@venturekit/infra 0.0.0-dev.20260514025219 → 0.0.0-dev.20260515022321

package/dist/cdk/shared/cross-stack-refs.js

@@ -0,0 +1,326 @@
+/**
+ * Cross-stack reference helpers for the lifecycle-aligned multi-stack
+ * layout. Producers write SSM `String` parameters; consumers read via
+ * CFN dynamic references (`{{resolve:ssm:…}}`) which AWS resolves at
+ * deploy time without forming a CFN stack-graph dependency.
+ *
+ * # Producer side: `writeSsm` / `writeSsmStringList`
+ *
+ * Producer stacks (network, data, identity, config, messaging, edge)
+ * publish their public surface by calling these helpers. The actual
+ * CDK construct is `ssm.StringParameter` — we wrap it for two
+ * reasons:
+ *
+ *   1. Stable logical IDs. CDK's default ID derives from the
+ *      construct path; we want IDs that don't churn across refactors
+ *      so a producer-side rename (e.g. moving from
+ *      `VentureDataStack.createRds` to `…createDatabase`) doesn't
+ *      orphan the parameter and force a redeploy of every consumer.
+ *      We derive the logical ID from a slug of the parameter name
+ *      (`/venturekit/p/s/data/rds/main/endpoint` →
+ *      `SsmVenturekitPSDataRdsMainEndpoint`), which is stable
+ *      regardless of where in the stack tree the call site lives.
+ *
+ *   2. Single audit point. Every cross-stack value flowing out of a
+ *      producer goes through `writeSsm`, so security review can grep
+ *      one symbol to enumerate the public surface.
+ *
+ * # Consumer side: `readSsm…` + `import…`
+ *
+ * Consumers never instantiate AWS resources from raw construct props;
+ * they call the typed `import…` helpers below which encapsulate the
+ * full `Foo.fromXAttributes({...})` rehydration. That keeps the
+ * cross-stack contract narrow: the producer publishes exactly the
+ * fields the importer expects, the importer fails loudly at synth if
+ * any are missing, and any change to the contract shape forces a
+ * coordinated edit at both ends.
+ *
+ * # Why not `Stack.exportValue` / `Fn::ImportValue`?
+ *
+ * See the long-form rationale in `ssm-keys.ts`. tl;dr: CFN exports
+ * carry a hard "cannot modify a consumed export" lock that makes the
+ * stable lower tiers unable to evolve. SSM dynamic references have
+ * no such lock.
+ *
+ * # Why not StringList parameters?
+ *
+ * SSM `StringList` parameters cannot be referenced by the
+ * `{{resolve:ssm:...}}` dynamic-reference syntax — only `String` and
+ * `SecureString`. We work around it by storing comma-joined strings
+ * via `writeSsmStringList` and splitting on read via
+ * `readSsmStringList`. The split happens at deploy time inside CDK
+ * after the dynamic reference resolves, so it works transparently.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as cognito from 'aws-cdk-lib/aws-cognito';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+// ─── Logical-ID derivation ────────────────────────────────────────────
+/**
+ * Convert an SSM parameter name to a stable CDK logical ID.
+ *
+ * Rules:
+ *   - Drop the leading slash.
+ *   - Replace every non-alphanumeric character with a single space.
+ *   - Title-case each word, drop spaces.
+ *   - Prefix `Ssm` so logical IDs are namespaced.
+ *
+ * `/venturekit/myapp/prod/data/rds/main/endpoint` →
+ *   `SsmVenturekitMyappProdDataRdsMainEndpoint`
+ *
+ * The output is deterministic, contains only alphanumerics, fits well
+ * within CFN's 255-char logical-ID limit (a maximally long key like
+ * `/venturekit/<32-char-project>/<8-char-stage>/messaging/queues/<32-char-id>/visibility-timeout-seconds`
+ * yields a ~120-char logical ID), and is stable across producer
+ * refactors.
+ */
+export function logicalIdForParameter(parameterName) {
+    const cleaned = parameterName
+        .replace(/^\/+/, '')
+        .replace(/[^a-zA-Z0-9]+/g, ' ')
+        .trim()
+        .split(/\s+/)
+        .map((segment) => segment.length === 0
+        ? ''
+        : segment[0].toUpperCase() + segment.slice(1).toLowerCase())
+        .join('');
+    return `Ssm${cleaned}`;
+}
+/**
+ * Publish a single string value to SSM at `name`. Returns the
+ * underlying `ssm.StringParameter` so the caller can grant additional
+ * IAM permissions (rare; the default SSM-read IAM is sufficient for
+ * the dynamic-reference path).
+ *
+ * Idempotent within one synth: calling `writeSsm` twice with the same
+ * name in the same stack throws CDK's standard
+ * "Construct with id 'X' already exists" — that's a producer bug
+ * (two producers claiming the same key).
+ */
+export function writeSsm(scope, name, value, opts = {}) {
+    const logicalId = logicalIdForParameter(name);
+    const param = new ssm.StringParameter(scope, logicalId, {
+        parameterName: name,
+        stringValue: value,
+        description: opts.description,
+        // Standard tier — free, 4 KB max value. None of our cross-stack
+        // values come anywhere near that ceiling (the largest is the
+        // comma-joined subnet IDs, ~150 bytes for 6 subnet IDs). Going
+        // Advanced would just cost money for no benefit.
+        tier: ssm.ParameterTier.STANDARD,
+    });
+    // Pin the CFN logical ID to exactly the slug we derived from the
+    // parameter name. CDK's default allocator appends an 8-char hash
+    // suffix to disambiguate L2 children that wrap an L1 `Resource`,
+    // which would make the logical ID unstable across CDK upgrades and
+    // less greppable. The slug already encodes the parameter name, so
+    // collisions inside one stack are impossible by construction.
+    param.node.defaultChild.overrideLogicalId(logicalId);
+    return param;
+}
+/**
+ * Publish a list as a single comma-joined `String` parameter. Use
+ * this for things like subnet ID lists where the consumer needs the
+ * individual values back. SSM `StringList` parameters are rejected
+ * by the `{{resolve:ssm:…}}` dynamic reference, so we round-trip via
+ * comma-joined strings.
+ *
+ * Throws if any element contains a comma — that would silently
+ * corrupt the list on read. AWS resource IDs (subnet IDs, AZ names,
+ * security group IDs) are guaranteed comma-free, so this should
+ * never fire in practice; the assertion just locks the assumption.
+ */
+export function writeSsmStringList(scope, name, values, opts = {}) {
+    for (const v of values) {
+        if (v.includes(',')) {
+            throw new Error(`writeSsmStringList: value '${v}' for parameter '${name}' contains a comma. ` +
+                `Comma-joined storage in SSM is the cross-stack workaround for the lack of ` +
+                `StringList support in CFN dynamic references; commas inside values would ` +
+                `silently corrupt the round-trip on the consumer side.`);
+        }
+    }
+    return writeSsm(scope, name, values.join(','), opts);
+}
+// ─── Consumer helpers ────────────────────────────────────────────────
+/**
+ * Read a single SSM string parameter as a CFN dynamic reference.
+ * The returned token resolves to the parameter's current value at
+ * deploy time — there is NO build-time / synth-time AWS API call,
+ * so this works in hermetic CI without AWS credentials.
+ *
+ * The token can be passed anywhere CDK accepts a string property
+ * (resource ARNs, IDs, env vars). It cannot be inspected at synth
+ * time — `console.log(value)` will print `${Token[TOKEN.123]}`,
+ * not the actual value.
+ */
+export function readSsmString(scope, name) {
+    return ssm.StringParameter.valueForStringParameter(scope, name);
+}
+/**
+ * Read a comma-joined `String` parameter and split it back into a
+ * list. Used as the symmetric counterpart to `writeSsmStringList`.
+ *
+ * Implementation note: because the parameter value is a CFN token
+ * resolved at deploy time, we cannot call `.split(',')` directly —
+ * the token is opaque to JS. CDK's `Fn.split` produces a CFN
+ * `Fn::Split` intrinsic that runs at deploy time; we then use
+ * `Fn.select` to access individual elements OR pass the whole
+ * `cdk.Token`-wrapped array into a context that accepts arrays.
+ *
+ * `count` is the **expected** number of elements — required because
+ * `Fn::Split` returns a length-unknown list and CDK refuses to
+ * iterate it without a hint. Callers who don't know the count up
+ * front (rare) should pass it through SSM as a separate parameter.
+ */
+export function readSsmStringList(scope, name, count) {
+    if (!Number.isInteger(count) || count <= 0) {
+        throw new Error(`readSsmStringList: 'count' must be a positive integer (got ${count}). ` +
+            `CFN's Fn::Split returns a length-unknown list; CDK can't iterate it ` +
+            `without an expected length.`);
+    }
+    const joined = readSsmString(scope, name);
+    // Fn.split returns a Token-wrapped array of strings. Fn.select picks
+    // a specific index. We unroll the list synchronously based on
+    // `count` so callers can pass the result anywhere a `string[]` is
+    // expected.
+    const tokens = cdk.Fn.split(',', joined, count);
+    // `cdk.Fn.split` already returns a string[]-typed token list of
+    // exactly `count` elements; surface it directly.
+    return tokens;
+}
+/**
+ * Reconstruct a VPC abstraction from its public attributes (read out
+ * of SSM by the consumer). This deliberately uses
+ * `Vpc.fromVpcAttributes` rather than `Vpc.fromLookup` because:
+ *
+ *   1. `fromLookup` makes a real `ec2:DescribeVpcs` API call at synth
+ *      time, breaking hermetic CI (the runner needs IAM creds).
+ *   2. `fromLookup` writes results into `cdk.context.json`, which
+ *      then needs to be checked in or regenerated; that's another
+ *      moving part for no benefit when the consumer already has
+ *      every needed attribute via SSM.
+ *
+ * AZ + subnet-ID lists must be the same length and same ordering —
+ * CDK uses the index to pair each subnet with its AZ. Lists shorter
+ * than the AZ list mean "no subnet in that AZ"; CDK handles that fine.
+ */
+export function importVpc(scope, id, params) {
+    return ec2.Vpc.fromVpcAttributes(scope, id, {
+        vpcId: params.vpcId,
+        availabilityZones: params.availabilityZones,
+        privateSubnetIds: params.privateSubnetIds,
+        publicSubnetIds: params.publicSubnetIds,
+        isolatedSubnetIds: params.isolatedSubnetIds,
+    });
+}
+/**
+ * Import the RDS connection surface (endpoint + port + SG) without
+ * actually instantiating an `IDatabaseInstance` — we don't need the
+ * full DB abstraction in the app stack, just enough to point Lambdas
+ * at it and open the SG.
+ */
+export function importRdsConnection(scope, id, params) {
+    const port = typeof params.port === 'number'
+        ? params.port
+        : Number.parseInt(params.port, 10);
+    if (!Number.isFinite(port)) {
+        throw new Error(`importRdsConnection: failed to parse RDS port from value '${params.port}'. ` +
+            `The producer (data stack) writes port as a numeric string via the SSM ` +
+            `parameter at ${id}.`);
+    }
+    const securityGroup = ec2.SecurityGroup.fromSecurityGroupId(scope, `${id}-sg`, params.securityGroupId, 
+    // `mutable: true` lets the consumer add ingress rules locally
+    // (the rule lands in the consumer stack; the imported SG itself
+    // is unchanged in the producer stack).
+    { mutable: true });
+    return { endpoint: params.endpoint, port, securityGroup };
+}
+/**
+ * Import an S3 bucket by ARN. Returns an `IBucket` so the consumer
+ * can call `bucket.grantReadWrite(lambdaRole)` etc. — those grants
+ * land in the consumer stack's IAM policy, leaving the bucket
+ * itself untouched.
+ *
+ * `Bucket.fromBucketArn` returns a less-typed view (no
+ * encryption/versioning info) than `fromBucketAttributes`, but for
+ * IAM grants and env-var injection that's all the app stack needs.
+ */
+export function importBucket(scope, id, bucketArn) {
+    return s3.Bucket.fromBucketArn(scope, id, bucketArn);
+}
+/**
+ * Import a DynamoDB table by ARN. Returns an `ITable` for IAM
+ * grants. Note: `Table.fromTableArn` does NOT include the GSI
+ * indexes — for `Query` against a GSI, the consumer must call
+ * `Table.fromTableAttributes({ tableArn, globalIndexes: ['gsi1'] })`
+ * instead. Since most app-stack code paths only read/write the
+ * primary key, ARN-only is the common case; we wrap it here for
+ * convenience and document the GSI exception.
+ */
+export function importDynamoTable(scope, id, tableArn) {
+    return dynamodb.Table.fromTableArn(scope, id, tableArn);
+}
+/**
+ * Import a Cognito User Pool. The pool ID is what `AdminInitiateAuth`
+ * etc. need at runtime; the ARN is what IAM policies scope to. Both
+ * are published by the identity stack via `identityKeys`.
+ */
+export function importUserPool(scope, id, params) {
+    // `fromUserPoolArn` is sufficient: CDK extracts the pool ID from
+    // the ARN, and the resulting IUserPool exposes `userPoolId`.
+    // Passing both fields explicitly via `fromUserPoolAttributes`
+    // would be redundant.
+    return cognito.UserPool.fromUserPoolArn(scope, id, params.userPoolArn);
+}
+/**
+ * Import an SQS queue by ARN. The CDK helper extracts the URL from
+ * the ARN under the standard naming convention, which is what
+ * Lambda's `addEventSource(new SqsEventSource(queue))` wants.
+ *
+ * On consumer-stack delete, the resulting `EventSourceMapping` is
+ * removed; the queue + DLQ + buffered messages live on in the
+ * messaging stack (plan §6.2).
+ */
+export function importQueue(scope, id, queueArn) {
+    return sqs.Queue.fromQueueArn(scope, id, queueArn);
+}
+/**
+ * Import an SNS topic by ARN. Used by the app stack to subscribe
+ * the bounce-handler Lambda to the notify events topic created in
+ * the config tier.
+ */
+export function importTopic(scope, id, topicArn) {
+    return sns.Topic.fromTopicArn(scope, id, topicArn);
+}
+/**
+ * Import a Secrets Manager secret by ARN. Used for every
+ * cross-stack secret reference (RDS master credentials, federated
+ * provider OAuth credentials, WhatsApp tokens, operator-declared
+ * `secrets` intents).
+ */
+export function importSecret(scope, id, secretArn) {
+    return secretsmanager.Secret.fromSecretCompleteArn(scope, id, secretArn);
+}
+/**
+ * Import an API Gateway HttpApi. The app stack needs this to add
+ * routes that target Lambdas in the app stack itself — the route
+ * `AWS::ApiGatewayV2::Route` resource lives in the consumer (app)
+ * stack and references the imported API by ID.
+ *
+ * IMPORTANT: `HttpApi.fromHttpApiAttributes` does NOT carry the
+ * `defaultStage` in its returned `IHttpApi`; consumers that need
+ * to attach access logs or stage variables must manage that
+ * separately on the producer (edge) side.
+ */
+export function importHttpApi(scope, id, params) {
+    return apigatewayv2.HttpApi.fromHttpApiAttributes(scope, id, {
+        httpApiId: params.apiId,
+    });
+}
+//# sourceMappingURL=cross-stack-refs.js.map

package/dist/cdk/shared/cross-stack-refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-stack-refs.js","sourceRoot":"","sources":["../../../src/cdk/shared/cross-stack-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAC;AAGrD,yEAAyE;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,MAAM,OAAO,GAAG,aAAa;SAC1B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,OAAO,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAC/D;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,MAAM,OAAO,EAAE,CAAC;AACzB,CAAC;AAcD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAgB,EAChB,IAAY,EACZ,KAAa,EACb,OAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE;QACtD,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gEAAgE;QAChE,6DAA6D;QAC7D,+DAA+D;QAC/D,iDAAiD;QACjD,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,QAAQ;KACjC,CAAC,CAAC;IACH,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC7D,KAAK,CAAC,IAAI,CAAC,YAAgC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAgB,EAChB,IAAY,EACZ,MAAgB,EAChB,OAAwB,EAAE;IAE1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,8BAA8B,CAAC,oBAAoB,IAAI,sBAAsB;gBAC7E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,uDAAuD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB,EAAE,IAAY;IAC1D,OAAO,GAAG,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgB,EAChB,IAAY,EACZ,KAAa;IAEb,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,8DAA8D,KAAK,KAAK;YACxE,sEAAsE;YACtE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,qEAAqE;IACrE,8DAA8D;IAC9D,kEAAkE;IAClE,YAAY;IACZ,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,gEAAgE;IAChE,iDAAiD;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,SAAS,CACvB,KAAgB,EAChB,EAAU,EACV,MAAuB;IAEvB,OAAO,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC,CAAC;AACL,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAgB,EAChB,EAAU,EACV,MAAiC;IAEjC,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC7B,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,6DAA6D,MAAM,CAAC,IAAI,KAAK;YAC7E,wEAAwE;YACxE,gBAAgB,EAAE,GAAG,CACtB,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC,mBAAmB,CACzD,KAAK,EACL,GAAG,EAAE,KAAK,EACV,MAAM,CAAC,eAAe;IACtB,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;IACvC,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAgB,EAChB,EAAU,EACV,SAAiB;IAEjB,OAAO,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgB,EAChB,EAAU,EACV,QAAgB;IAEhB,OAAO,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAgB,EAChB,EAAU,EACV,MAA4B;IAE5B,iEAAiE;IACjE,6DAA6D;IAC7D,8DAA8D;IAC9D,sBAAsB;IACtB,OAAO,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,KAAgB,EAChB,EAAU,EACV,QAAgB;IAEhB,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,KAAgB,EAChB,EAAU,EACV,QAAgB;IAEhB,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAgB,EAChB,EAAU,EACV,SAAiB;IAEjB,OAAO,cAAc,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AAC3E,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAgB,EAChB,EAAU,EACV,MAA2B;IAE3B,OAAO,YAAY,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,EAAE;QAC3D,SAAS,EAAE,MAAM,CAAC,KAAK;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/cdk/shared/lambda-helpers.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Lambda-bundling + runtime-mapping helpers shared between the legacy
+ * `VentureStack` and the new per-tier `VentureAppStack`. Pure
+ * functions only — no class state, no hidden globals beyond the
+ * lazily-loaded esbuild module.
+ *
+ * # Why a shared module
+ *
+ * During the §11 multi-stack migration both `stack.ts` (legacy) and
+ * `app-stack.ts` need to bundle handlers, map preset config to the
+ * `lambda.Runtime` / `lambda.Architecture` enums, and compute log-
+ * retention. Duplicating ~80 lines of bundling logic between two
+ * files would diverge over time. Step §11.10 deletes the legacy
+ * stack and this module becomes the single home.
+ */
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import type { EnvConfig } from '@venturekit/core';
+/**
+ * Bundle a Lambda handler in-process via esbuild's synchronous API.
+ *
+ * Replaces an earlier Docker-based bundling pipeline that spun up a
+ * SAM Node 20 image, ran `npm install -g esbuild`, and bundled the
+ * handler — taking ~30 s per Lambda. With 100+ handlers in a project
+ * that meant over an hour of synth time and a long tail of Docker-
+ * related failure modes (UID/HOME/permission edge cases on GitHub-
+ * hosted runners). In-process bundling collapses the entire sequence
+ * to a single `esbuild.buildSync` call: sub-second per handler,
+ * native Node module resolution against the consumer's `node_modules`,
+ * no Docker daemon dependency.
+ *
+ * The asset is the temp directory holding the bundled `index.js`, so
+ * CDK uploads only the bundled output to S3 — never the source tree.
+ *
+ * Modules baked into the Lambda runtime (`@aws-sdk/*`) are kept
+ * external so they aren't redundantly included in the bundle.
+ */
+export declare function bundleHandlerCodeWithEsbuild(handlerFile: string, projectDir: string): lambda.Code;
+/**
+ * Inline Lambda stub used in unit tests when `skipBundling: true`.
+ * Satisfies API Gateway's contract; tests assert on resource shape,
+ * not on Lambda execution.
+ */
+export declare function inlineStubLambdaCode(): lambda.Code;
+export declare function toLambdaRuntime(envConfig: EnvConfig): lambda.Runtime;
+export declare function toLambdaArchitecture(envConfig: EnvConfig): lambda.Architecture;
+export declare function toLogRetention(days: number): logs.RetentionDays;
+/**
+ * Tiny non-cryptographic 6-char hex hash. Used only to disambiguate
+ * Lambda function names that would otherwise overflow the 64-char
+ * limit; collision risk is acceptable because the truncated prefix
+ * already encodes most of the route path.
+ */
+export declare function shortHash(input: string): string;
+/**
+ * Cap a Lambda function name at the AWS hard limit (64 chars). When
+ * the natural name overflows, replace the trailing portion with a
+ * 6-char hash of the original — preserving the first 56 chars so
+ * operators can still recognize the resource by prefix.
+ */
+export declare function clampLambdaFunctionName(rawName: string): string;
+/**
+ * Recursively discover Lambda handler files under a directory. Used
+ * for `src/queues/`, `src/crons/`, `src/functions/` — all of which
+ * follow the same convention: every `.ts` / `.js` file (excluding
+ * `.d.ts` declarations) is one Lambda. The handler name is the
+ * dash-delimited relative path:
+ *
+ *   src/queues/order/create-order.ts → 'order-create-order'
+ *   src/crons/cleanup.ts             → 'cleanup'
+ *
+ * Test files (`*.test.ts`, `*.spec.ts`) are excluded so colocated
+ * tests don't accidentally become production Lambdas.
+ *
+ * Exported pure function so app-stack tests can build fixtures
+ * without spinning up a CDK stack.
+ */
+export declare function discoverFunctionFiles(dir: string, baseDir?: string): Array<{
+    name: string;
+    handlerFile: string;
+}>;
+//# sourceMappingURL=lambda-helpers.d.ts.map

package/dist/cdk/shared/lambda-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambda-helpers.d.ts","sourceRoot":"","sources":["../../../src/cdk/shared/lambda-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,sBAAsB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAuBlD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAAC,IAAI,CAgBb;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,IAAI,CAIlD;AAID,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAWpE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC,YAAY,CAI9E;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,aAAa,CAiB/D;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI/D;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB9C"}

package/dist/cdk/shared/lambda-helpers.js

@@ -0,0 +1,201 @@
+/**
+ * Lambda-bundling + runtime-mapping helpers shared between the legacy
+ * `VentureStack` and the new per-tier `VentureAppStack`. Pure
+ * functions only — no class state, no hidden globals beyond the
+ * lazily-loaded esbuild module.
+ *
+ * # Why a shared module
+ *
+ * During the §11 multi-stack migration both `stack.ts` (legacy) and
+ * `app-stack.ts` need to bundle handlers, map preset config to the
+ * `lambda.Runtime` / `lambda.Architecture` enums, and compute log-
+ * retention. Duplicating ~80 lines of bundling logic between two
+ * files would diverge over time. Step §11.10 deletes the legacy
+ * stack and this module becomes the single home.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { createRequire } from 'module';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as logs from 'aws-cdk-lib/aws-logs';
+// ─── esbuild lazy-load ──────────────────────────────────────────────
+/**
+ * Lazily-loaded esbuild module. Top-level import is avoided so unit
+ * tests that set `skipBundling: true` (which short-circuits before any
+ * bundling happens) don't pay the import cost or require esbuild to
+ * be installed in their sandbox. `createRequire` works around the
+ * fact that this file is ESM while esbuild's package exports are
+ * CJS-shaped.
+ */
+let esbuildModule;
+function loadEsbuild() {
+    if (!esbuildModule) {
+        const requireFromHere = createRequire(import.meta.url);
+        esbuildModule = requireFromHere('esbuild');
+    }
+    return esbuildModule;
+}
+// ─── Bundling ───────────────────────────────────────────────────────
+/**
+ * Bundle a Lambda handler in-process via esbuild's synchronous API.
+ *
+ * Replaces an earlier Docker-based bundling pipeline that spun up a
+ * SAM Node 20 image, ran `npm install -g esbuild`, and bundled the
+ * handler — taking ~30 s per Lambda. With 100+ handlers in a project
+ * that meant over an hour of synth time and a long tail of Docker-
+ * related failure modes (UID/HOME/permission edge cases on GitHub-
+ * hosted runners). In-process bundling collapses the entire sequence
+ * to a single `esbuild.buildSync` call: sub-second per handler,
+ * native Node module resolution against the consumer's `node_modules`,
+ * no Docker daemon dependency.
+ *
+ * The asset is the temp directory holding the bundled `index.js`, so
+ * CDK uploads only the bundled output to S3 — never the source tree.
+ *
+ * Modules baked into the Lambda runtime (`@aws-sdk/*`) are kept
+ * external so they aren't redundantly included in the bundle.
+ */
+export function bundleHandlerCodeWithEsbuild(handlerFile, projectDir) {
+    const outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'venturekit-bundle-'));
+    const outfile = path.join(outDir, 'index.js');
+    loadEsbuild().buildSync({
+        entryPoints: [handlerFile],
+        bundle: true,
+        platform: 'node',
+        target: 'node20',
+        outfile,
+        external: ['@aws-sdk/*'],
+        absWorkingDir: projectDir,
+        logLevel: 'error',
+    });
+    return lambda.Code.fromAsset(outDir);
+}
+/**
+ * Inline Lambda stub used in unit tests when `skipBundling: true`.
+ * Satisfies API Gateway's contract; tests assert on resource shape,
+ * not on Lambda execution.
+ */
+export function inlineStubLambdaCode() {
+    return lambda.Code.fromInline("exports.main = async () => ({ statusCode: 200, body: '{\"stub\":true}' });");
+}
+// ─── Runtime / architecture / log-retention mapping ────────────────
+export function toLambdaRuntime(envConfig) {
+    switch (envConfig.lambda.runtime) {
+        case 'nodejs22.x':
+            return lambda.Runtime.NODEJS_22_X;
+        case 'nodejs20.x':
+            return lambda.Runtime.NODEJS_20_X;
+        case 'nodejs18.x':
+            return lambda.Runtime.NODEJS_18_X;
+        default:
+            return lambda.Runtime.NODEJS_20_X;
+    }
+}
+export function toLambdaArchitecture(envConfig) {
+    return envConfig.lambda.architecture === 'x86_64'
+        ? lambda.Architecture.X86_64
+        : lambda.Architecture.ARM_64;
+}
+export function toLogRetention(days) {
+    if (days <= 1)
+        return logs.RetentionDays.ONE_DAY;
+    if (days <= 3)
+        return logs.RetentionDays.THREE_DAYS;
+    if (days <= 5)
+        return logs.RetentionDays.FIVE_DAYS;
+    if (days <= 7)
+        return logs.RetentionDays.ONE_WEEK;
+    if (days <= 14)
+        return logs.RetentionDays.TWO_WEEKS;
+    if (days <= 30)
+        return logs.RetentionDays.ONE_MONTH;
+    if (days <= 60)
+        return logs.RetentionDays.TWO_MONTHS;
+    if (days <= 90)
+        return logs.RetentionDays.THREE_MONTHS;
+    if (days <= 120)
+        return logs.RetentionDays.FOUR_MONTHS;
+    if (days <= 150)
+        return logs.RetentionDays.FIVE_MONTHS;
+    if (days <= 180)
+        return logs.RetentionDays.SIX_MONTHS;
+    if (days <= 365)
+        return logs.RetentionDays.ONE_YEAR;
+    if (days <= 400)
+        return logs.RetentionDays.THIRTEEN_MONTHS;
+    if (days <= 545)
+        return logs.RetentionDays.EIGHTEEN_MONTHS;
+    if (days <= 731)
+        return logs.RetentionDays.TWO_YEARS;
+    return logs.RetentionDays.INFINITE;
+}
+// ─── Naming helpers ─────────────────────────────────────────────────
+/**
+ * Tiny non-cryptographic 6-char hex hash. Used only to disambiguate
+ * Lambda function names that would otherwise overflow the 64-char
+ * limit; collision risk is acceptable because the truncated prefix
+ * already encodes most of the route path.
+ */
+export function shortHash(input) {
+    let h = 5381;
+    for (let i = 0; i < input.length; i++) {
+        h = ((h << 5) + h + input.charCodeAt(i)) | 0;
+    }
+    return (h >>> 0).toString(16).padStart(6, '0').slice(0, 6);
+}
+/**
+ * Cap a Lambda function name at the AWS hard limit (64 chars). When
+ * the natural name overflows, replace the trailing portion with a
+ * 6-char hash of the original — preserving the first 56 chars so
+ * operators can still recognize the resource by prefix.
+ */
+export function clampLambdaFunctionName(rawName) {
+    return rawName.length <= 64
+        ? rawName
+        : `${rawName.slice(0, 56)}-${shortHash(rawName)}`;
+}
+// ─── Function-file discovery ────────────────────────────────────────
+/**
+ * Recursively discover Lambda handler files under a directory. Used
+ * for `src/queues/`, `src/crons/`, `src/functions/` — all of which
+ * follow the same convention: every `.ts` / `.js` file (excluding
+ * `.d.ts` declarations) is one Lambda. The handler name is the
+ * dash-delimited relative path:
+ *
+ *   src/queues/order/create-order.ts → 'order-create-order'
+ *   src/crons/cleanup.ts             → 'cleanup'
+ *
+ * Test files (`*.test.ts`, `*.spec.ts`) are excluded so colocated
+ * tests don't accidentally become production Lambdas.
+ *
+ * Exported pure function so app-stack tests can build fixtures
+ * without spinning up a CDK stack.
+ */
+export function discoverFunctionFiles(dir, baseDir) {
+    const root = baseDir ?? dir;
+    const results = [];
+    if (!fs.existsSync(dir))
+        return results;
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            results.push(...discoverFunctionFiles(fullPath, root));
+            continue;
+        }
+        if (!/\.(ts|js)$/.test(entry.name))
+            continue;
+        if (entry.name.endsWith('.d.ts'))
+            continue;
+        if (/\.(test|spec)\.(ts|js)$/.test(entry.name))
+            continue;
+        const relativePath = path.relative(root, fullPath);
+        const name = relativePath
+            .replace(/\.(ts|js)$/, '')
+            .replace(/[\\/]/g, '-');
+        results.push({ name, handlerFile: fullPath });
+    }
+    return results;
+}
+//# sourceMappingURL=lambda-helpers.js.map

package/dist/cdk/shared/lambda-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambda-helpers.js","sourceRoot":"","sources":["../../../src/cdk/shared/lambda-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,sBAAsB,CAAC;AAG7C,uEAAuE;AAEvE;;;;;;;GAOG;AACH,IAAI,aAAmD,CAAC;AACxD,SAAS,WAAW;IAClB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,aAAa,GAAG,eAAe,CAAC,SAAS,CAA6B,CAAC;IACzE,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmB,EACnB,UAAkB;IAElB,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9C,WAAW,EAAE,CAAC,SAAS,CAAC;QACtB,WAAW,EAAE,CAAC,WAAW,CAAC;QAC1B,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,OAAO;QACP,QAAQ,EAAE,CAAC,YAAY,CAAC;QACxB,aAAa,EAAE,UAAU;QACzB,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAC3B,4EAA4E,CAC7E,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,QAAQ,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACpC;YACE,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,OAAO,SAAS,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ;QAC/C,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM;QAC5B,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;IACjD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACpD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACnD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;IAClD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACrD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;IACvD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;IACvD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;IACvD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACtD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;IACpD,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;IAC3D,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;IAC3D,IAAI,IAAI,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;IACrD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,uEAAuE;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,OAAO,CAAC,MAAM,IAAI,EAAE;QACzB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,OAAgB;IAEhB,MAAM,IAAI,GAAG,OAAO,IAAI,GAAG,CAAC;IAC5B,MAAM,OAAO,GAAiD,EAAE,CAAC;IAEjE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAExC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY;aACtB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;aACzB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}