alchemy 2.0.0-beta.4 → 2.0.0-beta.41

package/lib/AWS/ApiGateway/common.d.ts

@@ -0,0 +1,31 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+/**
+ * Wraps an API Gateway mutation so that recoverable 4xx responses are
+ * retried with backoff:
+ *
+ * - `BadRequestException` with `apiStatus is UPDATING` or
+ *   `already an update in progress` (transient, clears in seconds)
+ * - `TooManyRequestsException` (account-wide throttle, ~30s window)
+ *
+ * Drop-in usage:
+ *
+ * ```ts
+ * yield* retryOnApiStatusUpdating(
+ *   ag.createDeployment({ ... }),
+ * );
+ * ```
+ */
+export declare const retryOnApiStatusUpdating: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+export declare const restApiArn: (region: string, restApiId: string) => string;
+export declare const stageArn: (region: string, restApiId: string, stageName: string) => string;
+export declare const apiKeyArn: (region: string, apiKeyId: string) => string;
+export declare const usagePlanArn: (region: string, usagePlanId: string) => string;
+export declare const domainNameArn: (region: string, domainName: string) => string;
+export declare const vpcLinkArn: (region: string, vpcLinkId: string) => string;
+export declare const syncTags: (args_0: {
+    resourceArn: string;
+    oldTags: Record<string, string>;
+    newTags: Record<string, string>;
+}) => Effect.Effect<void, import("@distilled.cloud/aws/Errors").UnknownAwsError | import("@distilled.cloud/aws/Errors").AccessDeniedException | import("@distilled.cloud/aws/Errors").ExpiredTokenException | import("@distilled.cloud/aws/Errors").IncompleteSignature | import("@distilled.cloud/aws/Errors").InternalFailure | import("@distilled.cloud/aws/Errors").MalformedHttpRequestException | import("@distilled.cloud/aws/Errors").NotAuthorized | import("@distilled.cloud/aws/Errors").OptInRequired | import("@distilled.cloud/aws/Errors").RequestAbortedException | import("@distilled.cloud/aws/Errors").RequestEntityTooLargeException | import("@distilled.cloud/aws/Errors").RequestExpired | import("@distilled.cloud/aws/Errors").RequestTimeoutException | import("@distilled.cloud/aws/Errors").ServiceUnavailable | import("@distilled.cloud/aws/Errors").ThrottlingException | import("@distilled.cloud/aws/Errors").UnrecognizedClientException | import("@distilled.cloud/aws/Errors").UnknownOperationException | import("@distilled.cloud/aws/Errors").ValidationError | import("@distilled.cloud/aws/Errors").ValidationException | import("@distilled.cloud/aws/Errors").OperationAborted | import("@distilled.cloud/aws/Errors").EndpointError | import("@distilled.cloud/aws/Errors").NoMatchingRuleError | ag.BadRequestException | ag.ConflictException | ag.LimitExceededException | ag.NotFoundException | ag.TooManyRequestsException | ag.UnauthorizedException, import("effect/unstable/http/HttpClient").HttpClient | import("@distilled.cloud/aws/Region").Region | import("@distilled.cloud/aws/Credentials").Credentials>;
+//# sourceMappingURL=common.d.ts.map

package/lib/AWS/ApiGateway/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/AWS/ApiGateway/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAEvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAgExC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAC9C,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAKM,CAAC;AAE/B,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,WACJ,CAAC;AAEzD,eAAO,MAAM,QAAQ,GACnB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,WAAW,MAAM,WAC4D,CAAC;AAEhF,eAAO,MAAM,SAAS,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,WACJ,CAAC;AAEvD,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,EAAE,aAAa,MAAM,WACJ,CAAC;AAE7D,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,YAAY,MAAM,WACJ,CAAC;AAE7D,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,WACJ,CAAC;AAEzD,eAAO,MAAM,QAAQ;iBAKN,MAAM;aACV,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;skDAoB/B,CAAC"}

package/lib/AWS/ApiGateway/common.js

@@ -0,0 +1,94 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import * as Schedule from "effect/Schedule";
+import { diffTags, normalizeTags } from "../../Tags.js";
+/**
+ * API Gateway serializes mutations to a single RestApi at the control-plane
+ * level: while the API is transitioning between states it responds with a
+ * `BadRequestException` whose message matches one of:
+ *
+ * - `You cannot deploy a RestApi while the apiStatus is UPDATING or FAILED.`
+ * - `There is already an update in progress.`
+ *
+ * These are fundamentally transient — the retry window is short (seconds)
+ * and the only correct response is to wait and try again. Because the
+ * exception is a 4xx, the generic `Retry.transient` policy applied to the
+ * AWS SDK will not retry it, so we apply a targeted retry here for
+ * operations that race with concurrent mutations on the same RestApi
+ * (typically `createDeployment`, `updateStage`, `deleteStage`).
+ */
+const isApiStatusUpdatingError = (error) => {
+    if (!error || typeof error !== "object")
+        return false;
+    if (error._tag !== "BadRequestException")
+        return false;
+    const message = error.message ?? "";
+    return (message.includes("apiStatus is UPDATING") ||
+        message.includes("already an update in progress"));
+};
+/**
+ * `Create/Update/DeleteRestApi` (and a few sibling operations) are governed
+ * by a hard account-wide quota of one request every 30 seconds. The
+ * blanket SDK retry policy caps at 5 attempts with sub-second backoff, so
+ * tests and parallel deploys see `TooManyRequestsException` bubble out as
+ * the SDK gives up well inside the throttle window.
+ */
+const isThrottlingError = (error) => typeof error === "object" &&
+    error !== null &&
+    error._tag === "TooManyRequestsException";
+/**
+ * Schedule covering both fast (`apiStatus is UPDATING`) and slow
+ * (throttle) recoverable conditions. Exponential 2s base capped at 35s,
+ * with up to 12 attempts (~5 minutes total). The fast cases settle in the
+ * first few iterations; throttle waits ride the cap until a token is
+ * available.
+ */
+const apiGatewayMutationSchedule = pipe(Schedule.exponential(Duration.seconds(2), 2), Schedule.modifyDelay((d) => Effect.succeed(Duration.isGreaterThan(d, Duration.seconds(35))
+    ? Duration.seconds(35)
+    : d)), Schedule.both(Schedule.recurs(12)), Schedule.addDelay(() => Effect.succeed(Duration.millis(Math.random() * 1000))));
+/**
+ * Wraps an API Gateway mutation so that recoverable 4xx responses are
+ * retried with backoff:
+ *
+ * - `BadRequestException` with `apiStatus is UPDATING` or
+ *   `already an update in progress` (transient, clears in seconds)
+ * - `TooManyRequestsException` (account-wide throttle, ~30s window)
+ *
+ * Drop-in usage:
+ *
+ * ```ts
+ * yield* retryOnApiStatusUpdating(
+ *   ag.createDeployment({ ... }),
+ * );
+ * ```
+ */
+export const retryOnApiStatusUpdating = (effect) => Effect.retry(effect, {
+    schedule: apiGatewayMutationSchedule,
+    while: (error) => isApiStatusUpdatingError(error) || isThrottlingError(error),
+});
+export const restApiArn = (region, restApiId) => `arn:aws:apigateway:${region}::/restapis/${restApiId}`;
+export const stageArn = (region, restApiId, stageName) => `arn:aws:apigateway:${region}::/restapis/${restApiId}/stages/${stageName}`;
+export const apiKeyArn = (region, apiKeyId) => `arn:aws:apigateway:${region}::/apikeys/${apiKeyId}`;
+export const usagePlanArn = (region, usagePlanId) => `arn:aws:apigateway:${region}::/usageplans/${usagePlanId}`;
+export const domainNameArn = (region, domainName) => `arn:aws:apigateway:${region}::/domainnames/${domainName}`;
+export const vpcLinkArn = (region, vpcLinkId) => `arn:aws:apigateway:${region}::/vpclinks/${vpcLinkId}`;
+export const syncTags = Effect.fn(function* ({ resourceArn, oldTags, newTags, }) {
+    const { removed, upsert } = diffTags(oldTags, newTags);
+    if (removed.length > 0) {
+        yield* ag
+            .untagResource({
+            resourceArn,
+            tagKeys: removed,
+        })
+            .pipe(Effect.catchTag("NotFoundException", () => Effect.void), Effect.catchTag("BadRequestException", () => Effect.void));
+    }
+    if (upsert.length > 0) {
+        yield* ag.tagResource({
+            resourceArn,
+            tags: normalizeTags(upsert),
+        });
+    }
+});
+//# sourceMappingURL=common.js.map

package/lib/AWS/ApiGateway/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/AWS/ApiGateway/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kCAAkC,CAAC;AACvD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AACH,MAAM,wBAAwB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAK,KAA2B,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,OAAO,GAAI,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9D,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAClD,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAW,EAAE,CACpD,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACb,KAA2B,CAAC,IAAI,KAAK,0BAA0B,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,IAAI,CACrC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAC5C,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAoB,EAAE,EAAE,CAC5C,MAAM,CAAC,OAAO,CACZ,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC,CACN,CACF,EACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAClC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CACtD,CACF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAA8B,EACN,EAAE,CAC1B,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,0BAA0B;IACpC,KAAK,EAAE,CAAC,KAAc,EAAE,EAAE,CACxB,wBAAwB,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC;CAC9D,CAA2B,CAAC;AAE/B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,EAAE,CAC9D,sBAAsB,MAAM,eAAe,SAAS,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,MAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,EAAE,CAAC,sBAAsB,MAAM,eAAe,SAAS,WAAW,SAAS,EAAE,CAAC;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAC5D,sBAAsB,MAAM,cAAc,QAAQ,EAAE,CAAC;AAEvD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,WAAmB,EAAE,EAAE,CAClE,sBAAsB,MAAM,iBAAiB,WAAW,EAAE,CAAC;AAE7D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,UAAkB,EAAE,EAAE,CAClE,sBAAsB,MAAM,kBAAkB,UAAU,EAAE,CAAC;AAE7D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,EAAE,CAC9D,sBAAsB,MAAM,eAAe,SAAS,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC3C,WAAW,EACX,OAAO,EACP,OAAO,GAKR;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,CAAC,EAAE;aACN,aAAa,CAAC;YACb,WAAW;YACX,OAAO,EAAE,OAAO;SACjB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACvD,MAAM,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC1D,CAAC;IACN,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC;YACpB,WAAW;YACX,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/lib/AWS/ApiGateway/index.d.ts

@@ -0,0 +1,16 @@
+export { Account, AccountProvider, type AccountProps } from "./Account.ts";
+export { ApiKey, ApiKeyProvider, type ApiKeyProps } from "./ApiKey.ts";
+export { BasePathMapping, BasePathMappingProvider, type BasePathMappingProps, } from "./BasePathMapping.ts";
+export { Deployment, DeploymentResource, DeploymentProvider, type DeploymentProps, type DeploymentType, } from "./Deployment.ts";
+export { DomainName, DomainNameProvider, type DomainNameProps, } from "./DomainName.ts";
+export { GatewayResponse, GatewayResponseProvider, type GatewayResponseProps, } from "./GatewayResponse.ts";
+export { Resource, GatewayResource, ResourceProvider, type ApiGatewayResource, type ApiGatewayResourceProps, } from "./GatewayResource.ts";
+export { Method, MethodResource, MethodProvider, type MethodIntegrationProps, type MethodProps, type MethodType, } from "./Method.ts";
+export { RestApi, RestApiProvider, type RestApiProps, type RestApiBinding, } from "./RestApi.ts";
+export { Stage, StageResource, StageProvider, type StageProps, } from "./Stage.ts";
+export { UsagePlan, UsagePlanProvider, type UsagePlanProps, } from "./UsagePlan.ts";
+export { UsagePlanKey, UsagePlanKeyProvider, type UsagePlanKeyProps, } from "./UsagePlanKey.ts";
+export { Authorizer, AuthorizerProvider, type AuthorizerProps, } from "./Authorizer.ts";
+export { restApiArn, stageArn, apiKeyArn, usagePlanArn, domainNameArn, vpcLinkArn, syncTags, } from "./common.ts";
+export { VpcLink, VpcLinkProvider, type VpcLinkProps } from "./VpcLink.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/AWS/ApiGateway/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/AWS/ApiGateway/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,MAAM,EACN,cAAc,EACd,cAAc,EACd,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,OAAO,EACP,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,EACL,aAAa,EACb,aAAa,EACb,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC"}

package/lib/AWS/ApiGateway/index.js

@@ -0,0 +1,16 @@
+export { Account, AccountProvider } from "./Account.js";
+export { ApiKey, ApiKeyProvider } from "./ApiKey.js";
+export { BasePathMapping, BasePathMappingProvider, } from "./BasePathMapping.js";
+export { Deployment, DeploymentResource, DeploymentProvider, } from "./Deployment.js";
+export { DomainName, DomainNameProvider, } from "./DomainName.js";
+export { GatewayResponse, GatewayResponseProvider, } from "./GatewayResponse.js";
+export { Resource, GatewayResource, ResourceProvider, } from "./GatewayResource.js";
+export { Method, MethodResource, MethodProvider, } from "./Method.js";
+export { RestApi, RestApiProvider, } from "./RestApi.js";
+export { Stage, StageResource, StageProvider, } from "./Stage.js";
+export { UsagePlan, UsagePlanProvider, } from "./UsagePlan.js";
+export { UsagePlanKey, UsagePlanKeyProvider, } from "./UsagePlanKey.js";
+export { Authorizer, AuthorizerProvider, } from "./Authorizer.js";
+export { restApiArn, stageArn, apiKeyArn, usagePlanArn, domainNameArn, vpcLinkArn, syncTags, } from "./common.js";
+export { VpcLink, VpcLinkProvider } from "./VpcLink.js";
+//# sourceMappingURL=index.js.map

package/lib/AWS/ApiGateway/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/AWS/ApiGateway/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,eAAe,EAAqB,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAoB,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,eAAe,EACf,uBAAuB,GAExB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,kBAAkB,GAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,uBAAuB,GAExB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,QAAQ,EACR,eAAe,EACf,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,MAAM,EACN,cAAc,EACd,cAAc,GAIf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,OAAO,EACP,eAAe,GAGhB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,EACL,aAAa,EACb,aAAa,GAEd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,SAAS,EACT,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAqB,MAAM,cAAc,CAAC"}

package/lib/AWS/Arn.d.ts

@@ -0,0 +1,2 @@
+export type Arn = string;
+//# sourceMappingURL=Arn.d.ts.map

package/lib/AWS/Arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Arn.d.ts","sourceRoot":"","sources":["../../src/AWS/Arn.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC"}

package/lib/AWS/Arn.js

@@ -0,0 +1 @@
+//# sourceMappingURL=Arn.js.map

package/lib/AWS/Arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Arn.js","sourceRoot":"","sources":["../../src/AWS/Arn.ts"],"names":[],"mappings":""}

package/lib/AWS/Assets.d.ts

@@ -0,0 +1,65 @@
+import type { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import { lookupAssetsBucket } from "./Bootstrap.ts";
+/**
+ * Error type for Assets service operations.
+ */
+export type AssetsError = {
+    readonly _tag: "AssetsUploadError";
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly _tag: "AssetsCheckError";
+    readonly message: string;
+    readonly cause?: unknown;
+};
+/**
+ * Requirements for Assets operations (S3 operations need these).
+ */
+export type AssetsRequirements = Region | Credentials | HttpClient;
+declare const Assets_base: Context.ServiceClass<Assets, "AWS::Assets", {
+    /**
+     * The name of the assets bucket.
+     */
+    readonly bucketName: string;
+    /**
+     * Upload an asset to the assets bucket.
+     * Uses content-addressed storage: `lambda/{hash}.zip`
+     *
+     * @param hash - The content hash of the asset
+     * @param content - The asset content (zip file)
+     * @returns The S3 key where the asset was uploaded
+     */
+    readonly uploadAsset: (hash: string, content: Uint8Array) => Effect.Effect<string, AssetsError, AssetsRequirements>;
+    /**
+     * Check if an asset already exists in the assets bucket.
+     *
+     * @param hash - The content hash to check
+     * @returns true if the asset exists
+     */
+    readonly hasAsset: (hash: string) => Effect.Effect<boolean, AssetsError, AssetsRequirements>;
+}>;
+export declare class Assets extends Assets_base {
+}
+/**
+ * Look up the assets bucket by scanning for the bootstrap tags.
+ * Returns Option.some(bucketName) if found, Option.none() otherwise.
+ */
+export { lookupAssetsBucket };
+/**
+ * Layer that provides the Assets service.
+ * Looks up the assets bucket on initialization.
+ * If the bucket doesn't exist, the layer will fail - use `assetsLayerWithFallback` for graceful fallback.
+ */
+export declare const assetsLayer: Layer.Layer<Assets, Error, HttpClient | Region | Credentials>;
+/**
+ * Try to create the assets layer, but don't fail if the bucket doesn't exist.
+ * Returns Layer.empty if the bucket is not found.
+ */
+export declare const AssetsProvider: () => Layer.Layer<never, s3.ListBucketsError, HttpClient | Region | Credentials>;
+//# sourceMappingURL=Assets.d.ts.map

package/lib/AWS/Assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Assets.d.ts","sourceRoot":"","sources":["../../src/AWS/Assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;;IAK/D;;OAEG;yBACkB,MAAM;IAE3B;;;;;;;OAOG;0BACmB,CACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC;IAE3D;;;;;OAKG;uBACgB,CACjB,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC;;AA7BhE,qBAAa,MAAO,SAAQ,WA+BV;CAAG;AAYrB;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA+D9B;;;;GAIG;AACH,eAAO,MAAM,WAAW,+DAevB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,kFAcxB,CAAC"}

package/lib/AWS/Assets.js

@@ -0,0 +1,87 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { lookupAssetsBucket } from "./Bootstrap.js";
+export class Assets extends Context.Service()("AWS::Assets") {
+}
+/**
+ * S3 key prefix for Lambda function code assets.
+ */
+const LAMBDA_PREFIX = "lambda";
+/**
+ * Generate the S3 key for a Lambda asset.
+ */
+const getLambdaAssetKey = (hash) => `${LAMBDA_PREFIX}/${hash}.zip`;
+/**
+ * Look up the assets bucket by scanning for the bootstrap tags.
+ * Returns Option.some(bucketName) if found, Option.none() otherwise.
+ */
+export { lookupAssetsBucket };
+/**
+ * Create the Assets service implementation for a given bucket.
+ */
+const createAssetsService = (bucketName) => ({
+    bucketName,
+    uploadAsset: (hash, content) => {
+        const key = getLambdaAssetKey(hash);
+        return Effect.gen(function* () {
+            // Check if asset already exists
+            const exists = yield* s3
+                .headObject({ Bucket: bucketName, Key: key })
+                .pipe(Effect.map(() => true), Effect.catchTag("NotFound", () => Effect.succeed(false)));
+            if (exists) {
+                yield* Effect.logDebug(`Asset already exists: s3://${bucketName}/${key}`);
+                return key;
+            }
+            // Upload the asset
+            yield* s3.putObject({
+                Bucket: bucketName,
+                Key: key,
+                Body: content,
+                ContentType: "application/zip",
+            });
+            yield* Effect.logDebug(`Uploaded asset: s3://${bucketName}/${key}`);
+            return key;
+        }).pipe(Effect.mapError((err) => ({
+            _tag: "AssetsUploadError",
+            message: `Failed to upload asset ${key}`,
+            cause: err,
+        })));
+    },
+    hasAsset: (hash) => {
+        const key = getLambdaAssetKey(hash);
+        return s3.headObject({ Bucket: bucketName, Key: key }).pipe(Effect.map(() => true), Effect.catchTag("NotFound", () => Effect.succeed(false)), Effect.mapError((err) => ({
+            _tag: "AssetsCheckError",
+            message: `Failed to check asset ${key}`,
+            cause: err,
+        })));
+    },
+});
+/**
+ * Layer that provides the Assets service.
+ * Looks up the assets bucket on initialization.
+ * If the bucket doesn't exist, the layer will fail - use `assetsLayerWithFallback` for graceful fallback.
+ */
+export const assetsLayer = Layer.effect(Assets, Effect.gen(function* () {
+    const maybeBucket = yield* lookupAssetsBucket;
+    if (Option.isNone(maybeBucket)) {
+        return yield* Effect.fail(new Error("Assets bucket not found. Run 'alchemy bootstrap' to create it."));
+    }
+    return createAssetsService(maybeBucket.value);
+}));
+/**
+ * Try to create the assets layer, but don't fail if the bucket doesn't exist.
+ * Returns Layer.empty if the bucket is not found.
+ */
+export const AssetsProvider = () => Layer.unwrap(Effect.gen(function* () {
+    const maybeBucket = yield* lookupAssetsBucket;
+    if (Option.isNone(maybeBucket)) {
+        yield* Effect.logDebug("Assets bucket not found. Lambda will use inline ZipFile deployment.");
+        return Layer.empty;
+    }
+    return Layer.succeed(Assets, createAssetsService(maybeBucket.value));
+}));
+//# sourceMappingURL=Assets.js.map

package/lib/AWS/Assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Assets.js","sourceRoot":"","sources":["../../src/AWS/Assets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAsBpD,MAAM,OAAO,MAAO,SAAQ,OAAO,CAAC,OAAO,EA+BxC,CAAC,aAAa,CAAC;CAAG;AAErB;;GAEG;AACH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,aAAa,IAAI,IAAI,MAAM,CAAC;AAE3E;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B;;GAEG;AACH,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAyB,EAAE,CAAC,CAAC;IAC1E,UAAU;IACV,WAAW,EAAE,CAAC,IAAY,EAAE,OAAmB,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAEpC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,gCAAgC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE;iBACrB,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;iBAC5C,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EACtB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;YAEJ,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpB,8BAA8B,UAAU,IAAI,GAAG,EAAE,CAClD,CAAC;gBACF,OAAO,GAAG,CAAC;YACb,CAAC;YAED,mBAAmB;YACnB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC;gBAClB,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,iBAAiB;aAC/B,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;YACpE,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,GAAG,EAAe,EAAE,CAAC,CAAC;YACrB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,0BAA0B,GAAG,EAAE;YACxC,KAAK,EAAE,GAAG;SACX,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IACD,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAEpC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EACtB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EACxD,MAAM,CAAC,QAAQ,CACb,CAAC,GAAG,EAAe,EAAE,CAAC,CAAC;YACrB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,yBAAyB,GAAG,EAAE;YACvC,KAAK,EAAE,GAAG;SACX,CAAC,CACH,CACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CACrC,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE9C,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,gEAAgE,CACjE,CACF,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CACjC,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE9C,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpB,qEAAqE,CACtE,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/AuthProvider.d.ts

@@ -0,0 +1,34 @@
+import * as Redacted from "effect/Redacted";
+import { CredentialsStore } from "../Auth/Credentials.ts";
+export declare const AWS_AUTH_PROVIDER_NAME = "AWS";
+export type AwsAuthConfig = {
+    method: "sso";
+    ssoProfile: string;
+} | {
+    method: "stored";
+} | {
+    method: "env";
+};
+export interface AwsStoredCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    region?: string;
+}
+export interface AwsResolvedCredentials {
+    accessKeyId: Redacted.Redacted<string>;
+    secretAccessKey: Redacted.Redacted<string>;
+    sessionToken?: Redacted.Redacted<string>;
+    region?: string;
+    source: {
+        type: AwsAuthConfig["method"];
+        details?: string;
+    };
+}
+/**
+ * Layer that registers the AWS {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the AWS
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export declare const AwsAuth: import("effect/Layer").Layer<never, never, import("../index.ts").AuthProviders | CredentialsStore>;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/AWS/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../src/AWS/AuthProvider.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAS5C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AAS3E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,CAAC;AAwBtB,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,YAAY,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AA6DD;;;;GAIG;AACH,eAAO,MAAM,OAAO,oGA0QnB,CAAC"}

package/lib/AWS/AuthProvider.js

@@ -0,0 +1,211 @@
+import * as DistilledAuth from "@distilled.cloud/aws/Auth";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Match from "effect/Match";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import { ChildProcess } from "effect/unstable/process";
+import * as NodeCrypto from "node:crypto";
+import * as NodeOs from "node:os";
+import { AuthError, AuthProviderLayer, } from "../Auth/AuthProvider.js";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.js";
+import { getEnv, getEnvRedacted, getEnvRedactedRequired, retryOnce, } from "../Auth/Env.js";
+import * as Clank from "../Util/Clank.js";
+export const AWS_AUTH_PROVIDER_NAME = "AWS";
+const options = [
+    {
+        value: "sso",
+        label: "SSO",
+        hint: "aws sso login — credentials loaded from AWS SSO cache",
+    },
+    {
+        value: "env",
+        label: "Environment Variables",
+        hint: "AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY",
+    },
+    {
+        value: "stored",
+        label: "Stored",
+        hint: "stored in ~/.alchemy/credentials",
+    },
+];
+const runSsoCommand = (command, ssoProfile) => Effect.gen(function* () {
+    const handle = yield* ChildProcess.make("aws", ["sso", command, "--profile", ssoProfile], {
+        shell: false,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+    });
+    const exit = yield* handle.exitCode;
+    if (exit !== 0) {
+        yield* Effect.fail(new AuthError({
+            message: `aws sso ${command} exited with code ${exit}`,
+        }));
+    }
+}).pipe(Effect.scoped);
+const loginSSO = (config) => Clank.info(`AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`).pipe(Effect.andThen(runSsoCommand("login", config.ssoProfile)), Effect.matchEffect({
+    onSuccess: () => Clank.success("AWS SSO: login complete"),
+    onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
+}));
+/**
+ * `aws sso logout` only clears AWS CLI's own caches — it does not know about the
+ * `<sha1(sso_session)>.credentials.json` file that `@distilled.cloud/aws`
+ * writes alongside the SSO token. Without this cleanup, `loadProfileCredentials`
+ * short-circuits on the stale distilled cache file after logout and appears to
+ * stay logged in until the role creds hit their TTL.
+ */
+const clearDistilledSsoCache = (ssoProfile) => Effect.gen(function* () {
+    const auth = yield* DistilledAuth.Default;
+    const profile = yield* auth.loadProfile(ssoProfile);
+    const ssoSession = profile.sso_session;
+    if (!ssoSession)
+        return;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const hash = NodeCrypto.createHash("sha1").update(ssoSession).digest("hex");
+    const cacheFile = path.join(NodeOs.homedir(), ".aws", "sso", "cache", `${hash}.credentials.json`);
+    yield* fs.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
+}).pipe(Effect.catch(() => Effect.void));
+/**
+ * Layer that registers the AWS {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the AWS
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export const AwsAuth = AuthProviderLayer()(AWS_AUTH_PROVIDER_NAME, Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+    const loginStored = Effect.fnUntraced(function* (profileName) {
+        const accessKeyId = yield* Clank.text({
+            message: "AWS Access Key ID",
+            validate: (v) => (v.length === 0 ? "Required" : undefined),
+        }).pipe(retryOnce);
+        const secretAccessKey = yield* Clank.password({
+            message: "AWS Secret Access Key",
+            validate: (v) => (v.length === 0 ? "Required" : undefined),
+        }).pipe(retryOnce);
+        const sessionToken = yield* Clank.text({
+            message: "AWS Session Token (optional — press Enter or Esc to skip)",
+            placeholder: "(none)",
+        }).pipe(Effect.catch(() => Effect.succeed("")));
+        const region = yield* Clank.text({
+            message: "AWS Region",
+            placeholder: "us-east-1",
+            defaultValue: "us-east-1",
+        }).pipe(retryOnce);
+        yield* store.write(profileName, "aws", {
+            accessKeyId,
+            secretAccessKey,
+            sessionToken,
+            region,
+        });
+        yield* Clank.success("AWS credentials saved.");
+        return { method: "stored" };
+    });
+    const configureInteractive = (profileName) => Clank.select({
+        message: "AWS authentication method",
+        options,
+    }).pipe(Effect.flatMap((method) => Match.value(method).pipe(Match.when("env", () => Effect.succeed({ method: "env" })), Match.when("sso", () => Effect.gen(function* () {
+        const ssoProfile = yield* Clank.text({
+            message: "AWS profile name (from ~/.aws/config)",
+            placeholder: "default",
+            defaultValue: "default",
+        });
+        const config = {
+            method: "sso",
+            ssoProfile: ssoProfile ?? "default",
+        };
+        yield* loginSSO(config);
+        return config;
+    })), Match.when("stored", () => loginStored(profileName)), Match.exhaustive)));
+    const configureCredentials = (profileName, ctx) => Effect.gen(function* () {
+        if (ctx.ci) {
+            return { method: "env" };
+        }
+        return yield* configureInteractive(profileName);
+    }).pipe(Effect.mapError((e) => new AuthError({
+        message: "failed to configure credentials",
+        cause: e,
+    })));
+    const resolveCredentials = (profileName, config) => Match.value(config)
+        .pipe(Match.when({ method: "env" }, Effect.fnUntraced(function* () {
+        const accessKeyId = yield* getEnvRedactedRequired("AWS_ACCESS_KEY_ID");
+        const secretAccessKey = yield* getEnvRedactedRequired("AWS_SECRET_ACCESS_KEY");
+        const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
+        const region = yield* (getEnv("AWS_REGION") ??
+            getEnv("AWS_DEFAULT_REGION") ??
+            undefined);
+        return {
+            accessKeyId,
+            secretAccessKey,
+            sessionToken,
+            region,
+            source: { type: "env" },
+        };
+    })), Match.when({ method: "stored" }, () => store.read(profileName, "aws").pipe(Effect.flatMap((creds) => creds == null
+        ? Effect.fail(new AuthError({
+            message: "AWS stored credentials not found. Run: alchemy-effect login --configure",
+        }))
+        : Effect.succeed({
+            accessKeyId: Redacted.make(creds.accessKeyId),
+            secretAccessKey: Redacted.make(creds.secretAccessKey),
+            sessionToken: creds.sessionToken
+                ? Redacted.make(creds.sessionToken)
+                : undefined,
+            region: creds.region,
+            source: { type: "stored" },
+        })))), Match.when({ method: "sso" }, (config) => Effect.gen(function* () {
+        const auth = yield* DistilledAuth.Default;
+        const creds = yield* auth
+            .loadProfileCredentials(config.ssoProfile)
+            .pipe(Effect.mapError((e) => new AuthError({
+            message: "failed to load credentials",
+            cause: e,
+        })));
+        const profile = yield* auth
+            .loadProfile(config.ssoProfile)
+            .pipe(Effect.catch(() => Effect.succeed(undefined)));
+        return {
+            accessKeyId: creds.accessKeyId,
+            secretAccessKey: creds.secretAccessKey,
+            sessionToken: creds.sessionToken,
+            region: profile?.region,
+            source: { type: "sso", details: config.ssoProfile },
+        };
+    })), Match.exhaustive)
+        .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
+    const prettyPrint = (profileName, config) => resolveCredentials(profileName, config).pipe(Effect.tap((creds) => Effect.all([
+        Console.log(`  accessKeyId:     ${displayRedacted(creds.accessKeyId)}`),
+        Console.log(`  secretAccessKey: ${displayRedacted(creds.secretAccessKey)}`),
+        creds.sessionToken
+            ? Console.log(`  sessionToken:    ${displayRedacted(creds.sessionToken)}`)
+            : Effect.void,
+        creds.region
+            ? Console.log(`  region:          ${creds.region}`)
+            : Effect.void,
+        Console.log(
+        //@ts-expect-error
+        `  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`),
+    ])), Effect.catch((e) => Console.error(`  Failed to retrieve credentials: ${e}`)));
+    const logout = (profileName, config) => Match.value(config).pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "sso" }, (config) => Clank.info(`AWS: running 'aws sso logout --profile ${config.ssoProfile}'...`).pipe(Effect.zip(runSsoCommand("logout", config.ssoProfile)), Effect.zip(clearDistilledSsoCache(config.ssoProfile)), Effect.match({
+        onSuccess: () => Clank.success("AWS: SSO logout complete"),
+        onFailure: (e) => Clank.warn(`AWS: SSO logout failed: \`${e.message}\``),
+    }))), Match.when({ method: "stored" }, () => store
+        .delete(profileName, "aws")
+        .pipe(Effect.andThen(Clank.success("AWS: stored credentials removed")))), Match.exhaustive);
+    const login = (profileName, config) => Match.value(config)
+        .pipe(Match.when({ method: "env" }, () => Effect.void), Match.when({ method: "sso" }, (config) => DistilledAuth.loadProfileCredentials(config.ssoProfile).pipe(Effect.matchEffect({
+        onSuccess: () => Clank.info(`AWS: SSO profile '${config.ssoProfile}' already has valid credentials`),
+        onFailure: () => loginSSO(config),
+    }))), Match.when({ method: "stored" }, () => store
+        .read(profileName, "aws")
+        .pipe(Effect.flatMap((creds) => creds == null ? loginStored(profileName) : Effect.void))), Match.exhaustive)
+        .pipe(Effect.mapError((e) => new AuthError({ message: "login failed", cause: e })));
+    return {
+        configure: configureCredentials,
+        login,
+        logout,
+        prettyPrint,
+        read: resolveCredentials,
+    };
+}));
+//# sourceMappingURL=AuthProvider.js.map

package/lib/AWS/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../src/AWS/AuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,SAAS,EACT,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EACL,MAAM,EACN,cAAc,EACd,sBAAsB,EACtB,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AAE1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAO5C,MAAM,OAAO,GAIR;IACH;QACE,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,uDAAuD;KAC9D;IACD;QACE,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,2CAA2C;KAClD;IACD;QACE,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,kCAAkC;KACzC;CACF,CAAC;AAoBF,MAAM,aAAa,GAAG,CAAC,OAA2B,EAAE,UAAkB,EAAE,EAAE,CACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CACrC,KAAK,EACL,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,EACzC;QACE,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,SAAS;KAClB,CACF,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,WAAW,OAAO,qBAAqB,IAAI,EAAE;SACvD,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAEzB,MAAM,QAAQ,GAAG,CAAC,MAAiD,EAAE,EAAE,CACrE,KAAK,CAAC,IAAI,CACR,6CAA6C,MAAM,CAAC,UAAU,MAAM,CACrE,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EACzD,MAAM,CAAC,WAAW,CAAC;IACjB,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,IAAI,CAAC;CACxE,CAAC,CACH,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAE,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAI,OAAoC,CAAC,WAAW,CAAC;IACrE,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,MAAM,CAAC,OAAO,EAAE,EAChB,MAAM,EACN,KAAK,EACL,OAAO,EACP,GAAG,IAAI,mBAAmB,CAC3B,CAAC;IACF,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,iBAAiB,EAGrC,CACD,sBAAsB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAEtC,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAmB;QAClE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,OAAO,EAAE,mBAAmB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3D,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5C,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3D,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,2DAA2D;YACpE,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,WAAW;YACxB,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAuB,WAAW,EAAE,KAAK,EAAE;YAC3D,WAAW;YACX,eAAe;YACf,YAAY;YACZ,MAAM;SACP,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAE/C,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,CAAC,WAAmB,EAAE,EAAE,CACnD,KAAK,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,2BAA2B;QACpC,OAAO;KACR,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC,CAAC,EACnE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACnC,OAAO,EAAE,uCAAuC;YAChD,WAAW,EAAE,SAAS;YACtB,YAAY,EAAE,SAAS;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,KAAc;YACtB,UAAU,EAAE,UAAU,IAAI,SAAS;SACpC,CAAC;QAEF,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CACH,EACD,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EACpD,KAAK,CAAC,UAAU,CACjB,CACF,CACF,CAAC;IAEJ,MAAM,oBAAoB,GAAG,CAAC,WAAmB,EAAE,GAAqB,EAAE,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,KAAK,EAAE,CAAC;KACT,CAAC,CACL,CACF,CAAC;IAEJ,MAAM,kBAAkB,GAAG,CAAC,WAAmB,EAAE,MAAqB,EAAE,EAAE,CACxE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;SAChB,IAAI,CACH,KAAK,CAAC,IAAI,CACR,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,MAAM,WAAW,GACf,KAAK,CAAC,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,sBAAsB,CACnD,uBAAuB,CACxB,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CACpB,MAAM,CAAC,YAAY,CAAC;YAClB,MAAM,CAAC,oBAAoB,CAAC;YAC5B,SAAS,CACZ,CAAC;QACF,OAAO;YACL,WAAW;YACX,eAAe;YACf,YAAY;YACZ,MAAM;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE;SACjC,CAAC;IACJ,CAAC,CAAC,CACH,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,KAAK,CAAC,IAAI,CAAuB,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,KAAK,IAAI,IAAI;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CAAC;YACZ,OAAO,EACL,yEAAyE;SAC5E,CAAC,CACH;QACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACb,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAC7C,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;YACrD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAC9B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBACnC,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;SACpC,CAAC,CACP,CACF,CACF,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CACvC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI;aACtB,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC;aACzC,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,SAAS,CAAC;YACZ,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,CAAC;SACT,CAAC,CACL,CACF,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI;aACxB,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC;aAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;SAC7D,CAAC;IACJ,CAAC,CAAC,CACH,EACD,KAAK,CAAC,UAAU,CACjB;SACA,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAC5D,CACF,CAAC;IAEN,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAE,MAAqB,EAAE,EAAE,CACjE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,MAAM,CAAC,GAAG,CAAC;QACT,OAAO,CAAC,GAAG,CACT,sBAAsB,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAC3D;QACD,OAAO,CAAC,GAAG,CACT,sBAAsB,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAC/D;QACD,KAAK,CAAC,YAAY;YAChB,CAAC,CAAC,OAAO,CAAC,GAAG,CACT,sBAAsB,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAC5D;YACH,CAAC,CAAC,MAAM,CAAC,IAAI;QACf,KAAK,CAAC,MAAM;YACV,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,MAAM,EAAE,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,IAAI;QACf,OAAO,CAAC,GAAG;QACT,kBAAkB;QAClB,aAAa,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAC3G;KACF,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CACxD,CACF,CAAC;IAEJ,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAE,MAAqB,EAAE,EAAE,CAC5D,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAChD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CACvC,KAAK,CAAC,IAAI,CACR,0CAA0C,MAAM,CAAC,UAAU,MAAM,CAClE,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EACtD,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EACrD,MAAM,CAAC,KAAK,CAAC;QACX,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,0BAA0B,CAAC;QAC1D,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,IAAI,CAAC;KACzD,CAAC,CACH,CACF,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,KAAK;SACF,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC;SAC1B,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,CACjE,CACJ,EACD,KAAK,CAAC,UAAU,CACjB,CAAC;IAEJ,MAAM,KAAK,GAAG,CAAC,WAAmB,EAAE,MAAqB,EAAE,EAAE,CAC3D,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;SAChB,IAAI,CACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAChD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CACvC,aAAa,CAAC,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,WAAW,CAAC;QACjB,SAAS,EAAE,GAAG,EAAE,CACd,KAAK,CAAC,IAAI,CACR,qBAAqB,MAAM,CAAC,UAAU,iCAAiC,CACxE;QACH,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;KAClC,CAAC,CACH,CACF,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CACpC,KAAK;SACF,IAAI,CAAuB,WAAW,EAAE,KAAK,CAAC;SAC9C,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CACvD,CACF,CACJ,EACD,KAAK,CAAC,UAAU,CACjB;SACA,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAC5D,CACF,CAAC;IAEN,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,KAAK;QACL,MAAM;QACN,WAAW;QACX,IAAI,EAAE,kBAAkB;KACzB,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}