alchemy 2.0.0-beta.cli-platform-split → 2.0.0-beta.pkg-setup-rc

package/lib/AWS/EKS/PodIdentityAssociation.js

@@ -0,0 +1,214 @@
+import * as eks from "@distilled.cloud/aws/eks";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.js";
+import { createPhysicalName } from "../../PhysicalName.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.js";
+/**
+ * An Amazon EKS pod identity association that binds a service account to an IAM role.
+ *
+ * `PodIdentityAssociation` is the canonical workload-identity resource for EKS
+ * clusters that use EKS Pod Identity instead of IRSA.
+ *
+ * @section Managing Pod Identity
+ * @example Bind a Service Account to a Role
+ * ```typescript
+ * const association = yield* PodIdentityAssociation("ApiIdentity", {
+ *   clusterName: cluster.clusterName,
+ *   namespace: "default",
+ *   serviceAccount: "api",
+ *   roleArn: podRole.roleArn,
+ * });
+ * ```
+ */
+export const PodIdentityAssociation = Resource("AWS.EKS.PodIdentityAssociation");
+export const PodIdentityAssociationProvider = () => Provider.effect(PodIdentityAssociation, Effect.gen(function* () {
+    const toClientRequestToken = (id, action) => createPhysicalName({
+        id: `${id}-${action}`,
+        maxLength: 64,
+        delimiter: "-",
+    });
+    return {
+        stables: ["associationArn", "associationId"],
+        diff: Effect.fn(function* ({ olds, news }) {
+            if (!isResolved(news))
+                return;
+            if (olds.clusterName !== news.clusterName) {
+                return { action: "replace" };
+            }
+            if (olds.namespace !== news.namespace) {
+                return { action: "replace" };
+            }
+            if (olds.serviceAccount !== news.serviceAccount) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            if (output?.associationId) {
+                return yield* readAssociationById({
+                    clusterName: output.clusterName,
+                    associationId: output.associationId,
+                });
+            }
+            return yield* findAssociation({
+                id,
+                clusterName: olds.clusterName,
+                namespace: olds.namespace,
+                serviceAccount: olds.serviceAccount,
+            });
+        }),
+        create: Effect.fn(function* ({ id, news, session }) {
+            const tags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            yield* eks
+                .createPodIdentityAssociation({
+                clusterName: news.clusterName,
+                namespace: news.namespace,
+                serviceAccount: news.serviceAccount,
+                roleArn: news.roleArn,
+                disableSessionTags: news.disableSessionTags,
+                targetRoleArn: news.targetRoleArn,
+                policy: news.policy,
+                tags,
+                clientRequestToken: yield* toClientRequestToken(id, "create"),
+            })
+                .pipe(Effect.catchTag("ResourceInUseException", () => findAssociation({
+                id,
+                clusterName: news.clusterName,
+                namespace: news.namespace,
+                serviceAccount: news.serviceAccount,
+            }).pipe(Effect.flatMap((existing) => existing
+                ? Effect.succeed(existing)
+                : Effect.fail(new Error(`PodIdentityAssociation '${news.namespace}/${news.serviceAccount}' already exists and is not managed by alchemy`))), Effect.asVoid)));
+            const state = yield* findAssociation({
+                id,
+                clusterName: news.clusterName,
+                namespace: news.namespace,
+                serviceAccount: news.serviceAccount,
+            });
+            if (!state) {
+                return yield* Effect.fail(new Error(`PodIdentityAssociation '${news.namespace}/${news.serviceAccount}' could not be read after creation`));
+            }
+            yield* session.note(state.associationArn);
+            return state;
+        }),
+        update: Effect.fn(function* ({ id, olds, news, output, session }) {
+            if (olds.roleArn !== news.roleArn ||
+                olds.disableSessionTags !== news.disableSessionTags ||
+                olds.targetRoleArn !== news.targetRoleArn ||
+                olds.policy !== news.policy) {
+                yield* eks.updatePodIdentityAssociation({
+                    clusterName: output.clusterName,
+                    associationId: output.associationId,
+                    roleArn: news.roleArn,
+                    disableSessionTags: news.disableSessionTags,
+                    targetRoleArn: news.targetRoleArn,
+                    policy: news.policy,
+                    clientRequestToken: yield* toClientRequestToken(id, "update"),
+                });
+            }
+            const oldTags = {
+                ...(yield* createInternalTags(id)),
+                ...olds.tags,
+            };
+            const newTags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const { removed, upsert } = diffTags(oldTags, newTags);
+            if (upsert.length > 0) {
+                yield* eks.tagResource({
+                    resourceArn: output.associationArn,
+                    tags: Object.fromEntries(upsert.map((tag) => [tag.Key, tag.Value])),
+                });
+            }
+            if (removed.length > 0) {
+                yield* eks.untagResource({
+                    resourceArn: output.associationArn,
+                    tagKeys: removed,
+                });
+            }
+            const state = yield* readAssociationById({
+                clusterName: output.clusterName,
+                associationId: output.associationId,
+            });
+            if (!state) {
+                return yield* Effect.fail(new Error(`PodIdentityAssociation '${output.associationId}' could not be read after update`));
+            }
+            yield* session.note(output.associationArn);
+            return state;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* eks
+                .deletePodIdentityAssociation({
+                clusterName: output.clusterName,
+                associationId: output.associationId,
+            })
+                .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void));
+        }),
+    };
+}));
+const normalizeTags = (tags) => Object.fromEntries(Object.entries(tags ?? {}).filter((entry) => entry[1] !== undefined));
+const mapAssociation = (association) => ({
+    associationArn: association.associationArn,
+    associationId: association.associationId,
+    clusterName: association.clusterName,
+    namespace: association.namespace,
+    serviceAccount: association.serviceAccount,
+    roleArn: association.roleArn,
+    disableSessionTags: association.disableSessionTags ?? false,
+    targetRoleArn: association.targetRoleArn,
+    externalId: association.externalId,
+    ownerArn: association.ownerArn,
+    policy: association.policy,
+    tags: normalizeTags(association.tags),
+});
+const readAssociationById = Effect.fn(function* ({ clusterName, associationId, }) {
+    const response = yield* eks
+        .describePodIdentityAssociation({
+        clusterName,
+        associationId,
+    })
+        .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
+    const association = response?.association;
+    if (!association?.associationArn ||
+        !association.associationId ||
+        !association.clusterName ||
+        !association.namespace ||
+        !association.serviceAccount ||
+        !association.roleArn) {
+        return undefined;
+    }
+    return mapAssociation(association);
+});
+const findAssociation = Effect.fn(function* ({ id, clusterName, namespace, serviceAccount, }) {
+    let nextToken;
+    while (true) {
+        const response = yield* eks.listPodIdentityAssociations({
+            clusterName,
+            namespace,
+            serviceAccount,
+            nextToken,
+        });
+        for (const summary of response.associations ?? []) {
+            if (!summary.associationId) {
+                continue;
+            }
+            const association = yield* readAssociationById({
+                clusterName,
+                associationId: summary.associationId,
+            });
+            if (association && (yield* hasAlchemyTags(id, association.tags))) {
+                return association;
+            }
+        }
+        if (!response.nextToken) {
+            return undefined;
+        }
+        nextToken = response.nextToken;
+    }
+});
+//# sourceMappingURL=PodIdentityAssociation.js.map

package/lib/AWS/EKS/PodIdentityAssociation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PodIdentityAssociation.js","sourceRoot":"","sources":["../../../src/AWS/EKS/PodIdentityAssociation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA0D7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAC5C,gCAAgC,CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,EAAE,CACjD,QAAQ,CAAC,MAAM,CACb,sBAAsB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,MAAc,EAAE,EAAE,CAC1D,kBAAkB,CAAC;QACjB,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE;QACrB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;IAEL,OAAO;QACL,OAAO,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;QAC5C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YAED,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBAChD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,IAAI,MAAM,EAAE,aAAa,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC;oBAChC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC;gBAC5B,EAAE;gBACF,WAAW,EAAE,IAAI,CAAC,WAAqB;gBACvC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAChD,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YAEF,KAAK,CAAC,CAAC,GAAG;iBACP,4BAA4B,CAAC;gBAC5B,WAAW,EAAE,IAAI,CAAC,WAAqB;gBACvC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,IAAI,CAAC,OAAiB;gBAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,aAAa,EAAE,IAAI,CAAC,aAAmC;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI;gBACJ,kBAAkB,EAAE,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC;aAC9D,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAC7C,eAAe,CAAC;gBACd,EAAE;gBACF,WAAW,EAAE,IAAI,CAAC,WAAqB;gBACvC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;gBACN,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,KAAK,CACP,2BAA2B,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,gDAAgD,CACjH,CACF,CACN,EACD,MAAM,CAAC,MAAM,CACd,CACF,CACF,CAAC;YAEJ,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;gBACnC,EAAE;gBACF,WAAW,EAAE,IAAI,CAAC,WAAqB;gBACvC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,2BAA2B,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,oCAAoC,CACrG,CACF,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9D,IACE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;gBAC7B,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,kBAAkB;gBACnD,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;gBACzC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAC3B,CAAC;gBACD,KAAK,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC;oBACtC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAiB;oBAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;oBAC3C,aAAa,EAAE,IAAI,CAAC,aAAmC;oBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,kBAAkB,EAAE,KAAK,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;oBACrB,WAAW,EAAE,MAAM,CAAC,cAAc;oBAClC,IAAI,EAAE,MAAM,CAAC,WAAW,CACtB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAU,CAAC,CACnD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;oBACvB,WAAW,EAAE,MAAM,CAAC,cAAc;oBAClC,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;gBACvC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,KAAK,CACP,2BAA2B,MAAM,CAAC,aAAa,kCAAkC,CAClF,CACF,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,GAAG;iBACP,4BAA4B,CAAC;gBAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChE,CAAC;QACN,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,aAAa,GAAG,CAAC,IAAoD,EAAE,EAAE,CAC7E,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/B,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAC7D,CACF,CAAC;AAEJ,MAAM,cAAc,GAAG,CAAC,WAAuC,EAAE,EAAE,CAAC,CAAC;IACnE,cAAc,EAAE,WAAW,CAAC,cAAe;IAC3C,aAAa,EAAE,WAAW,CAAC,aAAc;IACzC,WAAW,EAAE,WAAW,CAAC,WAAY;IACrC,SAAS,EAAE,WAAW,CAAC,SAAU;IACjC,cAAc,EAAE,WAAW,CAAC,cAAe;IAC3C,OAAO,EAAE,WAAW,CAAC,OAAQ;IAC7B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,IAAI,KAAK;IAC3D,aAAa,EAAE,WAAW,CAAC,aAAa;IACxC,UAAU,EAAE,WAAW,CAAC,UAAU;IAClC,QAAQ,EAAE,WAAW,CAAC,QAAQ;IAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;IAC1B,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC/C,WAAW,EACX,aAAa,GAId;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;SACxB,8BAA8B,CAAC;QAC9B,WAAW;QACX,aAAa;KACd,CAAC;SACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;IAEJ,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,CAAC;IAC1C,IACE,CAAC,WAAW,EAAE,cAAc;QAC5B,CAAC,WAAW,CAAC,aAAa;QAC1B,CAAC,WAAW,CAAC,WAAW;QACxB,CAAC,WAAW,CAAC,SAAS;QACtB,CAAC,WAAW,CAAC,cAAc;QAC3B,CAAC,WAAW,CAAC,OAAO,EACpB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,cAAc,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAC3C,EAAE,EACF,WAAW,EACX,SAAS,EACT,cAAc,GAMf;IACC,IAAI,SAA6B,CAAC;IAElC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;YACtD,WAAW;YACX,SAAS;YACT,cAAc;YACd,SAAS;SACV,CAAC,CAAC;QAEH,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;gBAC7C,WAAW;gBACX,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;YAEH,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/lib/AWS/EKS/PodIdentityServiceAccount.d.ts

@@ -0,0 +1,109 @@
+import * as Effect from "effect/Effect";
+import type { Input } from "../../Input.ts";
+import * as Kubernetes from "../../Kubernetes/index.ts";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import { Role, type RoleArn, type Role as RoleResource } from "../IAM/Role.ts";
+import type { Cluster } from "./Cluster.ts";
+import { PodIdentityAssociation, type PodIdentityAssociation as PodIdentityAssociationResource } from "./PodIdentityAssociation.ts";
+export interface PodIdentityServiceAccountProps {
+    /**
+     * Target EKS cluster.
+     */
+    cluster: Cluster;
+    /**
+     * Namespace name or namespace helper result.
+     */
+    namespace: string | {
+        name: string;
+    } | Kubernetes.ObjectRef;
+    /**
+     * Optional explicit service account name. Defaults to the logical id.
+     */
+    serviceAccountName?: string;
+    /**
+     * Existing IAM role ARN to use for pod identity.
+     */
+    roleArn?: string;
+    /**
+     * Optional role name when Alchemy creates the IAM role.
+     */
+    roleName?: string;
+    /**
+     * Managed policy ARNs to attach when creating the IAM role.
+     */
+    managedPolicyArns?: string[];
+    /**
+     * Inline policies to attach when creating the IAM role.
+     */
+    inlinePolicies?: Record<string, PolicyDocument>;
+    /**
+     * Optional role description when Alchemy creates the IAM role.
+     */
+    description?: string;
+    /**
+     * Disable session tags for the pod identity association.
+     */
+    disableSessionTags?: boolean;
+    /**
+     * Optional target role ARN for chained role assumption.
+     */
+    targetRoleArn?: string;
+    /**
+     * Optional inline session policy JSON.
+     */
+    policy?: string;
+    /**
+     * Labels applied to the Kubernetes service account.
+     */
+    labels?: Record<string, string>;
+    /**
+     * Annotations applied to the Kubernetes service account.
+     */
+    annotations?: Record<string, string>;
+    /**
+     * Tags applied to AWS resources.
+     */
+    tags?: Record<string, string>;
+}
+export interface PodIdentityServiceAccountResources {
+    serviceAccount: Kubernetes.ObjectRef;
+    podIdentityAssociation: PodIdentityAssociationResource;
+    role: RoleResource | undefined;
+    roleArn: Input<string> | RoleArn;
+}
+/**
+ * Creates a Kubernetes service account and binds it to EKS Pod Identity.
+ *
+ * @example Service account with generated IAM role
+ * ```typescript
+ * const identity = yield* PodIdentityServiceAccount("ApiIdentity", {
+ *   cluster: cluster.cluster,
+ *   namespace: "default",
+ *   managedPolicyArns: ["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"],
+ * });
+ * ```
+ */
+export declare const PodIdentityServiceAccount: (id: string, props: PodIdentityServiceAccountProps) => Effect.Effect<{
+    serviceAccount: {
+        cluster: Cluster;
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace: string | undefined;
+        key: string;
+        object: {
+            apiVersion: string;
+            kind: string;
+            metadata: {
+                name: string;
+                namespace: string | undefined;
+                labels: Record<string, string> | undefined;
+                annotations: Record<string, string> | undefined;
+            };
+        };
+    };
+    podIdentityAssociation: PodIdentityAssociation;
+    role: Role | undefined;
+    roleArn: string | import("../../Output.ts").Output<`arn:aws:iam::${string}:role/${string}`, never>;
+}, never, import("../Providers.ts").Providers>;
+//# sourceMappingURL=PodIdentityServiceAccount.d.ts.map

package/lib/AWS/EKS/PodIdentityServiceAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PodIdentityServiceAccount.d.ts","sourceRoot":"","sources":["../../../src/AWS/EKS/PodIdentityServiceAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,KAAK,IAAI,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,IAAI,8BAA8B,EAC9D,MAAM,6BAA6B,CAAC;AAErC,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,CAAC,SAAS,CAAC;IAC5D;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,kCAAkC;IACjD,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;IACrC,sBAAsB,EAAE,8BAA8B,CAAC;IACvD,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IAC/B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,GACpC,IAAI,MAAM,EACV,OAAO,8BAA8B;;;;;;;;;;;;;;;;;;;;;;8CA+DpC,CAAC"}

package/lib/AWS/EKS/PodIdentityServiceAccount.js

@@ -0,0 +1,66 @@
+import * as Effect from "effect/Effect";
+import * as Kubernetes from "../../Kubernetes/index.js";
+import * as Namespace from "../../Namespace.js";
+import { Role } from "../IAM/Role.js";
+import { PodIdentityAssociation, } from "./PodIdentityAssociation.js";
+/**
+ * Creates a Kubernetes service account and binds it to EKS Pod Identity.
+ *
+ * @example Service account with generated IAM role
+ * ```typescript
+ * const identity = yield* PodIdentityServiceAccount("ApiIdentity", {
+ *   cluster: cluster.cluster,
+ *   namespace: "default",
+ *   managedPolicyArns: ["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"],
+ * });
+ * ```
+ */
+export const PodIdentityServiceAccount = (id, props) => Namespace.push(id, Effect.gen(function* () {
+    const serviceAccountName = props.serviceAccountName ?? id;
+    const role = props.roleArn
+        ? undefined
+        : yield* Role("Role", {
+            roleName: props.roleName,
+            assumeRolePolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: {
+                            Service: "pods.eks.amazonaws.com",
+                        },
+                        Action: ["sts:AssumeRole", "sts:TagSession"],
+                    },
+                ],
+            },
+            description: props.description ??
+                `Pod identity role for service account ${serviceAccountName}.`,
+            managedPolicyArns: props.managedPolicyArns,
+            inlinePolicies: props.inlinePolicies,
+            tags: props.tags,
+        });
+    const serviceAccount = yield* Kubernetes.ServiceAccount("ServiceAccount", {
+        cluster: props.cluster,
+        namespace: props.namespace,
+        name: serviceAccountName,
+        labels: props.labels,
+        annotations: props.annotations,
+    });
+    const podIdentityAssociation = yield* PodIdentityAssociation("PodIdentityAssociation", {
+        clusterName: props.cluster.clusterName,
+        namespace: Kubernetes.namespaceNameOf(props.namespace),
+        serviceAccount: serviceAccount.name,
+        roleArn: props.roleArn ?? role.roleArn,
+        disableSessionTags: props.disableSessionTags,
+        targetRoleArn: props.targetRoleArn,
+        policy: props.policy,
+        tags: props.tags,
+    });
+    return {
+        serviceAccount,
+        podIdentityAssociation,
+        role,
+        roleArn: props.roleArn ?? role.roleArn,
+    };
+}));
+//# sourceMappingURL=PodIdentityServiceAccount.js.map

package/lib/AWS/EKS/PodIdentityServiceAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PodIdentityServiceAccount.js","sourceRoot":"","sources":["../../../src/AWS/EKS/PodIdentityServiceAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,IAAI,EAA2C,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,6BAA6B,CAAC;AAoErC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,EAAU,EACV,KAAqC,EACrC,EAAE,CACF,SAAS,CAAC,IAAI,CACZ,EAAE,EACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAE1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,wBAAwB,EAAE;gBACxB,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,OAAO;wBACf,SAAS,EAAE;4BACT,OAAO,EAAE,wBAAwB;yBAClC;wBACD,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;qBAC7C;iBACF;aACF;YACD,WAAW,EACT,KAAK,CAAC,WAAW;gBACjB,yCAAyC,kBAAkB,GAAG;YAChE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IAEP,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,CACrD,gBAAgB,EAChB;QACE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CACF,CAAC;IAEF,MAAM,sBAAsB,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAC1D,wBAAwB,EACxB;QACE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,SAAS,EAAE,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;QACtD,cAAc,EAAE,cAAc,CAAC,IAAI;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAK,CAAC,OAAO;QACvC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CACF,CAAC;IAEF,OAAO;QACL,cAAc;QACd,sBAAsB;QACtB,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAK,CAAC,OAAO;KACK,CAAC;AACjD,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/EKS/PodIdentityWorkload.d.ts

@@ -0,0 +1,190 @@
+import * as Effect from "effect/Effect";
+import type { Input } from "../../Input.ts";
+import * as Kubernetes from "../../Kubernetes/index.ts";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import type { RoleArn, Role as RoleResource } from "../IAM/Role.ts";
+import type { Cluster } from "./Cluster.ts";
+import type { PodIdentityAssociation as PodIdentityAssociationResource } from "./PodIdentityAssociation.ts";
+import { type WorkloadServiceProps } from "./Workload.ts";
+export interface PodIdentityWorkloadProps {
+    /**
+     * Target EKS cluster.
+     */
+    cluster: Cluster;
+    /**
+     * Namespace name or namespace helper result.
+     */
+    namespace: string | {
+        name: string;
+    } | Kubernetes.ObjectRef;
+    /**
+     * Optional explicit workload name. Defaults to the logical id.
+     */
+    name?: string;
+    /**
+     * Optional explicit service account name. Defaults to the workload name.
+     */
+    serviceAccountName?: string;
+    /**
+     * Existing IAM role ARN to use for pod identity.
+     */
+    roleArn?: string;
+    /**
+     * Optional role name when Alchemy creates the IAM role.
+     */
+    roleName?: string;
+    /**
+     * Managed policy ARNs to attach when creating the IAM role.
+     */
+    managedPolicyArns?: string[];
+    /**
+     * Inline policies to attach when creating the IAM role.
+     */
+    inlinePolicies?: Record<string, PolicyDocument>;
+    /**
+     * Optional role description when Alchemy creates the IAM role.
+     */
+    description?: string;
+    /**
+     * Disable session tags for the pod identity association.
+     */
+    disableSessionTags?: boolean;
+    /**
+     * Optional target role ARN for chained role assumption.
+     */
+    targetRoleArn?: string;
+    /**
+     * Optional inline session policy JSON.
+     */
+    policy?: string;
+    /**
+     * Deployment labels.
+     */
+    labels?: Record<string, string>;
+    /**
+     * Pod labels. Defaults to `labels`.
+     */
+    podLabels?: Record<string, string>;
+    /**
+     * Labels applied to the Kubernetes service account.
+     */
+    serviceAccountLabels?: Record<string, string>;
+    /**
+     * Annotations applied to the Kubernetes service account.
+     */
+    serviceAccountAnnotations?: Record<string, string>;
+    /**
+     * Replica count.
+     * @default 1
+     */
+    replicas?: number;
+    /**
+     * Container specs for the pod template.
+     */
+    containers: Kubernetes.ContainerSpec[];
+    /**
+     * Optional service to create for the workload.
+     */
+    service?: WorkloadServiceProps;
+    /**
+     * Tags applied to AWS resources.
+     */
+    tags?: Record<string, string>;
+}
+export interface PodIdentityWorkloadResources {
+    deployment: Kubernetes.ObjectRef;
+    service: Kubernetes.ObjectRef | undefined;
+    serviceAccount: Kubernetes.ObjectRef;
+    podIdentityAssociation: PodIdentityAssociationResource;
+    role: RoleResource | undefined;
+    roleArn: Input<string> | RoleArn;
+    name: string;
+    labels: Record<string, string>;
+    podLabels: Record<string, string>;
+}
+/**
+ * Creates a pod-identity-enabled workload on an EKS cluster.
+ *
+ * This helper combines `PodIdentityServiceAccount` with `Workload` so callers
+ * can declare a service-account-backed deployment without manually wiring the
+ * IAM role, EKS pod identity association, Kubernetes service account, and
+ * deployment together.
+ *
+ * @example Pod identity workload with generated role
+ * ```typescript
+ * const app = yield* PodIdentityWorkload("api", {
+ *   cluster: cluster.cluster,
+ *   namespace: "default",
+ *   managedPolicyArns: ["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"],
+ *   containers: [
+ *     {
+ *       name: "api",
+ *       image: "nginx:latest",
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export declare const PodIdentityWorkload: (id: string, props: PodIdentityWorkloadProps) => Effect.Effect<{
+    deployment: {
+        cluster: Cluster;
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace: string | undefined;
+        key: string;
+        object: {
+            apiVersion: string;
+            kind: string;
+            metadata: {
+                name: string;
+                namespace: string | undefined;
+                labels: Record<string, string> | undefined;
+                annotations: Record<string, string> | undefined;
+            };
+        };
+    };
+    service: {
+        cluster: Cluster;
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace: string | undefined;
+        key: string;
+        object: {
+            apiVersion: string;
+            kind: string;
+            metadata: {
+                name: string;
+                namespace: string | undefined;
+                labels: Record<string, string> | undefined;
+                annotations: Record<string, string> | undefined;
+            };
+        };
+    } | undefined;
+    serviceAccount: {
+        cluster: Cluster;
+        apiVersion: string;
+        kind: string;
+        name: string;
+        namespace: string | undefined;
+        key: string;
+        object: {
+            apiVersion: string;
+            kind: string;
+            metadata: {
+                name: string;
+                namespace: string | undefined;
+                labels: Record<string, string> | undefined;
+                annotations: Record<string, string> | undefined;
+            };
+        };
+    };
+    podIdentityAssociation: PodIdentityAssociationResource;
+    role: RoleResource | undefined;
+    roleArn: string | import("../../Output.ts").Output<`arn:aws:iam::${string}:role/${string}`, never>;
+    name: string;
+    labels: Record<string, string>;
+    podLabels: Record<string, string>;
+}, never, import("../Providers.ts").Providers>;
+//# sourceMappingURL=PodIdentityWorkload.d.ts.map

package/lib/AWS/EKS/PodIdentityWorkload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PodIdentityWorkload.d.ts","sourceRoot":"","sources":["../../../src/AWS/EKS/PodIdentityWorkload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,sBAAsB,IAAI,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAE5G,OAAO,EAAY,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAEpE,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,CAAC,SAAS,CAAC;IAC5D;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;OAEG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;IACvC;;OAEG;IACH,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;IAC1C,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;IACrC,sBAAsB,EAAE,8BAA8B,CAAC;IACvD,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IAC/B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,mBAAmB,GAC9B,IAAI,MAAM,EACV,OAAO,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAiD9B,CAAC"}