@venturekit/infra 0.0.0-dev.20260514025219 → 0.0.0-dev.20260515022321

package/dist/cdk/network-stack.js

@@ -0,0 +1,265 @@
+/**
+ * Tier 0 — Network stack.
+ *
+ * Owns: VPC, all subnets (public / private-with-egress / isolated),
+ * NAT gateways or fck-nat instances, route tables, the gateway VPC
+ * endpoints (S3, DynamoDB), the optional interface endpoints
+ * (Secrets Manager — by default off until preset opts in), and the
+ * VPC flow log destination.
+ *
+ * # Lifecycle position
+ *
+ * Updated almost never (~once a year, when AWS rolls a new fck-nat
+ * AMI or the operator adds an AZ). Survives stack delete because
+ * everything is RETAIN. The data tier (RDS in private subnets) and
+ * the app tier (Lambdas in private subnets) both depend on the
+ * network tier's published surface; deleting the network stack
+ * orphans every subnet ID + VPC ID — recoverable via `cdk import`,
+ * never automatic.
+ *
+ * # Public surface (via SSM)
+ *
+ * Published exclusively under `networkKeys` in `shared/ssm-keys.ts`:
+ *
+ *   - `vpcId` — the singular VPC ID
+ *   - `availabilityZones` — comma-joined, ordered
+ *   - `privateSubnetIds`, `publicSubnetIds`, `isolatedSubnetIds` —
+ *     comma-joined, ordered to match `availabilityZones`
+ *
+ * That's it. Consumers never reach in for individual subnets, NAT
+ * IDs, or route table IDs — those are private to this stack.
+ *
+ * # Why no exports?
+ *
+ * `cdk.CfnOutput` + `Fn::ImportValue` carries CFN's "consumed export
+ * cannot be modified" lock. SSM dynamic references don't. See the
+ * long-form rationale in `shared/ssm-keys.ts`.
+ *
+ * # Free-tier handling
+ *
+ * On the `free` preset, no VPC is provisioned at all (the preset
+ * runs DynamoDB + storage-only Lambdas with no in-VPC dependencies,
+ * which keeps the deploy at $0/month). The CLI's stack generator
+ * therefore must not instantiate `VentureNetworkStack` when the
+ * preset resolves to `free` AND no intent demands a VPC. This stack
+ * itself never inspects the preset — it always provisions a VPC
+ * when constructed. The instantiation gate lives in the generator.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import { DATA_SAFETY_CONFIG } from '@venturekit/core';
+import { writeSsm, writeSsmStringList } from './shared/cross-stack-refs.js';
+import { networkKeys } from './shared/ssm-keys.js';
+/**
+ * Map a `days` retention setting to CDK's `logs.RetentionDays`
+ * enum, mirroring the existing helper in the legacy `VentureStack`.
+ * Kept inline (rather than imported from `stack.ts`) so this stack
+ * compiles independently of the legacy class — once the multi-stack
+ * cutover lands and `stack.ts` is deleted (plan §11 step 10), the
+ * helper has no other home anyway.
+ */
+function toLogRetention(days) {
+    if (days <= 1)
+        return logs.RetentionDays.ONE_DAY;
+    if (days <= 3)
+        return logs.RetentionDays.THREE_DAYS;
+    if (days <= 5)
+        return logs.RetentionDays.FIVE_DAYS;
+    if (days <= 7)
+        return logs.RetentionDays.ONE_WEEK;
+    if (days <= 14)
+        return logs.RetentionDays.TWO_WEEKS;
+    if (days <= 30)
+        return logs.RetentionDays.ONE_MONTH;
+    if (days <= 60)
+        return logs.RetentionDays.TWO_MONTHS;
+    if (days <= 90)
+        return logs.RetentionDays.THREE_MONTHS;
+    if (days <= 180)
+        return logs.RetentionDays.SIX_MONTHS;
+    if (days <= 365)
+        return logs.RetentionDays.ONE_YEAR;
+    return logs.RetentionDays.INFINITE;
+}
+export class VentureNetworkStack extends cdk.Stack {
+    /**
+     * In-process VPC reference for sibling stacks deployed in the
+     * same `cdk.App` (the standard `cdk deploy --all` case). Sibling
+     * stacks that take a direct CDK reference avoid one round-trip
+     * through SSM at synth time and get full CDK-typed access to the
+     * VPC abstraction, including AZ + subnet ordering.
+     *
+     * Cross-deploy and cross-account consumers must instead read the
+     * SSM parameters and reconstruct via `importVpc` from
+     * `shared/cross-stack-refs.ts` — that path uses
+     * `Vpc.fromVpcAttributes` which has slightly fewer affordances
+     * than the live reference (no `.selectSubnets({ subnetGroupName })`,
+     * for example).
+     */
+    vpc;
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { projectName, stage, envConfig } = props;
+        const vpcConfig = envConfig.vpc;
+        const dataSafetyConfig = DATA_SAFETY_CONFIG[envConfig.dataSafety];
+        // ── Subnet topology ───────────────────────────────────────────
+        // Always: public + private-with-egress.
+        // Optional: isolated subnets when the preset declares them
+        // (medium+ ships isolated for RDS — strict separation between
+        // workload subnets and database subnets, no chance of an
+        // accidental egress route reaching the DB).
+        const subnetConfig = [
+            { name: 'public', subnetType: ec2.SubnetType.PUBLIC, cidrMask: vpcConfig.publicSubnets.cidrMask },
+            { name: 'private', subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: vpcConfig.privateSubnets.cidrMask },
+        ];
+        if (vpcConfig.isolatedSubnets) {
+            subnetConfig.push({
+                name: 'isolated',
+                subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+                cidrMask: vpcConfig.isolatedSubnets.cidrMask,
+            });
+        }
+        // ── NAT provider ──────────────────────────────────────────────
+        // Cost-vs-reliability dial driven by the preset's `natType`:
+        //
+        //   - `'instance'` (nano/micro/medium): fck-nat AL2023 EC2
+        //     instance, ~$3-25/mo per AZ (vs $33/mo per AZ for managed
+        //     NAT GW + $0.045/GB processed). Single point of failure
+        //     in each AZ — the gateway VPC endpoints below + the
+        //     opt-in interface endpoints below substantially reduce
+        //     the blast radius of an instance outage.
+        //
+        //   - `'gateway'` (large): managed NAT Gateways, AWS SLA, zero
+        //     ops, much higher cost.
+        //
+        //   - `'none'` (free): no NAT at all. Private subnets become
+        //     egress-less; in-VPC dependencies must be reached via
+        //     gateway/interface endpoints or not at all. Used by the
+        //     free preset which doesn't put anything in private
+        //     subnets.
+        //
+        // fck-nat (Account `568608671756`) AMI is verified ARM64 AL2023
+        // and published in every commercial region; we pin the owner ID
+        // explicitly to avoid AMI-lookup typo-squatting.
+        const natGateways = vpcConfig.natType === 'none' ? 0 : vpcConfig.natGateways;
+        let natGatewayProvider;
+        if (vpcConfig.natType === 'instance' && natGateways > 0) {
+            natGatewayProvider = ec2.NatProvider.instanceV2({
+                instanceType: new ec2.InstanceType(vpcConfig.natInstanceType ?? 't4g.nano'),
+                machineImage: ec2.MachineImage.lookup({
+                    name: 'fck-nat-al2023-*-arm64-ebs',
+                    owners: ['568608671756'],
+                }),
+            });
+        }
+        // natType: 'gateway' leaves natGatewayProvider undefined, which
+        // is CDK's signal to provision managed NAT Gateways.
+        this.vpc = new ec2.Vpc(this, 'Vpc', {
+            maxAzs: vpcConfig.maxAzs,
+            natGateways,
+            natGatewayProvider,
+            ipAddresses: ec2.IpAddresses.cidr(vpcConfig.cidr),
+            subnetConfiguration: subnetConfig,
+            // Well-Architected: Security — the AWS-default SG allows
+            // anything-to-anything within the VPC; we lock it down so any
+            // SG attached without an explicit ingress rule effectively
+            // can't communicate, forcing thoughtful SG design.
+            restrictDefaultSecurityGroup: true,
+        });
+        // The L2 `ec2.Vpc` construct handles `DeletionPolicy=Retain`
+        // automatically when none of its dependents force replacement.
+        // We additionally pin `UpdateReplacePolicy=Retain` on the CFN
+        // VPC resource itself for production data-safety. CDK does not
+        // expose this knob via L2 props, so we drop to L1 here. This is
+        // the same pattern used in the legacy `VentureStack` for RDS,
+        // S3, etc.
+        if (dataSafetyConfig.removalPolicy === 'retain') {
+            const cfnVpc = this.vpc.node.defaultChild;
+            cfnVpc.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
+            cfnVpc.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+        }
+        // ── Flow logs ─────────────────────────────────────────────────
+        // Off by default on cheap presets (logs cost money; small dev
+        // environments don't need them). Strictly informational — the
+        // VPC functions identically without them.
+        if (vpcConfig.flowLogsEnabled) {
+            this.vpc.addFlowLog('FlowLog', {
+                destination: ec2.FlowLogDestination.toCloudWatchLogs(new logs.LogGroup(this, 'VpcFlowLogGroup', {
+                    logGroupName: `/venturekit/${projectName}/${stage}/vpc-flow-logs`,
+                    retention: toLogRetention(vpcConfig.flowLogsRetentionDays),
+                    removalPolicy: dataSafetyConfig.removalPolicy === 'retain'
+                        ? cdk.RemovalPolicy.RETAIN
+                        : cdk.RemovalPolicy.DESTROY,
+                })),
+                trafficType: ec2.FlowLogTrafficType.ALL,
+            });
+        }
+        // ── Gateway VPC endpoints — always on ─────────────────────────
+        // Free at hourly + per-GB rates. The route tables get an entry
+        // for the S3 / DynamoDB managed prefix lists pointing at the
+        // gateway endpoint, so VPC-internal traffic to those services
+        // never hits NAT.
+        //
+        // The migration runner's CodeBuild job downloads sources from
+        // `cdk-hnb659fds-assets-<account>-<region>` in S3; without the
+        // S3 gateway endpoint that traffic routes through NAT, which on
+        // the small presets is a single fck-nat instance and an outright
+        // reliability hazard (tracked as the "DOWNLOAD_SOURCE i/o
+        // timeout" production incident).
+        this.vpc.addGatewayEndpoint('S3Endpoint', {
+            service: ec2.GatewayVpcEndpointAwsService.S3,
+        });
+        this.vpc.addGatewayEndpoint('DynamoEndpoint', {
+            service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
+        });
+        // ── Interface endpoints — opt-in via preset ──────────────────
+        // ~$7.20/mo per AZ + $0.01/GB processed each, gated by
+        // `vpcConfig.enableVpcEndpoints` (off on free/nano, on for
+        // micro/medium/large). The single most-impactful endpoint to
+        // keep on is Secrets Manager: every VPC-attached Lambda calls
+        // `applyDbSecretToEnv()` on cold start, and without the
+        // endpoint that call traverses NAT — which on small presets is
+        // a single-AZ fck-nat instance whose hang would eat the entire
+        // Lambda timeout with no diagnostic output.
+        if (vpcConfig.enableVpcEndpoints) {
+            // Dedicated SG for interface endpoints. We allow inbound
+            // HTTPS from the VPC CIDR rather than from the Lambda SG,
+            // because:
+            //   1. The Lambda SG doesn't exist yet in this stack — it
+            //      lives in the app stack.
+            //   2. CIDR-based ingress is sufficient: interface endpoint
+            //      ENIs are addressable only from inside the VPC anyway.
+            const endpointSg = new ec2.SecurityGroup(this, 'VpcEndpointsSg', {
+                vpc: this.vpc,
+                description: `Interface endpoint SG for ${projectName}-${stage}`,
+                allowAllOutbound: false,
+            });
+            endpointSg.addIngressRule(ec2.Peer.ipv4(this.vpc.vpcCidrBlock), ec2.Port.tcp(443), 'HTTPS from anywhere in the VPC');
+            this.vpc.addInterfaceEndpoint('SecretsManagerEndpoint', {
+                service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
+                securityGroups: [endpointSg],
+                subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+                privateDnsEnabled: true,
+            });
+        }
+        // ── Publish the public surface to SSM ─────────────────────────
+        // Other tiers (data, app) read these via the
+        // `cross-stack-refs.importVpc(...)` helper. We deliberately
+        // publish the AZ list AND each subnet group separately rather
+        // than a denormalized blob — `Vpc.fromVpcAttributes` consumes
+        // them as parallel arrays, and storing the parts independently
+        // means a single subnet ID change doesn't churn the whole
+        // payload's hash.
+        writeSsm(this, networkKeys.vpcId(projectName, stage), this.vpc.vpcId, {
+            description: `VPC ID for ${projectName} ${stage}`,
+        });
+        writeSsmStringList(this, networkKeys.availabilityZones(projectName, stage), this.vpc.availabilityZones, { description: `AZ ordering for ${projectName} ${stage}` });
+        writeSsmStringList(this, networkKeys.privateSubnetIds(projectName, stage), this.vpc.privateSubnets.map((s) => s.subnetId), { description: `Private (with-egress) subnet IDs for ${projectName} ${stage}` });
+        writeSsmStringList(this, networkKeys.publicSubnetIds(projectName, stage), this.vpc.publicSubnets.map((s) => s.subnetId), { description: `Public subnet IDs for ${projectName} ${stage}` });
+        if (vpcConfig.isolatedSubnets) {
+            writeSsmStringList(this, networkKeys.isolatedSubnetIds(projectName, stage), this.vpc.isolatedSubnets.map((s) => s.subnetId), { description: `Isolated (no-egress) subnet IDs for ${projectName} ${stage}` });
+        }
+    }
+}
+//# sourceMappingURL=network-stack.js.map

package/dist/cdk/network-stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-stack.js","sourceRoot":"","sources":["../../src/cdk/network-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAkB,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAsBnD;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;IACjD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACpD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACnD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;IAClD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACrD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;IACvD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACtD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;IACpD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,GAAG,CAAC,KAAK;IAChD;;;;;;;;;;;;;OAaG;IACa,GAAG,CAAU;IAE7B,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA+B;QACvE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAChD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;QAChC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAElE,iEAAiE;QACjE,wCAAwC;QACxC,2DAA2D;QAC3D,8DAA8D;QAC9D,yDAAyD;QACzD,4CAA4C;QAC5C,MAAM,YAAY,GAA8B;YAC9C,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE;YACjG,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE;SACjH,CAAC;QACF,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YAC9B,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB;gBAC3C,QAAQ,EAAE,SAAS,CAAC,eAAe,CAAC,QAAQ;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,6DAA6D;QAC7D,EAAE;QACF,2DAA2D;QAC3D,+DAA+D;QAC/D,6DAA6D;QAC7D,yDAAyD;QACzD,4DAA4D;QAC5D,8CAA8C;QAC9C,EAAE;QACF,+DAA+D;QAC/D,6BAA6B;QAC7B,EAAE;QACF,6DAA6D;QAC7D,2DAA2D;QAC3D,6DAA6D;QAC7D,wDAAwD;QACxD,eAAe;QACf,EAAE;QACF,gEAAgE;QAChE,gEAAgE;QAChE,iDAAiD;QACjD,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC;QAC7E,IAAI,kBAA+C,CAAC;QACpD,IAAI,SAAS,CAAC,OAAO,KAAK,UAAU,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACxD,kBAAkB,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;gBAC9C,YAAY,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,eAAe,IAAI,UAAU,CAAC;gBAC3E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC;oBACpC,IAAI,EAAE,4BAA4B;oBAClC,MAAM,EAAE,CAAC,cAAc,CAAC;iBACzB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,gEAAgE;QAChE,qDAAqD;QAErD,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAClC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,WAAW;YACX,kBAAkB;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACjD,mBAAmB,EAAE,YAAY;YACjC,yDAAyD;YACzD,8DAA8D;YAC9D,2DAA2D;YAC3D,mDAAmD;YACnD,4BAA4B,EAAE,IAAI;SACnC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;QAChE,8DAA8D;QAC9D,WAAW;QACX,IAAI,gBAAgB,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC7D,MAAM,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAChE,MAAM,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACvE,CAAC;QAED,iEAAiE;QACjE,8DAA8D;QAC9D,8DAA8D;QAC9D,0CAA0C;QAC1C,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE;gBAC7B,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE;oBACzC,YAAY,EAAE,eAAe,WAAW,IAAI,KAAK,gBAAgB;oBACjE,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,qBAAqB,CAAC;oBAC1D,aAAa,EACX,gBAAgB,CAAC,aAAa,KAAK,QAAQ;wBACzC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM;wBAC1B,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;iBAChC,CAAC,CACH;gBACD,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG;aACxC,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,+DAA+D;QAC/D,6DAA6D;QAC7D,8DAA8D;QAC9D,kBAAkB;QAClB,EAAE;QACF,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;QAChE,iEAAiE;QACjE,0DAA0D;QAC1D,iCAAiC;QACjC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,EAAE;YACxC,OAAO,EAAE,GAAG,CAAC,4BAA4B,CAAC,EAAE;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,EAAE;YAC5C,OAAO,EAAE,GAAG,CAAC,4BAA4B,CAAC,QAAQ;SACnD,CAAC,CAAC;QAEH,gEAAgE;QAChE,uDAAuD;QACvD,2DAA2D;QAC3D,6DAA6D;QAC7D,8DAA8D;QAC9D,wDAAwD;QACxD,+DAA+D;QAC/D,+DAA+D;QAC/D,4CAA4C;QAC5C,IAAI,SAAS,CAAC,kBAAkB,EAAE,CAAC;YACjC,yDAAyD;YACzD,0DAA0D;YAC1D,WAAW;YACX,0DAA0D;YAC1D,+BAA+B;YAC/B,4DAA4D;YAC5D,6DAA6D;YAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,gBAAgB,EAAE;gBAC/D,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,6BAA6B,WAAW,IAAI,KAAK,EAAE;gBAChE,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAC;YACH,UAAU,CAAC,cAAc,CACvB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EACpC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EACjB,gCAAgC,CACjC,CAAC;YAEF,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,wBAAwB,EAAE;gBACtD,OAAO,EAAE,GAAG,CAAC,8BAA8B,CAAC,eAAe;gBAC3D,cAAc,EAAE,CAAC,UAAU,CAAC;gBAC5B,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE;gBAC3D,iBAAiB,EAAE,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,6CAA6C;QAC7C,4DAA4D;QAC5D,8DAA8D;QAC9D,8DAA8D;QAC9D,+DAA+D;QAC/D,0DAA0D;QAC1D,kBAAkB;QAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;YACpE,WAAW,EAAE,cAAc,WAAW,IAAI,KAAK,EAAE;SAClD,CAAC,CAAC;QACH,kBAAkB,CAChB,IAAI,EACJ,WAAW,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,EACjD,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAC1B,EAAE,WAAW,EAAE,mBAAmB,WAAW,IAAI,KAAK,EAAE,EAAE,CAC3D,CAAC;QACF,kBAAkB,CAChB,IAAI,EACJ,WAAW,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAChD,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAC3D,EAAE,WAAW,EAAE,wCAAwC,WAAW,IAAI,KAAK,EAAE,EAAE,CAChF,CAAC;QACF,kBAAkB,CAChB,IAAI,EACJ,WAAW,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,EAC/C,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAC1D,EAAE,WAAW,EAAE,yBAAyB,WAAW,IAAI,KAAK,EAAE,EAAE,CACjE,CAAC;QACF,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YAC9B,kBAAkB,CAChB,IAAI,EACJ,WAAW,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,EACjD,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAC5D,EAAE,WAAW,EAAE,uCAAuC,WAAW,IAAI,KAAK,EAAE,EAAE,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/cdk/shared/cross-stack-refs.d.ts

@@ -0,0 +1,278 @@
+/**
+ * Cross-stack reference helpers for the lifecycle-aligned multi-stack
+ * layout. Producers write SSM `String` parameters; consumers read via
+ * CFN dynamic references (`{{resolve:ssm:…}}`) which AWS resolves at
+ * deploy time without forming a CFN stack-graph dependency.
+ *
+ * # Producer side: `writeSsm` / `writeSsmStringList`
+ *
+ * Producer stacks (network, data, identity, config, messaging, edge)
+ * publish their public surface by calling these helpers. The actual
+ * CDK construct is `ssm.StringParameter` — we wrap it for two
+ * reasons:
+ *
+ *   1. Stable logical IDs. CDK's default ID derives from the
+ *      construct path; we want IDs that don't churn across refactors
+ *      so a producer-side rename (e.g. moving from
+ *      `VentureDataStack.createRds` to `…createDatabase`) doesn't
+ *      orphan the parameter and force a redeploy of every consumer.
+ *      We derive the logical ID from a slug of the parameter name
+ *      (`/venturekit/p/s/data/rds/main/endpoint` →
+ *      `SsmVenturekitPSDataRdsMainEndpoint`), which is stable
+ *      regardless of where in the stack tree the call site lives.
+ *
+ *   2. Single audit point. Every cross-stack value flowing out of a
+ *      producer goes through `writeSsm`, so security review can grep
+ *      one symbol to enumerate the public surface.
+ *
+ * # Consumer side: `readSsm…` + `import…`
+ *
+ * Consumers never instantiate AWS resources from raw construct props;
+ * they call the typed `import…` helpers below which encapsulate the
+ * full `Foo.fromXAttributes({...})` rehydration. That keeps the
+ * cross-stack contract narrow: the producer publishes exactly the
+ * fields the importer expects, the importer fails loudly at synth if
+ * any are missing, and any change to the contract shape forces a
+ * coordinated edit at both ends.
+ *
+ * # Why not `Stack.exportValue` / `Fn::ImportValue`?
+ *
+ * See the long-form rationale in `ssm-keys.ts`. tl;dr: CFN exports
+ * carry a hard "cannot modify a consumed export" lock that makes the
+ * stable lower tiers unable to evolve. SSM dynamic references have
+ * no such lock.
+ *
+ * # Why not StringList parameters?
+ *
+ * SSM `StringList` parameters cannot be referenced by the
+ * `{{resolve:ssm:...}}` dynamic-reference syntax — only `String` and
+ * `SecureString`. We work around it by storing comma-joined strings
+ * via `writeSsmStringList` and splitting on read via
+ * `readSsmStringList`. The split happens at deploy time inside CDK
+ * after the dynamic reference resolves, so it works transparently.
+ */
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as cognito from 'aws-cdk-lib/aws-cognito';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import { Construct } from 'constructs';
+/**
+ * Convert an SSM parameter name to a stable CDK logical ID.
+ *
+ * Rules:
+ *   - Drop the leading slash.
+ *   - Replace every non-alphanumeric character with a single space.
+ *   - Title-case each word, drop spaces.
+ *   - Prefix `Ssm` so logical IDs are namespaced.
+ *
+ * `/venturekit/myapp/prod/data/rds/main/endpoint` →
+ *   `SsmVenturekitMyappProdDataRdsMainEndpoint`
+ *
+ * The output is deterministic, contains only alphanumerics, fits well
+ * within CFN's 255-char logical-ID limit (a maximally long key like
+ * `/venturekit/<32-char-project>/<8-char-stage>/messaging/queues/<32-char-id>/visibility-timeout-seconds`
+ * yields a ~120-char logical ID), and is stable across producer
+ * refactors.
+ */
+export declare function logicalIdForParameter(parameterName: string): string;
+export interface WriteSsmOptions {
+    /**
+     * Optional human-readable description stored on the SSM parameter
+     * itself. Useful for operators inspecting parameters via
+     * `aws ssm describe-parameters` — the description shows up in the
+     * console alongside the key.
+     */
+    description?: string;
+}
+/**
+ * Publish a single string value to SSM at `name`. Returns the
+ * underlying `ssm.StringParameter` so the caller can grant additional
+ * IAM permissions (rare; the default SSM-read IAM is sufficient for
+ * the dynamic-reference path).
+ *
+ * Idempotent within one synth: calling `writeSsm` twice with the same
+ * name in the same stack throws CDK's standard
+ * "Construct with id 'X' already exists" — that's a producer bug
+ * (two producers claiming the same key).
+ */
+export declare function writeSsm(scope: Construct, name: string, value: string, opts?: WriteSsmOptions): ssm.StringParameter;
+/**
+ * Publish a list as a single comma-joined `String` parameter. Use
+ * this for things like subnet ID lists where the consumer needs the
+ * individual values back. SSM `StringList` parameters are rejected
+ * by the `{{resolve:ssm:…}}` dynamic reference, so we round-trip via
+ * comma-joined strings.
+ *
+ * Throws if any element contains a comma — that would silently
+ * corrupt the list on read. AWS resource IDs (subnet IDs, AZ names,
+ * security group IDs) are guaranteed comma-free, so this should
+ * never fire in practice; the assertion just locks the assumption.
+ */
+export declare function writeSsmStringList(scope: Construct, name: string, values: string[], opts?: WriteSsmOptions): ssm.StringParameter;
+/**
+ * Read a single SSM string parameter as a CFN dynamic reference.
+ * The returned token resolves to the parameter's current value at
+ * deploy time — there is NO build-time / synth-time AWS API call,
+ * so this works in hermetic CI without AWS credentials.
+ *
+ * The token can be passed anywhere CDK accepts a string property
+ * (resource ARNs, IDs, env vars). It cannot be inspected at synth
+ * time — `console.log(value)` will print `${Token[TOKEN.123]}`,
+ * not the actual value.
+ */
+export declare function readSsmString(scope: Construct, name: string): string;
+/**
+ * Read a comma-joined `String` parameter and split it back into a
+ * list. Used as the symmetric counterpart to `writeSsmStringList`.
+ *
+ * Implementation note: because the parameter value is a CFN token
+ * resolved at deploy time, we cannot call `.split(',')` directly —
+ * the token is opaque to JS. CDK's `Fn.split` produces a CFN
+ * `Fn::Split` intrinsic that runs at deploy time; we then use
+ * `Fn.select` to access individual elements OR pass the whole
+ * `cdk.Token`-wrapped array into a context that accepts arrays.
+ *
+ * `count` is the **expected** number of elements — required because
+ * `Fn::Split` returns a length-unknown list and CDK refuses to
+ * iterate it without a hint. Callers who don't know the count up
+ * front (rare) should pass it through SSM as a separate parameter.
+ */
+export declare function readSsmStringList(scope: Construct, name: string, count: number): string[];
+export interface ImportVpcParams {
+    vpcId: string;
+    /** AZ list, ordered to match the subnet ID lists. */
+    availabilityZones: string[];
+    /** Per-AZ private subnet IDs — same length + ordering as `availabilityZones`. */
+    privateSubnetIds: string[];
+    /** Per-AZ public subnet IDs (optional). */
+    publicSubnetIds?: string[];
+    /** Per-AZ isolated subnet IDs (optional). */
+    isolatedSubnetIds?: string[];
+}
+/**
+ * Reconstruct a VPC abstraction from its public attributes (read out
+ * of SSM by the consumer). This deliberately uses
+ * `Vpc.fromVpcAttributes` rather than `Vpc.fromLookup` because:
+ *
+ *   1. `fromLookup` makes a real `ec2:DescribeVpcs` API call at synth
+ *      time, breaking hermetic CI (the runner needs IAM creds).
+ *   2. `fromLookup` writes results into `cdk.context.json`, which
+ *      then needs to be checked in or regenerated; that's another
+ *      moving part for no benefit when the consumer already has
+ *      every needed attribute via SSM.
+ *
+ * AZ + subnet-ID lists must be the same length and same ordering —
+ * CDK uses the index to pair each subnet with its AZ. Lists shorter
+ * than the AZ list mean "no subnet in that AZ"; CDK handles that fine.
+ */
+export declare function importVpc(scope: Construct, id: string, params: ImportVpcParams): ec2.IVpc;
+export interface ImportRdsConnectionParams {
+    /** Output of `dataKeys.rdsEndpoint`. */
+    endpoint: string;
+    /** Output of `dataKeys.rdsPort` — string from SSM, parsed to number. */
+    port: string | number;
+    /** Output of `dataKeys.rdsSecurityGroupId`. */
+    securityGroupId: string;
+}
+export interface ImportedRdsConnection {
+    /** RDS host (passed straight through; consumer assembles the JDBC URL). */
+    endpoint: string;
+    /** Port as a number. */
+    port: number;
+    /**
+     * Imported SecurityGroup. The consumer attaches a Lambda SG and
+     * calls `rdsSg.connections.allowFrom(lambdaSg, ec2.Port.tcp(port))`
+     * — that emits an `AWS::EC2::SecurityGroupIngress` in the consumer
+     * stack which is removed cleanly on consumer-stack delete (plan
+     * §6.1).
+     */
+    securityGroup: ec2.ISecurityGroup;
+}
+/**
+ * Import the RDS connection surface (endpoint + port + SG) without
+ * actually instantiating an `IDatabaseInstance` — we don't need the
+ * full DB abstraction in the app stack, just enough to point Lambdas
+ * at it and open the SG.
+ */
+export declare function importRdsConnection(scope: Construct, id: string, params: ImportRdsConnectionParams): ImportedRdsConnection;
+/**
+ * Import an S3 bucket by ARN. Returns an `IBucket` so the consumer
+ * can call `bucket.grantReadWrite(lambdaRole)` etc. — those grants
+ * land in the consumer stack's IAM policy, leaving the bucket
+ * itself untouched.
+ *
+ * `Bucket.fromBucketArn` returns a less-typed view (no
+ * encryption/versioning info) than `fromBucketAttributes`, but for
+ * IAM grants and env-var injection that's all the app stack needs.
+ */
+export declare function importBucket(scope: Construct, id: string, bucketArn: string): s3.IBucket;
+/**
+ * Import a DynamoDB table by ARN. Returns an `ITable` for IAM
+ * grants. Note: `Table.fromTableArn` does NOT include the GSI
+ * indexes — for `Query` against a GSI, the consumer must call
+ * `Table.fromTableAttributes({ tableArn, globalIndexes: ['gsi1'] })`
+ * instead. Since most app-stack code paths only read/write the
+ * primary key, ARN-only is the common case; we wrap it here for
+ * convenience and document the GSI exception.
+ */
+export declare function importDynamoTable(scope: Construct, id: string, tableArn: string): dynamodb.ITable;
+export interface ImportUserPoolParams {
+    userPoolId: string;
+    userPoolArn: string;
+}
+/**
+ * Import a Cognito User Pool. The pool ID is what `AdminInitiateAuth`
+ * etc. need at runtime; the ARN is what IAM policies scope to. Both
+ * are published by the identity stack via `identityKeys`.
+ */
+export declare function importUserPool(scope: Construct, id: string, params: ImportUserPoolParams): cognito.IUserPool;
+/**
+ * Import an SQS queue by ARN. The CDK helper extracts the URL from
+ * the ARN under the standard naming convention, which is what
+ * Lambda's `addEventSource(new SqsEventSource(queue))` wants.
+ *
+ * On consumer-stack delete, the resulting `EventSourceMapping` is
+ * removed; the queue + DLQ + buffered messages live on in the
+ * messaging stack (plan §6.2).
+ */
+export declare function importQueue(scope: Construct, id: string, queueArn: string): sqs.IQueue;
+/**
+ * Import an SNS topic by ARN. Used by the app stack to subscribe
+ * the bounce-handler Lambda to the notify events topic created in
+ * the config tier.
+ */
+export declare function importTopic(scope: Construct, id: string, topicArn: string): sns.ITopic;
+/**
+ * Import a Secrets Manager secret by ARN. Used for every
+ * cross-stack secret reference (RDS master credentials, federated
+ * provider OAuth credentials, WhatsApp tokens, operator-declared
+ * `secrets` intents).
+ */
+export declare function importSecret(scope: Construct, id: string, secretArn: string): secretsmanager.ISecret;
+export interface ImportHttpApiParams {
+    apiId: string;
+    /**
+     * Default-stage name. Always `'$default'` for HttpApi today; we
+     * still accept it as a parameter for forward-compat with named
+     * stages.
+     */
+    defaultStageName: string;
+}
+/**
+ * Import an API Gateway HttpApi. The app stack needs this to add
+ * routes that target Lambdas in the app stack itself — the route
+ * `AWS::ApiGatewayV2::Route` resource lives in the consumer (app)
+ * stack and references the imported API by ID.
+ *
+ * IMPORTANT: `HttpApi.fromHttpApiAttributes` does NOT carry the
+ * `defaultStage` in its returned `IHttpApi`; consumers that need
+ * to attach access logs or stage variables must manage that
+ * separately on the producer (edge) side.
+ */
+export declare function importHttpApi(scope: Construct, id: string, params: ImportHttpApiParams): apigatewayv2.IHttpApi;
+//# sourceMappingURL=cross-stack-refs.d.ts.map

package/dist/cdk/shared/cross-stack-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-stack-refs.d.ts","sourceRoot":"","sources":["../../../src/cdk/shared/cross-stack-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAGH,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAanE;AAID,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,eAAoB,GACzB,GAAG,CAAC,eAAe,CAoBrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,GAAE,eAAoB,GACzB,GAAG,CAAC,eAAe,CAYrB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAiBV;AAID,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,eAAe,GACtB,GAAG,CAAC,IAAI,CAQV;AAED,MAAM,WAAW,yBAAyB;IACxC,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,yBAAyB,GAChC,qBAAqB,CAsBvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,EAAE,CAAC,OAAO,CAEZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GACf,QAAQ,CAAC,MAAM,CAEjB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,SAAS,CAMnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GACf,GAAG,CAAC,MAAM,CAEZ;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GACf,GAAG,CAAC,MAAM,CAEZ;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,cAAc,CAAC,OAAO,CAExB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,EAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,mBAAmB,GAC1B,YAAY,CAAC,QAAQ,CAIvB"}