditProvider,',\n ' registry: { get(name: string): { handler: CapabilityHandler } },',\n '): Promise<unknown> {',\n ' auditProvider.record({',\n \" type: 'flow_start',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flow.id}',`,\n \" stepName: '',\",\n \" capabilityName: '',\",\n ' inputHash: auditHash(input),',\n \" outputHash: '',\",\n ' durationMs: 0,',\n \" status: 'success',\",\n ' });',\n ` const flowSpan = provider.startSpan('flow.${flow.id}', {`,\n ` 'flow.id': '${flow.id}',`,\n ` 'flow.steps': ${flow.steps.length},`,\n ' });',\n ' const flowStart = Date.now();',\n '',\n ' try {',\n ' let stepResult: unknown = input;',\n stepCalls,\n ' auditProvider.record({',\n \" type: 'flow_end',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flow.id}',`,\n \" stepName: '',\",\n \" capabilityName: '',\",\n ' inputHash: auditHash(input),',\n ' outputHash: auditHash(stepResult),',\n ' durationMs: Date.now() - flowStart,',\n \" status: 'success',\",\n ' });',\n ` provider.recordMetric('flow.invocations', 1, { flow: '${flow.id}', status: 'success' });`,\n ' return stepResult;',\n ' } catch (error) {',\n ' flowSpan.setError(error instanceof Error ? error : new Error(String(error)));',\n ` provider.recordMetric('flow.errors', 1, { flow: '${flow.id}' });`,\n ' auditProvider.record({',\n \" type: 'flow_end',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flow.id}',`,\n \" stepName: '',\",\n \" capabilityName: '',\",\n ' inputHash: auditHash(input),',\n \" outputHash: '',\",\n ' durationMs: Date.now() - flowStart,',\n \" status: 'error',\",\n ' error: error instanceof Error ? error.message : String(error),',\n ' });',\n ' throw error;',\n ' } finally {',\n ` provider.recordMetric('flow.latency', Date.now() - flowStart, { flow: '${flow.id}' });`,\n ' flowSpan.end();',\n ' }',\n '}',\n '',\n ].join('\\n');\n\n return header + stepFunctions.join('\\n\\n') + '\\n\\n' + executeFlow;\n}\n","import type { WorkflowDefinition } from '@stackwright-services/types';\n\n/\n Instrumentation metadata for a single workflow state handler.\n * Mirrors StepInstrumentation but is scoped to state machine semantics:\n * transitions, dwell time, timeout events.\n /\nexport interface WorkflowStateInstrumentation {\n /* State name /\n stateName: string;\n /* Capability invoked on entry (from on_enter.use) /\n capabilityName: string;\n /* Workflow ID /\n workflowId: string;\n /* Whether this is a terminal state /\n isTerminal: boolean;\n /* Metric name constants /\n metrics: {\n /* Counter — fires each time the state is entered /\n invocations: string;\n /* Counter — fires when the on_enter capability throws /\n errors: string;\n /* Histogram — on_enter handler execution time in ms /\n latency: string;\n /* Counter — per-signal transition counts into this state /\n transitions: string;\n };\n}\n\n/\n Generate instrumentation metadata for all states that have an on_enter\n * capability in the workflow. States without on_enter have no Lambda handler\n * and are therefore excluded.\n /\nexport function generateWorkflowInstrumentation(\n workflow: WorkflowDefinition,\n): WorkflowStateInstrumentation[] {\n return Object.entries(workflow.states)\n .filter(([, state]) => !!state.on_enter)\n .map(([stateName, state]) => ({\n stateName,\n // filter above guarantees on_enter exists; fallback silences linter.\n capabilityName: state.on_enter?.use ?? 'unknown',\n workflowId: workflow.id,\n isTerminal: state.type === 'terminal',\n metrics: {\n invocations: 'workflow.state.invocations',\n errors: 'workflow.state.errors',\n latency: 'workflow.state.latency',\n transitions: 'workflow.state.transitions',\n },\n }));\n}\n\n/\n Generate a complete TypeScript Lambda handler file for an instrumented\n * workflow state.\n \n The generated handler:\n * - Opens a span per state execution (one span = one transition through the state)\n * - Records a `workflow.state.transitions` counter tagged with the incoming signal\n * - Records `workflow.state.invocations` / `workflow.state.errors` counters\n * - Records `workflow.state.latency` histogram (on_enter execution time)\n * - Emits an AuditProvider record on both success and error paths\n \n Providers default to noop — wire real implementations via your DI bootstrap.\n /\nexport function generateInstrumentedStateHandlerCode(\n instrumentation: WorkflowStateInstrumentation,\n capabilityParams: Record<string, unknown>,\n): string {\n const { stateName, capabilityName, workflowId, metrics } = instrumentation;\n const paramsJson = JSON.stringify(capabilityParams);\n const header = [\n '// Generated by @stackwright-services/compiler — DO NOT EDIT',\n `// Workflow: ${workflowId}, State: ${stateName}`,\n `// Capability: ${capabilityName}`,\n '//',\n '// DO NOT EDIT — regenerate from the source YAML.',\n '',\n \"import type { Context } from 'aws-lambda';\",\n \"import type { ObservabilityProvider } from '@stackwright-services/compiler';\",\n \"import type { AuditProvider } from '@stackwright-services/runtime';\",\n \"import { auditHash, noopAuditProvider } from '@stackwright-services/runtime';\",\n '',\n '// Noop observability — replace with real implementation in production bootstrap.',\n 'const noopProvider: ObservabilityProvider = {',\n ' startSpan: () => ({ setAttribute: () => {}, setError: () => {}, end: () => {} }),',\n ' recordMetric: () => {},',\n '};',\n '',\n ].join('\\n');\n\n const handlerLines = [\n 'export async function handler(event: unknown, _context: Context): Promise<unknown> {',\n ' // TODO: Replace noop providers with real implementations via DI bootstrap.',\n ' const provider: ObservabilityProvider = noopProvider;',\n ' const auditProvider: AuditProvider = noopAuditProvider;',\n ` // Capability params: ${paramsJson}`,\n '',\n ` const span = provider.startSpan('workflow.state.${stateName}', {`,\n ` 'workflow.id': '${workflowId}',`,\n ` 'state.name': '${stateName}',`,\n ` 'capability.name': '${capabilityName}',`,\n ' });',\n ' const startTime = Date.now();',\n '',\n ' // Transition count — which signal drove entry to this state.',\n \" const incomingSignal = (event as Record<string, unknown>)?.['signal'] as string \| undefined;\",\n ` provider.recordMetric('${metrics.transitions}', 1, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n \" signal: incomingSignal ?? 'initial',\",\n ' });',\n '',\n ' try {',\n ` // TODO: Wire capability invocation for '${capabilityName}'.`,\n ' const result = {',\n ' ...(event as Record<string, unknown>),',\n ` __state: '${stateName}',`,\n ` __capability: '${capabilityName}',`,\n ' __timestamp: new Date().toISOString(),',\n ' };',\n '',\n ` provider.recordMetric('${metrics.invocations}', 1, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n ` capability: '${capabilityName}',`,\n \" status: 'success',\",\n ' });',\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: _context.awsRequestId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${workflowId}',`,\n ` stepName: '${stateName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(event),',\n ' outputHash: auditHash(result),',\n ' durationMs: Date.now() - startTime,',\n \" status: 'success',\",\n ' });',\n ' return result;',\n ' } catch (error) {',\n ' span.setError(error instanceof Error ? error : new Error(String(error)));',\n ` provider.recordMetric('${metrics.errors}', 1, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n ' });',\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: _context.awsRequestId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${workflowId}',`,\n ` stepName: '${stateName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(event),',\n \" outputHash: '',\",\n ' durationMs: Date.now() - startTime,',\n \" status: 'error',\",\n ' error: error instanceof Error ? error.message : String(error),',\n ' });',\n ' throw error;',\n ' } finally {',\n ' const duration = Date.now() - startTime;',\n ` provider.recordMetric('${metrics.latency}', duration, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n ' });',\n ' span.end();',\n ' }',\n '}',\n '',\n ].join('\\n');\n\n return header + handlerLines;\n}\n","import type { FlowDefinition, Trigger } from '@stackwright-services/types';\nimport type { DerivedPermissions } from '../permissions';\nimport { toIamPolicy } from '../permissions';\n\n/\n Output files generated by the Lambda compile target.\n /\nexport interface LambdaTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Compile a flow definition to Lambda target output.\n \n Generates:\n * - handler.ts: Hono app entry point wired to the compiled flow\n * - Dockerfile: AWS Lambda Web Adapter base image\n * - iam-policy.json: Least-privilege IAM policy from derived permissions\n * - package.json: Minimal package for the Lambda function\n /\nexport function compileLambdaTarget(\n flow: FlowDefinition,\n permissions: DerivedPermissions,\n instrumentedCode: string,\n): LambdaTarget {\n const files: Record<string, string> = {};\n\n files['handler.ts'] = generateHandlerTs(flow);\n files['flow.ts'] = instrumentedCode;\n files['Dockerfile'] = generateDockerfile(flow);\n files['iam-policy.json'] = generateIamPolicy(flow.trigger, permissions);\n files['package.json'] = generatePackageJson(flow);\n\n // Trigger-specific infrastructure config files\n const triggerFiles = generateTriggerFiles(flow);\n for (const [path, content] of Object.entries(triggerFiles)) {\n files[path] = content;\n }\n\n return { files };\n}\n\nfunction generateHandlerTs(flow: FlowDefinition): string {\n const trigger = flow.trigger;\n\n let routeSetup: string;\n if (trigger.type === 'http') {\n const method = trigger.method.toLowerCase();\n const inputExpr = trigger.method === 'GET' ? 'c.req.query()' : 'await c.req.json()';\n routeSetup = `\napp.${method}('${trigger.path}', async (c) => {\n const input = ${inputExpr};\n const context = createContext(c);\n const provider = getObservabilityProvider();\n\n try {\n const result = await executeFlow(input, context, provider, registry);\n return c.json(result);\n } catch (error) {\n context.logger.error('Flow execution failed', { error: String(error) });\n return c.json({ error: 'Internal server error' }, 500);\n }\n});`;\n } else {\n routeSetup = `\n// Non-HTTP trigger: ${trigger.type}\n// This handler expects to be invoked by the trigger adapter\napp.post('/_invoke', async (c) => {\n const input = await c.req.json();\n const context = createContext(c);\n const provider = getObservabilityProvider();\n\n try {\n const result = await executeFlow(input, context, provider, registry);\n return c.json(result);\n } catch (error) {\n context.logger.error('Flow execution failed', { error: String(error) });\n return c.json({ error: 'Internal server error' }, 500);\n }\n});`;\n }\n\n return `// Auto-generated Lambda handler for flow: ${flow.id}\n// DO NOT EDIT -- regenerate from source YAML.\n\nimport { Hono } from 'hono';\nimport { executeFlow } from './flow';\nimport { CapabilityRegistry, registerAllCapabilities } from '@stackwright-services/capabilities';\nimport type { CapabilityContext } from '@stackwright-services/capabilities';\n\n// Initialize registry with all built-in capabilities\nconst registry = new CapabilityRegistry();\nregisterAllCapabilities(registry);\n\nconst app = new Hono();\n\n// Health check\napp.get('/health', (c) => c.json({ status: 'ok', flow: '${flow.id}' }));\n${routeSetup}\n\nfunction createContext(c: any): CapabilityContext {\n return {\n traceId: c.req.header('x-trace-id') ?? crypto.randomUUID(),\n logger: {\n debug: (msg: string, data?: Record<string, unknown>) => console.debug(JSON.stringify({ level: 'debug', msg, ...data })),\n info: (msg: string, data?: Record<string, unknown>) => console.info(JSON.stringify({ level: 'info', msg, ...data })),\n warn: (msg: string, data?: Record<string, unknown>) => console.warn(JSON.stringify({ level: 'warn', msg, ...data })),\n error: (msg: string, data?: Record<string, unknown>) => console.error(JSON.stringify({ level: 'error', msg, ...data })),\n },\n };\n}\n\nfunction getObservabilityProvider() {\n // No-op provider by default -- swap with OTel provider when configured\n return {\n startSpan: () => ({\n setAttribute: () => {},\n setError: () => {},\n end: () => {},\n }),\n recordMetric: () => {},\n };\n}\n\nexport default app;\n`;\n}\n\nfunction generateDockerfile(flow: FlowDefinition): string {\n return `# Auto-generated Dockerfile for flow: ${flow.id}\n# Uses AWS Lambda Web Adapter for Hono compatibility\n# DO NOT EDIT -- regenerate from source YAML.\n\nFROM public.ecr.aws/docker/library/node:22-slim AS builder\n\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --production=false\nCOPY . .\nRUN npm run build\n\nFROM public.ecr.aws/docker/library/node:22-slim AS runner\n\n# Install AWS Lambda Web Adapter\nCOPY --from=public.ecr.aws/awsguru/aws-lambda-web-adapter:0.8.4 /lambda-adapter /opt/extensions/lambda-adapter\n\nWORKDIR /app\nCOPY --from=builder /app/dist ./dist\nCOPY --from=builder /app/node_modules ./node_modules\nCOPY --from=builder /app/package.json ./\n\nENV PORT=8080\nENV AWS_LWA_PORT=8080\nENV NODE_ENV=production\n\nCMD [\"node\", \"dist/handler.js\"]\n`;\n}\n\nfunction generatePackageJson(flow: FlowDefinition): string {\n return (\n JSON.stringify(\n {\n name: `${flow.id}-lambda`,\n version: '0.0.1',\n private: true,\n scripts: {\n build: 'tsc',\n start: 'node dist/handler.js',\n },\n dependencies: {\n hono: '^4',\n '@stackwright-services/capabilities': 'workspace:',\n },\n devDependencies: {\n typescript: '^6',\n },\n },\n null,\n 2,\n ) + '\\n'\n );\n}\n\n/*\n Return additional IAM policy statements required by the trigger type.\n * These are merged with capability-derived permissions at compile time.\n /\nexport function getTriggerPermissions(trigger: Trigger): object[] {\n switch (trigger.type) {\n case 'event':\n return [\n {\n Effect: 'Allow',\n Action: ['sns:Subscribe', 'sns:Unsubscribe'],\n Resource: '${TOPIC_ARN}',\n },\n ];\n case 'schedule':\n return [\n {\n Effect: 'Allow',\n Action: ['events:PutRule', 'events:PutTargets', 'events:DeleteRule'],\n Resource: '',\n },\n ];\n case 'queue':\n return [\n {\n Effect: 'Allow',\n Action: ['sqs:ReceiveMessage', 'sqs:DeleteMessage', 'sqs:GetQueueAttributes'],\n Resource: '${QUEUE_ARN}',\n },\n ];\n case 'http':\n default:\n return [];\n }\n}\n\n/*\n Generate IAM policy JSON merging capability-derived permissions with\n * trigger-specific permissions.\n /\nfunction generateIamPolicy(trigger: Trigger, permissions: DerivedPermissions): string {\n const base = toIamPolicy(permissions) as { Version: string; Statement: object[] };\n const triggerStatements = getTriggerPermissions(trigger);\n base.Statement = [...base.Statement, ...triggerStatements];\n return JSON.stringify(base, null, 2) + '\\n';\n}\n\n/\n Generate trigger-specific infrastructure configuration files.\n * HTTP triggers need none; event/schedule/queue each get a config artifact.\n /\nfunction generateTriggerFiles(flow: FlowDefinition): Record<string, string> {\n const trigger = flow.trigger;\n\n switch (trigger.type) {\n case 'event': {\n const source = trigger.source.replace(/^bus:/, '');\n return {\n 'sns-subscription.json':\n JSON.stringify(\n {\n _comment: `Auto-generated SNS subscription for flow: ${flow.id}. Bind TOPIC_ARN and FUNCTION_ARN at deploy time.`,\n TopicArn: '${TOPIC_ARN}',\n Protocol: 'lambda',\n Endpoint: '${FUNCTION_ARN}',\n Attributes: {\n RawMessageDelivery: 'true',\n },\n source,\n },\n null,\n 2,\n ) + '\\n',\n };\n }\n case 'schedule':\n return {\n 'eventbridge-rule.json':\n JSON.stringify(\n {\n _comment: `Auto-generated EventBridge rule for flow: ${flow.id}. Bind FUNCTION_ARN at deploy time.`,\n Name: `${flow.id}-schedule`,\n ScheduleExpression: `cron(${trigger.cron})`,\n State: 'ENABLED',\n Targets: [\n {\n Id: `${flow.id}-target`,\n Arn: '${FUNCTION_ARN}',\n },\n ],\n },\n null,\n 2,\n ) + '\\n',\n };\n case 'queue':\n return {\n 'sqs-event-source-mapping.json':\n JSON.stringify(\n {\n _comment: `Auto-generated SQS event source mapping for flow: ${flow.id}. Bind QUEUE_ARN and FUNCTION_ARN at deploy time.`,\n EventSourceArn: '${QUEUE_ARN}',\n FunctionName: '${FUNCTION_ARN}',\n BatchSize: 10,\n Enabled: true,\n queueName: trigger.name,\n },\n null,\n 2,\n ) + '\\n',\n };\n case 'http':\n default:\n return {};\n }\n}\n","import type { FlowDefinition, Trigger } from '@stackwright-services/types';\nimport type { DerivedPermissions } from '../permissions';\nimport { toRbacRules } from '../permissions';\n\n/\n Output files generated by the Helm compile target.\n /\nexport interface HelmTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Compile a flow definition to Helm chart output.\n \n Generates a complete Helm chart compatible with the Defense Unicorns ecosystem.\n /\nexport function compileHelmTarget(\n flow: FlowDefinition,\n permissions: DerivedPermissions,\n): HelmTarget {\n const files: Record<string, string> = {};\n const chartName = sanitizeChartName(flow.id);\n const trigger = flow.trigger;\n\n // Common files for all trigger types\n files['Chart.yaml'] = generateChartYaml(chartName, flow);\n files['values.yaml'] = generateValuesYaml(chartName, flow);\n files['templates/service.yaml'] = generateServiceYaml(chartName);\n files['templates/serviceaccount.yaml'] = generateServiceAccountYaml(chartName);\n files['templates/_helpers.tpl'] = generateHelpersTpl(chartName);\n\n // Trigger-specific templates\n if (trigger.type === 'schedule') {\n // CronJob replaces Deployment; no Ingress for scheduled flows\n files['templates/cronjob.yaml'] = generateCronJobYaml(chartName, trigger.cron);\n } else {\n // All other trigger types use a Deployment\n files['templates/deployment.yaml'] = generateDeploymentYaml(chartName, trigger);\n // Only HTTP triggers get an Ingress — non-HTTP have no inbound traffic\n if (trigger.type === 'http') {\n files['templates/ingress.yaml'] = generateIngressYaml(chartName);\n }\n }\n\n // Event trigger: bus-config ConfigMap\n if (trigger.type === 'event') {\n files['templates/bus-subscription.yaml'] = generateBusConfigYaml(chartName, trigger.source);\n }\n\n // Queue trigger: queue-config ConfigMap\n if (trigger.type === 'queue') {\n files['templates/queue-config.yaml'] = generateQueueConfigYaml(chartName, trigger.name);\n }\n\n if (permissions.permissions.length > 0) {\n files['templates/rbac.yaml'] = generateRbacYaml(chartName, permissions);\n }\n\n return { files };\n}\n\nexport function sanitizeChartName(name: string): string {\n return name\n .replace(/[^a-z0-9-]/g, '-')\n .replace(/-+/g, '-')\n .replace(/^-\|-$/g, '');\n}\n\nfunction generateChartYaml(chartName: string, flow: FlowDefinition): string {\n return `# Auto-generated Helm chart for flow: ${flow.id}\n# Defense Unicorns compatible\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: v2\nname: ${chartName}\ndescription: ${flow.description}\ntype: application\nversion: 0.1.0\nappVersion: \"0.0.1\"\n`;\n}\n\nfunction generateValuesYaml(chartName: string, flow: FlowDefinition): string {\n const trigger = flow.trigger;\n\n let triggerValues = '';\n if (trigger.type === 'event') {\n const topic = trigger.source.replace(/^bus:/, '').toUpperCase().replace(/-/g, '_');\n triggerValues = `\n# Event trigger configuration\ntrigger:\n type: \"event\"\n busTopicArn: \"\\${BUS_TOPIC_${topic}_ARN}\"\n`;\n } else if (trigger.type === 'schedule') {\n triggerValues = `\n# Schedule trigger configuration\ntrigger:\n type: \"schedule\"\n schedule: \"${trigger.cron}\"\n`;\n } else if (trigger.type === 'queue') {\n const queueKey = trigger.name.toUpperCase().replace(/-/g, '_');\n triggerValues = `\n# Queue trigger configuration\ntrigger:\n type: \"queue\"\n queueUrl: \"\\${BUS_QUEUE_${queueKey}_URL}\"\n`;\n }\n\n // Only include ingress section for HTTP triggers\n const ingressSection =\n trigger.type === 'http'\n ? `\ningress:\n enabled: false\n className: \"\"\n annotations: {}\n hosts:\n - host: ${chartName}.local\n paths:\n - path: /\n pathType: ImplementationSpecific\n tls: []\n`\n : '';\n\n return `# Default values for ${chartName}\n# DO NOT EDIT -- regenerate from source YAML.\n\nreplicaCount: 1\n\nimage:\n repository: \"\"\n tag: \"latest\"\n pullPolicy: IfNotPresent\n\nimagePullSecrets: []\n\nserviceAccount:\n create: true\n name: \"\"\n annotations: {}\n\nservice:\n type: ClusterIP\n port: 8080\n${ingressSection}\nresources:\n limits:\n cpu: 500m\n memory: 256Mi\n requests:\n cpu: 100m\n memory: 128Mi\n\nenv: []\n\nnodeSelector: {}\ntolerations: []\naffinity: {}\n\n# Flow metadata\nflow:\n id: \"${flow.id}\"\n description: \"${flow.description}\"\n${triggerValues}`;\n}\n\nfunction generateDeploymentYaml(chartName: string, trigger: Trigger): string {\n let annotations = '';\n if (trigger.type === 'event') {\n annotations = ` annotations:\n stackwright.io/trigger-type: event\n stackwright.io/bus-topic: \"${trigger.source.replace(/^bus:/, '')}\"\n`;\n } else if (trigger.type === 'queue') {\n annotations = ` annotations:\n stackwright.io/trigger-type: queue\n stackwright.io/queue-name: \"${trigger.name}\"\n`;\n }\n\n return `# Auto-generated Deployment for ${chartName}\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\n${annotations}spec:\n replicas: {{ .Values.replicaCount }}\n selector:\n matchLabels:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 6 }}\n template:\n metadata:\n labels:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 8 }}\n spec:\n {{- with .Values.imagePullSecrets }}\n imagePullSecrets:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n serviceAccountName: {{ include \"${chartName}.serviceAccountName\" . }}\n containers:\n - name: {{ .Chart.Name }}\n image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n imagePullPolicy: {{ .Values.image.pullPolicy }}\n ports:\n - name: http\n containerPort: 8080\n protocol: TCP\n livenessProbe:\n httpGet:\n path: /health\n port: http\n initialDelaySeconds: 5\n periodSeconds: 10\n readinessProbe:\n httpGet:\n path: /health\n port: http\n initialDelaySeconds: 5\n periodSeconds: 10\n resources:\n {{- toYaml .Values.resources \| nindent 12 }}\n env:\n - name: PORT\n value: \"8080\"\n - name: NODE_ENV\n value: \"production\"\n - name: FLOW_ID\n value: {{ .Values.flow.id \| quote }}\n {{- with .Values.env }}\n {{- toYaml . \| nindent 12 }}\n {{- end }}\n {{- with .Values.nodeSelector }}\n nodeSelector:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n {{- with .Values.tolerations }}\n tolerations:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n {{- with .Values.affinity }}\n affinity:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n`;\n}\n\nfunction generateServiceYaml(chartName: string): string {\n return `# Auto-generated Service for ${chartName}\napiVersion: v1\nkind: Service\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nspec:\n type: {{ .Values.service.type }}\n ports:\n - port: {{ .Values.service.port }}\n targetPort: http\n protocol: TCP\n name: http\n selector:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 4 }}\n`;\n}\n\nfunction generateIngressYaml(chartName: string): string {\n return `# Auto-generated Ingress for ${chartName}\n{{- if .Values.ingress.enabled }}\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\n {{- with .Values.ingress.annotations }}\n annotations:\n {{- toYaml . \| nindent 4 }}\n {{- end }}\nspec:\n {{- if .Values.ingress.className }}\n ingressClassName: {{ .Values.ingress.className }}\n {{- end }}\n {{- if .Values.ingress.tls }}\n tls:\n {{- range .Values.ingress.tls }}\n - hosts:\n {{- range .hosts }}\n - {{ . \| quote }}\n {{- end }}\n secretName: {{ .secretName }}\n {{- end }}\n {{- end }}\n rules:\n {{- range .Values.ingress.hosts }}\n - host: {{ .host \| quote }}\n http:\n paths:\n {{- range .paths }}\n - path: {{ .path }}\n pathType: {{ .pathType }}\n backend:\n service:\n name: {{ include \"${chartName}.fullname\" $ }}\n port:\n name: http\n {{- end }}\n {{- end }}\n{{- end }}\n`;\n}\n\nfunction generateServiceAccountYaml(chartName: string): string {\n return `# Auto-generated ServiceAccount for ${chartName}\n{{- if .Values.serviceAccount.create }}\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: {{ include \"${chartName}.serviceAccountName\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\n {{- with .Values.serviceAccount.annotations }}\n annotations:\n {{- toYaml . \| nindent 4 }}\n {{- end }}\n{{- end }}\n`;\n}\n\nfunction generateHelpersTpl(chartName: string): string {\n return `{{/\nAuto-generated helpers for ${chartName}\n/}}\n\n{{- define \"${chartName}.name\" -}}\n{{- default .Chart.Name .Values.nameOverride \| trunc 63 \| trimSuffix \"-\" }}\n{{- end }}\n\n{{- define \"${chartName}.fullname\" -}}\n{{- if .Values.fullnameOverride }}\n{{- .Values.fullnameOverride \| trunc 63 \| trimSuffix \"-\" }}\n{{- else }}\n{{- $name := default .Chart.Name .Values.nameOverride }}\n{{- if contains $name .Release.Name }}\n{{- .Release.Name \| trunc 63 \| trimSuffix \"-\" }}\n{{- else }}\n{{- printf \"%s-%s\" .Release.Name $name \| trunc 63 \| trimSuffix \"-\" }}\n{{- end }}\n{{- end }}\n{{- end }}\n\n{{- define \"${chartName}.labels\" -}}\nhelm.sh/chart: {{ include \"${chartName}.name\" . }}-{{ .Chart.Version \| replace \"+\" \"_\" }}\n{{ include \"${chartName}.selectorLabels\" . }}\napp.kubernetes.io/managed-by: {{ .Release.Service }}\napp.kubernetes.io/part-of: stackwright-services\n{{- end }}\n\n{{- define \"${chartName}.selectorLabels\" -}}\napp.kubernetes.io/name: {{ include \"${chartName}.name\" . }}\napp.kubernetes.io/instance: {{ .Release.Name }}\n{{- end }}\n\n{{- define \"${chartName}.serviceAccountName\" -}}\n{{- if .Values.serviceAccount.create }}\n{{- default (include \"${chartName}.fullname\" .) .Values.serviceAccount.name }}\n{{- else }}\n{{- default \"default\" .Values.serviceAccount.name }}\n{{- end }}\n{{- end }}\n`;\n}\n\nfunction generateCronJobYaml(chartName: string, cron: string): string {\n return `# Auto-generated CronJob for ${chartName}\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: batch/v1\nkind: CronJob\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nspec:\n schedule: \"${cron}\"\n concurrencyPolicy: Forbid\n successfulJobsHistoryLimit: 3\n failedJobsHistoryLimit: 3\n jobTemplate:\n spec:\n template:\n metadata:\n labels:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 12 }}\n spec:\n serviceAccountName: {{ include \"${chartName}.serviceAccountName\" . }}\n containers:\n - name: {{ .Chart.Name }}\n image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n imagePullPolicy: {{ .Values.image.pullPolicy }}\n env:\n - name: PORT\n value: \"8080\"\n - name: NODE_ENV\n value: \"production\"\n - name: TRIGGER_MODE\n value: \"schedule\"\n - name: FLOW_ID\n value: {{ .Values.flow.id \| quote }}\n {{- with .Values.env }}\n {{- toYaml . \| nindent 16 }}\n {{- end }}\n resources:\n {{- toYaml .Values.resources \| nindent 16 }}\n restartPolicy: OnFailure\n`;\n}\n\nfunction generateBusConfigYaml(chartName: string, source: string): string {\n const topic = source.replace(/^bus:/, '');\n return `# Auto-generated bus subscription config for ${chartName}\n# The concrete subscription mechanism depends on the cluster's message bus operator.\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}-bus-config\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\ndata:\n trigger-type: \"event\"\n bus-topic: \"${topic}\"\n source: \"${source}\"\n`;\n}\n\nfunction generateQueueConfigYaml(chartName: string, queueName: string): string {\n return `# Auto-generated queue config for ${chartName}\n# The concrete queue binding depends on the cluster's message bus operator.\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}-queue-config\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\ndata:\n trigger-type: \"queue\"\n queue-name: \"${queueName}\"\n`;\n}\n\nfunction generateRbacYaml(chartName: string, permissions: DerivedPermissions): string {\n const rules = toRbacRules(permissions) as Array<{\n apiGroups: string[];\n resources: string[];\n verbs: string[];\n }>;\n const rulesYaml = rules\n .map(\n (r) =>\n ` - apiGroups: [${r.apiGroups.map((g) => `\"${g}\"`).join(', ')}]\\n resources: [${r.resources.map((res) => `\"${res}\"`).join(', ')}]\\n verbs: [${r.verbs.map((v) => `\"${v}\"`).join(', ')}]`,\n )\n .join('\\n');\n\n return `# Auto-generated RBAC for ${chartName}\n# Derived from least-privilege permission analysis\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nrules:\n${rulesYaml}\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: {{ include \"${chartName}.fullname\" . }}\nsubjects:\n - kind: ServiceAccount\n name: {{ include \"${chartName}.serviceAccountName\" . }}\n namespace: {{ .Release.Namespace }}\n`;\n}\n","import type {\n PredicateCondition,\n WorkflowDefinition,\n WorkflowState,\n WorkflowTransition,\n} from '@stackwright-services/types';\nimport type { DerivedPermissions } from '../permissions';\nimport { toStepFunctionsIamPolicy } from '../permissions';\nimport {\n generateInstrumentedStateHandlerCode,\n generateWorkflowInstrumentation,\n} from '../workflow-observability';\n\n/\n Output files generated by the Step Functions compile target.\n /\nexport interface StepFunctionsTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Compile a workflow definition to AWS Step Functions target output.\n \n Generates:\n * - asl-definition.json: Step Functions state machine definition in ASL\n * - iam-execution-role.json: IAM policy for the execution role\n * - handlers/<state>.ts: Lambda handler stubs for each state with on_enter\n * - package.json: Minimal package for the handlers\n /\nexport function compileStepFunctionsTarget(\n workflow: WorkflowDefinition,\n permissions: DerivedPermissions,\n): StepFunctionsTarget {\n const files: Record<string, string> = {};\n\n // 1. ASL state machine definition\n const asl = generateAslDefinition(workflow);\n files['asl-definition.json'] = JSON.stringify(asl, null, 2);\n\n // 2. IAM execution role policy\n files['iam-execution-role.json'] = JSON.stringify(\n toStepFunctionsIamPolicy(workflow, permissions),\n null,\n 2,\n );\n\n // 3. Per-state Lambda handler stubs (with observability instrumentation)\n for (const inst of generateWorkflowInstrumentation(workflow)) {\n const params = workflow.states[inst.stateName]?.on_enter?.with ?? {};\n files[`handlers/${inst.stateName}.ts`] = generateInstrumentedStateHandlerCode(inst, params);\n }\n\n // 4. Package manifest for the handlers\n files['package.json'] = generatePackageJson(workflow);\n\n return { files };\n}\n\n// ---------------------------------------------------------------------------\n// ASL Definition\n// ---------------------------------------------------------------------------\n\nfunction generateAslDefinition(workflow: WorkflowDefinition): Record<string, unknown> {\n const states: Record<string, unknown> = {};\n\n for (const [name, state] of Object.entries(workflow.states)) {\n Object.assign(states, generateAslStates(name, state, workflow));\n }\n\n const definition: Record<string, unknown> = {\n Comment: `Stackwright workflow: ${workflow.description}`,\n StartAt: workflow.initial,\n States: states,\n };\n\n if (workflow.timeouts?.absolute) {\n definition['TimeoutSeconds'] = iso8601ToSeconds(workflow.timeouts.absolute);\n }\n\n return definition;\n}\n\n/\n Generate one or more ASL states for a single workflow state.\n \n A single workflow state may expand into multiple ASL states\n * (e.g. Task + Choice, or Task + Succeed).\n \n Mapping rules:\n * Terminal + on_enter → Task → Succeed\n * Terminal + no on_enter → Succeed\n * Non-terminal + on_enter + 1 uncond. trans. → Task + Next\n * Non-terminal + on_enter + multi/cond. → Task → Choice\n * Non-terminal + no on_enter + transitions → Choice\n /\nfunction generateAslStates(\n name: string,\n state: WorkflowState,\n workflow: WorkflowDefinition,\n): Record<string, unknown> {\n const isTerminal = state.type === 'terminal';\n const hasOnEnter = !!state.on_enter;\n const transitions = state.transitions ?? [];\n\n // Terminal + on_enter → Task → generated Succeed\n if (isTerminal && hasOnEnter) {\n const succeedName = `${name}__succeed`;\n return {\n [name]: buildTaskState(workflow.id, name, succeedName),\n [succeedName]: { Type: 'Succeed' },\n };\n }\n\n // Terminal + no on_enter → plain Succeed\n if (isTerminal) {\n return { [name]: { Type: 'Succeed' } };\n }\n\n // Non-terminal with no transitions → dead-end (edge case)\n if (transitions.length === 0) {\n return hasOnEnter\n ? { [name]: buildTaskState(workflow.id, name) }\n : { [name]: { Type: 'Pass', End: true } };\n }\n\n // Single unconditional transition (no `when` predicate)\n const first = transitions[0];\n if (transitions.length === 1 && first && !first.when) {\n return hasOnEnter\n ? { [name]: buildTaskState(workflow.id, name, first.to) }\n : { [name]: { Type: 'Pass', Next: first.to } };\n }\n\n // Multiple or conditional transitions → Choice state\n if (hasOnEnter) {\n const choiceName = `${name}__choice`;\n return {\n [name]: buildTaskState(workflow.id, name, choiceName),\n [choiceName]: buildChoiceState(transitions),\n };\n }\n\n return { [name]: buildChoiceState(transitions) };\n}\n\n// ---------------------------------------------------------------------------\n// Task state builder\n// ---------------------------------------------------------------------------\n\nfunction buildTaskState(\n workflowId: string,\n stateName: string,\n next?: string,\n): Record<string, unknown> {\n const task: Record<string, unknown> = {\n Type: 'Task',\n Resource: 'arn:aws:states:::lambda:invoke',\n Parameters: {\n FunctionName: `${workflowId}-${stateName}`,\n 'Payload.$': '$',\n },\n };\n\n if (next) {\n task['Next'] = next;\n } else {\n task['End'] = true;\n }\n\n return task;\n}\n\n// ---------------------------------------------------------------------------\n// Choice state builder\n// ---------------------------------------------------------------------------\n\nfunction buildChoiceState(transitions: WorkflowTransition[]): Record<string, unknown> {\n const choices: object[] = [];\n let defaultTarget: string \| undefined;\n\n // Last transition without `when` becomes the Choice Default.\n const lastNoWhenIdx = findLastIndex(transitions, (t) => !t.when);\n\n for (const [i, t] of transitions.entries()) {\n if (i === lastNoWhenIdx) {\n defaultTarget = t.to;\n continue;\n }\n choices.push(transitionToChoiceRule(t));\n }\n\n const choiceState: Record<string, unknown> = {\n Type: 'Choice',\n Choices: choices,\n };\n\n if (defaultTarget) {\n choiceState['Default'] = defaultTarget;\n }\n\n return choiceState;\n}\n\nfunction transitionToChoiceRule(transition: WorkflowTransition): object {\n const signalCheck = { Variable: '$.signal', StringEquals: transition.on };\n\n if (!transition.when \|\| transition.when.length === 0) {\n return { ...signalCheck, Next: transition.to };\n }\n\n return {\n And: [signalCheck, ...transition.when.map(predicateToChoiceRule)],\n Next: transition.to,\n };\n}\n\n// ---------------------------------------------------------------------------\n// Predicate → ASL Choice Rule mapping\n// ---------------------------------------------------------------------------\n\nfunction predicateToChoiceRule(predicate: PredicateCondition): object {\n const variable = `$.${predicate.field}`;\n\n switch (predicate.op) {\n case 'equals':\n return buildEqualsRule(variable, predicate.value);\n case 'not_equals':\n return { Not: buildEqualsRule(variable, predicate.value) };\n case 'less_than':\n return { Variable: variable, NumericLessThan: predicate.value };\n case 'greater_than':\n return { Variable: variable, NumericGreaterThan: predicate.value };\n case 'less_than_or_equal':\n return { Variable: variable, NumericLessThanEquals: predicate.value };\n case 'greater_than_or_equal':\n return { Variable: variable, NumericGreaterThanEquals: predicate.value };\n case 'matches_prefix':\n return { Variable: variable, StringMatches: `${String(predicate.value)}` };\n case 'contains':\n return { Variable: variable, StringMatches: `${String(predicate.value)}` };\n case 'in':\n return buildInRule(variable, predicate.value);\n case 'not_in':\n return { Not: buildInRule(variable, predicate.value) };\n case 'less_than_field':\n case 'greater_than_field':\n case 'equals_field':\n // Field-comparison operators aren't natively supported in ASL Choice rules.\n // Fall back to a Pass state with a comment for manual handling.\n return { Variable: variable, StringEquals: `__UNSUPPORTED_FIELD_OP_${predicate.op}__` };\n }\n}\n\nfunction buildEqualsRule(variable: string, value: unknown): object {\n if (typeof value === 'string') return { Variable: variable, StringEquals: value };\n if (typeof value === 'number') return { Variable: variable, NumericEquals: value };\n if (typeof value === 'boolean') return { Variable: variable, BooleanEquals: value };\n return { Variable: variable, StringEquals: String(value) };\n}\n\nfunction buildInRule(variable: string, value: unknown): object {\n if (!Array.isArray(value)) return buildEqualsRule(variable, value);\n return { Or: value.map((v) => buildEqualsRule(variable, v)) };\n}\n\n// ---------------------------------------------------------------------------\n// ISO 8601 duration → seconds\n// ---------------------------------------------------------------------------\n\n/*\n Convert an ISO 8601 duration string to seconds.\n \n Uses calendar approximations: 1 year = 365 days, 1 month = 30 days.\n \n @example\n * iso8601ToSeconds('P3D') // → 259200\n * iso8601ToSeconds('PT1H') // → 3600\n * iso8601ToSeconds('PT30M') // → 1800\n /\nexport function iso8601ToSeconds(duration: string): number {\n const match = duration.match(\n /^P(?:(\\d+)Y)?(?:(\\d+)M)?(?:(\\d+)W)?(?:(\\d+)D)?(?:T(?:(\\d+)H)?(?:(\\d+)M)?(?:(\\d+)S)?)?$/,\n );\n if (!match) {\n throw new Error(`Invalid ISO 8601 duration: ${duration}`);\n }\n\n const [, years, months, weeks, days, hours, minutes, seconds] = match;\n\n let total = 0;\n if (years) total += parseInt(years, 10) 365 * 86_400;\n if (months) total += parseInt(months, 10) * 30 * 86_400;\n if (weeks) total += parseInt(weeks, 10) * 7 * 86_400;\n if (days) total += parseInt(days, 10) * 86_400;\n if (hours) total += parseInt(hours, 10) * 3_600;\n if (minutes) total += parseInt(minutes, 10) * 60;\n if (seconds) total += parseInt(seconds, 10);\n\n return total;\n}\n\n// ---------------------------------------------------------------------------\n// package.json generation\n// ---------------------------------------------------------------------------\n\nfunction generatePackageJson(workflow: WorkflowDefinition): string {\n return (\n JSON.stringify(\n {\n name: `${workflow.id}-stepfunctions`,\n version: '0.0.1',\n private: true,\n scripts: {\n build: 'tsc',\n },\n dependencies: {\n '@stackwright-services/capabilities': 'workspace:',\n },\n devDependencies: {\n '@types/aws-lambda': '^8',\n typescript: '^6',\n },\n },\n null,\n 2,\n ) + '\\n'\n );\n}\n\n// ---------------------------------------------------------------------------\n// Utilities\n// ---------------------------------------------------------------------------\n\nfunction findLastIndex<T>(arr: readonly T[], predicate: (item: T) => boolean): number {\n for (let i = arr.length - 1; i >= 0; i--) {\n if (predicate(arr[i] as T)) return i;\n }\n return -1;\n}\n","import type { FlowDefinition, HttpTrigger } from '@stackwright-services/types';\n\n/\n Output from the OpenAPI spec compile target.\n /\nexport interface OpenApiTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Options for OpenAPI spec generation.\n /\nexport interface OpenApiTargetOptions {\n /* Optional build key to include as an apiKey security scheme /\n buildKey?: string;\n /* Optional server URL for the spec /\n serverUrl?: string;\n /* Optional version string (defaults to \"0.0.1\") /\n version?: string;\n}\n\n/\n Compile an HTTP-triggered flow definition to an OpenAPI 3.1 specification.\n \n This is the bridge between Services and Pro: the generated spec is consumed\n * by Pro's existing OpenAPI parser to produce typed Pulse clients.\n \n For non-HTTP triggers, returns an empty target (no spec to generate).\n * AsyncAPI for event-driven flows is future work.\n \n @returns OpenApiTarget with openapi.yaml content, or empty files for non-HTTP triggers\n /\nexport function compileOpenApiTarget(\n flow: FlowDefinition,\n options: OpenApiTargetOptions = {},\n): OpenApiTarget {\n if (flow.trigger.type !== 'http') {\n return { files: {} };\n }\n\n const trigger = flow.trigger as HttpTrigger;\n const version = options.version ?? '0.0.1';\n\n const spec = buildOpenApiSpec(flow, trigger, version, options);\n\n return {\n files: {\n 'openapi.yaml': serializeYaml(spec),\n },\n };\n}\n\n// ─── Spec construction ───────────────────────────────────────────────────\n\nfunction buildOpenApiSpec(\n flow: FlowDefinition,\n trigger: HttpTrigger,\n version: string,\n options: OpenApiTargetOptions,\n): OpenApiSpec {\n const operationId = generateOperationId(flow.id, trigger.method);\n\n const spec: OpenApiSpec = {\n openapi: '3.1.0',\n info: {\n title: flow.id,\n description: flow.description,\n version,\n },\n paths: {\n [trigger.path]: {\n [trigger.method.toLowerCase()]: {\n operationId,\n summary: flow.description,\n ...(trigger.method === 'GET'\n ? { parameters: buildQueryParameters(trigger) }\n : { requestBody: buildRequestBody(trigger) }),\n responses: buildResponses(trigger),\n },\n },\n },\n };\n\n // Add server URL if provided\n if (options.serverUrl) {\n spec.servers = [{ url: options.serverUrl }];\n }\n\n // Add build-coherence key as security scheme\n if (options.buildKey) {\n spec.components = {\n ...spec.components,\n securitySchemes: {\n buildKey: {\n type: 'apiKey',\n in: 'header',\n name: 'x-stackwright-build-key',\n description:\n 'Build-coherence key. Auto-generated at compile time. Ensures frontend/backend version match.',\n },\n },\n };\n spec.security = [{ buildKey: [] }];\n\n // Extension with the actual key value so Pro's OpenAPI parser\n // can embed it in the generated Pulse client\n spec['x-stackwright-build-key'] = options.buildKey;\n }\n\n // Add schemas for input/output (placeholders referencing Zod schema names)\n spec.components = {\n ...spec.components,\n schemas: {\n [trigger.input_schema]: {\n type: 'object',\n description: `Input schema: ${trigger.input_schema} (resolve from Zod schema at build time)`,\n },\n [trigger.output_schema]: {\n type: 'object',\n description: `Output schema: ${trigger.output_schema} (resolve from Zod schema at build time)`,\n },\n },\n };\n\n return spec;\n}\n\n/\n Generate an operationId from flow ID and HTTP method.\n * e.g., \"at-risk-evacuation-patients\" + \"GET\" → \"getAtRiskEvacuationPatients\"\n /\nfunction generateOperationId(flowId: string, method: string): string {\n const camelCase = flowId\n .replace(/[^a-zA-Z0-9]+(.)/g, (_, ch: string) => ch.toUpperCase())\n .replace(/^[A-Z]/, (ch) => ch.toLowerCase());\n const prefix = method.toLowerCase();\n return `${prefix}${camelCase.charAt(0).toUpperCase()}${camelCase.slice(1)}`;\n}\n\nfunction buildQueryParameters(trigger: HttpTrigger): OpenApiParameter[] {\n return [\n {\n name: trigger.input_schema,\n in: 'query',\n description: `Query parameters per ${trigger.input_schema} schema`,\n required: false,\n schema: { $ref: `#/components/schemas/${trigger.input_schema}` },\n },\n ];\n}\n\nfunction buildRequestBody(trigger: HttpTrigger): OpenApiRequestBody {\n return {\n required: true,\n content: {\n 'application/json': {\n schema: { $ref: `#/components/schemas/${trigger.input_schema}` },\n },\n },\n };\n}\n\nfunction buildResponses(trigger: HttpTrigger): Record<string, OpenApiResponse> {\n return {\n '200': {\n description: 'Successful response',\n content: {\n 'application/json': {\n schema: { $ref: `#/components/schemas/${trigger.output_schema}` },\n },\n },\n },\n '400': {\n description: 'Validation error',\n content: {\n 'application/json': {\n schema: {\n type: 'object',\n properties: {\n error: { type: 'string' },\n code: { type: 'string' },\n details: { type: 'object' },\n },\n },\n },\n },\n },\n '500': {\n description: 'Internal server error',\n content: {\n 'application/json': {\n schema: {\n type: 'object',\n properties: {\n error: { type: 'string' },\n code: { type: 'string' },\n },\n },\n },\n },\n },\n };\n}\n\n// ─── Minimal YAML serializer ─────────────────────────────────────────────\n// We emit YAML by hand to avoid a dependency on js-yaml. The spec structure\n// is predictable and shallow enough for a recursive serializer.\n\nfunction serializeYaml(obj: unknown, indent: number = 0): string {\n const pad = ' '.repeat(indent);\n\n if (obj === null \|\| obj === undefined) return 'null';\n if (typeof obj === 'string') {\n if (needsQuoting(obj)) {\n return `'${obj.replace(/'/g, \"''\")}'`;\n }\n return obj;\n }\n if (typeof obj === 'number' \|\| typeof obj === 'boolean') return String(obj);\n\n if (Array.isArray(obj)) {\n if (obj.length === 0) return '[]';\n return obj\n .map((item) => {\n if (typeof item === 'object' && item !== null) {\n const inner = serializeYaml(item, indent + 1);\n const lines = inner.split('\\n');\n const firstLine = lines[0] ?? '';\n return `${pad}- ${firstLine.trimStart()}\\n${lines.slice(1).join('\\n')}`.trimEnd();\n }\n return `${pad}- ${serializeYaml(item)}`;\n })\n .join('\\n');\n }\n\n if (typeof obj === 'object') {\n const entries = Object.entries(obj as Record<string, unknown>);\n if (entries.length === 0) return '{}';\n return entries\n .map(([key, val]) => {\n const safeKey = keyNeedsQuoting(key) ? `'${key}'` : key;\n if (\n typeof val === 'object' &&\n val !== null &&\n !Array.isArray(val) &&\n Object.keys(val as object).length > 0\n ) {\n return `${pad}${safeKey}:\\n${serializeYaml(val, indent + 1)}`;\n }\n if (Array.isArray(val)) {\n if (val.length === 0) return `${pad}${safeKey}: []`;\n return `${pad}${safeKey}:\\n${serializeYaml(val, indent + 1)}`;\n }\n return `${pad}${safeKey}: ${serializeYaml(val)}`;\n })\n .join('\\n');\n }\n\n return String(obj);\n}\n\nfunction needsQuoting(str: string): boolean {\n return /[:{},&#?\|<>=!%@`\\n[\\]]/.test(str) \|\| str === '' \|\| str === 'true' \|\| str === 'false';\n}\n\nfunction keyNeedsQuoting(key: string): boolean {\n // Quote keys that YAML would parse as non-string types\n return /^\\d+$/.test(key) \|\| key === 'true' \|\| key === 'false' \|\| key === 'null' \|\| key === '';\n}\n\n// ─── Type definitions ────────────────────────────────────────────────────\n\ninterface OpenApiSpec {\n openapi: string;\n info: { title: string; description: string; version: string };\n servers?: Array<{ url: string }>;\n paths: Record<string, Record<string, unknown>>;\n components?: {\n schemas?: Record<string, unknown>;\n securitySchemes?: Record<string, unknown>;\n };\n security?: Array<Record<string, string[]>>;\n 'x-stackwright-build-key'?: string;\n}\n\ninterface OpenApiParameter {\n name: string;\n in: string;\n description: string;\n required: boolean;\n schema: unknown;\n}\n\ninterface OpenApiRequestBody {\n required: boolean;\n content: Record<string, { schema: unknown }>;\n}\n\ninterface OpenApiResponse {\n description: string;\n content?: Record<string, { schema: unknown }>;\n}\n","import type { FlowDefinition, WorkflowDefinition } from '@stackwright-services/types';\n\n/*\n Auth requirements derived from a definition.\n * The compiler emits these into target-specific auth configuration.\n /\nexport interface DerivedAuthRequirements {\n /* Whether any auth is required at all /\n requiresAuth: boolean;\n /* All roles referenced in guard_role transitions /\n requiredRoles: string[];\n /* Locations where auth is referenced (for audit trail) /\n sources: AuthRequirementSource[];\n}\n\nexport interface AuthRequirementSource {\n /* The role required /\n role: string;\n /* Where in the definition it's referenced /\n location: string;\n}\n\n/\n Derive auth requirements from a flow definition.\n \n For now, flows require auth if the HTTP trigger has auth config.\n * (Future: auth field on trigger schema)\n \n @security-critical — Determines whether auth is wired into compiled output.\n /\nexport function deriveFlowAuthRequirements(flow: FlowDefinition): DerivedAuthRequirements {\n // Flows don't currently have guard_role — return empty\n // Future: if trigger gains an auth field, derive from that\n void flow;\n return {\n requiresAuth: false,\n requiredRoles: [],\n sources: [],\n };\n}\n\n/\n Derive auth requirements from a workflow definition.\n \n Walks all states' transitions, collects guard_role references.\n * If ANY transition has guard_role, the workflow requires auth.\n \n @security-critical — Determines auth wiring in compiled output.\n /\nexport function deriveWorkflowAuthRequirements(\n workflow: WorkflowDefinition,\n): DerivedAuthRequirements {\n const sources: AuthRequirementSource[] = [];\n\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n if (transition.guard_role) {\n sources.push({\n role: transition.guard_role,\n location: `states.${stateName}.transitions[on=${transition.on}].guard_role`,\n });\n }\n }\n }\n }\n\n const uniqueRoles = [...new Set(sources.map((s) => s.role))];\n\n return {\n requiresAuth: sources.length > 0,\n requiredRoles: uniqueRoles,\n sources,\n };\n}\n\n/\n Generate Lambda authorizer configuration from auth requirements.\n * Used by the Lambda/Step Functions compile targets.\n /\nexport function toLambdaAuthorizerConfig(auth: DerivedAuthRequirements): object \| null {\n if (!auth.requiresAuth) return null;\n\n return {\n type: 'REQUEST',\n identitySource: 'method.request.header.Authorization',\n authorizerResultTtlInSeconds: 300,\n // The actual authorizer Lambda is provisioned separately —\n // this config tells API Gateway to require it\n requiredRoles: auth.requiredRoles,\n };\n}\n\n/\n Generate Helm auth annotations from auth requirements.\n * Used by the Helm compile target.\n /\nexport function toHelmAuthAnnotations(auth: DerivedAuthRequirements): Record<string, string> {\n if (!auth.requiresAuth) return {};\n\n return {\n 'stackwright.io/auth-required': 'true',\n 'stackwright.io/auth-roles': auth.requiredRoles.join(','),\n 'stackwright.io/auth-provider': 'oidc', // default, overridable via values.yaml\n };\n}\n","import { createHash } from 'node:crypto';\nimport type { FlowDefinition, WorkflowDefinition } from '@stackwright-services/types';\n\n/\n Build-coherence configuration derived from a definition.\n \n This is NOT authentication (that's AuthProvider). It's a deployment\n * coherence mechanism that ensures frontend and backend were compiled\n * from the same source at the same time.\n \n The key is:\n * - Generated deterministically from flow content + build timestamp\n * - Embedded in the compiled handler as middleware\n * - Embedded in the OpenAPI spec as an apiKey security scheme\n * - Short-lived: replaced every build\n * - NOT a secret: visible in frontend bundle and spec file\n \n Works naturally with blue/green and canary deployments —\n * matched frontend/backend pairs share the same key.\n /\nexport interface BuildCoherenceConfig {\n /* Whether build coherence is enabled /\n enabled: boolean;\n /* The build key (hex string) /\n buildKey: string;\n /* Hash of the flow content (for tracing which definition produced this key) /\n contentHash: string;\n /* Build timestamp (ISO 8601) /\n buildTimestamp: string;\n}\n\n/\n Derive build coherence config from a flow definition.\n \n The key is a SHA-256 hash of: flow content (serialized) + build timestamp.\n * Same source + same moment = same key. Different build = different key.\n \n Follows the same pattern as deriveFlowAuthRequirements() and\n * deriveFlowPermissions() — pure derivation, no side effects.\n \n @security-critical — The build key becomes a deployment coherence check.\n /\nexport function deriveBuildCoherence(\n flow: FlowDefinition \| WorkflowDefinition,\n options: { timestamp?: string; enabled?: boolean } = {},\n): BuildCoherenceConfig {\n const enabled = options.enabled ?? true;\n const buildTimestamp = options.timestamp ?? new Date().toISOString();\n\n // Content hash — deterministic from the definition alone\n const contentHash = createHash('sha256').update(JSON.stringify(flow)).digest('hex').slice(0, 16);\n\n // Build key — content + timestamp makes each build unique\n const buildKey = createHash('sha256')\n .update(`${contentHash}:${buildTimestamp}`)\n .digest('hex')\n .slice(0, 32);\n\n return {\n enabled,\n buildKey,\n contentHash,\n buildTimestamp,\n };\n}\n\n/\n Generate Hono middleware code that validates the build-coherence key.\n \n Injected into the compiled handler.ts by the Lambda and Helm targets.\n * The middleware runs before the flow handler and rejects requests\n * with a mismatched or missing build key.\n /\nexport function toBuildKeyMiddleware(config: BuildCoherenceConfig): string {\n if (!config.enabled) return '';\n\n return `\n// ─── Build Coherence ─────────────────────────────────────────────────\n// Auto-generated by the Stackwright Services compiler.\n// Ensures this backend matches the frontend that was compiled with it.\n// NOT authentication — that's AuthProvider's job.\nconst STACKWRIGHT_BUILD_KEY = process.env.STACKWRIGHT_BUILD_KEY ?? '${config.buildKey}';\nconst STACKWRIGHT_CONTENT_HASH = '${config.contentHash}';\n\napp.use('', async (c, next) => {\n // Skip health check\n if (c.req.path === '/health') return next();\n\n const clientKey = c.req.header('x-stackwright-build-key');\n if (!clientKey) {\n return c.json({\n error: 'Missing build-coherence key',\n code: 'BUILD_KEY_MISSING',\n hint: 'Include x-stackwright-build-key header. This is auto-set by the generated client.',\n }, 403);\n }\n if (clientKey !== STACKWRIGHT_BUILD_KEY) {\n return c.json({\n error: 'Build mismatch — frontend and backend were compiled from different builds',\n code: 'BUILD_COHERENCE_FAILURE',\n expected: STACKWRIGHT_BUILD_KEY.slice(0, 8) + '…',\n received: clientKey.slice(0, 8) + '…',\n contentHash: STACKWRIGHT_CONTENT_HASH,\n }, 403);\n }\n await next();\n});\n`;\n}\n\n/*\n Generate environment variables for the build key.\n * Used by Helm values.yaml and Lambda environment config.\n */\nexport function toBuildKeyEnv(config: BuildCoherenceConfig): Record<string, string> {\n if (!config.enabled) return {};\n\n return {\n STACKWRIGHT_BUILD_KEY: config.buildKey,\n STACKWRIGHT_CONTENT_HASH: config.contentHash,\n STACKWRIGHT_BUILD_TIMESTAMP: config.buildTimestamp,\n };\n}\n"],"mappings":";AACA;AAAA,EACE,mBAAmB;AAAA,OAEd;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,SAAS,iBAAiB;AAsC5B,SAAS,qBAAqB,KAA+C;AAClF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,SAAS;AACf,MAAI,WAAW,UAAU,aAAa,OAAQ,QAAO;AACrD,MAAI,YAAY,UAAU,aAAa,OAAQ,QAAO;AACtD,SAAO;AACT;AAWO,SAAS,SACd,aACA,UACA,SACkB;AAClB,MAAI;AACJ,MAAI;AACF,aAAS,UAAU,WAAW;AAAA,EAChC,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,CAAC,EAAE,MAAM,oBAAoB,SAAS,iBAAkB,IAAc,OAAO,GAAG,CAAC;AAAA,MACzF,UAAU,CAAC;AAAA,IACb;AAAA,EACF;AAEA,MAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,CAAC,EAAE,MAAM,kBAAkB,SAAS,yBAAyB,CAAC;AAAA,MACtE,UAAU,CAAC;AAAA,IACb;AAAA,EACF;AAEA,QAAM,UAAU,qBAAqB,MAAM;AAE3C,MAAI,YAAY,QAAQ;AACtB,WAAO,aAAa,QAAQ,UAAU,OAAO;AAAA,EAC/C,WAAW,YAAY,YAAY;AACjC,WAAO,iBAAiB,QAAQ,QAAQ;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SACE;AAAA,QACJ;AAAA,MACF;AAAA,MACA,UAAU,CAAC;AAAA,IACb;AAAA,EACF;AACF;AAKO,SAAS,aACd,QACA,UACA,SACsC;AAEtC,QAAM,SAAS,eAAe,UAAU,MAAM;AAE9C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAMA,UAA4B,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,MACpE,MAAM;AAAA,MACN,SAAS,MAAM;AAAA,MACf,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,IAC3B,EAAE;AACF,WAAO,EAAE,SAAS,OAAO,QAAAA,SAAQ,UAAU,CAAC,EAAE;AAAA,EAChD;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,SAA4B,CAAC;AACnC,QAAM,WAAgC,CAAC;AAKvC,MAAI,UAAU;AACZ,eAAW,QAAQ,KAAK,OAAO;AAC7B,UAAI,CAAC,SAAS,IAAI,KAAK,GAAG,GAAG;AAC3B,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,SAAS,KAAK,IAAI,oCAAoC,KAAK,GAAG;AAAA,UACvE,MAAM,SAAS,KAAK,IAAI;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,QAAM,YAAY,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAC9C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,WAAW;AAC5B,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,eAAS,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,wBAAwB,IAAI;AAAA,QACrC,MAAM,SAAS,IAAI;AAAA,MACrB,CAAC;AAAA,IACH;AACA,SAAK,IAAI,IAAI;AAAA,EACf;AAIA,QAAM,aAAuD,CAAC;AAC9D,aAAW,QAAQ,KAAK,OAAO;AAC7B,UAAM,YAAY,KAAK,OAAO,QAAQ;AACtC,QACE,OAAO,cAAc,aACpB,UAAU,WAAW,UAAU,KAAK,UAAU,WAAW,QAAQ,IAClE;AACA,iBAAW,KAAK,EAAE,KAAK,WAAW,UAAU,KAAK,KAAK,CAAC;AAAA,IACzD;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,SAAS,SAAS,mBAAmB;AAC3C,UAAM,aAAa,OAAO;AAE1B,eAAW,EAAE,KAAK,SAAS,KAAK,YAAY;AAC1C,YAAM,WAAW,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAAC;AAE/C,UAAI,WAAW,kBAAkB,WAAW,GAAG;AAC7C,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,WAAW,GAAG;AAAA,UACvB,MAAM,SAAS,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,WAAW,CAAC,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ,GAAG;AAC7D,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,WAAW,GAAG;AAAA,UACvB,MAAM,SAAS,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH;AAAA,IAEF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,OAAO,WAAW;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACF;AAKO,SAAS,iBACd,QACA,UAC0C;AAE1C,QAAM,SAAS,mBAAmB,UAAU,MAAM;AAElD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAMA,UAA4B,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,MACpE,MAAM;AAAA,MACN,SAAS,MAAM;AAAA,MACf,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,IAC3B,EAAE;AACF,WAAO,EAAE,SAAS,OAAO,QAAAA,SAAQ,UAAU,CAAC,EAAE;AAAA,EAChD;AAEA,QAAM,WAAW,OAAO;AACxB,QAAM,SAA4B,CAAC;AACnC,QAAM,WAAgC,CAAC;AACvC,QAAM,aAAa,OAAO,KAAK,SAAS,MAAM;AAG9C,MAAI,CAAC,WAAW,SAAS,SAAS,OAAO,GAAG;AAC1C,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,kBAAkB,SAAS,OAAO;AAAA,MAC3C,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,aAAa;AACrB,iBAAW,cAAc,MAAM,aAAa;AAC1C,YAAI,CAAC,WAAW,SAAS,WAAW,EAAE,GAAG;AACvC,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,SAAS,UAAU,SAAS,sCAAsC,WAAW,EAAE;AAAA,YAC/E,MAAM,UAAU,SAAS;AAAA,UAC3B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,QAAI,YAAY,MAAM,UAAU;AAC9B,UAAI,CAAC,SAAS,IAAI,MAAM,SAAS,GAAG,GAAG;AACrC,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,UAAU,SAAS,6CAA6C,MAAM,SAAS,GAAG;AAAA,UAC3F,MAAM,UAAU,SAAS;AAAA,QAC3B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,WAAW,OAAO,CAAC,SAAS,SAAS,OAAO,IAAI,GAAG,SAAS,UAAU;AAC7F,MAAI,eAAe,WAAW,KAAK,WAAW,SAAS,GAAG;AACxD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,SAAS,eAAe,CAAC,MAAM,eAAe,MAAM,YAAY,WAAW,IAAI;AACvF,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS,UAAU,SAAS;AAAA,QAC5B,MAAM,UAAU,SAAS;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,WAAW,SAAS,SAAS,OAAO,GAAG;AACzC,UAAM,YAAY,oBAAI,IAAY;AAClC,UAAM,QAAQ,CAAC,SAAS,OAAO;AAE/B,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,UAAU,MAAM,MAAM;AAC5B,UAAI,UAAU,IAAI,OAAO,EAAG;AAC5B,gBAAU,IAAI,OAAO;AAErB,YAAM,QAAQ,SAAS,OAAO,OAAO;AACrC,UAAI,OAAO,aAAa;AACtB,mBAAW,cAAc,MAAM,aAAa;AAC1C,cAAI,CAAC,UAAU,IAAI,WAAW,EAAE,GAAG;AACjC,kBAAM,KAAK,WAAW,EAAE;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAU,IAAI,SAAS,GAAG;AAC7B,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,UAAU,SAAS,0CAA0C,SAAS,OAAO;AAAA,UACtF,MAAM,UAAU,SAAS;AAAA,QAC3B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,eAAe,SAAS,GAAG;AAC7B,UAAM,mBAAmB,IAAI,IAAY,cAAc;AACvD,UAAM,eAAe,CAAC,GAAG,cAAc;AAGvC,UAAM,aAAa,oBAAI,IAAsB;AAC7C,eAAW,QAAQ,YAAY;AAC7B,iBAAW,IAAI,MAAM,CAAC,CAAC;AAAA,IACzB;AACA,eAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,UAAI,MAAM,aAAa;AACrB,mBAAW,cAAc,MAAM,aAAa;AAC1C,qBAAW,IAAI,WAAW,EAAE,GAAG,KAAK,SAAS;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAGA,WAAO,aAAa,SAAS,GAAG;AAC9B,YAAM,UAAU,aAAa,MAAM;AACnC,iBAAW,eAAe,WAAW,IAAI,OAAO,KAAK,CAAC,GAAG;AACvD,YAAI,CAAC,iBAAiB,IAAI,WAAW,GAAG;AACtC,2BAAiB,IAAI,WAAW;AAChC,uBAAa,KAAK,WAAW;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,eAAW,aAAa,YAAY;AAClC,UAAI,SAAS,OAAO,SAAS,GAAG,SAAS,cAAc,CAAC,iBAAiB,IAAI,SAAS,GAAG;AACvF,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,UAAU,SAAS;AAAA,UAC5B,MAAM,UAAU,SAAS;AAAA,QAC3B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS;AACpB,UAAM,kBAAkB,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AACnE,UAAM,cAAc,oBAAI,IAAY;AAEpC,eAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,UAAI,MAAM,aAAa;AACrB,mBAAW,cAAc,MAAM,aAAa;AAC1C,sBAAY,IAAI,WAAW,EAAE;AAC7B,cAAI,CAAC,gBAAgB,IAAI,WAAW,EAAE,GAAG;AACvC,qBAAS,KAAK;AAAA,cACZ,MAAM;AAAA,cACN,SAAS,wBAAwB,SAAS,kBAAkB,WAAW,EAAE;AAAA,cACzE,MAAM,UAAU,SAAS;AAAA,YAC3B,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,eAAW,UAAU,SAAS,SAAS;AACrC,UAAI,CAAC,YAAY,IAAI,OAAO,IAAI,GAAG;AACjC,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,WAAW,OAAO,IAAI;AAAA,UAC/B,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,aAAa;AACrB,YAAM,mBAAmB,oBAAI,IAAY;AACzC,iBAAW,cAAc,MAAM,aAAa;AAC1C,YAAI,CAAC,WAAW,MAAM;AACpB,cAAI,iBAAiB,IAAI,WAAW,EAAE,GAAG;AACvC,qBAAS,KAAK;AAAA,cACZ,MAAM;AAAA,cACN,SAAS,UAAU,SAAS,oDAAoD,WAAW,EAAE;AAAA,cAC7F,MAAM,UAAU,SAAS;AAAA,YAC3B,CAAC;AAAA,UACH;AACA,2BAAiB,IAAI,WAAW,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,YAAY,SAAS,UAAU,YAAY;AAC7C,QAAI,CAAC,SAAS,IAAI,SAAS,SAAS,WAAW,GAAG,GAAG;AACnD,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS,qDAAqD,SAAS,SAAS,WAAW,GAAG;AAAA,QAC9F,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,OAAO,WAAW;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACF;;;ACvYA,SAAS,2BACP,YACA,YACoB;AACpB,MAAI,CAAC,WAAY,QAAO;AAExB,MAAI,EAAE,SAAS,IAAI;AACnB,QAAM,kBAAkB;AAExB,aAAW,SAAS,QAAQ,iBAAiB,CAAC,QAAQ,YAAoB;AACxE,UAAM,QAAQ,WAAW,OAAO;AAChC,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,WAAO;AAAA,EACT,CAAC;AAED,SAAO,EAAE,GAAG,YAAY,SAAS;AACnC;AAeO,SAAS,sBACd,MACA,UACoB;AACpB,QAAM,UAA8B,CAAC;AAErC,aAAW,QAAQ,KAAK,OAAO;AAC7B,UAAM,aAAa,SAAS,OAAO,KAAK,GAAG;AAC3C,QAAI,CAAC,WAAY;AAEjB,QAAI,WAAW,WAAW,SAAS,UAAU;AAC3C,iBAAW,QAAQ,WAAW,WAAW,qBAAqB;AAC5D,cAAM,WAAW,2BAA2B,MAAM,KAAK,IAAI;AAC3D,gBAAQ,KAAK;AAAA,UACX,YAAY;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,UAAU,SAAS,KAAK,IAAI;AAAA,QAC9B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,aAAa,uBAAuB,QAAQ,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAQO,SAAS,0BACd,UACA,UACoB;AACpB,QAAM,UAA8B,CAAC;AAErC,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,UAAU;AAClB,YAAM,aAAa,SAAS,OAAO,MAAM,SAAS,GAAG;AACrD,UAAI,CAAC,WAAY;AAEjB,UAAI,WAAW,WAAW,SAAS,UAAU;AAC3C,mBAAW,QAAQ,WAAW,WAAW,qBAAqB;AAC5D,kBAAQ,KAAK;AAAA,YACX,YAAY;AAAA,YACZ,gBAAgB,MAAM,SAAS;AAAA,YAC/B,UAAU,UAAU,SAAS;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,UAAU,YAAY;AACjC,UAAM,aAAa,SAAS,OAAO,SAAS,SAAS,WAAW,GAAG;AACnE,QAAI,cAAc,WAAW,WAAW,SAAS,UAAU;AACzD,iBAAW,QAAQ,WAAW,WAAW,qBAAqB;AAC5D,gBAAQ,KAAK;AAAA,UACX,YAAY;AAAA,UACZ,gBAAgB,SAAS,SAAS,WAAW;AAAA,UAC7C,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,aAAa,uBAAuB,QAAQ,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAKA,SAAS,uBAAuB,aAAyD;AACvF,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAA+B,CAAC;AAEtC,aAAW,QAAQ,aAAa;AAC9B,UAAM,MAAM,GAAG,KAAK,QAAQ,IAAI,KAAK,MAAM,IAAI,KAAK,SAAS,EAAE;AAC/D,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,WAAK,IAAI,GAAG;AACZ,aAAO,KAAK,IAAI;AAAA,IAClB;AAAA,EACF;AAEA,SAAO;AACT;AAMO,SAAS,YAAY,SAAqC;AAC/D,MAAI,QAAQ,YAAY,WAAW,GAAG;AACpC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,CAAC;AAAA,IACd;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,QAAQ,YAAY,IAAI,CAAC,UAAU;AAAA,MAC5C,QAAQ;AAAA,MACR,QAAQ,eAAe,KAAK,MAAM;AAAA,MAClC,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,qBAAqB,KAAK,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IAC3F,EAAE;AAAA,EACJ;AACF;AAaO,SAAS,yBACd,UACA,SACQ;AACR,QAAM,aAAuB,CAAC;AAG9B,QAAM,oBAAoB,OAAO,QAAQ,SAAS,MAAM,EACrD,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,MAAM,aAAa,MAAS,EAClD,IAAI,CAAC,CAAC,IAAI,MAAM,IAAI;AAEvB,MAAI,kBAAkB,SAAS,GAAG;AAChC,eAAW,KAAK;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,CAAC,uBAAuB;AAAA,MAChC,UAAU,kBAAkB;AAAA,QAC1B,CAAC,SAAS,+BAA+B,SAAS,EAAE,IAAI,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,YAAY,SAAS,GAAG;AAClC,eAAW;AAAA,MACT,GAAG,QAAQ,YAAY,IAAI,CAAC,UAAU;AAAA,QACpC,QAAQ;AAAA,QACR,QAAQ,eAAe,KAAK,MAAM;AAAA,QAClC,UAAU,KAAK;AAAA,QACf,GAAI,KAAK,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,qBAAqB,KAAK,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3F,EAAE;AAAA,IACJ;AAAA,EACF;AAGA,MAAI,SAAS,UAAU,iBAAiB,SAAS,UAAU,UAAU;AACnE,eAAW,KAAK;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,CAAC,kBAAkB,qBAAqB,qBAAqB,sBAAsB;AAAA,MAC3F,UAAU,2BAA2B,SAAS,EAAE;AAAA,IAClD,CAAC;AAAA,EACH;AAGA,aAAW,KAAK;AAAA,IACd,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ,CAAC,uBAAuB,wBAAwB,mBAAmB;AAAA,IAC3E,UAAU,iDAAiD,SAAS,EAAE;AAAA,EACxE,CAAC;AAED,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,EACb;AACF;AAMO,SAAS,YAAY,SAAuC;AACjE,MAAI,QAAQ,YAAY,WAAW,EAAG,QAAO,CAAC;AAG9C,QAAM,UAAU,oBAAI,IAAsB;AAC1C,aAAW,QAAQ,QAAQ,aAAa;AACtC,UAAM,QAAQ,QAAQ,IAAI,KAAK,QAAQ,KAAK,CAAC;AAC7C,QAAI,CAAC,MAAM,SAAS,KAAK,MAAM,GAAG;AAChC,YAAM,KAAK,KAAK,MAAM;AAAA,IACxB;AACA,YAAQ,IAAI,KAAK,UAAU,KAAK;AAAA,EAClC;AAEA,SAAO,MAAM,KAAK,QAAQ,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO;AAAA,IAC/D,WAAW,CAAC,gBAAgB;AAAA,IAC5B,WAAW,CAAC,QAAQ;AAAA,IACpB;AAAA,EACF,EAAE;AACJ;;;ACzOO,SAAS,4BAA4B,MAA6C;AACvF,SAAO,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,IAC/B,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,SAAS;AAAA,MACP,SAAS;AAAA,MACT,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF,EAAE;AACJ;AAKO,SAAS,mBAAmB,MAAsB;AACvD,SAAO,KAAK,QAAQ,iBAAiB,GAAG;AAC1C;AAQO,SAAS,6BAA6B,iBAA8C;AACzF,QAAM,EAAE,UAAU,gBAAgB,QAAQ,QAAQ,IAAI;AACtD,QAAM,SAAS,mBAAmB,QAAQ;AAE1C,SAAO;AAAA,IACL,8BAA8B,MAAM;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,2CAA2C,QAAQ;AAAA,IACnD,2BAA2B,cAAc;AAAA,IACzC,mBAAmB,MAAM;AAAA,IACzB,qBAAqB,QAAQ;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,WAAW,kBAAkB,QAAQ,mBAAmB,cAAc;AAAA,IAC5G;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,oBAAoB,QAAQ;AAAA,IAC5B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,MAAM,kBAAkB,QAAQ,mBAAmB,cAAc;AAAA,IACvG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,oBAAoB,QAAQ;AAAA,IAC5B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,OAAO,yBAAyB,QAAQ,mBAAmB,cAAc;AAAA,IAC/G;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAMO,SAAS,6BAA6B,MAA8B;AACzE,QAAM,mBAAmB,4BAA4B,IAAI;AACzD,QAAM,gBAAgB,iBAAiB,IAAI,4BAA4B;AAEvE,QAAM,YAAY,iBACf;AAAA,IACC,CAAC,SACC,sCAAsC,mBAAmB,KAAK,QAAQ,CAAC,gEAAgE,KAAK,cAAc;AAAA,EAC9J,EACC,KAAK,IAAI;AAEZ,QAAM,SAAS;AAAA,IACb;AAAA,IACA,YAAY,KAAK,EAAE;AAAA,IACnB,mBAAmB,KAAK,WAAW;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK,EAAE;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,+CAA+C,KAAK,EAAE;AAAA,IACtD,mBAAmB,KAAK,EAAE;AAAA,IAC1B,qBAAqB,KAAK,MAAM,MAAM;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,KAAK,EAAE;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,6DAA6D,KAAK,EAAE;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,IACA,wDAAwD,KAAK,EAAE;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,KAAK,EAAE;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8EAA8E,KAAK,EAAE;AAAA,IACrF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,SAAO,SAAS,cAAc,KAAK,MAAM,IAAI,SAAS;AACxD;;;AClMO,SAAS,gCACd,UACgC;AAChC,SAAO,OAAO,QAAQ,SAAS,MAAM,EAClC,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,EACtC,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;AAAA,IAC5B;AAAA;AAAA,IAEA,gBAAgB,MAAM,UAAU,OAAO;AAAA,IACvC,YAAY,SAAS;AAAA,IACrB,YAAY,MAAM,SAAS;AAAA,IAC3B,SAAS;AAAA,MACP,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,aAAa;AAAA,IACf;AAAA,EACF,EAAE;AACN;AAeO,SAAS,qCACd,iBACA,kBACQ;AACR,QAAM,EAAE,WAAW,gBAAgB,YAAY,QAAQ,IAAI;AAC3D,QAAM,aAAa,KAAK,UAAU,gBAAgB;AAClD,QAAM,SAAS;AAAA,IACb;AAAA,IACA,gBAAgB,UAAU,YAAY,SAAS;AAAA,IAC/C,kBAAkB,cAAc;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,2BAA2B,UAAU;AAAA,IACrC;AAAA,IACA,qDAAqD,SAAS;AAAA,IAC9D,uBAAuB,UAAU;AAAA,IACjC,sBAAsB,SAAS;AAAA,IAC/B,2BAA2B,cAAc;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,4BAA4B,QAAQ,WAAW;AAAA,IAC/C,kBAAkB,UAAU;AAAA,IAC5B,eAAe,SAAS;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gDAAgD,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,IACA,mBAAmB,SAAS;AAAA,IAC5B,wBAAwB,cAAc;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,WAAW;AAAA,IACjD,oBAAoB,UAAU;AAAA,IAC9B,iBAAiB,SAAS;AAAA,IAC1B,sBAAsB,cAAc;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,UAAU;AAAA,IAC5B,oBAAoB,SAAS;AAAA,IAC7B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,MAAM;AAAA,IAC5C,oBAAoB,UAAU;AAAA,IAC9B,iBAAiB,SAAS;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,UAAU;AAAA,IAC5B,oBAAoB,SAAS;AAAA,IAC7B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,OAAO;AAAA,IAC7C,oBAAoB,UAAU;AAAA,IAC9B,iBAAiB,SAAS;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,SAAO,SAAS;AAClB;;;AC3JO,SAAS,oBACd,MACA,aACA,kBACc;AACd,QAAM,QAAgC,CAAC;AAEvC,QAAM,YAAY,IAAI,kBAAkB,IAAI;AAC5C,QAAM,SAAS,IAAI;AACnB,QAAM,YAAY,IAAI,mBAAmB,IAAI;AAC7C,QAAM,iBAAiB,IAAI,kBAAkB,KAAK,SAAS,WAAW;AACtE,QAAM,cAAc,IAAI,oBAAoB,IAAI;AAGhD,QAAM,eAAe,qBAAqB,IAAI;AAC9C,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC1D,UAAM,IAAI,IAAI;AAAA,EAChB;AAEA,SAAO,EAAE,MAAM;AACjB;AAEA,SAAS,kBAAkB,MAA8B;AACvD,QAAM,UAAU,KAAK;AAErB,MAAI;AACJ,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,UAAM,YAAY,QAAQ,WAAW,QAAQ,kBAAkB;AAC/D,iBAAa;AAAA,MACX,MAAM,KAAK,QAAQ,IAAI;AAAA,kBACX,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYzB,OAAO;AACL,iBAAa;AAAA,uBACM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAejC;AAEA,SAAO,8CAA8C,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0DAeJ,KAAK,EAAE;AAAA,EAC/D,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BZ;AAEA,SAAS,mBAAmB,MAA8B;AACxD,SAAO,yCAAyC,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BzD;AAEA,SAAS,oBAAoB,MAA8B;AACzD,SACE,KAAK;AAAA,IACH;AAAA,MACE,MAAM,GAAG,KAAK,EAAE;AAAA,MAChB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,sCAAsC;AAAA,MACxC;AAAA,MACA,iBAAiB;AAAA,QACf,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAER;AAMO,SAAS,sBAAsB,SAA4B;AAChE,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,QACL;AAAA,UACE,QAAQ;AAAA,UACR,QAAQ,CAAC,iBAAiB,iBAAiB;AAAA,UAC3C,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL;AAAA,UACE,QAAQ;AAAA,UACR,QAAQ,CAAC,kBAAkB,qBAAqB,mBAAmB;AAAA,UACnE,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL;AAAA,UACE,QAAQ;AAAA,UACR,QAAQ,CAAC,sBAAsB,qBAAqB,wBAAwB;AAAA,UAC5E,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AAAA,IACL;AACE,aAAO,CAAC;AAAA,EACZ;AACF;AAMA,SAAS,kBAAkB,SAAkB,aAAyC;AACpF,QAAM,OAAO,YAAY,WAAW;AACpC,QAAM,oBAAoB,sBAAsB,OAAO;AACvD,OAAK,YAAY,CAAC,GAAG,KAAK,WAAW,GAAG,iBAAiB;AACzD,SAAO,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI;AACzC;AAMA,SAAS,qBAAqB,MAA8C;AAC1E,QAAM,UAAU,KAAK;AAErB,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK,SAAS;AACZ,YAAM,SAAS,QAAQ,OAAO,QAAQ,SAAS,EAAE;AACjD,aAAO;AAAA,QACL,yBACE,KAAK;AAAA,UACH;AAAA,YACE,UAAU,6CAA6C,KAAK,EAAE;AAAA,YAC9D,UAAU;AAAA,YACV,UAAU;AAAA,YACV,UAAU;AAAA,YACV,YAAY;AAAA,cACV,oBAAoB;AAAA,YACtB;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,QACF,IAAI;AAAA,MACR;AAAA,IACF;AAAA,IACA,KAAK;AACH,aAAO;AAAA,QACL,yBACE,KAAK;AAAA,UACH;AAAA,YACE,UAAU,6CAA6C,KAAK,EAAE;AAAA,YAC9D,MAAM,GAAG,KAAK,EAAE;AAAA,YAChB,oBAAoB,QAAQ,QAAQ,IAAI;AAAA,YACxC,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,IAAI,GAAG,KAAK,EAAE;AAAA,gBACd,KAAK;AAAA,cACP;AAAA,YACF;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,QACF,IAAI;AAAA,MACR;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,iCACE,KAAK;AAAA,UACH;AAAA,YACE,UAAU,qDAAqD,KAAK,EAAE;AAAA,YACtE,gBAAgB;AAAA,YAChB,cAAc;AAAA,YACd,WAAW;AAAA,YACX,SAAS;AAAA,YACT,WAAW,QAAQ;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,QACF,IAAI;AAAA,MACR;AAAA,IACF,KAAK;AAAA,IACL;AACE,aAAO,CAAC;AAAA,EACZ;AACF;;;AC3RO,SAAS,kBACd,MACA,aACY;AACZ,QAAM,QAAgC,CAAC;AACvC,QAAM,YAAY,kBAAkB,KAAK,EAAE;AAC3C,QAAM,UAAU,KAAK;AAGrB,QAAM,YAAY,IAAI,kBAAkB,WAAW,IAAI;AACvD,QAAM,aAAa,IAAI,mBAAmB,WAAW,IAAI;AACzD,QAAM,wBAAwB,IAAI,oBAAoB,SAAS;AAC/D,QAAM,+BAA+B,IAAI,2BAA2B,SAAS;AAC7E,QAAM,wBAAwB,IAAI,mBAAmB,SAAS;AAG9D,MAAI,QAAQ,SAAS,YAAY;AAE/B,UAAM,wBAAwB,IAAI,oBAAoB,WAAW,QAAQ,IAAI;AAAA,EAC/E,OAAO;AAEL,UAAM,2BAA2B,IAAI,uBAAuB,WAAW,OAAO;AAE9E,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,wBAAwB,IAAI,oBAAoB,SAAS;AAAA,IACjE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,SAAS;AAC5B,UAAM,iCAAiC,IAAI,sBAAsB,WAAW,QAAQ,MAAM;AAAA,EAC5F;AAGA,MAAI,QAAQ,SAAS,SAAS;AAC5B,UAAM,6BAA6B,IAAI,wBAAwB,WAAW,QAAQ,IAAI;AAAA,EACxF;AAEA,MAAI,YAAY,YAAY,SAAS,GAAG;AACtC,UAAM,qBAAqB,IAAI,iBAAiB,WAAW,WAAW;AAAA,EACxE;AAEA,SAAO,EAAE,MAAM;AACjB;AAEO,SAAS,kBAAkB,MAAsB;AACtD,SAAO,KACJ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,OAAO,GAAG,EAClB,QAAQ,UAAU,EAAE;AACzB;AAEA,SAAS,kBAAkB,WAAmB,MAA8B;AAC1E,SAAO,yCAAyC,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA,QAIjD,SAAS;AAAA,eACF,KAAK,WAAW;AAAA;AAAA;AAAA;AAAA;AAK/B;AAEA,SAAS,mBAAmB,WAAmB,MAA8B;AAC3E,QAAM,UAAU,KAAK;AAErB,MAAI,gBAAgB;AACpB,MAAI,QAAQ,SAAS,SAAS;AAC5B,UAAM,QAAQ,QAAQ,OAAO,QAAQ,SAAS,EAAE,EAAE,YAAY,EAAE,QAAQ,MAAM,GAAG;AACjF,oBAAgB;AAAA;AAAA;AAAA;AAAA,+BAIW,KAAK;AAAA;AAAA,EAElC,WAAW,QAAQ,SAAS,YAAY;AACtC,oBAAgB;AAAA;AAAA;AAAA;AAAA,eAIL,QAAQ,IAAI;AAAA;AAAA,EAEzB,WAAW,QAAQ,SAAS,SAAS;AACnC,UAAM,WAAW,QAAQ,KAAK,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC7D,oBAAgB;AAAA;AAAA;AAAA;AAAA,4BAIQ,QAAQ;AAAA;AAAA,EAElC;AAGA,QAAM,iBACJ,QAAQ,SAAS,SACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAMM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAMf;AAEN,SAAO,wBAAwB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBxC,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAiBP,KAAK,EAAE;AAAA,kBACE,KAAK,WAAW;AAAA,EAChC,aAAa;AACf;AAEA,SAAS,uBAAuB,WAAmB,SAA0B;AAC3E,MAAI,cAAc;AAClB,MAAI,QAAQ,SAAS,SAAS;AAC5B,kBAAc;AAAA;AAAA,iCAEe,QAAQ,OAAO,QAAQ,SAAS,EAAE,CAAC;AAAA;AAAA,EAElE,WAAW,QAAQ,SAAS,SAAS;AACnC,kBAAc;AAAA;AAAA,kCAEgB,QAAQ,IAAI;AAAA;AAAA,EAE5C;AAEA,SAAO,mCAAmC,SAAS;AAAA;AAAA;AAAA;AAAA,sBAI/B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA,EAC1B,WAAW;AAAA;AAAA;AAAA;AAAA,qBAIQ,SAAS;AAAA;AAAA;AAAA;AAAA,uBAIP,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wCAMQ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8CjD;AAEA,SAAS,oBAAoB,WAA2B;AACtD,SAAO,gCAAgC,SAAS;AAAA;AAAA;AAAA;AAAA,sBAI5B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAST,SAAS;AAAA;AAE5B;AAEA,SAAS,oBAAoB,WAA2B;AACtD,SAAO,gCAAgC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAK5B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCA6BQ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAO7C;AAEA,SAAS,2BAA2B,WAA2B;AAC7D,SAAO,uCAAuC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAKnC,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAO5B;AAEA,SAAS,mBAAmB,WAA2B;AACrD,SAAO;AAAA,6BACoB,SAAS;AAAA;AAAA;AAAA,cAGxB,SAAS;AAAA;AAAA;AAAA;AAAA,cAIT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAaT,SAAS;AAAA,6BACM,SAAS;AAAA,cACxB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,cAKT,SAAS;AAAA,sCACe,SAAS;AAAA;AAAA;AAAA;AAAA,cAIjC,SAAS;AAAA;AAAA,wBAEC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAMjC;AAEA,SAAS,oBAAoB,WAAmB,MAAsB;AACpE,SAAO,gCAAgC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAK5B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA,eAEb,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BASQ,SAAS;AAAA;AAAA,4CAEQ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBrD;AAEA,SAAS,sBAAsB,WAAmB,QAAwB;AACxE,QAAM,QAAQ,OAAO,QAAQ,SAAS,EAAE;AACxC,SAAO,gDAAgD,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAM5C,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA,gBAGZ,KAAK;AAAA,aACR,MAAM;AAAA;AAEnB;AAEA,SAAS,wBAAwB,WAAmB,WAA2B;AAC7E,SAAO,qCAAqC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAMjC,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA,iBAGX,SAAS;AAAA;AAE1B;AAEA,SAAS,iBAAiB,WAAmB,aAAyC;AACpF,QAAM,QAAQ,YAAY,WAAW;AAKrC,QAAM,YAAY,MACf;AAAA,IACC,CAAC,MACC,mBAAmB,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,kBAAsB,EAAE,UAAU,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,cAAkB,EAAE,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,EAChM,EACC,KAAK,IAAI;AAEZ,SAAO,6BAA6B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAKzB,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA,EAE1B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAKW,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA,sBAIN,SAAS;AAAA;AAAA;AAAA,wBAGP,SAAS;AAAA;AAAA;AAGjC;;;ACndO,SAAS,2BACd,UACA,aACqB;AACrB,QAAM,QAAgC,CAAC;AAGvC,QAAM,MAAM,sBAAsB,QAAQ;AAC1C,QAAM,qBAAqB,IAAI,KAAK,UAAU,KAAK,MAAM,CAAC;AAG1D,QAAM,yBAAyB,IAAI,KAAK;AAAA,IACtC,yBAAyB,UAAU,WAAW;AAAA,IAC9C;AAAA,IACA;AAAA,EACF;AAGA,aAAW,QAAQ,gCAAgC,QAAQ,GAAG;AAC5D,UAAM,SAAS,SAAS,OAAO,KAAK,SAAS,GAAG,UAAU,QAAQ,CAAC;AACnE,UAAM,YAAY,KAAK,SAAS,KAAK,IAAI,qCAAqC,MAAM,MAAM;AAAA,EAC5F;AAGA,QAAM,cAAc,IAAIC,qBAAoB,QAAQ;AAEpD,SAAO,EAAE,MAAM;AACjB;AAMA,SAAS,sBAAsB,UAAuD;AACpF,QAAM,SAAkC,CAAC;AAEzC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAC3D,WAAO,OAAO,QAAQ,kBAAkB,MAAM,OAAO,QAAQ,CAAC;AAAA,EAChE;AAEA,QAAM,aAAsC;AAAA,IAC1C,SAAS,yBAAyB,SAAS,WAAW;AAAA,IACtD,SAAS,SAAS;AAAA,IAClB,QAAQ;AAAA,EACV;AAEA,MAAI,SAAS,UAAU,UAAU;AAC/B,eAAW,gBAAgB,IAAI,iBAAiB,SAAS,SAAS,QAAQ;AAAA,EAC5E;AAEA,SAAO;AACT;AAeA,SAAS,kBACP,MACA,OACA,UACyB;AACzB,QAAM,aAAa,MAAM,SAAS;AAClC,QAAM,aAAa,CAAC,CAAC,MAAM;AAC3B,QAAM,cAAc,MAAM,eAAe,CAAC;AAG1C,MAAI,cAAc,YAAY;AAC5B,UAAM,cAAc,GAAG,IAAI;AAC3B,WAAO;AAAA,MACL,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,MAAM,WAAW;AAAA,MACrD,CAAC,WAAW,GAAG,EAAE,MAAM,UAAU;AAAA,IACnC;AAAA,EACF;AAGA,MAAI,YAAY;AACd,WAAO,EAAE,CAAC,IAAI,GAAG,EAAE,MAAM,UAAU,EAAE;AAAA,EACvC;AAGA,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO,aACH,EAAE,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,IAAI,EAAE,IAC5C,EAAE,CAAC,IAAI,GAAG,EAAE,MAAM,QAAQ,KAAK,KAAK,EAAE;AAAA,EAC5C;AAGA,QAAM,QAAQ,YAAY,CAAC;AAC3B,MAAI,YAAY,WAAW,KAAK,SAAS,CAAC,MAAM,MAAM;AACpD,WAAO,aACH,EAAE,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,IACtD,EAAE,CAAC,IAAI,GAAG,EAAE,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,EACjD;AAGA,MAAI,YAAY;AACd,UAAM,aAAa,GAAG,IAAI;AAC1B,WAAO;AAAA,MACL,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,MAAM,UAAU;AAAA,MACpD,CAAC,UAAU,GAAG,iBAAiB,WAAW;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO,EAAE,CAAC,IAAI,GAAG,iBAAiB,WAAW,EAAE;AACjD;AAMA,SAAS,eACP,YACA,WACA,MACyB;AACzB,QAAM,OAAgC;AAAA,IACpC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,YAAY;AAAA,MACV,cAAc,GAAG,UAAU,IAAI,SAAS;AAAA,MACxC,aAAa;AAAA,IACf;AAAA,EACF;AAEA,MAAI,MAAM;AACR,SAAK,MAAM,IAAI;AAAA,EACjB,OAAO;AACL,SAAK,KAAK,IAAI;AAAA,EAChB;AAEA,SAAO;AACT;AAMA,SAAS,iBAAiB,aAA4D;AACpF,QAAM,UAAoB,CAAC;AAC3B,MAAI;AAGJ,QAAM,gBAAgB,cAAc,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI;AAE/D,aAAW,CAAC,GAAG,CAAC,KAAK,YAAY,QAAQ,GAAG;AAC1C,QAAI,MAAM,eAAe;AACvB,sBAAgB,EAAE;AAClB;AAAA,IACF;AACA,YAAQ,KAAK,uBAAuB,CAAC,CAAC;AAAA,EACxC;AAEA,QAAM,cAAuC;AAAA,IAC3C,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAEA,MAAI,eAAe;AACjB,gBAAY,SAAS,IAAI;AAAA,EAC3B;AAEA,SAAO;AACT;AAEA,SAAS,uBAAuB,YAAwC;AACtE,QAAM,cAAc,EAAE,UAAU,YAAY,cAAc,WAAW,GAAG;AAExE,MAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,WAAW,GAAG;AACpD,WAAO,EAAE,GAAG,aAAa,MAAM,WAAW,GAAG;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL,KAAK,CAAC,aAAa,GAAG,WAAW,KAAK,IAAI,qBAAqB,CAAC;AAAA,IAChE,MAAM,WAAW;AAAA,EACnB;AACF;AAMA,SAAS,sBAAsB,WAAuC;AACpE,QAAM,WAAW,KAAK,UAAU,KAAK;AAErC,UAAQ,UAAU,IAAI;AAAA,IACpB,KAAK;AACH,aAAO,gBAAgB,UAAU,UAAU,KAAK;AAAA,IAClD,KAAK;AACH,aAAO,EAAE,KAAK,gBAAgB,UAAU,UAAU,KAAK,EAAE;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,iBAAiB,UAAU,MAAM;AAAA,IAChE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,oBAAoB,UAAU,MAAM;AAAA,IACnE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,uBAAuB,UAAU,MAAM;AAAA,IACtE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,0BAA0B,UAAU,MAAM;AAAA,IACzE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,eAAe,GAAG,OAAO,UAAU,KAAK,CAAC,IAAI;AAAA,IAC5E,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,eAAe,IAAI,OAAO,UAAU,KAAK,CAAC,IAAI;AAAA,IAC7E,KAAK;AACH,aAAO,YAAY,UAAU,UAAU,KAAK;AAAA,IAC9C,KAAK;AACH,aAAO,EAAE,KAAK,YAAY,UAAU,UAAU,KAAK,EAAE;AAAA,IACvD,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAGH,aAAO,EAAE,UAAU,UAAU,cAAc,0BAA0B,UAAU,EAAE,KAAK;AAAA,EAC1F;AACF;AAEA,SAAS,gBAAgB,UAAkB,OAAwB;AACjE,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,UAAU,UAAU,cAAc,MAAM;AAChF,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,UAAU,UAAU,eAAe,MAAM;AACjF,MAAI,OAAO,UAAU,UAAW,QAAO,EAAE,UAAU,UAAU,eAAe,MAAM;AAClF,SAAO,EAAE,UAAU,UAAU,cAAc,OAAO,KAAK,EAAE;AAC3D;AAEA,SAAS,YAAY,UAAkB,OAAwB;AAC7D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,gBAAgB,UAAU,KAAK;AACjE,SAAO,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,gBAAgB,UAAU,CAAC,CAAC,EAAE;AAC9D;AAgBO,SAAS,iBAAiB,UAA0B;AACzD,QAAM,QAAQ,SAAS;AAAA,IACrB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,8BAA8B,QAAQ,EAAE;AAAA,EAC1D;AAEA,QAAM,CAAC,EAAE,OAAO,QAAQ,OAAO,MAAM,OAAO,SAAS,OAAO,IAAI;AAEhE,MAAI,QAAQ;AACZ,MAAI,MAAO,UAAS,SAAS,OAAO,EAAE,IAAI,MAAM;AAChD,MAAI,OAAQ,UAAS,SAAS,QAAQ,EAAE,IAAI,KAAK;AACjD,MAAI,MAAO,UAAS,SAAS,OAAO,EAAE,IAAI,IAAI;AAC9C,MAAI,KAAM,UAAS,SAAS,MAAM,EAAE,IAAI;AACxC,MAAI,MAAO,UAAS,SAAS,OAAO,EAAE,IAAI;AAC1C,MAAI,QAAS,UAAS,SAAS,SAAS,EAAE,IAAI;AAC9C,MAAI,QAAS,UAAS,SAAS,SAAS,EAAE;AAE1C,SAAO;AACT;AAMA,SAASA,qBAAoB,UAAsC;AACjE,SACE,KAAK;AAAA,IACH;AAAA,MACE,MAAM,GAAG,SAAS,EAAE;AAAA,MACpB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,QACP,OAAO;AAAA,MACT;AAAA,MACA,cAAc;AAAA,QACZ,sCAAsC;AAAA,MACxC;AAAA,MACA,iBAAiB;AAAA,QACf,qBAAqB;AAAA,QACrB,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAER;AAMA,SAAS,cAAiB,KAAmB,WAAyC;AACpF,WAAS,IAAI,IAAI,SAAS,GAAG,KAAK,GAAG,KAAK;AACxC,QAAI,UAAU,IAAI,CAAC,CAAM,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;;;AClTO,SAAS,qBACd,MACA,UAAgC,CAAC,GAClB;AACf,MAAI,KAAK,QAAQ,SAAS,QAAQ;AAChC,WAAO,EAAE,OAAO,CAAC,EAAE;AAAA,EACrB;AAEA,QAAM,UAAU,KAAK;AACrB,QAAM,UAAU,QAAQ,WAAW;AAEnC,QAAM,OAAO,iBAAiB,MAAM,SAAS,SAAS,OAAO;AAE7D,SAAO;AAAA,IACL,OAAO;AAAA,MACL,gBAAgB,cAAc,IAAI;AAAA,IACpC;AAAA,EACF;AACF;AAIA,SAAS,iBACP,MACA,SACA,SACA,SACa;AACb,QAAM,cAAc,oBAAoB,KAAK,IAAI,QAAQ,MAAM;AAE/D,QAAM,OAAoB;AAAA,IACxB,SAAS;AAAA,IACT,MAAM;AAAA,MACJ,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,CAAC,QAAQ,IAAI,GAAG;AAAA,QACd,CAAC,QAAQ,OAAO,YAAY,CAAC,GAAG;AAAA,UAC9B;AAAA,UACA,SAAS,KAAK;AAAA,UACd,GAAI,QAAQ,WAAW,QACnB,EAAE,YAAY,qBAAqB,OAAO,EAAE,IAC5C,EAAE,aAAa,iBAAiB,OAAO,EAAE;AAAA,UAC7C,WAAW,eAAe,OAAO;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,WAAW;AACrB,SAAK,UAAU,CAAC,EAAE,KAAK,QAAQ,UAAU,CAAC;AAAA,EAC5C;AAGA,MAAI,QAAQ,UAAU;AACpB,SAAK,aAAa;AAAA,MAChB,GAAG,KAAK;AAAA,MACR,iBAAiB;AAAA,QACf,UAAU;AAAA,UACR,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,aACE;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,SAAK,WAAW,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;AAIjC,SAAK,yBAAyB,IAAI,QAAQ;AAAA,EAC5C;AAGA,OAAK,aAAa;AAAA,IAChB,GAAG,KAAK;AAAA,IACR,SAAS;AAAA,MACP,CAAC,QAAQ,YAAY,GAAG;AAAA,QACtB,MAAM;AAAA,QACN,aAAa,iBAAiB,QAAQ,YAAY;AAAA,MACpD;AAAA,MACA,CAAC,QAAQ,aAAa,GAAG;AAAA,QACvB,MAAM;AAAA,QACN,aAAa,kBAAkB,QAAQ,aAAa;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,oBAAoB,QAAgB,QAAwB;AACnE,QAAM,YAAY,OACf,QAAQ,qBAAqB,CAAC,GAAG,OAAe,GAAG,YAAY,CAAC,EAChE,QAAQ,UAAU,CAAC,OAAO,GAAG,YAAY,CAAC;AAC7C,QAAM,SAAS,OAAO,YAAY;AAClC,SAAO,GAAG,MAAM,GAAG,UAAU,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC;AAC3E;AAEA,SAAS,qBAAqB,SAA0C;AACtE,SAAO;AAAA,IACL;AAAA,MACE,MAAM,QAAQ;AAAA,MACd,IAAI;AAAA,MACJ,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MACzD,UAAU;AAAA,MACV,QAAQ,EAAE,MAAM,wBAAwB,QAAQ,YAAY,GAAG;AAAA,IACjE;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,SAA0C;AAClE,SAAO;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,MACP,oBAAoB;AAAA,QAClB,QAAQ,EAAE,MAAM,wBAAwB,QAAQ,YAAY,GAAG;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,SAAuD;AAC7E,SAAO;AAAA,IACL,OAAO;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ,EAAE,MAAM,wBAAwB,QAAQ,aAAa,GAAG;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,YAAY;AAAA,cACV,OAAO,EAAE,MAAM,SAAS;AAAA,cACxB,MAAM,EAAE,MAAM,SAAS;AAAA,cACvB,SAAS,EAAE,MAAM,SAAS;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,YAAY;AAAA,cACV,OAAO,EAAE,MAAM,SAAS;AAAA,cACxB,MAAM,EAAE,MAAM,SAAS;AAAA,YACzB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,cAAc,KAAc,SAAiB,GAAW;AAC/D,QAAM,MAAM,KAAK,OAAO,MAAM;AAE9B,MAAI,QAAQ,QAAQ,QAAQ,OAAW,QAAO;AAC9C,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,IAAI,IAAI,QAAQ,MAAM,IAAI,CAAC;AAAA,IACpC;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,UAAW,QAAO,OAAO,GAAG;AAE1E,MAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,QAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,WAAO,IACJ,IAAI,CAAC,SAAS;AACb,UAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,cAAM,QAAQ,cAAc,MAAM,SAAS,CAAC;AAC5C,cAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,cAAM,YAAY,MAAM,CAAC,KAAK;AAC9B,eAAO,GAAG,GAAG,KAAK,UAAU,UAAU,CAAC;AAAA,EAAK,MAAM,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,QAAQ;AAAA,MAClF;AACA,aAAO,GAAG,GAAG,KAAK,cAAc,IAAI,CAAC;AAAA,IACvC,CAAC,EACA,KAAK,IAAI;AAAA,EACd;AAEA,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,UAAU,OAAO,QAAQ,GAA8B;AAC7D,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,WAAO,QACJ,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM;AACnB,YAAM,UAAU,gBAAgB,GAAG,IAAI,IAAI,GAAG,MAAM;AACpD,UACE,OAAO,QAAQ,YACf,QAAQ,QACR,CAAC,MAAM,QAAQ,GAAG,KAClB,OAAO,KAAK,GAAa,EAAE,SAAS,GACpC;AACA,eAAO,GAAG,GAAG,GAAG,OAAO;AAAA,EAAM,cAAc,KAAK,SAAS,CAAC,CAAC;AAAA,MAC7D;AACA,UAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,YAAI,IAAI,WAAW,EAAG,QAAO,GAAG,GAAG,GAAG,OAAO;AAC7C,eAAO,GAAG,GAAG,GAAG,OAAO;AAAA,EAAM,cAAc,KAAK,SAAS,CAAC,CAAC;AAAA,MAC7D;AACA,aAAO,GAAG,GAAG,GAAG,OAAO,KAAK,cAAc,GAAG,CAAC;AAAA,IAChD,CAAC,EACA,KAAK,IAAI;AAAA,EACd;AAEA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,KAAsB;AAC1C,SAAO,0BAA0B,KAAK,GAAG,KAAK,QAAQ,MAAM,QAAQ,UAAU,QAAQ;AACxF;AAEA,SAAS,gBAAgB,KAAsB;AAE7C,SAAO,QAAQ,KAAK,GAAG,KAAK,QAAQ,UAAU,QAAQ,WAAW,QAAQ,UAAU,QAAQ;AAC7F;;;AC/OO,SAAS,2BAA2B,MAA+C;AAGxF,OAAK;AACL,SAAO;AAAA,IACL,cAAc;AAAA,IACd,eAAe,CAAC;AAAA,IAChB,SAAS,CAAC;AAAA,EACZ;AACF;AAUO,SAAS,+BACd,UACyB;AACzB,QAAM,UAAmC,CAAC;AAE1C,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,aAAa;AACrB,iBAAW,cAAc,MAAM,aAAa;AAC1C,YAAI,WAAW,YAAY;AACzB,kBAAQ,KAAK;AAAA,YACX,MAAM,WAAW;AAAA,YACjB,UAAU,UAAU,SAAS,mBAAmB,WAAW,EAAE;AAAA,UAC/D,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAE3D,SAAO;AAAA,IACL,cAAc,QAAQ,SAAS;AAAA,IAC/B,eAAe;AAAA,IACf;AAAA,EACF;AACF;AAMO,SAAS,yBAAyB,MAA8C;AACrF,MAAI,CAAC,KAAK,aAAc,QAAO;AAE/B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,gBAAgB;AAAA,IAChB,8BAA8B;AAAA;AAAA;AAAA,IAG9B,eAAe,KAAK;AAAA,EACtB;AACF;AAMO,SAAS,sBAAsB,MAAuD;AAC3F,MAAI,CAAC,KAAK,aAAc,QAAO,CAAC;AAEhC,SAAO;AAAA,IACL,gCAAgC;AAAA,IAChC,6BAA6B,KAAK,cAAc,KAAK,GAAG;AAAA,IACxD,gCAAgC;AAAA;AAAA,EAClC;AACF;;;ACzGA,SAAS,kBAAkB;AA0CpB,SAAS,qBACd,MACA,UAAqD,CAAC,GAChC;AACtB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,iBAAiB,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAGnE,QAAM,cAAc,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAG/F,QAAM,WAAW,WAAW,QAAQ,EACjC,OAAO,GAAG,WAAW,IAAI,cAAc,EAAE,EACzC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AAEd,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASO,SAAS,qBAAqB,QAAsC;AACzE,MAAI,CAAC,OAAO,QAAS,QAAO;AAE5B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,sEAK6D,OAAO,QAAQ;AAAA,oCACjD,OAAO,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0BtD;AAMO,SAAS,cAAc,QAAsD;AAClF,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC;AAE7B,SAAO;AAAA,IACL,uBAAuB,OAAO;AAAA,IAC9B,0BAA0B,OAAO;AAAA,IACjC,6BAA6B,OAAO;AAAA,EACtC;AACF;","names":["errors","generatePackageJson"]}
1	+ {"version":3,"sources":["../src/validate.ts","../src/permissions.ts","../src/observability.ts","../src/workflow-observability.ts","../src/targets/lambda.ts","../src/targets/helm.ts","../src/targets/stepfunctions.ts","../src/targets/openapi.ts","../src/auth-permissions.ts","../src/build-coherence.ts"],"sourcesContent":["import type { CapabilityRegistry } from '@stackwright-services/capabilities';\nimport {\n scanDataSources as defaultScanDataSources,\n type DataSourceScanResult,\n} from '@stackwright-services/runtime';\nimport {\n FlowDefinition,\n WorkflowDefinition,\n type FlowDefinition as FlowDefinitionType,\n type WorkflowDefinition as WorkflowDefinitionType,\n} from '@stackwright-services/types';\nimport { parse as parseYaml } from 'yaml';\n\n/*\n Validation result -- either success with parsed data, or failure with errors.\n /\nexport interface ValidationResult<T = unknown> {\n success: boolean;\n data?: T;\n errors: ValidationError[];\n warnings: ValidationWarning[];\n}\n\nexport interface ValidationError {\n code: string;\n message: string;\n path?: string;\n}\n\nexport interface ValidationWarning {\n code: string;\n message: string;\n path?: string;\n}\n\n/\n Options for validation — injectable for testing.\n /\nexport interface ValidateOptions {\n /\n Injectable scanDataSources function — defaults to the real runtime scan.\n * Pass a mock in tests to avoid depending on installed packages.\n /\n scanDataSources?: () => DataSourceScanResult;\n}\n\n/\n Detect whether a parsed YAML object is a flow or workflow.\n /\nexport function detectDefinitionType(obj: unknown): 'flow' \| 'workflow' \| 'unknown' {\n if (typeof obj !== 'object' \|\| obj === null) return 'unknown';\n const record = obj as Record<string, unknown>;\n if ('steps' in record && 'trigger' in record) return 'flow';\n if ('states' in record && 'initial' in record) return 'workflow';\n return 'unknown';\n}\n\n/\n Validate a YAML string as a flow or workflow definition.\n \n Pass 1: Schema validation (Zod parse)\n * Pass 2: Semantic validation (capability refs, state graph, etc.)\n \n @param yamlContent - Raw YAML string\n * @param registry - Capability registry for ref validation (optional)\n /\nexport function validate(\n yamlContent: string,\n registry?: CapabilityRegistry,\n options?: ValidateOptions,\n): ValidationResult {\n let parsed: unknown;\n try {\n parsed = parseYaml(yamlContent);\n } catch (err) {\n return {\n success: false,\n errors: [{ code: 'YAML_PARSE_ERROR', message: `Invalid YAML: ${(err as Error).message}` }],\n warnings: [],\n };\n }\n\n if (parsed === null \|\| parsed === undefined) {\n return {\n success: false,\n errors: [{ code: 'EMPTY_DOCUMENT', message: 'YAML document is empty' }],\n warnings: [],\n };\n }\n\n const defType = detectDefinitionType(parsed);\n\n if (defType === 'flow') {\n return validateFlow(parsed, registry, options);\n } else if (defType === 'workflow') {\n return validateWorkflow(parsed, registry);\n } else {\n return {\n success: false,\n errors: [\n {\n code: 'UNKNOWN_DEFINITION_TYPE',\n message:\n 'Could not detect definition type. Expected a flow (with trigger + steps) or workflow (with states + initial).',\n },\n ],\n warnings: [],\n };\n }\n}\n\n/\n Validate a flow definition (two-pass).\n /\nexport function validateFlow(\n parsed: unknown,\n registry?: CapabilityRegistry,\n options?: ValidateOptions,\n): ValidationResult<FlowDefinitionType> {\n // Pass 1: Schema validation\n const result = FlowDefinition.safeParse(parsed);\n\n if (!result.success) {\n const errors: ValidationError[] = result.error.issues.map((issue) => ({\n code: 'SCHEMA_VALIDATION_ERROR',\n message: issue.message,\n path: issue.path.join('.'),\n }));\n return { success: false, errors, warnings: [] };\n }\n\n const flow = result.data;\n const errors: ValidationError[] = [];\n const warnings: ValidationWarning[] = [];\n\n // Pass 2: Semantic validation\n\n // Check capability references exist in registry\n if (registry) {\n for (const step of flow.steps) {\n if (!registry.has(step.use)) {\n errors.push({\n code: 'UNKNOWN_CAPABILITY',\n message: `Step \"${step.name}\" references unknown capability \"${step.use}\"`,\n path: `steps.${step.name}.use`,\n });\n }\n }\n }\n\n // Check for duplicate step names\n const stepNames = flow.steps.map((s) => s.name);\n const seen = new Set<string>();\n for (const name of stepNames) {\n if (seen.has(name)) {\n warnings.push({\n code: 'DUPLICATE_STEP_NAME',\n message: `Duplicate step name \"${name}\" -- step names should be unique for observability`,\n path: `steps.${name}`,\n });\n }\n seen.add(name);\n }\n\n // Check source: references (best-effort static hint — warnings only, never errors).\n // Providers may be installed at deploy time even if absent at build time.\n const sourceRefs: Array<{ ref: string; stepName: string }> = [];\n for (const step of flow.steps) {\n const sourceVal = step.with?.['source'];\n if (\n typeof sourceVal === 'string' &&\n (sourceVal.startsWith('openapi:') \|\| sourceVal.startsWith('pulse:'))\n ) {\n sourceRefs.push({ ref: sourceVal, stepName: step.name });\n }\n }\n\n if (sourceRefs.length > 0) {\n const doScan = options?.scanDataSources ?? defaultScanDataSources;\n const scanResult = doScan();\n\n for (const { ref, stepName } of sourceRefs) {\n const sourceId = ref.slice(ref.indexOf(':') + 1);\n\n if (scanResult.detectedProviders.length === 0) {\n warnings.push({\n code: 'SOURCE_UNVERIFIABLE',\n message: `source '${ref}' cannot be verified: no DataSourceProvider is installed`,\n path: `steps.${stepName}.with.source`,\n });\n } else if (!scanResult.sources.some((s) => s.id === sourceId)) {\n warnings.push({\n code: 'SOURCE_NOT_REGISTERED',\n message: `source '${ref}' is not registered by any installed provider`,\n path: `steps.${stepName}.with.source`,\n });\n }\n // source found — no warning\n }\n }\n\n return {\n success: errors.length === 0,\n data: flow,\n errors,\n warnings,\n };\n}\n\n/\n Validate a workflow definition (two-pass).\n /\nexport function validateWorkflow(\n parsed: unknown,\n registry?: CapabilityRegistry,\n): ValidationResult<WorkflowDefinitionType> {\n // Pass 1: Schema validation\n const result = WorkflowDefinition.safeParse(parsed);\n\n if (!result.success) {\n const errors: ValidationError[] = result.error.issues.map((issue) => ({\n code: 'SCHEMA_VALIDATION_ERROR',\n message: issue.message,\n path: issue.path.join('.'),\n }));\n return { success: false, errors, warnings: [] };\n }\n\n const workflow = result.data;\n const errors: ValidationError[] = [];\n const warnings: ValidationWarning[] = [];\n const stateNames = Object.keys(workflow.states);\n\n // Check initial state exists\n if (!stateNames.includes(workflow.initial)) {\n errors.push({\n code: 'INITIAL_STATE_NOT_FOUND',\n message: `Initial state \"${workflow.initial}\" does not exist in states map`,\n path: 'initial',\n });\n }\n\n // Check all transition targets exist\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n if (!stateNames.includes(transition.to)) {\n errors.push({\n code: 'TRANSITION_TARGET_NOT_FOUND',\n message: `State \"${stateName}\" has transition to unknown state \"${transition.to}\"`,\n path: `states.${stateName}.transitions`,\n });\n }\n }\n }\n\n // Check on_enter capability refs\n if (registry && state.on_enter) {\n if (!registry.has(state.on_enter.use)) {\n errors.push({\n code: 'UNKNOWN_CAPABILITY',\n message: `State \"${stateName}\" on_enter references unknown capability \"${state.on_enter.use}\"`,\n path: `states.${stateName}.on_enter.use`,\n });\n }\n }\n }\n\n // Check at least one terminal state exists\n const terminalStates = stateNames.filter((name) => workflow.states[name]?.type === 'terminal');\n if (terminalStates.length === 0 && stateNames.length > 0) {\n errors.push({\n code: 'NO_TERMINAL_STATE',\n message: 'Workflow has no terminal state -- workflows must have at least one terminal state',\n });\n }\n\n // Deadlock detection: non-terminal states with no transitions\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.type !== 'terminal' && (!state.transitions \|\| state.transitions.length === 0)) {\n errors.push({\n code: 'DEADLOCK_STATE',\n message: `State \"${stateName}\" is not terminal but has no transitions — workflow will deadlock here`,\n path: `states.${stateName}`,\n });\n }\n }\n\n // Reachability: BFS from initial state\n if (stateNames.includes(workflow.initial)) {\n const reachable = new Set<string>();\n const queue = [workflow.initial];\n\n while (queue.length > 0) {\n const current = queue.shift()!; // eslint-disable-line @typescript-eslint/no-non-null-assertion\n if (reachable.has(current)) continue;\n reachable.add(current);\n\n const state = workflow.states[current];\n if (state?.transitions) {\n for (const transition of state.transitions) {\n if (!reachable.has(transition.to)) {\n queue.push(transition.to);\n }\n }\n }\n }\n\n for (const stateName of stateNames) {\n if (!reachable.has(stateName)) {\n warnings.push({\n code: 'UNREACHABLE_STATE',\n message: `State \"${stateName}\" is not reachable from initial state \"${workflow.initial}\"`,\n path: `states.${stateName}`,\n });\n }\n }\n }\n\n // Terminal state reachability: reverse BFS from terminal states\n if (terminalStates.length > 0) {\n const canReachTerminal = new Set<string>(terminalStates);\n const reverseQueue = [...terminalStates];\n\n // Build reverse adjacency: for each state, which states transition TO it?\n const reverseAdj = new Map<string, string[]>();\n for (const name of stateNames) {\n reverseAdj.set(name, []);\n }\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n reverseAdj.get(transition.to)?.push(stateName);\n }\n }\n }\n\n // BFS backward from terminal states\n while (reverseQueue.length > 0) {\n const current = reverseQueue.shift()!; // eslint-disable-line @typescript-eslint/no-non-null-assertion\n for (const predecessor of reverseAdj.get(current) ?? []) {\n if (!canReachTerminal.has(predecessor)) {\n canReachTerminal.add(predecessor);\n reverseQueue.push(predecessor);\n }\n }\n }\n\n for (const stateName of stateNames) {\n if (workflow.states[stateName]?.type !== 'terminal' && !canReachTerminal.has(stateName)) {\n warnings.push({\n code: 'NO_PATH_TO_TERMINAL',\n message: `State \"${stateName}\" has no path to any terminal state`,\n path: `states.${stateName}`,\n });\n }\n }\n }\n\n // Signal consistency: validate transition signals against declared signals\n if (workflow.signals) {\n const declaredSignals = new Set(workflow.signals.map((s) => s.name));\n const usedSignals = new Set<string>();\n\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n usedSignals.add(transition.on);\n if (!declaredSignals.has(transition.on)) {\n warnings.push({\n code: 'UNKNOWN_SIGNAL',\n message: `Transition in state \"${stateName}\" uses signal \"${transition.on}\" which is not declared in workflow signals`,\n path: `states.${stateName}.transitions`,\n });\n }\n }\n }\n }\n\n for (const signal of workflow.signals) {\n if (!usedSignals.has(signal.name)) {\n warnings.push({\n code: 'UNUSED_SIGNAL',\n message: `Signal \"${signal.name}\" is declared but never used by any transition`,\n path: 'signals',\n });\n }\n }\n }\n\n // Ambiguous transitions: duplicate unguarded transitions for same signal in a state\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n const unguardedSignals = new Set<string>();\n for (const transition of state.transitions) {\n if (!transition.when) {\n if (unguardedSignals.has(transition.on)) {\n warnings.push({\n code: 'AMBIGUOUS_TRANSITION',\n message: `State \"${stateName}\" has multiple unguarded transitions for signal \"${transition.on}\" — only the first will match`,\n path: `states.${stateName}.transitions`,\n });\n }\n unguardedSignals.add(transition.on);\n }\n }\n }\n }\n\n // on_timeout capability validation\n if (registry && workflow.timeouts?.on_timeout) {\n if (!registry.has(workflow.timeouts.on_timeout.use)) {\n errors.push({\n code: 'UNKNOWN_CAPABILITY',\n message: `Timeout on_timeout references unknown capability \"${workflow.timeouts.on_timeout.use}\"`,\n path: 'timeouts.on_timeout.use',\n });\n }\n }\n\n return {\n success: errors.length === 0,\n data: workflow,\n errors,\n warnings,\n };\n}\n","import type { CapabilityRegistry } from '@stackwright-services/capabilities';\nimport type {\n FlowDefinition,\n RequiredPermission,\n WorkflowDefinition,\n} from '@stackwright-services/types';\n\n/\n A derived permission set -- the minimal set of permissions a service needs.\n * Computed by walking all capability invocations and collecting their requiredPermissions.\n /\nexport interface DerivedPermissions {\n /* All required permissions, deduplicated /\n permissions: RequiredPermission[];\n /* Which capabilities contributed each permission (for audit trail) /\n sources: PermissionSource[];\n}\n\nexport interface PermissionSource {\n /* The permission /\n permission: RequiredPermission;\n /* The capability that requires it /\n capabilityName: string;\n /* Where in the definition it's invoked /\n location: string;\n}\n\n/\n Resolve permission variable placeholders ($-prefixed) from step parameters.\n \n Permission resources may contain `$field` placeholders (e.g. `webhook:$url`)\n * that are resolved at compile time against the step's `with` block.\n * Unresolvable placeholders are left as-is (they'll be runtime-resolved or\n * represent wildcards).\n /\nfunction resolvePermissionVariables(\n permission: RequiredPermission,\n stepParams: Record<string, unknown> \| undefined,\n): RequiredPermission {\n if (!stepParams) return permission;\n\n let { resource } = permission;\n const variablePattern = /\\$([a-zA-Z_][a-zA-Z0-9_])/g;\n\n resource = resource.replace(variablePattern, (_match, varName: string) => {\n const value = stepParams[varName];\n if (typeof value === 'string') return value;\n if (typeof value === 'number' \|\| typeof value === 'boolean') return String(value);\n return _match; // Leave unresolved if not a primitive\n });\n\n return { ...permission, resource };\n}\n\n/*\n Derive the minimal permission set from a flow definition.\n \n Walks all steps, looks up each capability in the registry,\n * collects requiredPermissions from Effect capabilities.\n * Transform capabilities contribute no permissions (they're pure).\n \n Permission variables (e.g. `$url`) are resolved from step parameters\n * at compile time for static permission derivation.\n \n @security-critical -- This is least-privilege derivation.\n * The output of this function determines the IAM policy / RBAC manifest.\n /\nexport function deriveFlowPermissions(\n flow: FlowDefinition,\n registry: CapabilityRegistry,\n): DerivedPermissions {\n const sources: PermissionSource[] = [];\n\n for (const step of flow.steps) {\n const capability = registry.lookup(step.use);\n if (!capability) continue;\n\n if (capability.definition.kind === 'effect') {\n for (const perm of capability.definition.requiredPermissions) {\n const resolved = resolvePermissionVariables(perm, step.with);\n sources.push({\n permission: resolved,\n capabilityName: step.use,\n location: `steps.${step.name}`,\n });\n }\n }\n }\n\n return {\n permissions: deduplicatePermissions(sources.map((s) => s.permission)),\n sources,\n };\n}\n\n/\n Derive the minimal permission set from a workflow definition.\n \n Walks all states' on_enter actions, collects requiredPermissions\n * from Effect capabilities.\n /\nexport function deriveWorkflowPermissions(\n workflow: WorkflowDefinition,\n registry: CapabilityRegistry,\n): DerivedPermissions {\n const sources: PermissionSource[] = [];\n\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.on_enter) {\n const capability = registry.lookup(state.on_enter.use);\n if (!capability) continue;\n\n if (capability.definition.kind === 'effect') {\n for (const perm of capability.definition.requiredPermissions) {\n sources.push({\n permission: perm,\n capabilityName: state.on_enter.use,\n location: `states.${stateName}.on_enter`,\n });\n }\n }\n }\n }\n\n // Collect permissions from timeout escalation action\n if (workflow.timeouts?.on_timeout) {\n const capability = registry.lookup(workflow.timeouts.on_timeout.use);\n if (capability && capability.definition.kind === 'effect') {\n for (const perm of capability.definition.requiredPermissions) {\n sources.push({\n permission: perm,\n capabilityName: workflow.timeouts.on_timeout.use,\n location: 'timeouts.on_timeout',\n });\n }\n }\n }\n\n return {\n permissions: deduplicatePermissions(sources.map((s) => s.permission)),\n sources,\n };\n}\n\n/\n Deduplicate permissions by resource + action + scope.\n /\nfunction deduplicatePermissions(permissions: RequiredPermission[]): RequiredPermission[] {\n const seen = new Set<string>();\n const unique: RequiredPermission[] = [];\n\n for (const perm of permissions) {\n const key = `${perm.resource}:${perm.action}:${perm.scope ?? ''}`;\n if (!seen.has(key)) {\n seen.add(key);\n unique.push(perm);\n }\n }\n\n return unique;\n}\n\n/\n Generate an AWS IAM policy document from derived permissions.\n * Used by the Lambda compile target.\n /\nexport function toIamPolicy(derived: DerivedPermissions): object {\n if (derived.permissions.length === 0) {\n return {\n Version: '2012-10-17',\n Statement: [],\n };\n }\n\n return {\n Version: '2012-10-17',\n Statement: derived.permissions.map((perm) => ({\n Effect: 'Allow',\n Action: `stackwright:${perm.action}`,\n Resource: perm.resource,\n ...(perm.scope ? { Condition: { StringEquals: { 'stackwright:scope': perm.scope } } } : {}),\n })),\n };\n}\n\n/\n Generate an IAM policy for a Step Functions execution role.\n \n Includes:\n * - Lambda invoke permissions for each state's on_enter handler\n * - Capability-derived permissions (from deriveWorkflowPermissions)\n * - EventBridge permissions if timeouts are configured\n * - CloudWatch Logs for execution logging\n \n @security-critical\n /\nexport function toStepFunctionsIamPolicy(\n workflow: WorkflowDefinition,\n derived: DerivedPermissions,\n): object {\n const statements: object[] = [];\n\n // 1. Lambda invoke for each state with on_enter\n const statesWithActions = Object.entries(workflow.states)\n .filter(([, state]) => state.on_enter !== undefined)\n .map(([name]) => name);\n\n if (statesWithActions.length > 0) {\n statements.push({\n Sid: 'InvokeStateLambdas',\n Effect: 'Allow',\n Action: ['lambda:InvokeFunction'],\n Resource: statesWithActions.map(\n (name) => `arn:aws:lambda:::function:${workflow.id}-${name}`,\n ),\n });\n }\n\n // 2. Capability-derived permissions\n if (derived.permissions.length > 0) {\n statements.push(\n ...derived.permissions.map((perm) => ({\n Effect: 'Allow',\n Action: `stackwright:${perm.action}`,\n Resource: perm.resource,\n ...(perm.scope ? { Condition: { StringEquals: { 'stackwright:scope': perm.scope } } } : {}),\n })),\n );\n }\n\n // 3. EventBridge for timeouts\n if (workflow.timeouts?.pending_after \|\| workflow.timeouts?.absolute) {\n statements.push({\n Sid: 'TimeoutScheduling',\n Effect: 'Allow',\n Action: ['events:PutRule', 'events:PutTargets', 'events:DeleteRule', 'events:RemoveTargets'],\n Resource: `arn:aws:events:::rule/${workflow.id}-timeout-`,\n });\n }\n\n // 4. CloudWatch Logs\n statements.push({\n Sid: 'ExecutionLogging',\n Effect: 'Allow',\n Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],\n Resource: `arn:aws:logs:::log-group:/aws/stepfunctions/${workflow.id}:`,\n });\n\n return {\n Version: '2012-10-17',\n Statement: statements,\n };\n}\n\n/\n Generate a Kubernetes RBAC rule set from derived permissions.\n * Used by the Helm compile target.\n /\nexport function toRbacRules(derived: DerivedPermissions): object[] {\n if (derived.permissions.length === 0) return [];\n\n // Group by resource for cleaner RBAC\n const grouped = new Map<string, string[]>();\n for (const perm of derived.permissions) {\n const verbs = grouped.get(perm.resource) ?? [];\n if (!verbs.includes(perm.action)) {\n verbs.push(perm.action);\n }\n grouped.set(perm.resource, verbs);\n }\n\n return Array.from(grouped.entries()).map(([resource, verbs]) => ({\n apiGroups: ['stackwright.io'],\n resources: [resource],\n verbs,\n }));\n}\n","import type { FlowDefinition } from '@stackwright-services/types';\n\n/\n The ObservabilityProvider interface -- what the generated code calls.\n * This is defined here for code generation; the runtime package implements it.\n /\nexport interface ObservabilityProvider {\n /* Start a span for a capability invocation /\n startSpan(name: string, attributes?: Record<string, string \| number \| boolean>): SpanHandle;\n /* Record a metric /\n recordMetric(name: string, value: number, tags?: Record<string, string>): void;\n}\n\nexport interface SpanHandle {\n /* Set attributes on the span /\n setAttribute(key: string, value: string \| number \| boolean): void;\n /* Mark the span as errored /\n setError(error: Error): void;\n /* End the span /\n end(): void;\n}\n\n/\n Instrumentation metadata for a single step.\n /\nexport interface StepInstrumentation {\n /* Step name (used as span name) /\n stepName: string;\n /* Capability name (span attribute) /\n capabilityName: string;\n /* Flow ID (span attribute) /\n flowId: string;\n /* Metric names /\n metrics: {\n latency: string;\n invocations: string;\n errors: string;\n };\n}\n\n/\n Generate instrumentation metadata for all steps in a flow.\n /\nexport function generateFlowInstrumentation(flow: FlowDefinition): StepInstrumentation[] {\n return flow.steps.map((step) => ({\n stepName: step.name,\n capabilityName: step.use,\n flowId: flow.id,\n metrics: {\n latency: 'flow.step.latency',\n invocations: 'flow.step.invocations',\n errors: 'flow.step.errors',\n },\n }));\n}\n\n/\n Sanitize a string to be a valid TypeScript identifier.\n /\nexport function sanitizeIdentifier(name: string): string {\n return name.replace(/[^a-zA-Z0-9]/g, '_');\n}\n\n/\n Generate the TypeScript code for an instrumented step handler.\n \n This is what the compiler emits into the generated handler file.\n * Each step becomes an async function wrapped with observability AND audit.\n /\nexport function generateInstrumentedStepCode(instrumentation: StepInstrumentation): string {\n const { stepName, capabilityName, flowId, metrics } = instrumentation;\n const fnName = sanitizeIdentifier(stepName);\n\n return [\n `async function executeStep_${fnName}(`,\n ' input: unknown,',\n ' context: CapabilityContext,',\n ' provider: ObservabilityProvider,',\n ' auditProvider: AuditProvider,',\n ' handler: CapabilityHandler,',\n '): Promise<unknown> {',\n ` const span = provider.startSpan('step.${stepName}', {`,\n ` 'capability.name': '${capabilityName}',`,\n ` 'flow.id': '${flowId}',`,\n ` 'step.name': '${stepName}',`,\n ' });',\n ' const startTime = Date.now();',\n '',\n ' try {',\n ' const result = await handler(input, context);',\n ` provider.recordMetric('${metrics.invocations}', 1, { step: '${stepName}', capability: '${capabilityName}', status: 'success' });`,\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flowId}',`,\n ` stepName: '${stepName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(input),',\n ' outputHash: auditHash(result),',\n ' durationMs: Date.now() - startTime,',\n \" status: 'success',\",\n ' });',\n ' return result;',\n ' } catch (error) {',\n ' span.setError(error instanceof Error ? error : new Error(String(error)));',\n ` provider.recordMetric('${metrics.errors}', 1, { step: '${stepName}', capability: '${capabilityName}' });`,\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flowId}',`,\n ` stepName: '${stepName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(input),',\n \" outputHash: '',\",\n ' durationMs: Date.now() - startTime,',\n \" status: 'error',\",\n ' error: error instanceof Error ? error.message : String(error),',\n ' });',\n ' throw error;',\n ' } finally {',\n ' const duration = Date.now() - startTime;',\n ` provider.recordMetric('${metrics.latency}', duration, { step: '${stepName}', capability: '${capabilityName}' });`,\n ' span.end();',\n ' }',\n '}',\n ].join('\\n');\n}\n\n/\n Generate the full instrumented handler code for a flow.\n * Returns the complete TypeScript source for the compiled handler.\n /\nexport function generateInstrumentedFlowCode(flow: FlowDefinition): string {\n const instrumentations = generateFlowInstrumentation(flow);\n const stepFunctions = instrumentations.map(generateInstrumentedStepCode);\n\n const stepCalls = instrumentations\n .map(\n (inst) =>\n ` stepResult = await executeStep_${sanitizeIdentifier(inst.stepName)}(stepResult, context, provider, auditProvider, registry.get('${inst.capabilityName}').handler);`,\n )\n .join('\\n');\n\n const header = [\n '// Auto-generated by @stackwright-services/compiler',\n `// Flow: ${flow.id}`,\n `// Description: ${flow.description}`,\n '//',\n '// DO NOT EDIT -- regenerate from the source YAML.',\n '',\n \"import type { CapabilityContext, CapabilityHandler } from '@stackwright-services/capabilities';\",\n \"import type { ObservabilityProvider } from '@stackwright-services/compiler';\",\n \"import type { AuditProvider, AuditEvent } from '@stackwright-services/runtime';\",\n \"import { auditHash } from '@stackwright-services/runtime';\",\n '',\n ].join('\\n');\n\n const executeFlow = [\n 'export async function executeFlow(',\n ' input: unknown,',\n ' context: CapabilityContext,',\n ' provider: ObservabilityProvider,',\n ' auditProvider: AuditProvider,',\n ' registry: { get(name: string): { handler: CapabilityHandler } },',\n '): Promise<unknown> {',\n ' auditProvider.record({',\n \" type: 'flow_start',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flow.id}',`,\n \" stepName: '',\",\n \" capabilityName: '',\",\n ' inputHash: auditHash(input),',\n \" outputHash: '',\",\n ' durationMs: 0,',\n \" status: 'success',\",\n ' });',\n ` const flowSpan = provider.startSpan('flow.${flow.id}', {`,\n ` 'flow.id': '${flow.id}',`,\n ` 'flow.steps': ${flow.steps.length},`,\n ' });',\n ' const flowStart = Date.now();',\n '',\n ' try {',\n ' let stepResult: unknown = input;',\n stepCalls,\n ' auditProvider.record({',\n \" type: 'flow_end',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flow.id}',`,\n \" stepName: '',\",\n \" capabilityName: '',\",\n ' inputHash: auditHash(input),',\n ' outputHash: auditHash(stepResult),',\n ' durationMs: Date.now() - flowStart,',\n \" status: 'success',\",\n ' });',\n ` provider.recordMetric('flow.invocations', 1, { flow: '${flow.id}', status: 'success' });`,\n ' return stepResult;',\n ' } catch (error) {',\n ' flowSpan.setError(error instanceof Error ? error : new Error(String(error)));',\n ` provider.recordMetric('flow.errors', 1, { flow: '${flow.id}' });`,\n ' auditProvider.record({',\n \" type: 'flow_end',\",\n ' traceId: context.traceId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${flow.id}',`,\n \" stepName: '',\",\n \" capabilityName: '',\",\n ' inputHash: auditHash(input),',\n \" outputHash: '',\",\n ' durationMs: Date.now() - flowStart,',\n \" status: 'error',\",\n ' error: error instanceof Error ? error.message : String(error),',\n ' });',\n ' throw error;',\n ' } finally {',\n ` provider.recordMetric('flow.latency', Date.now() - flowStart, { flow: '${flow.id}' });`,\n ' flowSpan.end();',\n ' }',\n '}',\n '',\n ].join('\\n');\n\n return header + stepFunctions.join('\\n\\n') + '\\n\\n' + executeFlow;\n}\n","import type { WorkflowDefinition } from '@stackwright-services/types';\n\n/\n Instrumentation metadata for a single workflow state handler.\n * Mirrors StepInstrumentation but is scoped to state machine semantics:\n * transitions, dwell time, timeout events.\n /\nexport interface WorkflowStateInstrumentation {\n /* State name /\n stateName: string;\n /* Capability invoked on entry (from on_enter.use) /\n capabilityName: string;\n /* Workflow ID /\n workflowId: string;\n /* Whether this is a terminal state /\n isTerminal: boolean;\n /* Metric name constants /\n metrics: {\n /* Counter — fires each time the state is entered /\n invocations: string;\n /* Counter — fires when the on_enter capability throws /\n errors: string;\n /* Histogram — on_enter handler execution time in ms /\n latency: string;\n /* Counter — per-signal transition counts into this state /\n transitions: string;\n };\n}\n\n/\n Generate instrumentation metadata for all states that have an on_enter\n * capability in the workflow. States without on_enter have no Lambda handler\n * and are therefore excluded.\n /\nexport function generateWorkflowInstrumentation(\n workflow: WorkflowDefinition,\n): WorkflowStateInstrumentation[] {\n return Object.entries(workflow.states)\n .filter(([, state]) => !!state.on_enter)\n .map(([stateName, state]) => ({\n stateName,\n // filter above guarantees on_enter exists; fallback silences linter.\n capabilityName: state.on_enter?.use ?? 'unknown',\n workflowId: workflow.id,\n isTerminal: state.type === 'terminal',\n metrics: {\n invocations: 'workflow.state.invocations',\n errors: 'workflow.state.errors',\n latency: 'workflow.state.latency',\n transitions: 'workflow.state.transitions',\n },\n }));\n}\n\n/\n Generate a complete TypeScript Lambda handler file for an instrumented\n * workflow state.\n \n The generated handler:\n * - Opens a span per state execution (one span = one transition through the state)\n * - Records a `workflow.state.transitions` counter tagged with the incoming signal\n * - Records `workflow.state.invocations` / `workflow.state.errors` counters\n * - Records `workflow.state.latency` histogram (on_enter execution time)\n * - Emits an AuditProvider record on both success and error paths\n \n Providers default to noop — wire real implementations via your DI bootstrap.\n /\nexport function generateInstrumentedStateHandlerCode(\n instrumentation: WorkflowStateInstrumentation,\n capabilityParams: Record<string, unknown>,\n): string {\n const { stateName, capabilityName, workflowId, metrics } = instrumentation;\n const paramsJson = JSON.stringify(capabilityParams);\n const header = [\n '// Generated by @stackwright-services/compiler — DO NOT EDIT',\n `// Workflow: ${workflowId}, State: ${stateName}`,\n `// Capability: ${capabilityName}`,\n '//',\n '// DO NOT EDIT — regenerate from the source YAML.',\n '',\n \"import type { Context } from 'aws-lambda';\",\n \"import type { ObservabilityProvider } from '@stackwright-services/compiler';\",\n \"import type { AuditProvider } from '@stackwright-services/runtime';\",\n \"import { auditHash, noopAuditProvider } from '@stackwright-services/runtime';\",\n '',\n '// Noop observability — replace with real implementation in production bootstrap.',\n 'const noopProvider: ObservabilityProvider = {',\n ' startSpan: () => ({ setAttribute: () => {}, setError: () => {}, end: () => {} }),',\n ' recordMetric: () => {},',\n '};',\n '',\n ].join('\\n');\n\n const handlerLines = [\n 'export async function handler(event: unknown, _context: Context): Promise<unknown> {',\n ' // TODO: Replace noop providers with real implementations via DI bootstrap.',\n ' const provider: ObservabilityProvider = noopProvider;',\n ' const auditProvider: AuditProvider = noopAuditProvider;',\n ` // Capability params: ${paramsJson}`,\n '',\n ` const span = provider.startSpan('workflow.state.${stateName}', {`,\n ` 'workflow.id': '${workflowId}',`,\n ` 'state.name': '${stateName}',`,\n ` 'capability.name': '${capabilityName}',`,\n ' });',\n ' const startTime = Date.now();',\n '',\n ' // Transition count — which signal drove entry to this state.',\n \" const incomingSignal = (event as Record<string, unknown>)?.['signal'] as string \| undefined;\",\n ` provider.recordMetric('${metrics.transitions}', 1, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n \" signal: incomingSignal ?? 'initial',\",\n ' });',\n '',\n ' try {',\n ` // TODO: Wire capability invocation for '${capabilityName}'.`,\n ' const result = {',\n ' ...(event as Record<string, unknown>),',\n ` __state: '${stateName}',`,\n ` __capability: '${capabilityName}',`,\n ' __timestamp: new Date().toISOString(),',\n ' };',\n '',\n ` provider.recordMetric('${metrics.invocations}', 1, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n ` capability: '${capabilityName}',`,\n \" status: 'success',\",\n ' });',\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: _context.awsRequestId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${workflowId}',`,\n ` stepName: '${stateName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(event),',\n ' outputHash: auditHash(result),',\n ' durationMs: Date.now() - startTime,',\n \" status: 'success',\",\n ' });',\n ' return result;',\n ' } catch (error) {',\n ' span.setError(error instanceof Error ? error : new Error(String(error)));',\n ` provider.recordMetric('${metrics.errors}', 1, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n ' });',\n ' auditProvider.record({',\n \" type: 'capability_invocation',\",\n ' traceId: _context.awsRequestId,',\n ' timestamp: new Date().toISOString(),',\n ` flowId: '${workflowId}',`,\n ` stepName: '${stateName}',`,\n ` capabilityName: '${capabilityName}',`,\n ' inputHash: auditHash(event),',\n \" outputHash: '',\",\n ' durationMs: Date.now() - startTime,',\n \" status: 'error',\",\n ' error: error instanceof Error ? error.message : String(error),',\n ' });',\n ' throw error;',\n ' } finally {',\n ' const duration = Date.now() - startTime;',\n ` provider.recordMetric('${metrics.latency}', duration, {`,\n ` workflow: '${workflowId}',`,\n ` state: '${stateName}',`,\n ' });',\n ' span.end();',\n ' }',\n '}',\n '',\n ].join('\\n');\n\n return header + handlerLines;\n}\n","import type { FlowDefinition, Trigger } from '@stackwright-services/types';\nimport type { DerivedPermissions } from '../permissions';\nimport { toIamPolicy } from '../permissions';\n\n/\n Output files generated by the Lambda compile target.\n /\nexport interface LambdaTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Compile a flow definition to Lambda target output.\n \n Generates:\n * - handler.ts: Hono app entry point wired to the compiled flow\n * - Dockerfile: AWS Lambda Web Adapter base image\n * - iam-policy.json: Least-privilege IAM policy from derived permissions\n * - package.json: Minimal package for the Lambda function\n /\nexport function compileLambdaTarget(\n flow: FlowDefinition,\n permissions: DerivedPermissions,\n instrumentedCode: string,\n): LambdaTarget {\n const files: Record<string, string> = {};\n\n files['handler.ts'] = generateHandlerTs(flow);\n files['flow.ts'] = instrumentedCode;\n files['Dockerfile'] = generateDockerfile(flow);\n files['iam-policy.json'] = generateIamPolicy(flow.trigger, permissions);\n files['package.json'] = generatePackageJson(flow);\n\n // Trigger-specific infrastructure config files\n const triggerFiles = generateTriggerFiles(flow);\n for (const [path, content] of Object.entries(triggerFiles)) {\n files[path] = content;\n }\n\n return { files };\n}\n\nfunction generateHandlerTs(flow: FlowDefinition): string {\n const trigger = flow.trigger;\n\n let routeSetup: string;\n if (trigger.type === 'http') {\n const method = trigger.method.toLowerCase();\n const inputExpr = trigger.method === 'GET' ? 'c.req.query()' : 'await c.req.json()';\n routeSetup = `\napp.${method}('${trigger.path}', async (c) => {\n const input = ${inputExpr};\n const context = createContext(c);\n const provider = getObservabilityProvider();\n\n try {\n const result = await executeFlow(input, context, provider, registry);\n return c.json(result);\n } catch (error) {\n context.logger.error('Flow execution failed', { error: String(error) });\n return c.json({ error: 'Internal server error' }, 500);\n }\n});`;\n } else {\n routeSetup = `\n// Non-HTTP trigger: ${trigger.type}\n// This handler expects to be invoked by the trigger adapter\napp.post('/_invoke', async (c) => {\n const input = await c.req.json();\n const context = createContext(c);\n const provider = getObservabilityProvider();\n\n try {\n const result = await executeFlow(input, context, provider, registry);\n return c.json(result);\n } catch (error) {\n context.logger.error('Flow execution failed', { error: String(error) });\n return c.json({ error: 'Internal server error' }, 500);\n }\n});`;\n }\n\n return `// Auto-generated Lambda handler for flow: ${flow.id}\n// DO NOT EDIT -- regenerate from source YAML.\n\nimport { Hono } from 'hono';\nimport { executeFlow } from './flow';\nimport { CapabilityRegistry, registerAllCapabilities } from '@stackwright-services/capabilities';\nimport type { CapabilityContext } from '@stackwright-services/capabilities';\n\n// Initialize registry with all built-in capabilities\nconst registry = new CapabilityRegistry();\nregisterAllCapabilities(registry);\n\nconst app = new Hono();\n\n// Health check\napp.get('/health', (c) => c.json({ status: 'ok', flow: '${flow.id}' }));\n${routeSetup}\n\nfunction createContext(c: any): CapabilityContext {\n return {\n traceId: c.req.header('x-trace-id') ?? crypto.randomUUID(),\n logger: {\n debug: (msg: string, data?: Record<string, unknown>) => console.debug(JSON.stringify({ level: 'debug', msg, ...data })),\n info: (msg: string, data?: Record<string, unknown>) => console.info(JSON.stringify({ level: 'info', msg, ...data })),\n warn: (msg: string, data?: Record<string, unknown>) => console.warn(JSON.stringify({ level: 'warn', msg, ...data })),\n error: (msg: string, data?: Record<string, unknown>) => console.error(JSON.stringify({ level: 'error', msg, ...data })),\n },\n };\n}\n\nfunction getObservabilityProvider() {\n // No-op provider by default -- swap with OTel provider when configured\n return {\n startSpan: () => ({\n setAttribute: () => {},\n setError: () => {},\n end: () => {},\n }),\n recordMetric: () => {},\n };\n}\n\nexport default app;\n`;\n}\n\nfunction generateDockerfile(flow: FlowDefinition): string {\n return `# Auto-generated Dockerfile for flow: ${flow.id}\n# Uses AWS Lambda Web Adapter for Hono compatibility\n# DO NOT EDIT -- regenerate from source YAML.\n\nFROM public.ecr.aws/docker/library/node:22-slim AS builder\n\nWORKDIR /app\nCOPY package.json ./\nRUN npm install --production=false\nCOPY . .\nRUN npm run build\n\nFROM public.ecr.aws/docker/library/node:22-slim AS runner\n\n# Install AWS Lambda Web Adapter\nCOPY --from=public.ecr.aws/awsguru/aws-lambda-web-adapter:0.8.4 /lambda-adapter /opt/extensions/lambda-adapter\n\nWORKDIR /app\nCOPY --from=builder /app/dist ./dist\nCOPY --from=builder /app/node_modules ./node_modules\nCOPY --from=builder /app/package.json ./\n\nENV PORT=8080\nENV AWS_LWA_PORT=8080\nENV NODE_ENV=production\n\nCMD [\"node\", \"dist/handler.js\"]\n`;\n}\n\nfunction generatePackageJson(flow: FlowDefinition): string {\n return (\n JSON.stringify(\n {\n name: `${flow.id}-lambda`,\n version: '0.0.1',\n private: true,\n scripts: {\n build: 'tsc',\n start: 'node dist/handler.js',\n },\n dependencies: {\n hono: '^4',\n '@stackwright-services/capabilities': 'workspace:',\n },\n devDependencies: {\n typescript: '^6',\n },\n },\n null,\n 2,\n ) + '\\n'\n );\n}\n\n/*\n Return additional IAM policy statements required by the trigger type.\n * These are merged with capability-derived permissions at compile time.\n /\nexport function getTriggerPermissions(trigger: Trigger): object[] {\n switch (trigger.type) {\n case 'event':\n return [\n {\n Effect: 'Allow',\n Action: ['sns:Subscribe', 'sns:Unsubscribe'],\n Resource: '${TOPIC_ARN}',\n },\n ];\n case 'schedule':\n return [\n {\n Effect: 'Allow',\n Action: ['events:PutRule', 'events:PutTargets', 'events:DeleteRule'],\n Resource: '',\n },\n ];\n case 'queue':\n return [\n {\n Effect: 'Allow',\n Action: ['sqs:ReceiveMessage', 'sqs:DeleteMessage', 'sqs:GetQueueAttributes'],\n Resource: '${QUEUE_ARN}',\n },\n ];\n case 'http':\n default:\n return [];\n }\n}\n\n/*\n Generate IAM policy JSON merging capability-derived permissions with\n * trigger-specific permissions.\n /\nfunction generateIamPolicy(trigger: Trigger, permissions: DerivedPermissions): string {\n const base = toIamPolicy(permissions) as { Version: string; Statement: object[] };\n const triggerStatements = getTriggerPermissions(trigger);\n base.Statement = [...base.Statement, ...triggerStatements];\n return JSON.stringify(base, null, 2) + '\\n';\n}\n\n/\n Generate trigger-specific infrastructure configuration files.\n * HTTP triggers need none; event/schedule/queue each get a config artifact.\n /\nfunction generateTriggerFiles(flow: FlowDefinition): Record<string, string> {\n const trigger = flow.trigger;\n\n switch (trigger.type) {\n case 'event': {\n const source = trigger.source.replace(/^bus:/, '');\n return {\n 'sns-subscription.json':\n JSON.stringify(\n {\n _comment: `Auto-generated SNS subscription for flow: ${flow.id}. Bind TOPIC_ARN and FUNCTION_ARN at deploy time.`,\n TopicArn: '${TOPIC_ARN}',\n Protocol: 'lambda',\n Endpoint: '${FUNCTION_ARN}',\n Attributes: {\n RawMessageDelivery: 'true',\n },\n source,\n },\n null,\n 2,\n ) + '\\n',\n };\n }\n case 'schedule':\n return {\n 'eventbridge-rule.json':\n JSON.stringify(\n {\n _comment: `Auto-generated EventBridge rule for flow: ${flow.id}. Bind FUNCTION_ARN at deploy time.`,\n Name: `${flow.id}-schedule`,\n ScheduleExpression: `cron(${trigger.cron})`,\n State: 'ENABLED',\n Targets: [\n {\n Id: `${flow.id}-target`,\n Arn: '${FUNCTION_ARN}',\n },\n ],\n },\n null,\n 2,\n ) + '\\n',\n };\n case 'queue':\n return {\n 'sqs-event-source-mapping.json':\n JSON.stringify(\n {\n _comment: `Auto-generated SQS event source mapping for flow: ${flow.id}. Bind QUEUE_ARN and FUNCTION_ARN at deploy time.`,\n EventSourceArn: '${QUEUE_ARN}',\n FunctionName: '${FUNCTION_ARN}',\n BatchSize: 10,\n Enabled: true,\n queueName: trigger.name,\n },\n null,\n 2,\n ) + '\\n',\n };\n case 'http':\n default:\n return {};\n }\n}\n","import type { FlowDefinition, Trigger } from '@stackwright-services/types';\nimport type { DerivedPermissions } from '../permissions';\nimport { toRbacRules } from '../permissions';\n\n/\n Output files generated by the Helm compile target.\n /\nexport interface HelmTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Compile a flow definition to Helm chart output.\n \n Generates a complete Helm chart compatible with the Defense Unicorns ecosystem.\n /\nexport function compileHelmTarget(\n flow: FlowDefinition,\n permissions: DerivedPermissions,\n): HelmTarget {\n const files: Record<string, string> = {};\n const chartName = sanitizeChartName(flow.id);\n const trigger = flow.trigger;\n\n // Common files for all trigger types\n files['Chart.yaml'] = generateChartYaml(chartName, flow);\n files['values.yaml'] = generateValuesYaml(chartName, flow);\n files['templates/service.yaml'] = generateServiceYaml(chartName);\n files['templates/serviceaccount.yaml'] = generateServiceAccountYaml(chartName);\n files['templates/_helpers.tpl'] = generateHelpersTpl(chartName);\n\n // Trigger-specific templates\n if (trigger.type === 'schedule') {\n // CronJob replaces Deployment; no Ingress for scheduled flows\n files['templates/cronjob.yaml'] = generateCronJobYaml(chartName, trigger.cron);\n } else {\n // All other trigger types use a Deployment\n files['templates/deployment.yaml'] = generateDeploymentYaml(chartName, trigger);\n // Only HTTP triggers get an Ingress — non-HTTP have no inbound traffic\n if (trigger.type === 'http') {\n files['templates/ingress.yaml'] = generateIngressYaml(chartName);\n }\n }\n\n // Event trigger: bus-config ConfigMap\n if (trigger.type === 'event') {\n files['templates/bus-subscription.yaml'] = generateBusConfigYaml(chartName, trigger.source);\n }\n\n // Queue trigger: queue-config ConfigMap\n if (trigger.type === 'queue') {\n files['templates/queue-config.yaml'] = generateQueueConfigYaml(chartName, trigger.name);\n }\n\n if (permissions.permissions.length > 0) {\n files['templates/rbac.yaml'] = generateRbacYaml(chartName, permissions);\n }\n\n return { files };\n}\n\nexport function sanitizeChartName(name: string): string {\n return name\n .replace(/[^a-z0-9-]/g, '-')\n .replace(/-+/g, '-')\n .replace(/^-\|-$/g, '');\n}\n\nfunction generateChartYaml(chartName: string, flow: FlowDefinition): string {\n return `# Auto-generated Helm chart for flow: ${flow.id}\n# Defense Unicorns compatible\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: v2\nname: ${chartName}\ndescription: ${flow.description}\ntype: application\nversion: 0.1.0\nappVersion: \"0.0.1\"\n`;\n}\n\nfunction generateValuesYaml(chartName: string, flow: FlowDefinition): string {\n const trigger = flow.trigger;\n\n let triggerValues = '';\n if (trigger.type === 'event') {\n const topic = trigger.source.replace(/^bus:/, '').toUpperCase().replace(/-/g, '_');\n triggerValues = `\n# Event trigger configuration\ntrigger:\n type: \"event\"\n busTopicArn: \"\\${BUS_TOPIC_${topic}_ARN}\"\n`;\n } else if (trigger.type === 'schedule') {\n triggerValues = `\n# Schedule trigger configuration\ntrigger:\n type: \"schedule\"\n schedule: \"${trigger.cron}\"\n`;\n } else if (trigger.type === 'queue') {\n const queueKey = trigger.name.toUpperCase().replace(/-/g, '_');\n triggerValues = `\n# Queue trigger configuration\ntrigger:\n type: \"queue\"\n queueUrl: \"\\${BUS_QUEUE_${queueKey}_URL}\"\n`;\n }\n\n // Only include ingress section for HTTP triggers\n const ingressSection =\n trigger.type === 'http'\n ? `\ningress:\n enabled: false\n className: \"\"\n annotations: {}\n hosts:\n - host: ${chartName}.local\n paths:\n - path: /\n pathType: ImplementationSpecific\n tls: []\n`\n : '';\n\n return `# Default values for ${chartName}\n# DO NOT EDIT -- regenerate from source YAML.\n\nreplicaCount: 1\n\nimage:\n repository: \"\"\n tag: \"latest\"\n pullPolicy: IfNotPresent\n\nimagePullSecrets: []\n\nserviceAccount:\n create: true\n name: \"\"\n annotations: {}\n\nservice:\n type: ClusterIP\n port: 8080\n${ingressSection}\nresources:\n limits:\n cpu: 500m\n memory: 256Mi\n requests:\n cpu: 100m\n memory: 128Mi\n\nenv: []\n\nnodeSelector: {}\ntolerations: []\naffinity: {}\n\n# Flow metadata\nflow:\n id: \"${flow.id}\"\n description: \"${flow.description}\"\n${triggerValues}`;\n}\n\nfunction generateDeploymentYaml(chartName: string, trigger: Trigger): string {\n let annotations = '';\n if (trigger.type === 'event') {\n annotations = ` annotations:\n stackwright.io/trigger-type: event\n stackwright.io/bus-topic: \"${trigger.source.replace(/^bus:/, '')}\"\n`;\n } else if (trigger.type === 'queue') {\n annotations = ` annotations:\n stackwright.io/trigger-type: queue\n stackwright.io/queue-name: \"${trigger.name}\"\n`;\n }\n\n return `# Auto-generated Deployment for ${chartName}\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\n${annotations}spec:\n replicas: {{ .Values.replicaCount }}\n selector:\n matchLabels:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 6 }}\n template:\n metadata:\n labels:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 8 }}\n spec:\n {{- with .Values.imagePullSecrets }}\n imagePullSecrets:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n serviceAccountName: {{ include \"${chartName}.serviceAccountName\" . }}\n containers:\n - name: {{ .Chart.Name }}\n image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n imagePullPolicy: {{ .Values.image.pullPolicy }}\n ports:\n - name: http\n containerPort: 8080\n protocol: TCP\n livenessProbe:\n httpGet:\n path: /health\n port: http\n initialDelaySeconds: 5\n periodSeconds: 10\n readinessProbe:\n httpGet:\n path: /health\n port: http\n initialDelaySeconds: 5\n periodSeconds: 10\n resources:\n {{- toYaml .Values.resources \| nindent 12 }}\n env:\n - name: PORT\n value: \"8080\"\n - name: NODE_ENV\n value: \"production\"\n - name: FLOW_ID\n value: {{ .Values.flow.id \| quote }}\n {{- with .Values.env }}\n {{- toYaml . \| nindent 12 }}\n {{- end }}\n {{- with .Values.nodeSelector }}\n nodeSelector:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n {{- with .Values.tolerations }}\n tolerations:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n {{- with .Values.affinity }}\n affinity:\n {{- toYaml . \| nindent 8 }}\n {{- end }}\n`;\n}\n\nfunction generateServiceYaml(chartName: string): string {\n return `# Auto-generated Service for ${chartName}\napiVersion: v1\nkind: Service\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nspec:\n type: {{ .Values.service.type }}\n ports:\n - port: {{ .Values.service.port }}\n targetPort: http\n protocol: TCP\n name: http\n selector:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 4 }}\n`;\n}\n\nfunction generateIngressYaml(chartName: string): string {\n return `# Auto-generated Ingress for ${chartName}\n{{- if .Values.ingress.enabled }}\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\n {{- with .Values.ingress.annotations }}\n annotations:\n {{- toYaml . \| nindent 4 }}\n {{- end }}\nspec:\n {{- if .Values.ingress.className }}\n ingressClassName: {{ .Values.ingress.className }}\n {{- end }}\n {{- if .Values.ingress.tls }}\n tls:\n {{- range .Values.ingress.tls }}\n - hosts:\n {{- range .hosts }}\n - {{ . \| quote }}\n {{- end }}\n secretName: {{ .secretName }}\n {{- end }}\n {{- end }}\n rules:\n {{- range .Values.ingress.hosts }}\n - host: {{ .host \| quote }}\n http:\n paths:\n {{- range .paths }}\n - path: {{ .path }}\n pathType: {{ .pathType }}\n backend:\n service:\n name: {{ include \"${chartName}.fullname\" $ }}\n port:\n name: http\n {{- end }}\n {{- end }}\n{{- end }}\n`;\n}\n\nfunction generateServiceAccountYaml(chartName: string): string {\n return `# Auto-generated ServiceAccount for ${chartName}\n{{- if .Values.serviceAccount.create }}\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: {{ include \"${chartName}.serviceAccountName\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\n {{- with .Values.serviceAccount.annotations }}\n annotations:\n {{- toYaml . \| nindent 4 }}\n {{- end }}\n{{- end }}\n`;\n}\n\nfunction generateHelpersTpl(chartName: string): string {\n return `{{/\nAuto-generated helpers for ${chartName}\n/}}\n\n{{- define \"${chartName}.name\" -}}\n{{- default .Chart.Name .Values.nameOverride \| trunc 63 \| trimSuffix \"-\" }}\n{{- end }}\n\n{{- define \"${chartName}.fullname\" -}}\n{{- if .Values.fullnameOverride }}\n{{- .Values.fullnameOverride \| trunc 63 \| trimSuffix \"-\" }}\n{{- else }}\n{{- $name := default .Chart.Name .Values.nameOverride }}\n{{- if contains $name .Release.Name }}\n{{- .Release.Name \| trunc 63 \| trimSuffix \"-\" }}\n{{- else }}\n{{- printf \"%s-%s\" .Release.Name $name \| trunc 63 \| trimSuffix \"-\" }}\n{{- end }}\n{{- end }}\n{{- end }}\n\n{{- define \"${chartName}.labels\" -}}\nhelm.sh/chart: {{ include \"${chartName}.name\" . }}-{{ .Chart.Version \| replace \"+\" \"_\" }}\n{{ include \"${chartName}.selectorLabels\" . }}\napp.kubernetes.io/managed-by: {{ .Release.Service }}\napp.kubernetes.io/part-of: stackwright-services\n{{- end }}\n\n{{- define \"${chartName}.selectorLabels\" -}}\napp.kubernetes.io/name: {{ include \"${chartName}.name\" . }}\napp.kubernetes.io/instance: {{ .Release.Name }}\n{{- end }}\n\n{{- define \"${chartName}.serviceAccountName\" -}}\n{{- if .Values.serviceAccount.create }}\n{{- default (include \"${chartName}.fullname\" .) .Values.serviceAccount.name }}\n{{- else }}\n{{- default \"default\" .Values.serviceAccount.name }}\n{{- end }}\n{{- end }}\n`;\n}\n\nfunction generateCronJobYaml(chartName: string, cron: string): string {\n return `# Auto-generated CronJob for ${chartName}\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: batch/v1\nkind: CronJob\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nspec:\n schedule: \"${cron}\"\n concurrencyPolicy: Forbid\n successfulJobsHistoryLimit: 3\n failedJobsHistoryLimit: 3\n jobTemplate:\n spec:\n template:\n metadata:\n labels:\n {{- include \"${chartName}.selectorLabels\" . \| nindent 12 }}\n spec:\n serviceAccountName: {{ include \"${chartName}.serviceAccountName\" . }}\n containers:\n - name: {{ .Chart.Name }}\n image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n imagePullPolicy: {{ .Values.image.pullPolicy }}\n env:\n - name: PORT\n value: \"8080\"\n - name: NODE_ENV\n value: \"production\"\n - name: TRIGGER_MODE\n value: \"schedule\"\n - name: FLOW_ID\n value: {{ .Values.flow.id \| quote }}\n {{- with .Values.env }}\n {{- toYaml . \| nindent 16 }}\n {{- end }}\n resources:\n {{- toYaml .Values.resources \| nindent 16 }}\n restartPolicy: OnFailure\n`;\n}\n\nfunction generateBusConfigYaml(chartName: string, source: string): string {\n const topic = source.replace(/^bus:/, '');\n return `# Auto-generated bus subscription config for ${chartName}\n# The concrete subscription mechanism depends on the cluster's message bus operator.\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}-bus-config\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\ndata:\n trigger-type: \"event\"\n bus-topic: \"${topic}\"\n source: \"${source}\"\n`;\n}\n\nfunction generateQueueConfigYaml(chartName: string, queueName: string): string {\n return `# Auto-generated queue config for ${chartName}\n# The concrete queue binding depends on the cluster's message bus operator.\n# DO NOT EDIT -- regenerate from source YAML.\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}-queue-config\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\ndata:\n trigger-type: \"queue\"\n queue-name: \"${queueName}\"\n`;\n}\n\nfunction generateRbacYaml(chartName: string, permissions: DerivedPermissions): string {\n const rules = toRbacRules(permissions) as Array<{\n apiGroups: string[];\n resources: string[];\n verbs: string[];\n }>;\n const rulesYaml = rules\n .map(\n (r) =>\n ` - apiGroups: [${r.apiGroups.map((g) => `\"${g}\"`).join(', ')}]\\n resources: [${r.resources.map((res) => `\"${res}\"`).join(', ')}]\\n verbs: [${r.verbs.map((v) => `\"${v}\"`).join(', ')}]`,\n )\n .join('\\n');\n\n return `# Auto-generated RBAC for ${chartName}\n# Derived from least-privilege permission analysis\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nrules:\n${rulesYaml}\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: {{ include \"${chartName}.fullname\" . }}\n labels:\n {{- include \"${chartName}.labels\" . \| nindent 4 }}\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: {{ include \"${chartName}.fullname\" . }}\nsubjects:\n - kind: ServiceAccount\n name: {{ include \"${chartName}.serviceAccountName\" . }}\n namespace: {{ .Release.Namespace }}\n`;\n}\n","import type {\n PredicateCondition,\n WorkflowDefinition,\n WorkflowState,\n WorkflowTransition,\n} from '@stackwright-services/types';\nimport type { DerivedPermissions } from '../permissions';\nimport { toStepFunctionsIamPolicy } from '../permissions';\nimport {\n generateInstrumentedStateHandlerCode,\n generateWorkflowInstrumentation,\n} from '../workflow-observability';\n\n/\n Output files generated by the Step Functions compile target.\n /\nexport interface StepFunctionsTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Compile a workflow definition to AWS Step Functions target output.\n \n Generates:\n * - asl-definition.json: Step Functions state machine definition in ASL\n * - iam-execution-role.json: IAM policy for the execution role\n * - handlers/<state>.ts: Lambda handler stubs for each state with on_enter\n * - package.json: Minimal package for the handlers\n /\nexport function compileStepFunctionsTarget(\n workflow: WorkflowDefinition,\n permissions: DerivedPermissions,\n): StepFunctionsTarget {\n const files: Record<string, string> = {};\n\n // 1. ASL state machine definition\n const asl = generateAslDefinition(workflow);\n files['asl-definition.json'] = JSON.stringify(asl, null, 2);\n\n // 2. IAM execution role policy\n files['iam-execution-role.json'] = JSON.stringify(\n toStepFunctionsIamPolicy(workflow, permissions),\n null,\n 2,\n );\n\n // 3. Per-state Lambda handler stubs (with observability instrumentation)\n for (const inst of generateWorkflowInstrumentation(workflow)) {\n const params = workflow.states[inst.stateName]?.on_enter?.with ?? {};\n files[`handlers/${inst.stateName}.ts`] = generateInstrumentedStateHandlerCode(inst, params);\n }\n\n // 4. Package manifest for the handlers\n files['package.json'] = generatePackageJson(workflow);\n\n return { files };\n}\n\n// ---------------------------------------------------------------------------\n// ASL Definition\n// ---------------------------------------------------------------------------\n\nfunction generateAslDefinition(workflow: WorkflowDefinition): Record<string, unknown> {\n const states: Record<string, unknown> = {};\n\n for (const [name, state] of Object.entries(workflow.states)) {\n Object.assign(states, generateAslStates(name, state, workflow));\n }\n\n const definition: Record<string, unknown> = {\n Comment: `Stackwright workflow: ${workflow.description}`,\n StartAt: workflow.initial,\n States: states,\n };\n\n if (workflow.timeouts?.absolute) {\n definition['TimeoutSeconds'] = iso8601ToSeconds(workflow.timeouts.absolute);\n }\n\n return definition;\n}\n\n/\n Generate one or more ASL states for a single workflow state.\n \n A single workflow state may expand into multiple ASL states\n * (e.g. Task + Choice, or Task + Succeed).\n \n Mapping rules:\n * Terminal + on_enter → Task → Succeed\n * Terminal + no on_enter → Succeed\n * Non-terminal + on_enter + 1 uncond. trans. → Task + Next\n * Non-terminal + on_enter + multi/cond. → Task → Choice\n * Non-terminal + no on_enter + transitions → Choice\n /\nfunction generateAslStates(\n name: string,\n state: WorkflowState,\n workflow: WorkflowDefinition,\n): Record<string, unknown> {\n const isTerminal = state.type === 'terminal';\n const hasOnEnter = !!state.on_enter;\n const transitions = state.transitions ?? [];\n\n // Terminal + on_enter → Task → generated Succeed\n if (isTerminal && hasOnEnter) {\n const succeedName = `${name}__succeed`;\n return {\n [name]: buildTaskState(workflow.id, name, succeedName),\n [succeedName]: { Type: 'Succeed' },\n };\n }\n\n // Terminal + no on_enter → plain Succeed\n if (isTerminal) {\n return { [name]: { Type: 'Succeed' } };\n }\n\n // Non-terminal with no transitions → dead-end (edge case)\n if (transitions.length === 0) {\n return hasOnEnter\n ? { [name]: buildTaskState(workflow.id, name) }\n : { [name]: { Type: 'Pass', End: true } };\n }\n\n // Single unconditional transition (no `when` predicate)\n const first = transitions[0];\n if (transitions.length === 1 && first && !first.when) {\n return hasOnEnter\n ? { [name]: buildTaskState(workflow.id, name, first.to) }\n : { [name]: { Type: 'Pass', Next: first.to } };\n }\n\n // Multiple or conditional transitions → Choice state\n if (hasOnEnter) {\n const choiceName = `${name}__choice`;\n return {\n [name]: buildTaskState(workflow.id, name, choiceName),\n [choiceName]: buildChoiceState(transitions),\n };\n }\n\n return { [name]: buildChoiceState(transitions) };\n}\n\n// ---------------------------------------------------------------------------\n// Task state builder\n// ---------------------------------------------------------------------------\n\nfunction buildTaskState(\n workflowId: string,\n stateName: string,\n next?: string,\n): Record<string, unknown> {\n const task: Record<string, unknown> = {\n Type: 'Task',\n Resource: 'arn:aws:states:::lambda:invoke',\n Parameters: {\n FunctionName: `${workflowId}-${stateName}`,\n 'Payload.$': '$',\n },\n };\n\n if (next) {\n task['Next'] = next;\n } else {\n task['End'] = true;\n }\n\n return task;\n}\n\n// ---------------------------------------------------------------------------\n// Choice state builder\n// ---------------------------------------------------------------------------\n\nfunction buildChoiceState(transitions: WorkflowTransition[]): Record<string, unknown> {\n const choices: object[] = [];\n let defaultTarget: string \| undefined;\n\n // Last transition without `when` becomes the Choice Default.\n const lastNoWhenIdx = findLastIndex(transitions, (t) => !t.when);\n\n for (const [i, t] of transitions.entries()) {\n if (i === lastNoWhenIdx) {\n defaultTarget = t.to;\n continue;\n }\n choices.push(transitionToChoiceRule(t));\n }\n\n const choiceState: Record<string, unknown> = {\n Type: 'Choice',\n Choices: choices,\n };\n\n if (defaultTarget) {\n choiceState['Default'] = defaultTarget;\n }\n\n return choiceState;\n}\n\nfunction transitionToChoiceRule(transition: WorkflowTransition): object {\n const signalCheck = { Variable: '$.signal', StringEquals: transition.on };\n\n if (!transition.when \|\| transition.when.length === 0) {\n return { ...signalCheck, Next: transition.to };\n }\n\n return {\n And: [signalCheck, ...transition.when.map(predicateToChoiceRule)],\n Next: transition.to,\n };\n}\n\n// ---------------------------------------------------------------------------\n// Predicate → ASL Choice Rule mapping\n// ---------------------------------------------------------------------------\n\nfunction predicateToChoiceRule(predicate: PredicateCondition): object {\n const variable = `$.${predicate.field}`;\n\n switch (predicate.op) {\n case 'equals':\n return buildEqualsRule(variable, predicate.value);\n case 'not_equals':\n return { Not: buildEqualsRule(variable, predicate.value) };\n case 'less_than':\n return { Variable: variable, NumericLessThan: predicate.value };\n case 'greater_than':\n return { Variable: variable, NumericGreaterThan: predicate.value };\n case 'less_than_or_equal':\n return { Variable: variable, NumericLessThanEquals: predicate.value };\n case 'greater_than_or_equal':\n return { Variable: variable, NumericGreaterThanEquals: predicate.value };\n case 'matches_prefix':\n return { Variable: variable, StringMatches: `${String(predicate.value)}` };\n case 'contains':\n return { Variable: variable, StringMatches: `${String(predicate.value)}` };\n case 'in':\n return buildInRule(variable, predicate.value);\n case 'not_in':\n return { Not: buildInRule(variable, predicate.value) };\n case 'less_than_field':\n case 'greater_than_field':\n case 'equals_field':\n case 'not_equals_field':\n case 'less_than_or_equal_field':\n case 'greater_than_or_equal_field':\n // Field-comparison operators aren't natively supported in ASL Choice rules.\n // Fall back to a Pass state with a comment for manual handling.\n return { Variable: variable, StringEquals: `__UNSUPPORTED_FIELD_OP_${predicate.op}__` };\n }\n}\n\nfunction buildEqualsRule(variable: string, value: unknown): object {\n if (typeof value === 'string') return { Variable: variable, StringEquals: value };\n if (typeof value === 'number') return { Variable: variable, NumericEquals: value };\n if (typeof value === 'boolean') return { Variable: variable, BooleanEquals: value };\n return { Variable: variable, StringEquals: String(value) };\n}\n\nfunction buildInRule(variable: string, value: unknown): object {\n if (!Array.isArray(value)) return buildEqualsRule(variable, value);\n return { Or: value.map((v) => buildEqualsRule(variable, v)) };\n}\n\n// ---------------------------------------------------------------------------\n// ISO 8601 duration → seconds\n// ---------------------------------------------------------------------------\n\n/*\n Convert an ISO 8601 duration string to seconds.\n \n Uses calendar approximations: 1 year = 365 days, 1 month = 30 days.\n \n @example\n * iso8601ToSeconds('P3D') // → 259200\n * iso8601ToSeconds('PT1H') // → 3600\n * iso8601ToSeconds('PT30M') // → 1800\n /\nexport function iso8601ToSeconds(duration: string): number {\n const match = duration.match(\n /^P(?:(\\d+)Y)?(?:(\\d+)M)?(?:(\\d+)W)?(?:(\\d+)D)?(?:T(?:(\\d+)H)?(?:(\\d+)M)?(?:(\\d+)S)?)?$/,\n );\n if (!match) {\n throw new Error(`Invalid ISO 8601 duration: ${duration}`);\n }\n\n const [, years, months, weeks, days, hours, minutes, seconds] = match;\n\n let total = 0;\n if (years) total += parseInt(years, 10) 365 * 86_400;\n if (months) total += parseInt(months, 10) * 30 * 86_400;\n if (weeks) total += parseInt(weeks, 10) * 7 * 86_400;\n if (days) total += parseInt(days, 10) * 86_400;\n if (hours) total += parseInt(hours, 10) * 3_600;\n if (minutes) total += parseInt(minutes, 10) * 60;\n if (seconds) total += parseInt(seconds, 10);\n\n return total;\n}\n\n// ---------------------------------------------------------------------------\n// package.json generation\n// ---------------------------------------------------------------------------\n\nfunction generatePackageJson(workflow: WorkflowDefinition): string {\n return (\n JSON.stringify(\n {\n name: `${workflow.id}-stepfunctions`,\n version: '0.0.1',\n private: true,\n scripts: {\n build: 'tsc',\n },\n dependencies: {\n '@stackwright-services/capabilities': 'workspace:',\n },\n devDependencies: {\n '@types/aws-lambda': '^8',\n typescript: '^6',\n },\n },\n null,\n 2,\n ) + '\\n'\n );\n}\n\n// ---------------------------------------------------------------------------\n// Utilities\n// ---------------------------------------------------------------------------\n\nfunction findLastIndex<T>(arr: readonly T[], predicate: (item: T) => boolean): number {\n for (let i = arr.length - 1; i >= 0; i--) {\n if (predicate(arr[i] as T)) return i;\n }\n return -1;\n}\n","import type { FlowDefinition, HttpTrigger } from '@stackwright-services/types';\n\n/\n Output from the OpenAPI spec compile target.\n /\nexport interface OpenApiTarget {\n /* Generated files, keyed by relative path /\n files: Record<string, string>;\n}\n\n/\n Options for OpenAPI spec generation.\n /\nexport interface OpenApiTargetOptions {\n /* Optional build key to include as an apiKey security scheme /\n buildKey?: string;\n /* Optional server URL for the spec /\n serverUrl?: string;\n /* Optional version string (defaults to \"0.0.1\") /\n version?: string;\n}\n\n/\n Compile an HTTP-triggered flow definition to an OpenAPI 3.1 specification.\n \n This is the bridge between Services and Pro: the generated spec is consumed\n * by Pro's existing OpenAPI parser to produce typed Pulse clients.\n \n For non-HTTP triggers, returns an empty target (no spec to generate).\n * AsyncAPI for event-driven flows is future work.\n \n @returns OpenApiTarget with openapi.yaml content, or empty files for non-HTTP triggers\n /\nexport function compileOpenApiTarget(\n flow: FlowDefinition,\n options: OpenApiTargetOptions = {},\n): OpenApiTarget {\n if (flow.trigger.type !== 'http') {\n return { files: {} };\n }\n\n const trigger = flow.trigger as HttpTrigger;\n const version = options.version ?? '0.0.1';\n\n const spec = buildOpenApiSpec(flow, trigger, version, options);\n\n return {\n files: {\n 'openapi.yaml': serializeYaml(spec),\n },\n };\n}\n\n// ─── Spec construction ───────────────────────────────────────────────────\n\nfunction buildOpenApiSpec(\n flow: FlowDefinition,\n trigger: HttpTrigger,\n version: string,\n options: OpenApiTargetOptions,\n): OpenApiSpec {\n const operationId = generateOperationId(flow.id, trigger.method);\n\n const spec: OpenApiSpec = {\n openapi: '3.1.0',\n info: {\n title: flow.id,\n description: flow.description,\n version,\n },\n paths: {\n [trigger.path]: {\n [trigger.method.toLowerCase()]: {\n operationId,\n summary: flow.description,\n ...(trigger.method === 'GET'\n ? { parameters: buildQueryParameters(trigger) }\n : { requestBody: buildRequestBody(trigger) }),\n responses: buildResponses(trigger),\n },\n },\n },\n };\n\n // Add server URL if provided\n if (options.serverUrl) {\n spec.servers = [{ url: options.serverUrl }];\n }\n\n // Add build-coherence key as security scheme\n if (options.buildKey) {\n spec.components = {\n ...spec.components,\n securitySchemes: {\n buildKey: {\n type: 'apiKey',\n in: 'header',\n name: 'x-stackwright-build-key',\n description:\n 'Build-coherence key. Auto-generated at compile time. Ensures frontend/backend version match.',\n },\n },\n };\n spec.security = [{ buildKey: [] }];\n\n // Extension with the actual key value so Pro's OpenAPI parser\n // can embed it in the generated Pulse client\n spec['x-stackwright-build-key'] = options.buildKey;\n }\n\n // Add schemas for input/output (placeholders referencing Zod schema names)\n spec.components = {\n ...spec.components,\n schemas: {\n [trigger.input_schema]: {\n type: 'object',\n description: `Input schema: ${trigger.input_schema} (resolve from Zod schema at build time)`,\n },\n [trigger.output_schema]: {\n type: 'object',\n description: `Output schema: ${trigger.output_schema} (resolve from Zod schema at build time)`,\n },\n },\n };\n\n return spec;\n}\n\n/\n Generate an operationId from flow ID and HTTP method.\n * e.g., \"at-risk-evacuation-patients\" + \"GET\" → \"getAtRiskEvacuationPatients\"\n /\nfunction generateOperationId(flowId: string, method: string): string {\n const camelCase = flowId\n .replace(/[^a-zA-Z0-9]+(.)/g, (_, ch: string) => ch.toUpperCase())\n .replace(/^[A-Z]/, (ch) => ch.toLowerCase());\n const prefix = method.toLowerCase();\n return `${prefix}${camelCase.charAt(0).toUpperCase()}${camelCase.slice(1)}`;\n}\n\nfunction buildQueryParameters(trigger: HttpTrigger): OpenApiParameter[] {\n return [\n {\n name: trigger.input_schema,\n in: 'query',\n description: `Query parameters per ${trigger.input_schema} schema`,\n required: false,\n schema: { $ref: `#/components/schemas/${trigger.input_schema}` },\n },\n ];\n}\n\nfunction buildRequestBody(trigger: HttpTrigger): OpenApiRequestBody {\n return {\n required: true,\n content: {\n 'application/json': {\n schema: { $ref: `#/components/schemas/${trigger.input_schema}` },\n },\n },\n };\n}\n\nfunction buildResponses(trigger: HttpTrigger): Record<string, OpenApiResponse> {\n return {\n '200': {\n description: 'Successful response',\n content: {\n 'application/json': {\n schema: { $ref: `#/components/schemas/${trigger.output_schema}` },\n },\n },\n },\n '400': {\n description: 'Validation error',\n content: {\n 'application/json': {\n schema: {\n type: 'object',\n properties: {\n error: { type: 'string' },\n code: { type: 'string' },\n details: { type: 'object' },\n },\n },\n },\n },\n },\n '500': {\n description: 'Internal server error',\n content: {\n 'application/json': {\n schema: {\n type: 'object',\n properties: {\n error: { type: 'string' },\n code: { type: 'string' },\n },\n },\n },\n },\n },\n };\n}\n\n// ─── Minimal YAML serializer ─────────────────────────────────────────────\n// We emit YAML by hand to avoid a dependency on js-yaml. The spec structure\n// is predictable and shallow enough for a recursive serializer.\n\nfunction serializeYaml(obj: unknown, indent: number = 0): string {\n const pad = ' '.repeat(indent);\n\n if (obj === null \|\| obj === undefined) return 'null';\n if (typeof obj === 'string') {\n if (needsQuoting(obj)) {\n return `'${obj.replace(/'/g, \"''\")}'`;\n }\n return obj;\n }\n if (typeof obj === 'number' \|\| typeof obj === 'boolean') return String(obj);\n\n if (Array.isArray(obj)) {\n if (obj.length === 0) return '[]';\n return obj\n .map((item) => {\n if (typeof item === 'object' && item !== null) {\n const inner = serializeYaml(item, indent + 1);\n const lines = inner.split('\\n');\n const firstLine = lines[0] ?? '';\n return `${pad}- ${firstLine.trimStart()}\\n${lines.slice(1).join('\\n')}`.trimEnd();\n }\n return `${pad}- ${serializeYaml(item)}`;\n })\n .join('\\n');\n }\n\n if (typeof obj === 'object') {\n const entries = Object.entries(obj as Record<string, unknown>);\n if (entries.length === 0) return '{}';\n return entries\n .map(([key, val]) => {\n const safeKey = keyNeedsQuoting(key) ? `'${key}'` : key;\n if (\n typeof val === 'object' &&\n val !== null &&\n !Array.isArray(val) &&\n Object.keys(val as object).length > 0\n ) {\n return `${pad}${safeKey}:\\n${serializeYaml(val, indent + 1)}`;\n }\n if (Array.isArray(val)) {\n if (val.length === 0) return `${pad}${safeKey}: []`;\n return `${pad}${safeKey}:\\n${serializeYaml(val, indent + 1)}`;\n }\n return `${pad}${safeKey}: ${serializeYaml(val)}`;\n })\n .join('\\n');\n }\n\n return String(obj);\n}\n\nfunction needsQuoting(str: string): boolean {\n return /[:{},&#?\|<>=!%@`\\n[\\]]/.test(str) \|\| str === '' \|\| str === 'true' \|\| str === 'false';\n}\n\nfunction keyNeedsQuoting(key: string): boolean {\n // Quote keys that YAML would parse as non-string types\n return /^\\d+$/.test(key) \|\| key === 'true' \|\| key === 'false' \|\| key === 'null' \|\| key === '';\n}\n\n// ─── Type definitions ────────────────────────────────────────────────────\n\ninterface OpenApiSpec {\n openapi: string;\n info: { title: string; description: string; version: string };\n servers?: Array<{ url: string }>;\n paths: Record<string, Record<string, unknown>>;\n components?: {\n schemas?: Record<string, unknown>;\n securitySchemes?: Record<string, unknown>;\n };\n security?: Array<Record<string, string[]>>;\n 'x-stackwright-build-key'?: string;\n}\n\ninterface OpenApiParameter {\n name: string;\n in: string;\n description: string;\n required: boolean;\n schema: unknown;\n}\n\ninterface OpenApiRequestBody {\n required: boolean;\n content: Record<string, { schema: unknown }>;\n}\n\ninterface OpenApiResponse {\n description: string;\n content?: Record<string, { schema: unknown }>;\n}\n","import type { FlowDefinition, WorkflowDefinition } from '@stackwright-services/types';\n\n/*\n Auth requirements derived from a definition.\n * The compiler emits these into target-specific auth configuration.\n /\nexport interface DerivedAuthRequirements {\n /* Whether any auth is required at all /\n requiresAuth: boolean;\n /* All roles referenced in guard_role transitions /\n requiredRoles: string[];\n /* Locations where auth is referenced (for audit trail) /\n sources: AuthRequirementSource[];\n}\n\nexport interface AuthRequirementSource {\n /* The role required /\n role: string;\n /* Where in the definition it's referenced /\n location: string;\n}\n\n/\n Derive auth requirements from a flow definition.\n \n For now, flows require auth if the HTTP trigger has auth config.\n * (Future: auth field on trigger schema)\n \n @security-critical — Determines whether auth is wired into compiled output.\n /\nexport function deriveFlowAuthRequirements(flow: FlowDefinition): DerivedAuthRequirements {\n // Flows don't currently have guard_role — return empty\n // Future: if trigger gains an auth field, derive from that\n void flow;\n return {\n requiresAuth: false,\n requiredRoles: [],\n sources: [],\n };\n}\n\n/\n Derive auth requirements from a workflow definition.\n \n Walks all states' transitions, collects guard_role references.\n * If ANY transition has guard_role, the workflow requires auth.\n \n @security-critical — Determines auth wiring in compiled output.\n /\nexport function deriveWorkflowAuthRequirements(\n workflow: WorkflowDefinition,\n): DerivedAuthRequirements {\n const sources: AuthRequirementSource[] = [];\n\n for (const [stateName, state] of Object.entries(workflow.states)) {\n if (state.transitions) {\n for (const transition of state.transitions) {\n if (transition.guard_role) {\n sources.push({\n role: transition.guard_role,\n location: `states.${stateName}.transitions[on=${transition.on}].guard_role`,\n });\n }\n }\n }\n }\n\n const uniqueRoles = [...new Set(sources.map((s) => s.role))];\n\n return {\n requiresAuth: sources.length > 0,\n requiredRoles: uniqueRoles,\n sources,\n };\n}\n\n/\n Generate Lambda authorizer configuration from auth requirements.\n * Used by the Lambda/Step Functions compile targets.\n /\nexport function toLambdaAuthorizerConfig(auth: DerivedAuthRequirements): object \| null {\n if (!auth.requiresAuth) return null;\n\n return {\n type: 'REQUEST',\n identitySource: 'method.request.header.Authorization',\n authorizerResultTtlInSeconds: 300,\n // The actual authorizer Lambda is provisioned separately —\n // this config tells API Gateway to require it\n requiredRoles: auth.requiredRoles,\n };\n}\n\n/\n Generate Helm auth annotations from auth requirements.\n * Used by the Helm compile target.\n /\nexport function toHelmAuthAnnotations(auth: DerivedAuthRequirements): Record<string, string> {\n if (!auth.requiresAuth) return {};\n\n return {\n 'stackwright.io/auth-required': 'true',\n 'stackwright.io/auth-roles': auth.requiredRoles.join(','),\n 'stackwright.io/auth-provider': 'oidc', // default, overridable via values.yaml\n };\n}\n","import { createHash } from 'node:crypto';\nimport type { FlowDefinition, WorkflowDefinition } from '@stackwright-services/types';\n\n/\n Build-coherence configuration derived from a definition.\n \n This is NOT authentication (that's AuthProvider). It's a deployment\n * coherence mechanism that ensures frontend and backend were compiled\n * from the same source at the same time.\n \n The key is:\n * - Generated deterministically from flow content + build timestamp\n * - Embedded in the compiled handler as middleware\n * - Embedded in the OpenAPI spec as an apiKey security scheme\n * - Short-lived: replaced every build\n * - NOT a secret: visible in frontend bundle and spec file\n \n Works naturally with blue/green and canary deployments —\n * matched frontend/backend pairs share the same key.\n /\nexport interface BuildCoherenceConfig {\n /* Whether build coherence is enabled /\n enabled: boolean;\n /* The build key (hex string) /\n buildKey: string;\n /* Hash of the flow content (for tracing which definition produced this key) /\n contentHash: string;\n /* Build timestamp (ISO 8601) /\n buildTimestamp: string;\n}\n\n/\n Derive build coherence config from a flow definition.\n \n The key is a SHA-256 hash of: flow content (serialized) + build timestamp.\n * Same source + same moment = same key. Different build = different key.\n \n Follows the same pattern as deriveFlowAuthRequirements() and\n * deriveFlowPermissions() — pure derivation, no side effects.\n \n @security-critical — The build key becomes a deployment coherence check.\n /\nexport function deriveBuildCoherence(\n flow: FlowDefinition \| WorkflowDefinition,\n options: { timestamp?: string; enabled?: boolean } = {},\n): BuildCoherenceConfig {\n const enabled = options.enabled ?? true;\n const buildTimestamp = options.timestamp ?? new Date().toISOString();\n\n // Content hash — deterministic from the definition alone\n const contentHash = createHash('sha256').update(JSON.stringify(flow)).digest('hex').slice(0, 16);\n\n // Build key — content + timestamp makes each build unique\n const buildKey = createHash('sha256')\n .update(`${contentHash}:${buildTimestamp}`)\n .digest('hex')\n .slice(0, 32);\n\n return {\n enabled,\n buildKey,\n contentHash,\n buildTimestamp,\n };\n}\n\n/\n Generate Hono middleware code that validates the build-coherence key.\n \n Injected into the compiled handler.ts by the Lambda and Helm targets.\n * The middleware runs before the flow handler and rejects requests\n * with a mismatched or missing build key.\n /\nexport function toBuildKeyMiddleware(config: BuildCoherenceConfig): string {\n if (!config.enabled) return '';\n\n return `\n// ─── Build Coherence ─────────────────────────────────────────────────\n// Auto-generated by the Stackwright Services compiler.\n// Ensures this backend matches the frontend that was compiled with it.\n// NOT authentication — that's AuthProvider's job.\nconst STACKWRIGHT_BUILD_KEY = process.env.STACKWRIGHT_BUILD_KEY ?? '${config.buildKey}';\nconst STACKWRIGHT_CONTENT_HASH = '${config.contentHash}';\n\napp.use('', async (c, next) => {\n // Skip health check\n if (c.req.path === '/health') return next();\n\n const clientKey = c.req.header('x-stackwright-build-key');\n if (!clientKey) {\n return c.json({\n error: 'Missing build-coherence key',\n code: 'BUILD_KEY_MISSING',\n hint: 'Include x-stackwright-build-key header. This is auto-set by the generated client.',\n }, 403);\n }\n if (clientKey !== STACKWRIGHT_BUILD_KEY) {\n return c.json({\n error: 'Build mismatch — frontend and backend were compiled from different builds',\n code: 'BUILD_COHERENCE_FAILURE',\n expected: STACKWRIGHT_BUILD_KEY.slice(0, 8) + '…',\n received: clientKey.slice(0, 8) + '…',\n contentHash: STACKWRIGHT_CONTENT_HASH,\n }, 403);\n }\n await next();\n});\n`;\n}\n\n/*\n Generate environment variables for the build key.\n * Used by Helm values.yaml and Lambda environment config.\n */\nexport function toBuildKeyEnv(config: BuildCoherenceConfig): Record<string, string> {\n if (!config.enabled) return {};\n\n return {\n STACKWRIGHT_BUILD_KEY: config.buildKey,\n STACKWRIGHT_CONTENT_HASH: config.contentHash,\n STACKWRIGHT_BUILD_TIMESTAMP: config.buildTimestamp,\n };\n}\n"],"mappings":";AACA;AAAA,EACE,mBAAmB;AAAA,OAEd;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,SAAS,iBAAiB;AAsC5B,SAAS,qBAAqB,KAA+C;AAClF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,SAAS;AACf,MAAI,WAAW,UAAU,aAAa,OAAQ,QAAO;AACrD,MAAI,YAAY,UAAU,aAAa,OAAQ,QAAO;AACtD,SAAO;AACT;AAWO,SAAS,SACd,aACA,UACA,SACkB;AAClB,MAAI;AACJ,MAAI;AACF,aAAS,UAAU,WAAW;AAAA,EAChC,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,CAAC,EAAE,MAAM,oBAAoB,SAAS,iBAAkB,IAAc,OAAO,GAAG,CAAC;AAAA,MACzF,UAAU,CAAC;AAAA,IACb;AAAA,EACF;AAEA,MAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,CAAC,EAAE,MAAM,kBAAkB,SAAS,yBAAyB,CAAC;AAAA,MACtE,UAAU,CAAC;AAAA,IACb;AAAA,EACF;AAEA,QAAM,UAAU,qBAAqB,MAAM;AAE3C,MAAI,YAAY,QAAQ;AACtB,WAAO,aAAa,QAAQ,UAAU,OAAO;AAAA,EAC/C,WAAW,YAAY,YAAY;AACjC,WAAO,iBAAiB,QAAQ,QAAQ;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SACE;AAAA,QACJ;AAAA,MACF;AAAA,MACA,UAAU,CAAC;AAAA,IACb;AAAA,EACF;AACF;AAKO,SAAS,aACd,QACA,UACA,SACsC;AAEtC,QAAM,SAAS,eAAe,UAAU,MAAM;AAE9C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAMA,UAA4B,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,MACpE,MAAM;AAAA,MACN,SAAS,MAAM;AAAA,MACf,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,IAC3B,EAAE;AACF,WAAO,EAAE,SAAS,OAAO,QAAAA,SAAQ,UAAU,CAAC,EAAE;AAAA,EAChD;AAEA,QAAM,OAAO,OAAO;AACpB,QAAM,SAA4B,CAAC;AACnC,QAAM,WAAgC,CAAC;AAKvC,MAAI,UAAU;AACZ,eAAW,QAAQ,KAAK,OAAO;AAC7B,UAAI,CAAC,SAAS,IAAI,KAAK,GAAG,GAAG;AAC3B,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,SAAS,KAAK,IAAI,oCAAoC,KAAK,GAAG;AAAA,UACvE,MAAM,SAAS,KAAK,IAAI;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,QAAM,YAAY,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAC9C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,WAAW;AAC5B,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,eAAS,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,wBAAwB,IAAI;AAAA,QACrC,MAAM,SAAS,IAAI;AAAA,MACrB,CAAC;AAAA,IACH;AACA,SAAK,IAAI,IAAI;AAAA,EACf;AAIA,QAAM,aAAuD,CAAC;AAC9D,aAAW,QAAQ,KAAK,OAAO;AAC7B,UAAM,YAAY,KAAK,OAAO,QAAQ;AACtC,QACE,OAAO,cAAc,aACpB,UAAU,WAAW,UAAU,KAAK,UAAU,WAAW,QAAQ,IAClE;AACA,iBAAW,KAAK,EAAE,KAAK,WAAW,UAAU,KAAK,KAAK,CAAC;AAAA,IACzD;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,SAAS,SAAS,mBAAmB;AAC3C,UAAM,aAAa,OAAO;AAE1B,eAAW,EAAE,KAAK,SAAS,KAAK,YAAY;AAC1C,YAAM,WAAW,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAAC;AAE/C,UAAI,WAAW,kBAAkB,WAAW,GAAG;AAC7C,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,WAAW,GAAG;AAAA,UACvB,MAAM,SAAS,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,WAAW,CAAC,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ,GAAG;AAC7D,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,WAAW,GAAG;AAAA,UACvB,MAAM,SAAS,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH;AAAA,IAEF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,OAAO,WAAW;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACF;AAKO,SAAS,iBACd,QACA,UAC0C;AAE1C,QAAM,SAAS,mBAAmB,UAAU,MAAM;AAElD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAMA,UAA4B,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,MACpE,MAAM;AAAA,MACN,SAAS,MAAM;AAAA,MACf,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,IAC3B,EAAE;AACF,WAAO,EAAE,SAAS,OAAO,QAAAA,SAAQ,UAAU,CAAC,EAAE;AAAA,EAChD;AAEA,QAAM,WAAW,OAAO;AACxB,QAAM,SAA4B,CAAC;AACnC,QAAM,WAAgC,CAAC;AACvC,QAAM,aAAa,OAAO,KAAK,SAAS,MAAM;AAG9C,MAAI,CAAC,WAAW,SAAS,SAAS,OAAO,GAAG;AAC1C,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,kBAAkB,SAAS,OAAO;AAAA,MAC3C,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,aAAa;AACrB,iBAAW,cAAc,MAAM,aAAa;AAC1C,YAAI,CAAC,WAAW,SAAS,WAAW,EAAE,GAAG;AACvC,iBAAO,KAAK;AAAA,YACV,MAAM;AAAA,YACN,SAAS,UAAU,SAAS,sCAAsC,WAAW,EAAE;AAAA,YAC/E,MAAM,UAAU,SAAS;AAAA,UAC3B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,QAAI,YAAY,MAAM,UAAU;AAC9B,UAAI,CAAC,SAAS,IAAI,MAAM,SAAS,GAAG,GAAG;AACrC,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,UAAU,SAAS,6CAA6C,MAAM,SAAS,GAAG;AAAA,UAC3F,MAAM,UAAU,SAAS;AAAA,QAC3B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,WAAW,OAAO,CAAC,SAAS,SAAS,OAAO,IAAI,GAAG,SAAS,UAAU;AAC7F,MAAI,eAAe,WAAW,KAAK,WAAW,SAAS,GAAG;AACxD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,SAAS,eAAe,CAAC,MAAM,eAAe,MAAM,YAAY,WAAW,IAAI;AACvF,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS,UAAU,SAAS;AAAA,QAC5B,MAAM,UAAU,SAAS;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,WAAW,SAAS,SAAS,OAAO,GAAG;AACzC,UAAM,YAAY,oBAAI,IAAY;AAClC,UAAM,QAAQ,CAAC,SAAS,OAAO;AAE/B,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,UAAU,MAAM,MAAM;AAC5B,UAAI,UAAU,IAAI,OAAO,EAAG;AAC5B,gBAAU,IAAI,OAAO;AAErB,YAAM,QAAQ,SAAS,OAAO,OAAO;AACrC,UAAI,OAAO,aAAa;AACtB,mBAAW,cAAc,MAAM,aAAa;AAC1C,cAAI,CAAC,UAAU,IAAI,WAAW,EAAE,GAAG;AACjC,kBAAM,KAAK,WAAW,EAAE;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAU,IAAI,SAAS,GAAG;AAC7B,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,UAAU,SAAS,0CAA0C,SAAS,OAAO;AAAA,UACtF,MAAM,UAAU,SAAS;AAAA,QAC3B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,eAAe,SAAS,GAAG;AAC7B,UAAM,mBAAmB,IAAI,IAAY,cAAc;AACvD,UAAM,eAAe,CAAC,GAAG,cAAc;AAGvC,UAAM,aAAa,oBAAI,IAAsB;AAC7C,eAAW,QAAQ,YAAY;AAC7B,iBAAW,IAAI,MAAM,CAAC,CAAC;AAAA,IACzB;AACA,eAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,UAAI,MAAM,aAAa;AACrB,mBAAW,cAAc,MAAM,aAAa;AAC1C,qBAAW,IAAI,WAAW,EAAE,GAAG,KAAK,SAAS;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAGA,WAAO,aAAa,SAAS,GAAG;AAC9B,YAAM,UAAU,aAAa,MAAM;AACnC,iBAAW,eAAe,WAAW,IAAI,OAAO,KAAK,CAAC,GAAG;AACvD,YAAI,CAAC,iBAAiB,IAAI,WAAW,GAAG;AACtC,2BAAiB,IAAI,WAAW;AAChC,uBAAa,KAAK,WAAW;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,eAAW,aAAa,YAAY;AAClC,UAAI,SAAS,OAAO,SAAS,GAAG,SAAS,cAAc,CAAC,iBAAiB,IAAI,SAAS,GAAG;AACvF,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,UAAU,SAAS;AAAA,UAC5B,MAAM,UAAU,SAAS;AAAA,QAC3B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS;AACpB,UAAM,kBAAkB,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AACnE,UAAM,cAAc,oBAAI,IAAY;AAEpC,eAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,UAAI,MAAM,aAAa;AACrB,mBAAW,cAAc,MAAM,aAAa;AAC1C,sBAAY,IAAI,WAAW,EAAE;AAC7B,cAAI,CAAC,gBAAgB,IAAI,WAAW,EAAE,GAAG;AACvC,qBAAS,KAAK;AAAA,cACZ,MAAM;AAAA,cACN,SAAS,wBAAwB,SAAS,kBAAkB,WAAW,EAAE;AAAA,cACzE,MAAM,UAAU,SAAS;AAAA,YAC3B,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,eAAW,UAAU,SAAS,SAAS;AACrC,UAAI,CAAC,YAAY,IAAI,OAAO,IAAI,GAAG;AACjC,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN,SAAS,WAAW,OAAO,IAAI;AAAA,UAC/B,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,aAAa;AACrB,YAAM,mBAAmB,oBAAI,IAAY;AACzC,iBAAW,cAAc,MAAM,aAAa;AAC1C,YAAI,CAAC,WAAW,MAAM;AACpB,cAAI,iBAAiB,IAAI,WAAW,EAAE,GAAG;AACvC,qBAAS,KAAK;AAAA,cACZ,MAAM;AAAA,cACN,SAAS,UAAU,SAAS,oDAAoD,WAAW,EAAE;AAAA,cAC7F,MAAM,UAAU,SAAS;AAAA,YAC3B,CAAC;AAAA,UACH;AACA,2BAAiB,IAAI,WAAW,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,YAAY,SAAS,UAAU,YAAY;AAC7C,QAAI,CAAC,SAAS,IAAI,SAAS,SAAS,WAAW,GAAG,GAAG;AACnD,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS,qDAAqD,SAAS,SAAS,WAAW,GAAG;AAAA,QAC9F,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,OAAO,WAAW;AAAA,IAC3B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACF;;;ACvYA,SAAS,2BACP,YACA,YACoB;AACpB,MAAI,CAAC,WAAY,QAAO;AAExB,MAAI,EAAE,SAAS,IAAI;AACnB,QAAM,kBAAkB;AAExB,aAAW,SAAS,QAAQ,iBAAiB,CAAC,QAAQ,YAAoB;AACxE,UAAM,QAAQ,WAAW,OAAO;AAChC,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,WAAO;AAAA,EACT,CAAC;AAED,SAAO,EAAE,GAAG,YAAY,SAAS;AACnC;AAeO,SAAS,sBACd,MACA,UACoB;AACpB,QAAM,UAA8B,CAAC;AAErC,aAAW,QAAQ,KAAK,OAAO;AAC7B,UAAM,aAAa,SAAS,OAAO,KAAK,GAAG;AAC3C,QAAI,CAAC,WAAY;AAEjB,QAAI,WAAW,WAAW,SAAS,UAAU;AAC3C,iBAAW,QAAQ,WAAW,WAAW,qBAAqB;AAC5D,cAAM,WAAW,2BAA2B,MAAM,KAAK,IAAI;AAC3D,gBAAQ,KAAK;AAAA,UACX,YAAY;AAAA,UACZ,gBAAgB,KAAK;AAAA,UACrB,UAAU,SAAS,KAAK,IAAI;AAAA,QAC9B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,aAAa,uBAAuB,QAAQ,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAQO,SAAS,0BACd,UACA,UACoB;AACpB,QAAM,UAA8B,CAAC;AAErC,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,UAAU;AAClB,YAAM,aAAa,SAAS,OAAO,MAAM,SAAS,GAAG;AACrD,UAAI,CAAC,WAAY;AAEjB,UAAI,WAAW,WAAW,SAAS,UAAU;AAC3C,mBAAW,QAAQ,WAAW,WAAW,qBAAqB;AAC5D,kBAAQ,KAAK;AAAA,YACX,YAAY;AAAA,YACZ,gBAAgB,MAAM,SAAS;AAAA,YAC/B,UAAU,UAAU,SAAS;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,UAAU,YAAY;AACjC,UAAM,aAAa,SAAS,OAAO,SAAS,SAAS,WAAW,GAAG;AACnE,QAAI,cAAc,WAAW,WAAW,SAAS,UAAU;AACzD,iBAAW,QAAQ,WAAW,WAAW,qBAAqB;AAC5D,gBAAQ,KAAK;AAAA,UACX,YAAY;AAAA,UACZ,gBAAgB,SAAS,SAAS,WAAW;AAAA,UAC7C,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,aAAa,uBAAuB,QAAQ,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAKA,SAAS,uBAAuB,aAAyD;AACvF,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAA+B,CAAC;AAEtC,aAAW,QAAQ,aAAa;AAC9B,UAAM,MAAM,GAAG,KAAK,QAAQ,IAAI,KAAK,MAAM,IAAI,KAAK,SAAS,EAAE;AAC/D,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,WAAK,IAAI,GAAG;AACZ,aAAO,KAAK,IAAI;AAAA,IAClB;AAAA,EACF;AAEA,SAAO;AACT;AAMO,SAAS,YAAY,SAAqC;AAC/D,MAAI,QAAQ,YAAY,WAAW,GAAG;AACpC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,CAAC;AAAA,IACd;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,QAAQ,YAAY,IAAI,CAAC,UAAU;AAAA,MAC5C,QAAQ;AAAA,MACR,QAAQ,eAAe,KAAK,MAAM;AAAA,MAClC,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,qBAAqB,KAAK,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IAC3F,EAAE;AAAA,EACJ;AACF;AAaO,SAAS,yBACd,UACA,SACQ;AACR,QAAM,aAAuB,CAAC;AAG9B,QAAM,oBAAoB,OAAO,QAAQ,SAAS,MAAM,EACrD,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,MAAM,aAAa,MAAS,EAClD,IAAI,CAAC,CAAC,IAAI,MAAM,IAAI;AAEvB,MAAI,kBAAkB,SAAS,GAAG;AAChC,eAAW,KAAK;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,CAAC,uBAAuB;AAAA,MAChC,UAAU,kBAAkB;AAAA,QAC1B,CAAC,SAAS,+BAA+B,SAAS,EAAE,IAAI,IAAI;AAAA,MAC9D;AAAA,IACF,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,YAAY,SAAS,GAAG;AAClC,eAAW;AAAA,MACT,GAAG,QAAQ,YAAY,IAAI,CAAC,UAAU;AAAA,QACpC,QAAQ;AAAA,QACR,QAAQ,eAAe,KAAK,MAAM;AAAA,QAClC,UAAU,KAAK;AAAA,QACf,GAAI,KAAK,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,qBAAqB,KAAK,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3F,EAAE;AAAA,IACJ;AAAA,EACF;AAGA,MAAI,SAAS,UAAU,iBAAiB,SAAS,UAAU,UAAU;AACnE,eAAW,KAAK;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ,CAAC,kBAAkB,qBAAqB,qBAAqB,sBAAsB;AAAA,MAC3F,UAAU,2BAA2B,SAAS,EAAE;AAAA,IAClD,CAAC;AAAA,EACH;AAGA,aAAW,KAAK;AAAA,IACd,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ,CAAC,uBAAuB,wBAAwB,mBAAmB;AAAA,IAC3E,UAAU,iDAAiD,SAAS,EAAE;AAAA,EACxE,CAAC;AAED,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,EACb;AACF;AAMO,SAAS,YAAY,SAAuC;AACjE,MAAI,QAAQ,YAAY,WAAW,EAAG,QAAO,CAAC;AAG9C,QAAM,UAAU,oBAAI,IAAsB;AAC1C,aAAW,QAAQ,QAAQ,aAAa;AACtC,UAAM,QAAQ,QAAQ,IAAI,KAAK,QAAQ,KAAK,CAAC;AAC7C,QAAI,CAAC,MAAM,SAAS,KAAK,MAAM,GAAG;AAChC,YAAM,KAAK,KAAK,MAAM;AAAA,IACxB;AACA,YAAQ,IAAI,KAAK,UAAU,KAAK;AAAA,EAClC;AAEA,SAAO,MAAM,KAAK,QAAQ,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO;AAAA,IAC/D,WAAW,CAAC,gBAAgB;AAAA,IAC5B,WAAW,CAAC,QAAQ;AAAA,IACpB;AAAA,EACF,EAAE;AACJ;;;ACzOO,SAAS,4BAA4B,MAA6C;AACvF,SAAO,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,IAC/B,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,SAAS;AAAA,MACP,SAAS;AAAA,MACT,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF,EAAE;AACJ;AAKO,SAAS,mBAAmB,MAAsB;AACvD,SAAO,KAAK,QAAQ,iBAAiB,GAAG;AAC1C;AAQO,SAAS,6BAA6B,iBAA8C;AACzF,QAAM,EAAE,UAAU,gBAAgB,QAAQ,QAAQ,IAAI;AACtD,QAAM,SAAS,mBAAmB,QAAQ;AAE1C,SAAO;AAAA,IACL,8BAA8B,MAAM;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,2CAA2C,QAAQ;AAAA,IACnD,2BAA2B,cAAc;AAAA,IACzC,mBAAmB,MAAM;AAAA,IACzB,qBAAqB,QAAQ;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,WAAW,kBAAkB,QAAQ,mBAAmB,cAAc;AAAA,IAC5G;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,oBAAoB,QAAQ;AAAA,IAC5B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,MAAM,kBAAkB,QAAQ,mBAAmB,cAAc;AAAA,IACvG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,oBAAoB,QAAQ;AAAA,IAC5B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,OAAO,yBAAyB,QAAQ,mBAAmB,cAAc;AAAA,IAC/G;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAMO,SAAS,6BAA6B,MAA8B;AACzE,QAAM,mBAAmB,4BAA4B,IAAI;AACzD,QAAM,gBAAgB,iBAAiB,IAAI,4BAA4B;AAEvE,QAAM,YAAY,iBACf;AAAA,IACC,CAAC,SACC,sCAAsC,mBAAmB,KAAK,QAAQ,CAAC,gEAAgE,KAAK,cAAc;AAAA,EAC9J,EACC,KAAK,IAAI;AAEZ,QAAM,SAAS;AAAA,IACb;AAAA,IACA,YAAY,KAAK,EAAE;AAAA,IACnB,mBAAmB,KAAK,WAAW;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK,EAAE;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,+CAA+C,KAAK,EAAE;AAAA,IACtD,mBAAmB,KAAK,EAAE;AAAA,IAC1B,qBAAqB,KAAK,MAAM,MAAM;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,KAAK,EAAE;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,6DAA6D,KAAK,EAAE;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,IACA,wDAAwD,KAAK,EAAE;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,KAAK,EAAE;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8EAA8E,KAAK,EAAE;AAAA,IACrF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,SAAO,SAAS,cAAc,KAAK,MAAM,IAAI,SAAS;AACxD;;;AClMO,SAAS,gCACd,UACgC;AAChC,SAAO,OAAO,QAAQ,SAAS,MAAM,EAClC,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,EACtC,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;AAAA,IAC5B;AAAA;AAAA,IAEA,gBAAgB,MAAM,UAAU,OAAO;AAAA,IACvC,YAAY,SAAS;AAAA,IACrB,YAAY,MAAM,SAAS;AAAA,IAC3B,SAAS;AAAA,MACP,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,aAAa;AAAA,IACf;AAAA,EACF,EAAE;AACN;AAeO,SAAS,qCACd,iBACA,kBACQ;AACR,QAAM,EAAE,WAAW,gBAAgB,YAAY,QAAQ,IAAI;AAC3D,QAAM,aAAa,KAAK,UAAU,gBAAgB;AAClD,QAAM,SAAS;AAAA,IACb;AAAA,IACA,gBAAgB,UAAU,YAAY,SAAS;AAAA,IAC/C,kBAAkB,cAAc;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,QAAM,eAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,2BAA2B,UAAU;AAAA,IACrC;AAAA,IACA,qDAAqD,SAAS;AAAA,IAC9D,uBAAuB,UAAU;AAAA,IACjC,sBAAsB,SAAS;AAAA,IAC/B,2BAA2B,cAAc;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,4BAA4B,QAAQ,WAAW;AAAA,IAC/C,kBAAkB,UAAU;AAAA,IAC5B,eAAe,SAAS;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gDAAgD,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,IACA,mBAAmB,SAAS;AAAA,IAC5B,wBAAwB,cAAc;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,WAAW;AAAA,IACjD,oBAAoB,UAAU;AAAA,IAC9B,iBAAiB,SAAS;AAAA,IAC1B,sBAAsB,cAAc;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,UAAU;AAAA,IAC5B,oBAAoB,SAAS;AAAA,IAC7B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,MAAM;AAAA,IAC5C,oBAAoB,UAAU;AAAA,IAC9B,iBAAiB,SAAS;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,UAAU;AAAA,IAC5B,oBAAoB,SAAS;AAAA,IAC7B,0BAA0B,cAAc;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8BAA8B,QAAQ,OAAO;AAAA,IAC7C,oBAAoB,UAAU;AAAA,IAC9B,iBAAiB,SAAS;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AAEX,SAAO,SAAS;AAClB;;;AC3JO,SAAS,oBACd,MACA,aACA,kBACc;AACd,QAAM,QAAgC,CAAC;AAEvC,QAAM,YAAY,IAAI,kBAAkB,IAAI;AAC5C,QAAM,SAAS,IAAI;AACnB,QAAM,YAAY,IAAI,mBAAmB,IAAI;AAC7C,QAAM,iBAAiB,IAAI,kBAAkB,KAAK,SAAS,WAAW;AACtE,QAAM,cAAc,IAAI,oBAAoB,IAAI;AAGhD,QAAM,eAAe,qBAAqB,IAAI;AAC9C,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC1D,UAAM,IAAI,IAAI;AAAA,EAChB;AAEA,SAAO,EAAE,MAAM;AACjB;AAEA,SAAS,kBAAkB,MAA8B;AACvD,QAAM,UAAU,KAAK;AAErB,MAAI;AACJ,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,UAAM,YAAY,QAAQ,WAAW,QAAQ,kBAAkB;AAC/D,iBAAa;AAAA,MACX,MAAM,KAAK,QAAQ,IAAI;AAAA,kBACX,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYzB,OAAO;AACL,iBAAa;AAAA,uBACM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAejC;AAEA,SAAO,8CAA8C,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0DAeJ,KAAK,EAAE;AAAA,EAC/D,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BZ;AAEA,SAAS,mBAAmB,MAA8B;AACxD,SAAO,yCAAyC,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BzD;AAEA,SAAS,oBAAoB,MAA8B;AACzD,SACE,KAAK;AAAA,IACH;AAAA,MACE,MAAM,GAAG,KAAK,EAAE;AAAA,MAChB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,sCAAsC;AAAA,MACxC;AAAA,MACA,iBAAiB;AAAA,QACf,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAER;AAMO,SAAS,sBAAsB,SAA4B;AAChE,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,QACL;AAAA,UACE,QAAQ;AAAA,UACR,QAAQ,CAAC,iBAAiB,iBAAiB;AAAA,UAC3C,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL;AAAA,UACE,QAAQ;AAAA,UACR,QAAQ,CAAC,kBAAkB,qBAAqB,mBAAmB;AAAA,UACnE,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL;AAAA,UACE,QAAQ;AAAA,UACR,QAAQ,CAAC,sBAAsB,qBAAqB,wBAAwB;AAAA,UAC5E,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF,KAAK;AAAA,IACL;AACE,aAAO,CAAC;AAAA,EACZ;AACF;AAMA,SAAS,kBAAkB,SAAkB,aAAyC;AACpF,QAAM,OAAO,YAAY,WAAW;AACpC,QAAM,oBAAoB,sBAAsB,OAAO;AACvD,OAAK,YAAY,CAAC,GAAG,KAAK,WAAW,GAAG,iBAAiB;AACzD,SAAO,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI;AACzC;AAMA,SAAS,qBAAqB,MAA8C;AAC1E,QAAM,UAAU,KAAK;AAErB,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK,SAAS;AACZ,YAAM,SAAS,QAAQ,OAAO,QAAQ,SAAS,EAAE;AACjD,aAAO;AAAA,QACL,yBACE,KAAK;AAAA,UACH;AAAA,YACE,UAAU,6CAA6C,KAAK,EAAE;AAAA,YAC9D,UAAU;AAAA,YACV,UAAU;AAAA,YACV,UAAU;AAAA,YACV,YAAY;AAAA,cACV,oBAAoB;AAAA,YACtB;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,QACF,IAAI;AAAA,MACR;AAAA,IACF;AAAA,IACA,KAAK;AACH,aAAO;AAAA,QACL,yBACE,KAAK;AAAA,UACH;AAAA,YACE,UAAU,6CAA6C,KAAK,EAAE;AAAA,YAC9D,MAAM,GAAG,KAAK,EAAE;AAAA,YAChB,oBAAoB,QAAQ,QAAQ,IAAI;AAAA,YACxC,OAAO;AAAA,YACP,SAAS;AAAA,cACP;AAAA,gBACE,IAAI,GAAG,KAAK,EAAE;AAAA,gBACd,KAAK;AAAA,cACP;AAAA,YACF;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,QACF,IAAI;AAAA,MACR;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,iCACE,KAAK;AAAA,UACH;AAAA,YACE,UAAU,qDAAqD,KAAK,EAAE;AAAA,YACtE,gBAAgB;AAAA,YAChB,cAAc;AAAA,YACd,WAAW;AAAA,YACX,SAAS;AAAA,YACT,WAAW,QAAQ;AAAA,UACrB;AAAA,UACA;AAAA,UACA;AAAA,QACF,IAAI;AAAA,MACR;AAAA,IACF,KAAK;AAAA,IACL;AACE,aAAO,CAAC;AAAA,EACZ;AACF;;;AC3RO,SAAS,kBACd,MACA,aACY;AACZ,QAAM,QAAgC,CAAC;AACvC,QAAM,YAAY,kBAAkB,KAAK,EAAE;AAC3C,QAAM,UAAU,KAAK;AAGrB,QAAM,YAAY,IAAI,kBAAkB,WAAW,IAAI;AACvD,QAAM,aAAa,IAAI,mBAAmB,WAAW,IAAI;AACzD,QAAM,wBAAwB,IAAI,oBAAoB,SAAS;AAC/D,QAAM,+BAA+B,IAAI,2BAA2B,SAAS;AAC7E,QAAM,wBAAwB,IAAI,mBAAmB,SAAS;AAG9D,MAAI,QAAQ,SAAS,YAAY;AAE/B,UAAM,wBAAwB,IAAI,oBAAoB,WAAW,QAAQ,IAAI;AAAA,EAC/E,OAAO;AAEL,UAAM,2BAA2B,IAAI,uBAAuB,WAAW,OAAO;AAE9E,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,wBAAwB,IAAI,oBAAoB,SAAS;AAAA,IACjE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,SAAS;AAC5B,UAAM,iCAAiC,IAAI,sBAAsB,WAAW,QAAQ,MAAM;AAAA,EAC5F;AAGA,MAAI,QAAQ,SAAS,SAAS;AAC5B,UAAM,6BAA6B,IAAI,wBAAwB,WAAW,QAAQ,IAAI;AAAA,EACxF;AAEA,MAAI,YAAY,YAAY,SAAS,GAAG;AACtC,UAAM,qBAAqB,IAAI,iBAAiB,WAAW,WAAW;AAAA,EACxE;AAEA,SAAO,EAAE,MAAM;AACjB;AAEO,SAAS,kBAAkB,MAAsB;AACtD,SAAO,KACJ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,OAAO,GAAG,EAClB,QAAQ,UAAU,EAAE;AACzB;AAEA,SAAS,kBAAkB,WAAmB,MAA8B;AAC1E,SAAO,yCAAyC,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA,QAIjD,SAAS;AAAA,eACF,KAAK,WAAW;AAAA;AAAA;AAAA;AAAA;AAK/B;AAEA,SAAS,mBAAmB,WAAmB,MAA8B;AAC3E,QAAM,UAAU,KAAK;AAErB,MAAI,gBAAgB;AACpB,MAAI,QAAQ,SAAS,SAAS;AAC5B,UAAM,QAAQ,QAAQ,OAAO,QAAQ,SAAS,EAAE,EAAE,YAAY,EAAE,QAAQ,MAAM,GAAG;AACjF,oBAAgB;AAAA;AAAA;AAAA;AAAA,+BAIW,KAAK;AAAA;AAAA,EAElC,WAAW,QAAQ,SAAS,YAAY;AACtC,oBAAgB;AAAA;AAAA;AAAA;AAAA,eAIL,QAAQ,IAAI;AAAA;AAAA,EAEzB,WAAW,QAAQ,SAAS,SAAS;AACnC,UAAM,WAAW,QAAQ,KAAK,YAAY,EAAE,QAAQ,MAAM,GAAG;AAC7D,oBAAgB;AAAA;AAAA;AAAA;AAAA,4BAIQ,QAAQ;AAAA;AAAA,EAElC;AAGA,QAAM,iBACJ,QAAQ,SAAS,SACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAMM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAMf;AAEN,SAAO,wBAAwB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBxC,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAiBP,KAAK,EAAE;AAAA,kBACE,KAAK,WAAW;AAAA,EAChC,aAAa;AACf;AAEA,SAAS,uBAAuB,WAAmB,SAA0B;AAC3E,MAAI,cAAc;AAClB,MAAI,QAAQ,SAAS,SAAS;AAC5B,kBAAc;AAAA;AAAA,iCAEe,QAAQ,OAAO,QAAQ,SAAS,EAAE,CAAC;AAAA;AAAA,EAElE,WAAW,QAAQ,SAAS,SAAS;AACnC,kBAAc;AAAA;AAAA,kCAEgB,QAAQ,IAAI;AAAA;AAAA,EAE5C;AAEA,SAAO,mCAAmC,SAAS;AAAA;AAAA;AAAA;AAAA,sBAI/B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA,EAC1B,WAAW;AAAA;AAAA;AAAA;AAAA,qBAIQ,SAAS;AAAA;AAAA;AAAA;AAAA,uBAIP,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wCAMQ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8CjD;AAEA,SAAS,oBAAoB,WAA2B;AACtD,SAAO,gCAAgC,SAAS;AAAA;AAAA;AAAA;AAAA,sBAI5B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAST,SAAS;AAAA;AAE5B;AAEA,SAAS,oBAAoB,WAA2B;AACtD,SAAO,gCAAgC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAK5B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCA6BQ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAO7C;AAEA,SAAS,2BAA2B,WAA2B;AAC7D,SAAO,uCAAuC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAKnC,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAO5B;AAEA,SAAS,mBAAmB,WAA2B;AACrD,SAAO;AAAA,6BACoB,SAAS;AAAA;AAAA;AAAA,cAGxB,SAAS;AAAA;AAAA;AAAA;AAAA,cAIT,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAaT,SAAS;AAAA,6BACM,SAAS;AAAA,cACxB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,cAKT,SAAS;AAAA,sCACe,SAAS;AAAA;AAAA;AAAA;AAAA,cAIjC,SAAS;AAAA;AAAA,wBAEC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAMjC;AAEA,SAAS,oBAAoB,WAAmB,MAAsB;AACpE,SAAO,gCAAgC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAK5B,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA,eAEb,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BASQ,SAAS;AAAA;AAAA,4CAEQ,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBrD;AAEA,SAAS,sBAAsB,WAAmB,QAAwB;AACxE,QAAM,QAAQ,OAAO,QAAQ,SAAS,EAAE;AACxC,SAAO,gDAAgD,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAM5C,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA,gBAGZ,KAAK;AAAA,aACR,MAAM;AAAA;AAEnB;AAEA,SAAS,wBAAwB,WAAmB,WAA2B;AAC7E,SAAO,qCAAqC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAMjC,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA,iBAGX,SAAS;AAAA;AAE1B;AAEA,SAAS,iBAAiB,WAAmB,aAAyC;AACpF,QAAM,QAAQ,YAAY,WAAW;AAKrC,QAAM,YAAY,MACf;AAAA,IACC,CAAC,MACC,mBAAmB,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,kBAAsB,EAAE,UAAU,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,cAAkB,EAAE,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,EAChM,EACC,KAAK,IAAI;AAEZ,SAAO,6BAA6B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAKzB,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA,EAE1B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,sBAKW,SAAS;AAAA;AAAA,mBAEZ,SAAS;AAAA;AAAA;AAAA;AAAA,sBAIN,SAAS;AAAA;AAAA;AAAA,wBAGP,SAAS;AAAA;AAAA;AAGjC;;;ACndO,SAAS,2BACd,UACA,aACqB;AACrB,QAAM,QAAgC,CAAC;AAGvC,QAAM,MAAM,sBAAsB,QAAQ;AAC1C,QAAM,qBAAqB,IAAI,KAAK,UAAU,KAAK,MAAM,CAAC;AAG1D,QAAM,yBAAyB,IAAI,KAAK;AAAA,IACtC,yBAAyB,UAAU,WAAW;AAAA,IAC9C;AAAA,IACA;AAAA,EACF;AAGA,aAAW,QAAQ,gCAAgC,QAAQ,GAAG;AAC5D,UAAM,SAAS,SAAS,OAAO,KAAK,SAAS,GAAG,UAAU,QAAQ,CAAC;AACnE,UAAM,YAAY,KAAK,SAAS,KAAK,IAAI,qCAAqC,MAAM,MAAM;AAAA,EAC5F;AAGA,QAAM,cAAc,IAAIC,qBAAoB,QAAQ;AAEpD,SAAO,EAAE,MAAM;AACjB;AAMA,SAAS,sBAAsB,UAAuD;AACpF,QAAM,SAAkC,CAAC;AAEzC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAC3D,WAAO,OAAO,QAAQ,kBAAkB,MAAM,OAAO,QAAQ,CAAC;AAAA,EAChE;AAEA,QAAM,aAAsC;AAAA,IAC1C,SAAS,yBAAyB,SAAS,WAAW;AAAA,IACtD,SAAS,SAAS;AAAA,IAClB,QAAQ;AAAA,EACV;AAEA,MAAI,SAAS,UAAU,UAAU;AAC/B,eAAW,gBAAgB,IAAI,iBAAiB,SAAS,SAAS,QAAQ;AAAA,EAC5E;AAEA,SAAO;AACT;AAeA,SAAS,kBACP,MACA,OACA,UACyB;AACzB,QAAM,aAAa,MAAM,SAAS;AAClC,QAAM,aAAa,CAAC,CAAC,MAAM;AAC3B,QAAM,cAAc,MAAM,eAAe,CAAC;AAG1C,MAAI,cAAc,YAAY;AAC5B,UAAM,cAAc,GAAG,IAAI;AAC3B,WAAO;AAAA,MACL,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,MAAM,WAAW;AAAA,MACrD,CAAC,WAAW,GAAG,EAAE,MAAM,UAAU;AAAA,IACnC;AAAA,EACF;AAGA,MAAI,YAAY;AACd,WAAO,EAAE,CAAC,IAAI,GAAG,EAAE,MAAM,UAAU,EAAE;AAAA,EACvC;AAGA,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO,aACH,EAAE,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,IAAI,EAAE,IAC5C,EAAE,CAAC,IAAI,GAAG,EAAE,MAAM,QAAQ,KAAK,KAAK,EAAE;AAAA,EAC5C;AAGA,QAAM,QAAQ,YAAY,CAAC;AAC3B,MAAI,YAAY,WAAW,KAAK,SAAS,CAAC,MAAM,MAAM;AACpD,WAAO,aACH,EAAE,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,IACtD,EAAE,CAAC,IAAI,GAAG,EAAE,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,EACjD;AAGA,MAAI,YAAY;AACd,UAAM,aAAa,GAAG,IAAI;AAC1B,WAAO;AAAA,MACL,CAAC,IAAI,GAAG,eAAe,SAAS,IAAI,MAAM,UAAU;AAAA,MACpD,CAAC,UAAU,GAAG,iBAAiB,WAAW;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO,EAAE,CAAC,IAAI,GAAG,iBAAiB,WAAW,EAAE;AACjD;AAMA,SAAS,eACP,YACA,WACA,MACyB;AACzB,QAAM,OAAgC;AAAA,IACpC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,YAAY;AAAA,MACV,cAAc,GAAG,UAAU,IAAI,SAAS;AAAA,MACxC,aAAa;AAAA,IACf;AAAA,EACF;AAEA,MAAI,MAAM;AACR,SAAK,MAAM,IAAI;AAAA,EACjB,OAAO;AACL,SAAK,KAAK,IAAI;AAAA,EAChB;AAEA,SAAO;AACT;AAMA,SAAS,iBAAiB,aAA4D;AACpF,QAAM,UAAoB,CAAC;AAC3B,MAAI;AAGJ,QAAM,gBAAgB,cAAc,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI;AAE/D,aAAW,CAAC,GAAG,CAAC,KAAK,YAAY,QAAQ,GAAG;AAC1C,QAAI,MAAM,eAAe;AACvB,sBAAgB,EAAE;AAClB;AAAA,IACF;AACA,YAAQ,KAAK,uBAAuB,CAAC,CAAC;AAAA,EACxC;AAEA,QAAM,cAAuC;AAAA,IAC3C,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAEA,MAAI,eAAe;AACjB,gBAAY,SAAS,IAAI;AAAA,EAC3B;AAEA,SAAO;AACT;AAEA,SAAS,uBAAuB,YAAwC;AACtE,QAAM,cAAc,EAAE,UAAU,YAAY,cAAc,WAAW,GAAG;AAExE,MAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,WAAW,GAAG;AACpD,WAAO,EAAE,GAAG,aAAa,MAAM,WAAW,GAAG;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL,KAAK,CAAC,aAAa,GAAG,WAAW,KAAK,IAAI,qBAAqB,CAAC;AAAA,IAChE,MAAM,WAAW;AAAA,EACnB;AACF;AAMA,SAAS,sBAAsB,WAAuC;AACpE,QAAM,WAAW,KAAK,UAAU,KAAK;AAErC,UAAQ,UAAU,IAAI;AAAA,IACpB,KAAK;AACH,aAAO,gBAAgB,UAAU,UAAU,KAAK;AAAA,IAClD,KAAK;AACH,aAAO,EAAE,KAAK,gBAAgB,UAAU,UAAU,KAAK,EAAE;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,iBAAiB,UAAU,MAAM;AAAA,IAChE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,oBAAoB,UAAU,MAAM;AAAA,IACnE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,uBAAuB,UAAU,MAAM;AAAA,IACtE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,0BAA0B,UAAU,MAAM;AAAA,IACzE,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,eAAe,GAAG,OAAO,UAAU,KAAK,CAAC,IAAI;AAAA,IAC5E,KAAK;AACH,aAAO,EAAE,UAAU,UAAU,eAAe,IAAI,OAAO,UAAU,KAAK,CAAC,IAAI;AAAA,IAC7E,KAAK;AACH,aAAO,YAAY,UAAU,UAAU,KAAK;AAAA,IAC9C,KAAK;AACH,aAAO,EAAE,KAAK,YAAY,UAAU,UAAU,KAAK,EAAE;AAAA,IACvD,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAGH,aAAO,EAAE,UAAU,UAAU,cAAc,0BAA0B,UAAU,EAAE,KAAK;AAAA,EAC1F;AACF;AAEA,SAAS,gBAAgB,UAAkB,OAAwB;AACjE,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,UAAU,UAAU,cAAc,MAAM;AAChF,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,UAAU,UAAU,eAAe,MAAM;AACjF,MAAI,OAAO,UAAU,UAAW,QAAO,EAAE,UAAU,UAAU,eAAe,MAAM;AAClF,SAAO,EAAE,UAAU,UAAU,cAAc,OAAO,KAAK,EAAE;AAC3D;AAEA,SAAS,YAAY,UAAkB,OAAwB;AAC7D,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,gBAAgB,UAAU,KAAK;AACjE,SAAO,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,gBAAgB,UAAU,CAAC,CAAC,EAAE;AAC9D;AAgBO,SAAS,iBAAiB,UAA0B;AACzD,QAAM,QAAQ,SAAS;AAAA,IACrB;AAAA,EACF;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,8BAA8B,QAAQ,EAAE;AAAA,EAC1D;AAEA,QAAM,CAAC,EAAE,OAAO,QAAQ,OAAO,MAAM,OAAO,SAAS,OAAO,IAAI;AAEhE,MAAI,QAAQ;AACZ,MAAI,MAAO,UAAS,SAAS,OAAO,EAAE,IAAI,MAAM;AAChD,MAAI,OAAQ,UAAS,SAAS,QAAQ,EAAE,IAAI,KAAK;AACjD,MAAI,MAAO,UAAS,SAAS,OAAO,EAAE,IAAI,IAAI;AAC9C,MAAI,KAAM,UAAS,SAAS,MAAM,EAAE,IAAI;AACxC,MAAI,MAAO,UAAS,SAAS,OAAO,EAAE,IAAI;AAC1C,MAAI,QAAS,UAAS,SAAS,SAAS,EAAE,IAAI;AAC9C,MAAI,QAAS,UAAS,SAAS,SAAS,EAAE;AAE1C,SAAO;AACT;AAMA,SAASA,qBAAoB,UAAsC;AACjE,SACE,KAAK;AAAA,IACH;AAAA,MACE,MAAM,GAAG,SAAS,EAAE;AAAA,MACpB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,QACP,OAAO;AAAA,MACT;AAAA,MACA,cAAc;AAAA,QACZ,sCAAsC;AAAA,MACxC;AAAA,MACA,iBAAiB;AAAA,QACf,qBAAqB;AAAA,QACrB,YAAY;AAAA,MACd;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAER;AAMA,SAAS,cAAiB,KAAmB,WAAyC;AACpF,WAAS,IAAI,IAAI,SAAS,GAAG,KAAK,GAAG,KAAK;AACxC,QAAI,UAAU,IAAI,CAAC,CAAM,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;;;ACrTO,SAAS,qBACd,MACA,UAAgC,CAAC,GAClB;AACf,MAAI,KAAK,QAAQ,SAAS,QAAQ;AAChC,WAAO,EAAE,OAAO,CAAC,EAAE;AAAA,EACrB;AAEA,QAAM,UAAU,KAAK;AACrB,QAAM,UAAU,QAAQ,WAAW;AAEnC,QAAM,OAAO,iBAAiB,MAAM,SAAS,SAAS,OAAO;AAE7D,SAAO;AAAA,IACL,OAAO;AAAA,MACL,gBAAgB,cAAc,IAAI;AAAA,IACpC;AAAA,EACF;AACF;AAIA,SAAS,iBACP,MACA,SACA,SACA,SACa;AACb,QAAM,cAAc,oBAAoB,KAAK,IAAI,QAAQ,MAAM;AAE/D,QAAM,OAAoB;AAAA,IACxB,SAAS;AAAA,IACT,MAAM;AAAA,MACJ,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,CAAC,QAAQ,IAAI,GAAG;AAAA,QACd,CAAC,QAAQ,OAAO,YAAY,CAAC,GAAG;AAAA,UAC9B;AAAA,UACA,SAAS,KAAK;AAAA,UACd,GAAI,QAAQ,WAAW,QACnB,EAAE,YAAY,qBAAqB,OAAO,EAAE,IAC5C,EAAE,aAAa,iBAAiB,OAAO,EAAE;AAAA,UAC7C,WAAW,eAAe,OAAO;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,QAAQ,WAAW;AACrB,SAAK,UAAU,CAAC,EAAE,KAAK,QAAQ,UAAU,CAAC;AAAA,EAC5C;AAGA,MAAI,QAAQ,UAAU;AACpB,SAAK,aAAa;AAAA,MAChB,GAAG,KAAK;AAAA,MACR,iBAAiB;AAAA,QACf,UAAU;AAAA,UACR,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,aACE;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,SAAK,WAAW,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;AAIjC,SAAK,yBAAyB,IAAI,QAAQ;AAAA,EAC5C;AAGA,OAAK,aAAa;AAAA,IAChB,GAAG,KAAK;AAAA,IACR,SAAS;AAAA,MACP,CAAC,QAAQ,YAAY,GAAG;AAAA,QACtB,MAAM;AAAA,QACN,aAAa,iBAAiB,QAAQ,YAAY;AAAA,MACpD;AAAA,MACA,CAAC,QAAQ,aAAa,GAAG;AAAA,QACvB,MAAM;AAAA,QACN,aAAa,kBAAkB,QAAQ,aAAa;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,oBAAoB,QAAgB,QAAwB;AACnE,QAAM,YAAY,OACf,QAAQ,qBAAqB,CAAC,GAAG,OAAe,GAAG,YAAY,CAAC,EAChE,QAAQ,UAAU,CAAC,OAAO,GAAG,YAAY,CAAC;AAC7C,QAAM,SAAS,OAAO,YAAY;AAClC,SAAO,GAAG,MAAM,GAAG,UAAU,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC;AAC3E;AAEA,SAAS,qBAAqB,SAA0C;AACtE,SAAO;AAAA,IACL;AAAA,MACE,MAAM,QAAQ;AAAA,MACd,IAAI;AAAA,MACJ,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MACzD,UAAU;AAAA,MACV,QAAQ,EAAE,MAAM,wBAAwB,QAAQ,YAAY,GAAG;AAAA,IACjE;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,SAA0C;AAClE,SAAO;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,MACP,oBAAoB;AAAA,QAClB,QAAQ,EAAE,MAAM,wBAAwB,QAAQ,YAAY,GAAG;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,SAAuD;AAC7E,SAAO;AAAA,IACL,OAAO;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ,EAAE,MAAM,wBAAwB,QAAQ,aAAa,GAAG;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,YAAY;AAAA,cACV,OAAO,EAAE,MAAM,SAAS;AAAA,cACxB,MAAM,EAAE,MAAM,SAAS;AAAA,cACvB,SAAS,EAAE,MAAM,SAAS;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,YAAY;AAAA,cACV,OAAO,EAAE,MAAM,SAAS;AAAA,cACxB,MAAM,EAAE,MAAM,SAAS;AAAA,YACzB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,cAAc,KAAc,SAAiB,GAAW;AAC/D,QAAM,MAAM,KAAK,OAAO,MAAM;AAE9B,MAAI,QAAQ,QAAQ,QAAQ,OAAW,QAAO;AAC9C,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,IAAI,IAAI,QAAQ,MAAM,IAAI,CAAC;AAAA,IACpC;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,UAAW,QAAO,OAAO,GAAG;AAE1E,MAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,QAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,WAAO,IACJ,IAAI,CAAC,SAAS;AACb,UAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,cAAM,QAAQ,cAAc,MAAM,SAAS,CAAC;AAC5C,cAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,cAAM,YAAY,MAAM,CAAC,KAAK;AAC9B,eAAO,GAAG,GAAG,KAAK,UAAU,UAAU,CAAC;AAAA,EAAK,MAAM,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,QAAQ;AAAA,MAClF;AACA,aAAO,GAAG,GAAG,KAAK,cAAc,IAAI,CAAC;AAAA,IACvC,CAAC,EACA,KAAK,IAAI;AAAA,EACd;AAEA,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAM,UAAU,OAAO,QAAQ,GAA8B;AAC7D,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,WAAO,QACJ,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM;AACnB,YAAM,UAAU,gBAAgB,GAAG,IAAI,IAAI,GAAG,MAAM;AACpD,UACE,OAAO,QAAQ,YACf,QAAQ,QACR,CAAC,MAAM,QAAQ,GAAG,KAClB,OAAO,KAAK,GAAa,EAAE,SAAS,GACpC;AACA,eAAO,GAAG,GAAG,GAAG,OAAO;AAAA,EAAM,cAAc,KAAK,SAAS,CAAC,CAAC;AAAA,MAC7D;AACA,UAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,YAAI,IAAI,WAAW,EAAG,QAAO,GAAG,GAAG,GAAG,OAAO;AAC7C,eAAO,GAAG,GAAG,GAAG,OAAO;AAAA,EAAM,cAAc,KAAK,SAAS,CAAC,CAAC;AAAA,MAC7D;AACA,aAAO,GAAG,GAAG,GAAG,OAAO,KAAK,cAAc,GAAG,CAAC;AAAA,IAChD,CAAC,EACA,KAAK,IAAI;AAAA,EACd;AAEA,SAAO,OAAO,GAAG;AACnB;AAEA,SAAS,aAAa,KAAsB;AAC1C,SAAO,0BAA0B,KAAK,GAAG,KAAK,QAAQ,MAAM,QAAQ,UAAU,QAAQ;AACxF;AAEA,SAAS,gBAAgB,KAAsB;AAE7C,SAAO,QAAQ,KAAK,GAAG,KAAK,QAAQ,UAAU,QAAQ,WAAW,QAAQ,UAAU,QAAQ;AAC7F;;;AC/OO,SAAS,2BAA2B,MAA+C;AAGxF,OAAK;AACL,SAAO;AAAA,IACL,cAAc;AAAA,IACd,eAAe,CAAC;AAAA,IAChB,SAAS,CAAC;AAAA,EACZ;AACF;AAUO,SAAS,+BACd,UACyB;AACzB,QAAM,UAAmC,CAAC;AAE1C,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,SAAS,MAAM,GAAG;AAChE,QAAI,MAAM,aAAa;AACrB,iBAAW,cAAc,MAAM,aAAa;AAC1C,YAAI,WAAW,YAAY;AACzB,kBAAQ,KAAK;AAAA,YACX,MAAM,WAAW;AAAA,YACjB,UAAU,UAAU,SAAS,mBAAmB,WAAW,EAAE;AAAA,UAC/D,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAE3D,SAAO;AAAA,IACL,cAAc,QAAQ,SAAS;AAAA,IAC/B,eAAe;AAAA,IACf;AAAA,EACF;AACF;AAMO,SAAS,yBAAyB,MAA8C;AACrF,MAAI,CAAC,KAAK,aAAc,QAAO;AAE/B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,gBAAgB;AAAA,IAChB,8BAA8B;AAAA;AAAA;AAAA,IAG9B,eAAe,KAAK;AAAA,EACtB;AACF;AAMO,SAAS,sBAAsB,MAAuD;AAC3F,MAAI,CAAC,KAAK,aAAc,QAAO,CAAC;AAEhC,SAAO;AAAA,IACL,gCAAgC;AAAA,IAChC,6BAA6B,KAAK,cAAc,KAAK,GAAG;AAAA,IACxD,gCAAgC;AAAA;AAAA,EAClC;AACF;;;ACzGA,SAAS,kBAAkB;AA0CpB,SAAS,qBACd,MACA,UAAqD,CAAC,GAChC;AACtB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,iBAAiB,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAGnE,QAAM,cAAc,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAG/F,QAAM,WAAW,WAAW,QAAQ,EACjC,OAAO,GAAG,WAAW,IAAI,cAAc,EAAE,EACzC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AAEd,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASO,SAAS,qBAAqB,QAAsC;AACzE,MAAI,CAAC,OAAO,QAAS,QAAO;AAE5B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,sEAK6D,OAAO,QAAQ;AAAA,oCACjD,OAAO,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0BtD;AAMO,SAAS,cAAc,QAAsD;AAClF,MAAI,CAAC,OAAO,QAAS,QAAO,CAAC;AAE7B,SAAO;AAAA,IACL,uBAAuB,OAAO;AAAA,IAC9B,0BAA0B,OAAO;AAAA,IACjC,6BAA6B,OAAO;AAAA,EACtC;AACF;","names":["errors","generatePackageJson"]}