agent-claw: automated task changes

cdk/node_modules/aws-cdk-lib/pipelines/.jsiirc.json

@@ -0,0 +1,13 @@
+{
+  "targets": {
+    "java": {
+      "package": "software.amazon.awscdk.pipelines"
+    },
+    "dotnet": {
+      "namespace": "Amazon.CDK.Pipelines"
+    },
+    "python": {
+      "module": "aws_cdk.pipelines"
+    }
+  }
+}

cdk/node_modules/aws-cdk-lib/pipelines/ORIGINAL_API.md

@@ -0,0 +1,747 @@
+# CDK Pipelines, original API
+
+This document describes the API the CDK Pipelines library originally went into
+Developer Preview with. The API has since been reworked, but the original one
+left in place because of popular adoption. The original API still works and is
+still supported, but the revised one is preferred for future projects as it
+is more flexible and abstracts more unnecessary details from the user.
+
+## Migrating from the original to the modern API
+
+It's possible to migrate a pipeline in-place from the original to the modern API.
+The changes necessary are the following:
+
+### The Pipeline
+
+Replace `new CdkPipeline` with `new CodePipeline`. Some
+configuration properties have been changed:
+
+| Old API                        | New API                                                                                        |
+|--------------------------------|------------------------------------------------------------------------------------------------|
+| `cloudAssemblyArtifact`        | removed                                                                                        |
+| `sourceAction`                 | removed                                                                                        |
+| `synthAction`                  | `synth`                                                                                        |
+| `crossAccountKeys`             | new default is `false`; specify `crossAccountKeys: true` if you need cross-account deployments |
+| `cdkCliVersion`                | `cliVersion`                                                                                   |
+| `selfMutating`                 | `selfMutation`                                                                                 |
+| `vpc`, `subnetSelection`       | `codeBuildDefaults.vpc`, `codeBuildDefaults.subnetSelection`                                    |
+| `selfMutationBuildSpec`        | `selfMutationCodeBuildDefaults.partialBuildSpec`                                               |
+| `assetBuildSpec`               | `assetPublishingCodeBuildDefaults.partialBuildSpec`                                            |
+| `assetPreinstallCommands`      | use `assetPublishingCodeBuildDefaults.partialBuildSpec` instead                                |
+| `singlePublisherPerType: true` | `publishAssetsInParallel: false`                                                               |
+| `supportDockerAssets`          | `dockerEnabledForSelfMutation`                                                                 |
+
+### The synth
+
+As the argument to `synth`, use `new ShellStep` or `new CodeBuildStep`,
+depending on whether or not you want to customize the AWS CodeBuild Project that gets generated.
+
+Contrary to `SimpleSynthAction.standardNpmSynth`, you need to specify
+all commands necessary to do a full CDK build and synth, so do include
+installing dependencies and running the CDK CLI. For example, the old API:
+
+```ts
+const sourceArtifact = new codepipeline.Artifact();
+const cloudAssemblyArtifact = new codepipeline.Artifact();
+pipelines.SimpleSynthAction.standardNpmSynth({
+  sourceArtifact,
+  cloudAssemblyArtifact,
+
+  // Use this if you need a build step (if you're not using ts-node
+  // or if you have TypeScript Lambdas that need to be compiled).
+  buildCommand: 'npm run build',
+}),
+```
+
+Becomes:
+
+```ts
+new pipelines.ShellStep('Synth', {
+  input: pipelines.CodePipelineSource.connection('my-org/my-app', 'main', {
+    connectionArn: 'arn:aws:codestar-connections:us-east-1:222222222222:connection/7d2469ff-514a-4e4f-9003-5ca4a43cdc41', // Created using the AWS console * });',
+  }),
+  commands: [
+    'npm ci',
+    'npm run build',
+    'npx cdk synth',
+  ],
+});
+```
+
+Instead of specifying the pipeline source with the `sourceAction` property to
+the pipeline, specify it as the `input` property to the `ShellStep` instead.
+You can use any of the factory functions on `CodePipelineSource`.
+
+For example, for a GitHub source, the following old API:
+
+```ts
+sourceAction: new cpactions.GitHubSourceAction({
+  actionName: 'GitHub',
+  output: sourceArtifact,
+  // Replace these with your actual GitHub project name
+  owner: 'OWNER',
+  repo: 'REPO',
+  branch: 'main', // default: 'master'
+}),
+```
+
+Translates into:
+
+```ts
+input: pipelines.CodePipelineSource.gitHub('OWNER/REPO', 'main', {
+  authentication: cdk.SecretValue.secretsManager('GITHUB_TOKEN_NAME'),
+}),
+```
+
+### Deployments
+
+Adding CDK Stages to deploy is done by calling `addStage()`, or
+potentially `addWave().addStage()`. All stages inside a wave are
+deployed in parallel, which was not a capability of the original API.
+
+| Old API                       | New API                                                                                                                       |
+|-------------------------------|-------------------------------------------------------------------------------------------------------------------------------|
+| `addApplicationStage()`       | `addStage()`                                                                                                                  |
+| `addStage().addApplication()` | `addStage()`. Adding multiple CDK Stages into a single Pipeline stage is not supported, add multiple Pipeline stages instead. |
+
+### Approvals
+
+Approvals are added by adding `pre` and `post` options to `addStage()`, with
+steps to execute before and after the deployments, respectively. We recommend
+putting manual approvals in `pre` steps, and automated approvals in `post` steps.
+
+#### Manual approvals
+
+For example, specifying a manual approval on a stage deployment in old API:
+
+```ts
+declare const pipeline: pipelines.CdkPipeline;
+const stage = pipeline.addApplicationStage(...);
+stage.addAction(new pipelines.ManualApprovalAction({
+  actionName: 'ManualApproval',
+  runOrder: testingStage.nextSequentialRunOrder(),
+}));
+```
+
+Becomes:
+
+```ts
+const stage = new MyApplicationStage(this, 'MyApplication');
+pipeline.addStage(stage, {
+  pre: [
+    new pipelines.ManualApprovalStep('ManualApproval'),
+  ],
+});
+```
+
+Note that this we've used `pre` to put the manual approval *before* a Stage
+deployment (this was not possible in the old API). Be sure to put the manual
+approval in the `pre` steps list of the *next* Stage to keep
+it in the same location in the pipeline.
+
+#### Automated approvals
+
+For example, specifying an automated approval after a stage is deployed in the following old API:
+
+```ts
+const stage = pipeline.addApplicationStage(...);
+stage.addActions(new pipelines.ShellScriptAction({
+  actionName: 'MyValidation',
+  commands: ['curl -Ssf $VAR'],
+  useOutputs: {
+    VAR: pipeline.stackOutput(stage.cfnOutput),
+  },
+  // Optionally specify a BuildEnvironment
+  environment: { ... },
+}));
+```
+
+Becomes:
+
+```ts
+const stage = new MyApplicationStage(this, 'MyApplication');
+pipeline.addStage(stage, {
+  post: [
+    new pipelines.CodeBuildStep('MyValidation', {
+      commands: ['curl -Ssf $VAR'],
+      envFromCfnOutput: {
+        VAR: stage.cfnOutput,
+      },
+      // Optionally specify a BuildEnvironment
+      buildEnvironment: { ... },
+    }),
+  ],
+});
+```
+
+You can also use `ShellStep` if you don't need any of the CodeBuild Project
+customizations (like `buildEnvironment`).
+
+#### Change set approvals
+
+In the old API, there were two properties that were used to add actions to the pipeline
+in between the `CreateChangeSet` and `ExecuteChangeSet` actions: `manualApprovals` and `extraRunOrderSpace`.
+This can be achieved in the modern API via the `stackSteps` property, which allows steps to be added
+at the stack level:
+
+```ts
+const stage = new MyApplicationStage(this, 'MyApplication');
+pipeline.addStage(stage, {
+  stackSteps: [{
+    stack: stage.stack1,
+    changeSet: [new pipelines.ManualApprovalStep('ChangeSet Approval')],
+  }],
+});
+```
+
+### Custom CodePipeline Actions
+
+See the section [**Arbitrary CodePipeline actions** in the
+main `README`](https://github.com/aws/aws-cdk/blob/main/packages/@aws-cdk/pipelines/README.md#arbitrary-codepipeline-actions) for an example of how to inject arbitrary
+CodeBuild Actions.
+
+## Defining the pipeline
+
+In the original API, you have to import the `aws-codepipeline` construct
+library and create `Artifact` objects for the source and Cloud Assembly
+artifacts:
+
+```ts
+import { Construct, Stage, Stack, StackProps, StageProps } from 'aws-cdk-lib';
+import * as codepipeline from 'aws-cdk-lib/aws-codepipeline';
+
+/**
+ * Stack to hold the pipeline
+ */
+class MyPipelineStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    const sourceArtifact = new codepipeline.Artifact();
+    const cloudAssemblyArtifact = new codepipeline.Artifact();
+
+    const pipeline = new pipelines.CdkPipeline(this, 'Pipeline', {
+      cloudAssemblyArtifact,
+
+      sourceAction: new cpactions.GitHubSourceAction({
+        actionName: 'GitHub',
+        output: sourceArtifact,
+        oauthToken: cdk.SecretValue.secretsManager('GITHUB_TOKEN_NAME'),
+        // Replace these with your actual GitHub project name
+        owner: 'OWNER',
+        repo: 'REPO',
+        branch: 'main', // default: 'master'
+      }),
+
+      synthAction: pipelines.SimpleSynthAction.standardNpmSynth({
+        sourceArtifact,
+        cloudAssemblyArtifact,
+
+        // Use this if you need a build step (if you're not using ts-node
+        // or if you have TypeScript Lambdas that need to be compiled).
+        buildCommand: 'npm run build',
+      }),
+    });
+
+    // Do this as many times as necessary with any account and region
+    // Account and region may different from the pipeline's.
+    pipeline.addApplicationStage(new MyApplication(this, 'Prod', {
+      env: {
+        account: '123456789012',
+        region: 'eu-west-1',
+      }
+    }));
+  }
+}
+```
+
+### A note on cost
+
+By default, the `CdkPipeline` construct creates an AWS Key Management Service
+(AWS KMS) Customer Master Key (CMK) for you to encrypt the artifacts in the
+artifact bucket, which incurs a cost of
+**$1/month**. This default configuration is necessary to allow cross-account
+deployments.
+
+If you do not intend to perform cross-account deployments, you can disable
+the creation of the Customer Master Keys by passing `crossAccountKeys: false`
+when defining the Pipeline:
+
+```ts
+const pipeline = new pipelines.CdkPipeline(this, 'Pipeline', {
+  crossAccountKeys: false,
+
+  // ...
+});
+```
+
+### Defining the Pipeline (Source and Synth)
+
+The pipeline is defined by instantiating `CdkPipeline` in a Stack. This defines the
+source location for the pipeline as well as the build commands. For example, the following
+defines a pipeline whose source is stored in a GitHub repository, and uses NPM
+to build. The Pipeline will be provisioned in account `111111111111` and region
+`eu-west-1`:
+
+```ts
+class MyPipelineStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    const sourceArtifact = new codepipeline.Artifact();
+    const cloudAssemblyArtifact = new codepipeline.Artifact();
+
+    const pipeline = new pipelines.CdkPipeline(this, 'Pipeline', {
+      pipelineName: 'MyAppPipeline',
+      cloudAssemblyArtifact,
+
+      sourceAction: new cpactions.GitHubSourceAction({
+        actionName: 'GitHub',
+        output: sourceArtifact,
+        oauthToken: cdk.SecretValue.secretsManager('GITHUB_TOKEN_NAME'),
+        // Replace these with your actual GitHub project name
+        owner: 'OWNER',
+        repo: 'REPO',
+        branch: 'main', // default: 'master'
+      }),
+
+      synthAction: pipelines.SimpleSynthAction.standardNpmSynth({
+        sourceArtifact,
+        cloudAssemblyArtifact,
+
+        // Optionally specify a VPC in which the action runs
+        vpc: new ec2.Vpc(this, 'NpmSynthVpc'),
+
+        // Use this if you need a build step (if you're not using ts-node
+        // or if you have TypeScript Lambdas that need to be compiled).
+        buildCommand: 'npm run build',
+      }),
+    });
+  }
+}
+
+const app = new App();
+new MyPipelineStack(app, 'PipelineStack', {
+  env: {
+    account: '111111111111',
+    region: 'eu-west-1',
+  }
+});
+```
+
+If you prefer more control over the underlying CodePipeline object, you can
+create one yourself, including custom Source and Build stages:
+
+```ts
+const codePipeline = new codepipeline.Pipeline(pipelineStack, 'CodePipeline', {
+  stages: [
+    {
+      stageName: 'CustomSource',
+      actions: [...],
+    },
+    {
+      stageName: 'CustomBuild',
+      actions: [...],
+    },
+  ],
+});
+
+const app = new App();
+const cdkPipeline = new pipelines.CdkPipeline(app, 'CdkPipeline', {
+  codePipeline,
+  cloudAssemblyArtifact,
+});
+```
+
+If you use assets for files or Docker images, every asset will get its own upload action during the asset stage.
+By setting the value `singlePublisherPerType` to `true`, only one action for files and one action for
+Docker images is created that handles all assets of the respective type.
+
+If you need to run commands to setup proxies, mirrors, etc you can supply them using the `assetPreInstallCommands`.
+
+#### Sources
+
+Any of the regular sources from the [`aws-cdk-lib/aws-codepipeline-actions`](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-codepipeline-actions-readme.html#github) module can be used.
+
+#### Synths
+
+You define how to build and synth the project by specifying a `synthAction`.
+This can be any CodePipeline action that produces an artifact with a CDK
+Cloud Assembly in it (the contents of the `cdk.out` directory created when
+`cdk synth` is called). Pass the output artifact of the synth in the
+Pipeline's `cloudAssemblyArtifact` property.
+
+`SimpleSynthAction` is available for synths that can be performed by running a couple
+of simple shell commands (install, build, and synth) using AWS CodeBuild. When
+using these, the source repository does not need to have a `buildspec.yml`. An example
+of using `SimpleSynthAction` to run a Maven build followed by a CDK synth:
+
+```ts
+const pipeline = new pipelines.CdkPipeline(this, 'Pipeline', {
+  // ...
+  synthAction: new pipelines.SimpleSynthAction({
+    sourceArtifact,
+    cloudAssemblyArtifact,
+    installCommands: ['npm install -g aws-cdk'],
+    buildCommands: ['mvn package'],
+    synthCommand: 'cdk synth',
+  })
+});
+```
+
+Available as factory functions on `SimpleSynthAction` are some common
+convention-based synth:
+
+* `SimpleSynthAction.standardNpmSynth()`: build using NPM conventions. Expects a `package-lock.json`,
+  a `cdk.json`, and expects the CLI to be a versioned dependency in `package.json`. Does
+  not perform a build step by default.
+* `CdkSynth.standardYarnSynth()`: build using Yarn conventions. Expects a `yarn.lock`
+  a `cdk.json`, and expects the CLI to be a versioned dependency in `package.json`. Does
+  not perform a build step by default.
+
+If you need a custom build/synth step that is not covered by `SimpleSynthAction`, you can
+always add a custom CodeBuild project and pass a corresponding `CodeBuildAction` to the
+pipeline.
+
+#### Add Additional permissions to the CodeBuild Project Role for building and synthesizing
+
+You can customize the role permissions used by the CodeBuild project so it has access to
+the needed resources. eg: Adding CodeArtifact repo permissions so we pull npm packages
+from the CA repo instead of NPM.
+
+```ts
+class MyPipelineStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    ...
+    const pipeline = new pipelines.CdkPipeline(this, 'Pipeline', {
+      ...
+      synthAction: pipelines.SimpleSynthAction.standardNpmSynth({
+        sourceArtifact,
+        cloudAssemblyArtifact,
+
+        // Use this to customize and a permissions required for the build
+        // and synth
+        rolePolicyStatements: [
+          new iam.PolicyStatement({
+            actions: ['codeartifact:*', 'sts:GetServiceBearerToken'],
+            resources: ['arn:codeartifact:repo:arn'],
+          }),
+        ],
+
+        // Then you can login to codeartifact repository
+        // and npm will now pull packages from your repository
+        // Note the codeartifact login command requires more params to work.
+        buildCommands: [
+          'aws codeartifact login --tool npm',
+          'npm run build',
+        ],
+      }),
+    });
+  }
+}
+```
+
+### Adding Application Stages
+
+To define an application that can be added to the pipeline integrally, define a subclass
+of `Stage`. The `Stage` can contain one or more stack which make up your application. If
+there are dependencies between the stacks, the stacks will automatically be added to the
+pipeline in the right order. Stacks that don't depend on each other will be deployed in
+parallel. You can add a dependency relationship between stacks by calling
+`stack1.addDependency(stack2)`.
+
+Stages take a default `env` argument which the Stacks inside the Stage will fall back to
+if no `env` is defined for them.
+
+An application is added to the pipeline by calling `addApplicationStage()` with instances
+of the Stage. The same class can be instantiated and added to the pipeline multiple times
+to define different stages of your DTAP or multi-region application pipeline:
+
+```ts
+// Testing stage
+pipeline.addApplicationStage(new MyApplication(this, 'Testing', {
+  env: { account: '111111111111', region: 'eu-west-1' }
+}));
+
+// Acceptance stage
+pipeline.addApplicationStage(new MyApplication(this, 'Acceptance', {
+  env: { account: '222222222222', region: 'eu-west-1' }
+}));
+
+// Production stage
+pipeline.addApplicationStage(new MyApplication(this, 'Production', {
+  env: { account: '333333333333', region: 'eu-west-1' }
+}));
+```
+
+> Be aware that adding new stages via `addApplicationStage()` will
+> automatically add them to the pipeline and deploy the new stacks, but
+> *removing* them from the pipeline or deleting the pipeline stack will not
+> automatically delete deployed application stacks. You must delete those
+> stacks by hand using the AWS CloudFormation console or the AWS CLI.
+
+### More Control
+
+Every *Application Stage* added by `addApplicationStage()` will lead to the addition of
+an individual *Pipeline Stage*, which is subsequently returned. You can add more
+actions to the stage by calling `addAction()` on it. For example:
+
+```ts
+const testingStage = pipeline.addApplicationStage(new MyApplication(this, 'Testing', {
+  env: { account: '111111111111', region: 'eu-west-1' }
+}));
+
+// Add a action -- in this case, a Manual Approval action
+// (for illustration purposes: testingStage.addManualApprovalAction() is a
+// convenience shorthand that does the same)
+testingStage.addAction(new pipelines.ManualApprovalAction({
+  actionName: 'ManualApproval',
+  runOrder: testingStage.nextSequentialRunOrder(),
+}));
+```
+
+You can also add more than one *Application Stage* to one *Pipeline Stage*. For example:
+
+```ts
+// Create an empty pipeline stage
+const testingStage = pipeline.addStage('Testing');
+
+// Add two application stages to the same pipeline stage
+testingStage.addApplication(new MyApplication1(this, 'MyApp1', {
+  env: { account: '111111111111', region: 'eu-west-1' }
+}));
+testingStage.addApplication(new MyApplication2(this, 'MyApp2', {
+  env: { account: '111111111111', region: 'eu-west-1' }
+}));
+```
+
+Even more, adding a manual approval action or reserving space for some extra sequential actions
+between 'Prepare' and 'Execute' ChangeSet actions is possible.
+
+```ts
+  pipeline.addApplicationStage(new MyApplication(this, 'Production'), {
+    manualApprovals: true,
+    extraRunOrderSpace: 1,
+  });
+```
+
+### Adding validations to the pipeline
+
+You can add any type of CodePipeline Action to the pipeline in order to validate
+the deployments you are performing.
+
+The CDK Pipelines construct library comes with a `ShellScriptAction` which uses AWS CodeBuild
+to run a set of shell commands (potentially running a test set that comes with your application,
+using stack outputs of the deployed stacks).
+
+In its simplest form, adding validation actions looks like this:
+
+```ts
+const stage = pipeline.addApplicationStage(new MyApplication(/* ... */));
+
+stage.addActions(new pipelines.ShellScriptAction({
+  actionName: 'MyValidation',
+  commands: ['curl -Ssf https://my.webservice.com/'],
+  // Optionally specify a VPC if, for example, the service is deployed with a private load balancer
+  vpc,
+  // Optionally specify SecurityGroups
+  securityGroups,
+  // Optionally specify a BuildEnvironment
+  environment,
+}));
+```
+
+#### Using CloudFormation Stack Outputs in ShellScriptAction
+
+Because many CloudFormation deployments result in the generation of resources with unpredictable
+names, validations have support for reading back CloudFormation Outputs after a deployment. This
+makes it possible to pass (for example) the generated URL of a load balancer to the test set.
+
+To use Stack Outputs, expose the `CfnOutput` object you're interested in, and
+call `pipeline.stackOutput()` on it:
+
+```ts
+class MyLbApplication extends Stage {
+  public readonly loadBalancerAddress: CfnOutput;
+
+  constructor(scope: Construct, id: string, props?: StageProps) {
+    super(scope, id, props);
+
+    const lbStack = new LoadBalancerStack(this, 'Stack');
+
+    // Or create this in `LoadBalancerStack` directly
+    this.loadBalancerAddress = new CfnOutput(lbStack, 'LbAddress', {
+      value: `https://${lbStack.loadBalancer.loadBalancerDnsName}/`
+    });
+  }
+}
+
+const lbApp = new MyLbApplication(this, 'MyApp', {
+  env: { /* ... */ }
+});
+const stage = pipeline.addApplicationStage(lbApp);
+stage.addActions(new pipelines.ShellScriptAction({
+  // ...
+  useOutputs: {
+    // When the test is executed, this will make $URL contain the
+    // load balancer address.
+    URL: pipeline.stackOutput(lbApp.loadBalancerAddress),
+  }
+});
+```
+
+#### Using additional files in Shell Script Actions
+
+As part of a validation, you probably want to run a test suite that's more
+elaborate than what can be expressed in a couple of lines of shell script.
+You can bring additional files into the shell script validation by supplying
+the `additionalArtifacts` property.
+
+Here are some typical examples for how you might want to bring in additional
+files from several sources:
+
+* Directory from the source repository
+* Additional compiled artifacts from the synth step
+
+#### Controlling IAM permissions
+
+IAM permissions can be added to the execution role of a `ShellScriptAction` in
+two ways.
+
+Either pass additional policy statements in the `rolePolicyStatements` property:
+
+```ts
+new pipelines.ShellScriptAction({
+  // ...
+  rolePolicyStatements: [
+    new iam.PolicyStatement({
+      actions: ['s3:GetObject'],
+      resources: ['*'],
+    }),
+  ],
+}));
+```
+
+The Action can also be used as a Grantable after having been added to a Pipeline:
+
+```ts
+const action = new pipelines.ShellScriptAction({ /* ... */ });
+pipeline.addStage('Test').addActions(action);
+
+bucket.grants.read(action);
+```
+
+#### Additional files from the source repository
+
+Bringing in additional files from the source repository is appropriate if the
+files in the source repository are directly usable in the test (for example,
+if they are executable shell scripts themselves). Pass the `sourceArtifact`:
+
+```ts
+const sourceArtifact = new codepipeline.Artifact();
+
+const pipeline = new pipelines.CdkPipeline(this, 'Pipeline', {
+  // ...
+});
+
+const validationAction = new pipelines.ShellScriptAction({
+  actionName: 'TestUsingSourceArtifact',
+  additionalArtifacts: [sourceArtifact],
+
+  // 'test.sh' comes from the source repository
+  commands: ['./test.sh'],
+});
+```
+
+#### Additional files from the synth step
+
+Getting the additional files from the synth step is appropriate if your
+tests need the compilation step that is done as part of synthesis.
+
+On the synthesis step, specify `additionalArtifacts` to package
+additional subdirectories into artifacts, and use the same artifact
+in the `ShellScriptAction`'s `additionalArtifacts`:
+
+```ts
+// If you are using additional output artifacts from the synth step,
+// they must be named.
+const cloudAssemblyArtifact = new codepipeline.Artifact('CloudAsm');
+const integTestsArtifact = new codepipeline.Artifact('IntegTests');
+
+const pipeline = new pipelines.CdkPipeline(this, 'Pipeline', {
+  synthAction: pipelines.SimpleSynthAction.standardNpmSynth({
+    sourceArtifact,
+    cloudAssemblyArtifact,
+    buildCommands: ['npm run build'],
+    additionalArtifacts: [
+      {
+        directory: 'test',
+        artifact: integTestsArtifact,
+      }
+    ],
+  }),
+  // ...
+});
+
+const validationAction = new pipelines.ShellScriptAction({
+  actionName: 'TestUsingBuildArtifact',
+  additionalArtifacts: [integTestsArtifact],
+  // 'test.js' was produced from 'test/test.ts' during the synth step
+  commands: ['node ./test.js'],
+});
+```
+
+### Confirm permissions broadening
+
+To keep tabs on the security impact of changes going out through your pipeline,
+you can insert a security check before any stage deployment. This security check
+will check if the upcoming deployment would add any new IAM permissions or
+security group rules, and if so pause the pipeline and require you to confirm
+the changes.
+
+The security check will appear as two distinct actions in your pipeline: first
+a CodeBuild project that runs `cdk diff` on the stage that's about to be deployed,
+followed by a Manual Approval action that pauses the pipeline. If it so happens
+that there no new IAM permissions or security group rules will be added by the deployment,
+the manual approval step is automatically satisfied. The pipeline will look like this:
+
+```txt
+Pipeline
+├── ...
+├── MyApplicationStage
+│    ├── MyApplicationSecurityCheck       // Security Diff Action
+│    ├── MyApplicationManualApproval      // Manual Approval Action
+│    ├── Stack.Prepare
+│    └── Stack.Deploy
+└── ...
+```
+
+You can enable the security check by passing `confirmBroadeningPermissions` to
+`addApplicationStage`:
+
+```ts
+const stage = pipeline.addApplicationStage(new MyApplication(this, 'PreProd'), {
+  confirmBroadeningPermissions: true,
+});
+```
+
+To get notified when there is a change that needs your manual approval,
+create an SNS Topic, subscribe your own email address, and pass it in via
+`securityNotificationTopic`:
+
+```ts
+import * as sns from 'aws-cdk-lib/aws-sns';
+import * as subscriptions from 'aws-cdk-lib/aws-sns-subscriptions';
+
+const topic = new sns.Topic(this, 'SecurityChangesTopic');
+topic.addSubscription(new subscriptions.EmailSubscription('test@email.com'));
+
+const pipeline = new pipelines.CdkPipeline(app, 'Pipeline', { /* ... */ });
+const stage = pipeline.addApplicationStage(new MyApplication(this, 'PreProd'), {
+  confirmBroadeningPermissions: true,
+  securityNotificationTopic: topic,
+});
+```
+
+**Note**: Manual Approvals notifications only apply when an application has security
+check enabled.

cdk/node_modules/aws-cdk-lib/pipelines/index.d.ts

@@ -0,0 +1 @@
+export * from './lib';

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/asset-type.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Type of the asset that is being published
+ */
+export declare enum AssetType {
+    /**
+     * A file
+     */
+    FILE = "file",
+    /**
+     * A Docker image
+     */
+    DOCKER_IMAGE = "docker-image"
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/asset-type.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.AssetType=void 0;var AssetType;(function(AssetType2){AssetType2.FILE="file",AssetType2.DOCKER_IMAGE="docker-image"})(AssetType||(exports.AssetType=AssetType={}));

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/file-set.d.ts

@@ -0,0 +1,48 @@
+import type { Step } from './step';
+/**
+ * A set of files traveling through the deployment pipeline
+ *
+ * Individual steps in the pipeline produce or consume
+ * `FileSet`s.
+ */
+export declare class FileSet implements IFileSetProducer {
+    /** Human-readable descriptor for this file set (does not need to be unique) */
+    readonly id: string;
+    /**
+     * The primary output of a file set producer
+     *
+     * The primary output of a FileSet is itself.
+     */
+    readonly primaryOutput?: FileSet;
+    private _producer?;
+    constructor(
+    /** Human-readable descriptor for this file set (does not need to be unique) */
+    id: string, producer?: Step);
+    /**
+     * The Step that produces this FileSet
+     */
+    get producer(): Step;
+    /**
+     * Mark the given Step as the producer for this FileSet
+     *
+     * This method can only be called once.
+     */
+    producedBy(producer?: Step): void;
+    /**
+     * Return a string representation of this FileSet
+     */
+    toString(): string;
+}
+/**
+ * Any class that produces, or is itself, a `FileSet`
+ *
+ * Steps implicitly produce a primary FileSet as an output.
+ */
+export interface IFileSetProducer {
+    /**
+     * The `FileSet` produced by this file set producer
+     *
+     * @default - This producer doesn't produce any file set
+     */
+    readonly primaryOutput?: FileSet;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/file-set.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.FileSet=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class FileSet{id;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.FileSet",version:"2.252.0"};primaryOutput=this;_producer;constructor(id,producer){this.id=id;try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_Step(producer)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,FileSet),error}this._producer=producer}get producer(){if(!this._producer)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`FilesetDoesnTProducerCall`,`FileSet '${this.id}' doesn't have a producer; call 'fileSet.producedBy()'`);return this._producer}producedBy(producer){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_Step(producer)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.producedBy),error}if(this._producer)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`FilesetAlreadyProducerWhile`,`FileSet '${this.id}' already has a producer (${this._producer}) while setting producer: ${producer}`);this._producer=producer}toString(){return`FileSet(${this.id})`}}exports.FileSet=FileSet;

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/index.d.ts

@@ -0,0 +1,8 @@
+export * from './asset-type';
+export * from './file-set';
+export * from './shell-step';
+export * from './stack-deployment';
+export * from './stage-deployment';
+export * from './step';
+export * from './wave';
+export * from './manual-approval';

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/index.js

@@ -0,0 +1 @@
+"use strict";var __createBinding=exports&&exports.__createBinding||(Object.create?(function(o,m,k,k2){k2===void 0&&(k2=k);var desc=Object.getOwnPropertyDescriptor(m,k);(!desc||("get"in desc?!m.__esModule:desc.writable||desc.configurable))&&(desc={enumerable:!0,get:function(){return m[k]}}),Object.defineProperty(o,k2,desc)}):(function(o,m,k,k2){k2===void 0&&(k2=k),o[k2]=m[k]})),__exportStar=exports&&exports.__exportStar||function(m,exports2){for(var p in m)p!=="default"&&!Object.prototype.hasOwnProperty.call(exports2,p)&&__createBinding(exports2,m,p)};Object.defineProperty(exports,"__esModule",{value:!0});var _noFold;exports.AssetType=void 0,Object.defineProperty(exports,_noFold="AssetType",{enumerable:!0,configurable:!0,get:()=>{var value=require("./asset-type").AssetType;return Object.defineProperty(exports,_noFold="AssetType",{enumerable:!0,configurable:!0,value}),value}}),exports.FileSet=void 0,Object.defineProperty(exports,_noFold="FileSet",{enumerable:!0,configurable:!0,get:()=>{var value=require("./file-set").FileSet;return Object.defineProperty(exports,_noFold="FileSet",{enumerable:!0,configurable:!0,value}),value}}),exports.ShellStep=void 0,Object.defineProperty(exports,_noFold="ShellStep",{enumerable:!0,configurable:!0,get:()=>{var value=require("./shell-step").ShellStep;return Object.defineProperty(exports,_noFold="ShellStep",{enumerable:!0,configurable:!0,value}),value}}),exports.StackOutputReference=void 0,Object.defineProperty(exports,_noFold="StackOutputReference",{enumerable:!0,configurable:!0,get:()=>{var value=require("./shell-step").StackOutputReference;return Object.defineProperty(exports,_noFold="StackOutputReference",{enumerable:!0,configurable:!0,value}),value}}),exports.StackDeployment=void 0,Object.defineProperty(exports,_noFold="StackDeployment",{enumerable:!0,configurable:!0,get:()=>{var value=require("./stack-deployment").StackDeployment;return Object.defineProperty(exports,_noFold="StackDeployment",{enumerable:!0,configurable:!0,value}),value}}),exports.StageDeployment=void 0,Object.defineProperty(exports,_noFold="StageDeployment",{enumerable:!0,configurable:!0,get:()=>{var value=require("./stage-deployment").StageDeployment;return Object.defineProperty(exports,_noFold="StageDeployment",{enumerable:!0,configurable:!0,value}),value}}),exports.Step=void 0,Object.defineProperty(exports,_noFold="Step",{enumerable:!0,configurable:!0,get:()=>{var value=require("./step").Step;return Object.defineProperty(exports,_noFold="Step",{enumerable:!0,configurable:!0,value}),value}}),exports.Wave=void 0,Object.defineProperty(exports,_noFold="Wave",{enumerable:!0,configurable:!0,get:()=>{var value=require("./wave").Wave;return Object.defineProperty(exports,_noFold="Wave",{enumerable:!0,configurable:!0,value}),value}}),exports.ManualApprovalStep=void 0,Object.defineProperty(exports,_noFold="ManualApprovalStep",{enumerable:!0,configurable:!0,get:()=>{var value=require("./manual-approval").ManualApprovalStep;return Object.defineProperty(exports,_noFold="ManualApprovalStep",{enumerable:!0,configurable:!0,value}),value}});

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/manual-approval.d.ts

@@ -0,0 +1,55 @@
+import { Step } from './step';
+import type { ITopic } from '../../../aws-sns';
+/**
+ * Construction properties for a `ManualApprovalStep`
+ */
+export interface ManualApprovalStepProps {
+    /**
+     * The comment to display with this manual approval
+     *
+     * @default - No comment
+     */
+    readonly comment?: string;
+    /**
+     * The URL for review associated with this manual approval
+     *
+     * @default - No URL
+     */
+    readonly reviewUrl?: string;
+    /**
+     * Optional SNS topic to send notifications to when an approval is pending
+     *
+     * @default - No notifications
+     */
+    readonly notificationTopic?: ITopic;
+}
+/**
+ * A manual approval step
+ *
+ * If this step is added to a Pipeline, the Pipeline will
+ * be paused waiting for a human to resume it
+ *
+ * Only engines that support pausing the deployment will
+ * support this step type.
+ */
+export declare class ManualApprovalStep extends Step {
+    /**
+     * The comment associated with this manual approval
+     *
+     * @default - No comment
+     */
+    readonly comment?: string;
+    /**
+     * The URL for review associated with this manual approval
+     *
+     * @default - No URL
+     */
+    readonly reviewUrl?: string;
+    /**
+     * Optional SNS topic to send notifications
+     *
+     * @default - No notifications
+     */
+    readonly notificationTopic?: ITopic;
+    constructor(id: string, props?: ManualApprovalStepProps);
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/manual-approval.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ManualApprovalStep=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var step_1=()=>{var tmp=require("./step");return step_1=()=>tmp,tmp};class ManualApprovalStep extends step_1().Step{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.ManualApprovalStep",version:"2.252.0"};comment;reviewUrl;notificationTopic;constructor(id,props={}){super(id);try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_ManualApprovalStepProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,ManualApprovalStep),error}this.comment=props.comment,this.reviewUrl=props.reviewUrl,this.notificationTopic=props.notificationTopic,this.discoverReferencedOutputs(props.comment)}}exports.ManualApprovalStep=ManualApprovalStep;

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/shell-step.d.ts

@@ -0,0 +1,186 @@
+import type { IFileSetProducer } from './file-set';
+import { FileSet } from './file-set';
+import type { StackDeployment } from './stack-deployment';
+import { Step } from './step';
+import type { CfnOutput } from '../../../core';
+/**
+ * Construction properties for a `ShellStep`.
+ */
+export interface ShellStepProps {
+    /**
+     * Commands to run
+     */
+    readonly commands: string[];
+    /**
+     * Installation commands to run before the regular commands
+     *
+     * For deployment engines that support it, install commands will be classified
+     * differently in the job history from the regular `commands`.
+     *
+     * @default - No installation commands
+     */
+    readonly installCommands?: string[];
+    /**
+     * Environment variables to set
+     *
+     * @default - No environment variables
+     */
+    readonly env?: Record<string, string>;
+    /**
+     * Set environment variables based on Stack Outputs
+     *
+     * `ShellStep`s following stack or stage deployments may
+     * access the `CfnOutput`s of those stacks to get access to
+     * --for example--automatically generated resource names or
+     * endpoint URLs.
+     *
+     * @default - No environment variables created from stack outputs
+     */
+    readonly envFromCfnOutputs?: Record<string, CfnOutput>;
+    /**
+     * FileSet to run these scripts on
+     *
+     * The files in the FileSet will be placed in the working directory when
+     * the script is executed. Use `additionalInputs` to download file sets
+     * to other directories as well.
+     *
+     * @default - No input specified
+     */
+    readonly input?: IFileSetProducer;
+    /**
+     * Additional FileSets to put in other directories
+     *
+     * Specifies a mapping from directory name to FileSets. During the
+     * script execution, the FileSets will be available in the directories
+     * indicated.
+     *
+     * The directory names may be relative. For example, you can put
+     * the main input and an additional input side-by-side with the
+     * following configuration:
+     *
+     * ```ts
+     * const script = new pipelines.ShellStep('MainScript', {
+     *   commands: ['npm ci','npm run build','npx cdk synth'],
+     *   input: pipelines.CodePipelineSource.gitHub('org/source1', 'main'),
+     *   additionalInputs: {
+     *     '../siblingdir': pipelines.CodePipelineSource.gitHub('org/source2', 'main'),
+     *   }
+     * });
+     * ```
+     *
+     * @default - No additional inputs
+     */
+    readonly additionalInputs?: Record<string, IFileSetProducer>;
+    /**
+     * The directory that will contain the primary output fileset
+     *
+     * After running the script, the contents of the given directory
+     * will be treated as the primary output of this Step.
+     *
+     * @default - No primary output
+     */
+    readonly primaryOutputDirectory?: string;
+}
+/**
+ * Run shell script commands in the pipeline. This is a generic step designed
+ * to be deployment engine agnostic.
+ */
+export declare class ShellStep extends Step {
+    /**
+     * Commands to run
+     */
+    readonly commands: string[];
+    /**
+     * Installation commands to run before the regular commands
+     *
+     * For deployment engines that support it, install commands will be classified
+     * differently in the job history from the regular `commands`.
+     *
+     * @default - No installation commands
+     */
+    readonly installCommands: string[];
+    /**
+     * Environment variables to set
+     *
+     * @default - No environment variables
+     */
+    readonly env: Record<string, string>;
+    /**
+     * Set environment variables based on Stack Outputs
+     *
+     * @default - No environment variables created from stack outputs
+     */
+    readonly envFromCfnOutputs: Record<string, StackOutputReference>;
+    /**
+     * Input FileSets
+     *
+     * A list of `(FileSet, directory)` pairs, which are a copy of the
+     * input properties. This list should not be modified directly.
+     */
+    readonly inputs: FileSetLocation[];
+    /**
+     * Output FileSets
+     *
+     * A list of `(FileSet, directory)` pairs, which are a copy of the
+     * input properties. This list should not be modified directly.
+     */
+    readonly outputs: FileSetLocation[];
+    private readonly _additionalOutputs;
+    private _primaryOutputDirectory?;
+    constructor(id: string, props: ShellStepProps);
+    /**
+     * Configure the given output directory as primary output
+     *
+     * If no primary output has been configured yet, this directory
+     * will become the primary output of this ShellStep, otherwise this
+     * method will throw if the given directory is different than the
+     * currently configured primary output directory.
+     */
+    primaryOutputDirectory(directory: string): FileSet;
+    /**
+     * Add an additional output FileSet based on a directory.
+     *
+     *
+     * After running the script, the contents of the given directory
+     * will be exported as a `FileSet`. Use the `FileSet` as the
+     * input to another step.
+     *
+     * Multiple calls with the exact same directory name string (not normalized)
+     * will return the same FileSet.
+     */
+    addOutputDirectory(directory: string): FileSet;
+    get consumedStackOutputs(): StackOutputReference[];
+}
+/**
+ * Location of a FileSet consumed or produced by a ShellStep
+ */
+export interface FileSetLocation {
+    /**
+     * The (relative) directory where the FileSet is found
+     */
+    readonly directory: string;
+    /**
+     * The FileSet object
+     */
+    readonly fileSet: FileSet;
+}
+/**
+ * A Reference to a Stack Output
+ */
+export declare class StackOutputReference {
+    /** A human-readable description of the producing stack */
+    readonly stackDescription: string;
+    /** Artifact id of the producing stack */
+    private readonly stackArtifactId;
+    /** Output name of the producing stack */
+    readonly outputName: string;
+    /**
+     * Create a StackOutputReference that references the given CfnOutput
+     */
+    static fromCfnOutput(output: CfnOutput): StackOutputReference;
+    private constructor();
+    /**
+     * Whether or not this stack output is being produced by the given Stack deployment
+     */
+    isProducedBy(stack: StackDeployment): boolean;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/shell-step.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.StackOutputReference=exports.ShellStep=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var file_set_1=()=>{var tmp=require("./file-set");return file_set_1=()=>tmp,tmp},step_1=()=>{var tmp=require("./step");return step_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},javascript_1=()=>{var tmp=require("../private/javascript");return javascript_1=()=>tmp,tmp};class ShellStep extends step_1().Step{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.ShellStep",version:"2.252.0"};commands;installCommands;env;envFromCfnOutputs;inputs=[];outputs=[];_additionalOutputs={};_primaryOutputDirectory;constructor(id,props){super(id);try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_ShellStepProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,ShellStep),error}if(this.commands=props.commands,this.installCommands=props.installCommands??[],this.env=props.env??{},this.envFromCfnOutputs=(0,javascript_1().mapValues)(props.envFromCfnOutputs??{},x=>StackOutputReference.fromCfnOutput(x)),this.discoverReferencedOutputs({env:this.env}),props.input){const fileSet=props.input.primaryOutput;if(!fileSet)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`ShouldBePrimaryInputShould`,`'${id}': primary input should be a step that has produced a file set, got ${props.input}`);this.addDependencyFileSet(fileSet),this.inputs.push({directory:".",fileSet})}for(const[directory,step]of Object.entries(props.additionalInputs??{})){if(directory===".")throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`InputDirectory`,`'${id}': input for directory '.' should be passed via 'input' property`);const fileSet=step.primaryOutput;if(!fileSet)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`ShouldBeAdditionalinputDirectoryShould`,`'${id}': additionalInput for directory '${directory}' should be a step that has produced a file set, got ${step}`);this.addDependencyFileSet(fileSet),this.inputs.push({directory,fileSet})}if(props.primaryOutputDirectory){this._primaryOutputDirectory=props.primaryOutputDirectory;const fileSet=new(file_set_1()).FileSet("Output",this);this.configurePrimaryOutput(fileSet),this.outputs.push({directory:props.primaryOutputDirectory,fileSet})}}primaryOutputDirectory(directory){if(this._primaryOutputDirectory!==void 0){if(this._primaryOutputDirectory!==directory)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`PrimaryOutputDirectoryConflict`,`${this}: primaryOutputDirectory is '${this._primaryOutputDirectory}', cannot be changed to '${directory}'`);return this.primaryOutput}this._primaryOutputDirectory=directory;const fileSet=new(file_set_1()).FileSet("Output",this);return this.configurePrimaryOutput(fileSet),this.outputs.push({directory,fileSet}),fileSet}addOutputDirectory(directory){let fileSet=this._additionalOutputs[directory];return fileSet||(fileSet=new(file_set_1()).FileSet(directory,this),this._additionalOutputs[directory]=fileSet,this.outputs.push({directory,fileSet})),fileSet}get consumedStackOutputs(){return Object.values(this.envFromCfnOutputs)}}exports.ShellStep=ShellStep;class StackOutputReference{stackDescription;stackArtifactId;outputName;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.StackOutputReference",version:"2.252.0"};static fromCfnOutput(output){try{jsiiDeprecationWarnings().aws_cdk_lib_CfnOutput(output)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromCfnOutput),error}const stack=core_1().Stack.of(output);return new StackOutputReference(stack.node.path,stack.artifactId,stack.resolve(output.logicalId))}constructor(stackDescription,stackArtifactId,outputName){this.stackDescription=stackDescription,this.stackArtifactId=stackArtifactId,this.outputName=outputName}isProducedBy(stack){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_StackDeployment(stack)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.isProducedBy),error}return stack.stackArtifactId===this.stackArtifactId}}exports.StackOutputReference=StackOutputReference;

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/stack-deployment.d.ts

@@ -0,0 +1,212 @@
+import { AssetType } from './asset-type';
+import type { Step } from './step';
+import * as cxapi from '../../../cx-api';
+/**
+ * Properties for a `StackDeployment`
+ */
+export interface StackDeploymentProps {
+    /**
+     * Artifact ID for this stack
+     */
+    readonly stackArtifactId: string;
+    /**
+     * Construct path for this stack
+     */
+    readonly constructPath: string;
+    /**
+     * Name for this stack
+     */
+    readonly stackName: string;
+    /**
+     * Region where the stack should be deployed
+     *
+     * @default - Pipeline region
+     */
+    readonly region?: string;
+    /**
+     * Account where the stack should be deployed
+     *
+     * @default - Pipeline account
+     */
+    readonly account?: string;
+    /**
+     * Role to assume before deploying this stack
+     *
+     * @default - Don't assume any role
+     */
+    readonly assumeRoleArn?: string;
+    /**
+     * Execution role to pass to CloudFormation
+     *
+     * @default - No execution role
+     */
+    readonly executionRoleArn?: string;
+    /**
+     * Tags to apply to the stack
+     *
+     * @default - No tags
+     */
+    readonly tags?: Record<string, string>;
+    /**
+     * Template path on disk to cloud assembly (cdk.out)
+     */
+    readonly absoluteTemplatePath: string;
+    /**
+     * Assets referenced by this stack
+     *
+     * @default - No assets
+     */
+    readonly assets?: StackAsset[];
+    /**
+     * The S3 URL which points to the template asset location in the publishing
+     * bucket.
+     *
+     * @default - Stack template is not published
+     */
+    readonly templateS3Uri?: string;
+}
+/**
+ * Deployment of a single Stack
+ *
+ * You don't need to instantiate this class -- it will
+ * be automatically instantiated as necessary when you
+ * add a `Stage` to a pipeline.
+ */
+export declare class StackDeployment {
+    /**
+     * Build a `StackDeployment` from a Stack Artifact in a Cloud Assembly.
+     */
+    static fromArtifact(stackArtifact: cxapi.CloudFormationStackArtifact): StackDeployment;
+    /**
+     * Artifact ID for this stack
+     */
+    readonly stackArtifactId: string;
+    /**
+     * Construct path for this stack
+     */
+    readonly constructPath: string;
+    /**
+     * Name for this stack
+     */
+    readonly stackName: string;
+    /**
+     * Region where the stack should be deployed
+     *
+     * @default - Pipeline region
+     */
+    readonly region?: string;
+    /**
+     * Account where the stack should be deployed
+     *
+     * @default - Pipeline account
+     */
+    readonly account?: string;
+    /**
+     * Role to assume before deploying this stack
+     *
+     * @default - Don't assume any role
+     */
+    readonly assumeRoleArn?: string;
+    /**
+     * Execution role to pass to CloudFormation
+     *
+     * @default - No execution role
+     */
+    readonly executionRoleArn?: string;
+    /**
+     * Tags to apply to the stack
+     */
+    readonly tags: Record<string, string>;
+    /**
+     * Assets referenced by this stack
+     */
+    readonly assets: StackAsset[];
+    /**
+     * Other stacks this stack depends on
+     */
+    readonly stackDependencies: StackDeployment[];
+    /**
+     * The asset that represents the CloudFormation template for this stack.
+     */
+    readonly templateAsset?: StackAsset;
+    /**
+     * The S3 URL which points to the template asset location in the publishing
+     * bucket.
+     *
+     * This is `undefined` if the stack template is not published. Use the
+     * `DefaultStackSynthesizer` to ensure it is.
+     *
+     * Example value: `https://bucket.s3.amazonaws.com/object/key`
+     */
+    readonly templateUrl?: string;
+    /**
+     * Template path on disk to CloudAssembly
+     */
+    readonly absoluteTemplatePath: string;
+    /**
+     * Steps that take place before stack is prepared. If your pipeline engine disables 'prepareStep', then this will happen before stack deploys
+     */
+    readonly pre: Step[];
+    /**
+     * Steps that take place after stack is prepared but before stack deploys. Your pipeline engine may not disable `prepareStep`.
+     */
+    readonly changeSet: Step[];
+    /**
+     * Steps to execute after stack deploys
+     */
+    readonly post: Step[];
+    private constructor();
+    /**
+     * Add a dependency on another stack
+     */
+    addStackDependency(stackDeployment: StackDeployment): void;
+    /**
+     * Adds steps to each phase of the stack
+     * @param pre steps executed before stack.prepare
+     * @param changeSet steps executed after stack.prepare and before stack.deploy
+     * @param post steps executed after stack.deploy
+     */
+    addStackSteps(pre: Step[], changeSet: Step[], post: Step[]): void;
+}
+/**
+ * An asset used by a Stack
+ */
+export interface StackAsset {
+    /**
+     * Absolute asset manifest path
+     *
+     * This needs to be made relative at a later point in time, but when this
+     * information is parsed we don't know about the root cloud assembly yet.
+     */
+    readonly assetManifestPath: string;
+    /**
+     * Asset identifier
+     */
+    readonly assetId: string;
+    /**
+     * Asset selector to pass to `cdk-assets`.
+     */
+    readonly assetSelector: string;
+    /**
+     * Type of asset to publish
+     */
+    readonly assetType: AssetType;
+    /**
+     * The display name of this asset
+     *
+     * @default - Use some generated string as display name
+     */
+    readonly displayName?: string;
+    /**
+     * Role ARN to assume to publish
+     *
+     * @default - No need to assume any role
+     */
+    readonly assetPublishingRoleArn?: string;
+    /**
+     * Does this asset represent the CloudFormation template for the stack
+     *
+     * @default false
+     */
+    readonly isTemplate: boolean;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/stack-deployment.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.StackDeployment=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var path=()=>{var tmp=require("path");return path=()=>tmp,tmp},asset_type_1=()=>{var tmp=require("./asset-type");return asset_type_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},cxapi=()=>{var tmp=require("../../../cx-api");return cxapi=()=>tmp,tmp},asset_manifest_1=()=>{var tmp=require("../private/asset-manifest");return asset_manifest_1=()=>tmp,tmp},cloud_assembly_internals_1=()=>{var tmp=require("../private/cloud-assembly-internals");return cloud_assembly_internals_1=()=>tmp,tmp};class StackDeployment{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.StackDeployment",version:"2.252.0"};static fromArtifact(stackArtifact){try{jsiiDeprecationWarnings().aws_cdk_lib_cx_api_CloudFormationStackArtifact(stackArtifact)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromArtifact),error}const artRegion=stackArtifact.environment.region,region=artRegion===cxapi().UNKNOWN_REGION?void 0:artRegion,artAccount=stackArtifact.environment.account,account=artAccount===cxapi().UNKNOWN_ACCOUNT?void 0:artAccount;return new StackDeployment({account,region,tags:stackArtifact.tags,stackArtifactId:stackArtifact.id,constructPath:stackArtifact.hierarchicalId,stackName:stackArtifact.stackName,absoluteTemplatePath:path().join(stackArtifact.assembly.directory,stackArtifact.templateFile),assumeRoleArn:stackArtifact.assumeRoleArn,executionRoleArn:stackArtifact.cloudFormationExecutionRoleArn,assets:extractStackAssets(stackArtifact),templateS3Uri:stackArtifact.stackTemplateAssetObjectUrl})}stackArtifactId;constructPath;stackName;region;account;assumeRoleArn;executionRoleArn;tags;assets;stackDependencies=[];templateAsset;templateUrl;absoluteTemplatePath;pre=[];changeSet=[];post=[];constructor(props){this.stackArtifactId=props.stackArtifactId,this.constructPath=props.constructPath,this.account=props.account,this.region=props.region,this.tags=props.tags??{},this.assumeRoleArn=props.assumeRoleArn,this.executionRoleArn=props.executionRoleArn,this.stackName=props.stackName,this.absoluteTemplatePath=props.absoluteTemplatePath,this.templateUrl=props.templateS3Uri?s3UrlFromUri(props.templateS3Uri,props.region):void 0,this.assets=new Array;for(const asset of props.assets??[])asset.isTemplate?this.templateAsset=asset:this.assets.push(asset)}addStackDependency(stackDeployment){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_StackDeployment(stackDeployment)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addStackDependency),error}this.stackDependencies.push(stackDeployment)}addStackSteps(pre,changeSet,post){this.pre.push(...pre),this.changeSet.push(...changeSet),this.post.push(...post)}}exports.StackDeployment=StackDeployment;function extractStackAssets(stackArtifact){const ret=new Array,assetManifests=stackArtifact.dependencies.filter(cloud_assembly_internals_1().isAssetManifest);for(const manifestArtifact of assetManifests){const manifest=asset_manifest_1().AssetManifestReader.fromFile(manifestArtifact.file);for(const entry of manifest.entries){let assetType,isTemplate=!1;if(entry instanceof asset_manifest_1().DockerImageManifestEntry)assetType=asset_type_1().AssetType.DOCKER_IMAGE;else if(entry instanceof asset_manifest_1().FileManifestEntry)isTemplate=entry.source.packaging==="file"&&entry.source.path===stackArtifact.templateFile,assetType=asset_type_1().AssetType.FILE;else throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`UnrecognizedAssetType`,`Unrecognized asset type: ${entry.type}`);ret.push({assetManifestPath:manifestArtifact.file,assetId:entry.id.assetId,assetSelector:entry.id.toString(),assetType,assetPublishingRoleArn:entry.destination.assumeRoleArn,isTemplate,displayName:entry.displayName})}}return ret}function s3UrlFromUri(uri,region){const url=uri.split("/");return`https://${url[2]}.s3.${region?`${region}.`:""}amazonaws.com/${url[3]}`}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/stage-deployment.d.ts

@@ -0,0 +1,79 @@
+import { StackDeployment } from './stack-deployment';
+import type { StackSteps, Step } from './step';
+import type * as cdk from '../../../core';
+/**
+ * Properties for a `StageDeployment`
+ */
+export interface StageDeploymentProps {
+    /**
+     * Stage name to use in the pipeline
+     *
+     * @default - Use Stage's construct ID
+     */
+    readonly stageName?: string;
+    /**
+     * Additional steps to run before any of the stacks in the stage
+     *
+     * @default - No additional steps
+     */
+    readonly pre?: Step[];
+    /**
+     * Additional steps to run after all of the stacks in the stage
+     *
+     * @default - No additional steps
+     */
+    readonly post?: Step[];
+    /**
+     * Instructions for additional steps that are run at the stack level
+     *
+     * @default - No additional instructions
+     */
+    readonly stackSteps?: StackSteps[];
+}
+/**
+ * Deployment of a single `Stage`
+ *
+ * A `Stage` consists of one or more `Stacks`, which will be
+ * deployed in dependency order.
+ */
+export declare class StageDeployment {
+    /** The stacks deployed in this stage */
+    readonly stacks: StackDeployment[];
+    /**
+     * Create a new `StageDeployment` from a `Stage`
+     *
+     * Synthesizes the target stage, and deployes the stacks found inside
+     * in dependency order.
+     */
+    static fromStage(stage: cdk.Stage, props?: StageDeploymentProps): StageDeployment;
+    /**
+     * The display name of this stage
+     */
+    readonly stageName: string;
+    /**
+     * Additional steps that are run before any of the stacks in the stage
+     */
+    readonly pre: Step[];
+    /**
+     * Additional steps that are run after all of the stacks in the stage
+     */
+    readonly post: Step[];
+    /**
+     * Instructions for additional steps that are run at stack level
+     */
+    readonly stackSteps: StackSteps[];
+    /**
+     * Determine if all stacks in stage should be deployed with prepare
+     * step or not.
+     */
+    readonly prepareStep?: boolean;
+    private constructor();
+    /**
+     * Add an additional step to run before any of the stacks in this stage
+     */
+    addPre(...steps: Step[]): void;
+    /**
+     * Add an additional step to run after all of the stacks in this stage
+     */
+    addPost(...steps: Step[]): void;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/stage-deployment.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.StageDeployment=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var stack_deployment_1=()=>{var tmp=require("./stack-deployment");return stack_deployment_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},cloud_assembly_internals_1=()=>{var tmp=require("../private/cloud-assembly-internals");return cloud_assembly_internals_1=()=>tmp,tmp},construct_internals_1=()=>{var tmp=require("../private/construct-internals");return construct_internals_1=()=>tmp,tmp};class StageDeployment{stacks;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.StageDeployment",version:"2.252.0"};static fromStage(stage,props={}){try{jsiiDeprecationWarnings().aws_cdk_lib_Stage(stage),jsiiDeprecationWarnings().aws_cdk_lib_pipelines_StageDeploymentProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromStage),error}const assembly=(0,construct_internals_1().pipelineSynth)(stage);if(assembly.stacks.length===0)throw new(core_1()).ValidationError((0,literal_string_1().lit)`GivenStageConstruct`,`The given Stage construct ('${stage.node.path}') should contain at least one Stack`,stage);const stepFromArtifact=new Map;for(const artifact of assembly.stacks){if(artifact.assumeRoleAdditionalOptions?.Tags&&artifact.assumeRoleArn)throw new(core_1()).ValidationError((0,literal_string_1().lit)`DeploymentStack`,`Deployment of stack ${artifact.stackName} requires assuming the role ${artifact.assumeRoleArn} with session tags, but assuming roles with session tags is not supported by CodePipeline.`,stage);const step=stack_deployment_1().StackDeployment.fromArtifact(artifact);stepFromArtifact.set(artifact,step)}if(props.stackSteps)for(const stackstep of props.stackSteps){const stackArtifact=assembly.getStackArtifact(stackstep.stack.artifactId),thisStep=stepFromArtifact.get(stackArtifact);if(!thisStep)throw new(core_1()).ValidationError((0,literal_string_1().lit)`LogicErrorAddedStepArtifact`,"Logic error: we just added a step for this artifact but it disappeared.",stage);thisStep.addStackSteps(stackstep.pre??[],stackstep.changeSet??[],stackstep.post??[])}for(const artifact of assembly.stacks){const thisStep=stepFromArtifact.get(artifact);if(!thisStep)throw new(core_1()).ValidationError((0,literal_string_1().lit)`LogicErrorAddedStepArtifact`,"Logic error: we just added a step for this artifact but it disappeared.",stage);const stackDependencies=artifact.dependencies.filter(cloud_assembly_internals_1().isStackArtifact);for(const dep of stackDependencies){const depStep=stepFromArtifact.get(dep);if(!depStep)throw new(core_1()).ValidationError((0,literal_string_1().lit)`StackDependsStackFound`,`Stack '${artifact.id}' depends on stack not found in same Stage: '${dep.id}'`,stage);thisStep.addStackDependency(depStep)}}return new StageDeployment(Array.from(stepFromArtifact.values()),{stageName:stage.stageName,...props})}stageName;pre;post;stackSteps;prepareStep;constructor(stacks,props={}){this.stacks=stacks,this.stageName=props.stageName??"",this.pre=props.pre??[],this.post=props.post??[],this.stackSteps=props.stackSteps??[]}addPre(...steps){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_Step(steps)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addPre),error}this.pre.push(...steps)}addPost(...steps){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_Step(steps)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addPost),error}this.post.push(...steps)}}exports.StageDeployment=StageDeployment;

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/step.d.ts

@@ -0,0 +1,108 @@
+import type { FileSet, IFileSetProducer } from './file-set';
+import type { StackOutputReference } from './shell-step';
+import type { Stack } from '../../../core';
+/**
+ * A generic Step which can be added to a Pipeline
+ *
+ * Steps can be used to add Sources, Build Actions and Validations
+ * to your pipeline.
+ *
+ * This class is abstract. See specific subclasses of Step for
+ * useful steps to add to your Pipeline
+ */
+export declare abstract class Step implements IFileSetProducer {
+    /** Identifier for this step */
+    readonly id: string;
+    /**
+     * Define a sequence of steps to be executed in order.
+     *
+     * If you need more fine-grained step ordering, use the `addStepDependency()`
+     * API. For example, if you want `secondStep` to occur after `firstStep`, call
+     * `secondStep.addStepDependency(firstStep)`.
+     */
+    static sequence(steps: Step[]): Step[];
+    /**
+     * The list of FileSets consumed by this Step
+     */
+    readonly dependencyFileSets: FileSet[];
+    /**
+     * Whether or not this is a Source step
+     *
+     * What it means to be a Source step depends on the engine.
+     */
+    readonly isSource: boolean;
+    private _primaryOutput?;
+    private _dependencies;
+    constructor(
+    /** Identifier for this step */
+    id: string);
+    /**
+     * Return the steps this step depends on, based on the FileSets it requires
+     */
+    get dependencies(): Step[];
+    /**
+     * Return a string representation of this Step
+     */
+    toString(): string;
+    /**
+     * The primary FileSet produced by this Step
+     *
+     * Not all steps produce an output FileSet--if they do
+     * you can substitute the `Step` object for the `FileSet` object.
+     */
+    get primaryOutput(): FileSet | undefined;
+    /**
+     * Add a dependency on another step.
+     */
+    addStepDependency(step: Step): void;
+    /**
+     * Add an additional FileSet to the set of file sets required by this step
+     *
+     * This will lead to a dependency on the producer of that file set.
+     */
+    protected addDependencyFileSet(fs: FileSet): void;
+    /**
+     * Configure the given FileSet as the primary output of this step
+     */
+    protected configurePrimaryOutput(fs: FileSet): void;
+    /**
+     * Crawl the given structure for references to StepOutputs and add dependencies on all steps found
+     *
+     * Should be called in the constructor of subclasses based on what the user
+     * passes in as construction properties. The format of the structure passed in
+     * here does not have to correspond exactly to what gets rendered into the
+     * engine, it just needs to contain the same data.
+     */
+    protected discoverReferencedOutputs(structure: any): void;
+    /**
+     * StackOutputReferences this step consumes.
+     */
+    get consumedStackOutputs(): StackOutputReference[];
+}
+/**
+ * Instructions for additional steps that are run at stack level
+ */
+export interface StackSteps {
+    /**
+     * The stack you want the steps to run in
+     */
+    readonly stack: Stack;
+    /**
+     * Steps that execute before stack is prepared
+     *
+     * @default - no additional steps
+     */
+    readonly pre?: Step[];
+    /**
+     * Steps that execute after stack is prepared but before stack is deployed
+     *
+     * @default - no additional steps
+     */
+    readonly changeSet?: Step[];
+    /**
+     * Steps that execute after stack is deployed
+     *
+     * @default - no additional steps
+     */
+    readonly post?: Step[];
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/step.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.Step=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},step_output_1=()=>{var tmp=require("../helpers-internal/step-output");return step_output_1=()=>tmp,tmp};class Step{id;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.Step",version:"2.252.0"};static sequence(steps){for(let i=1;i<steps.length;i++)steps[i].addStepDependency(steps[i-1]);return steps}dependencyFileSets=[];isSource=!1;_primaryOutput;_dependencies=new Set;constructor(id){if(this.id=id,core_1().Token.isUnresolved(id))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`StepCannotUnresolved`,`Step id cannot be unresolved, got '${id}'`)}get dependencies(){return Array.from(new Set([...this.dependencyFileSets.map(f=>f.producer),...this._dependencies]))}toString(){return`${this.constructor.name}(${this.id})`}get primaryOutput(){return this._primaryOutput}addStepDependency(step){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_Step(step)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addStepDependency),error}this._dependencies.add(step)}addDependencyFileSet(fs){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_FileSet(fs)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addDependencyFileSet),error}this.dependencyFileSets.push(fs)}configurePrimaryOutput(fs){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_FileSet(fs)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.configurePrimaryOutput),error}this._primaryOutput=fs}discoverReferencedOutputs(structure){for(const output of step_output_1().StepOutput.findAll(structure))this._dependencies.add(output.step),step_output_1().StepOutput.recordProducer(output)}get consumedStackOutputs(){return[]}}exports.Step=Step;

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/wave.d.ts

@@ -0,0 +1,97 @@
+import { StageDeployment } from './stage-deployment';
+import type { StackSteps, Step } from './step';
+import type * as cdk from '../../../core';
+/**
+ * Construction properties for a `Wave`
+ */
+export interface WaveProps {
+    /**
+     * Additional steps to run before any of the stages in the wave
+     *
+     * @default - No additional steps
+     */
+    readonly pre?: Step[];
+    /**
+     * Additional steps to run after all of the stages in the wave
+     *
+     * @default - No additional steps
+     */
+    readonly post?: Step[];
+}
+/**
+ * Multiple stages that are deployed in parallel
+ */
+export declare class Wave {
+    /** Identifier for this Wave */
+    readonly id: string;
+    /**
+     * Additional steps that are run before any of the stages in the wave
+     */
+    readonly pre: Step[];
+    /**
+     * Additional steps that are run after all of the stages in the wave
+     */
+    readonly post: Step[];
+    /**
+     * The stages that are deployed in this wave
+     */
+    readonly stages: StageDeployment[];
+    constructor(
+    /** Identifier for this Wave */
+    id: string, props?: WaveProps);
+    /**
+     * Add a Stage to this wave
+     *
+     * It will be deployed in parallel with all other stages in this
+     * wave.
+     */
+    addStage(stage: cdk.Stage, options?: AddStageOpts): StageDeployment;
+    /**
+     * Add an additional step to run before any of the stages in this wave
+     */
+    addPre(...steps: Step[]): void;
+    /**
+     * Add an additional step to run after all of the stages in this wave
+     */
+    addPost(...steps: Step[]): void;
+}
+/**
+ * Options to pass to `addStage`
+ */
+export interface AddStageOpts {
+    /**
+     * Additional steps to run before any of the stacks in the stage
+     *
+     * @default - No additional steps
+     */
+    readonly pre?: Step[];
+    /**
+     * Additional steps to run after all of the stacks in the stage
+     *
+     * @default - No additional steps
+     */
+    readonly post?: Step[];
+    /**
+     * Instructions for stack level steps
+     *
+     * @default - No additional instructions
+     */
+    readonly stackSteps?: StackSteps[];
+}
+/**
+ * Options to pass to `addWave`
+ */
+export interface WaveOptions {
+    /**
+     * Additional steps to run before any of the stages in the wave
+     *
+     * @default - No additional steps
+     */
+    readonly pre?: Step[];
+    /**
+     * Additional steps to run after all of the stages in the wave
+     *
+     * @default - No additional steps
+     */
+    readonly post?: Step[];
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/blueprint/wave.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.Wave=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var stage_deployment_1=()=>{var tmp=require("./stage-deployment");return stage_deployment_1=()=>tmp,tmp};class Wave{id;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.Wave",version:"2.252.0"};pre;post;stages=[];constructor(id,props={}){this.id=id;try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_WaveProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,Wave),error}this.pre=props.pre??[],this.post=props.post??[]}addStage(stage,options={}){try{jsiiDeprecationWarnings().aws_cdk_lib_Stage(stage),jsiiDeprecationWarnings().aws_cdk_lib_pipelines_AddStageOpts(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addStage),error}const ret=stage_deployment_1().StageDeployment.fromStage(stage,options);return this.stages.push(ret),ret}addPre(...steps){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_Step(steps)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addPre),error}this.pre.push(...steps)}addPost(...steps){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_Step(steps)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addPost),error}this.post.push(...steps)}}exports.Wave=Wave;

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/artifact-map.d.ts

@@ -0,0 +1,33 @@
+import * as cp from '../../../aws-codepipeline';
+import { FileSet } from '../blueprint';
+/**
+ * Translate FileSets to CodePipeline Artifacts
+ */
+export declare class ArtifactMap {
+    private artifacts;
+    private usedNames;
+    /**
+     * Return the matching CodePipeline artifact for a FileSet
+     */
+    toCodePipeline(x: FileSet): cp.Artifact;
+    private makeUniqueName;
+}
+/**
+ * A FileSet created from a CodePipeline artifact
+ *
+ * You only need to use this if you want to add CDK Pipeline stages
+ * add the end of an existing CodePipeline, which should be very rare.
+ */
+export declare class CodePipelineFileSet extends FileSet {
+    /**
+     * Turn a CodePipeline Artifact into a FileSet
+     */
+    static fromArtifact(artifact: cp.Artifact): CodePipelineFileSet;
+    /**
+     * The artifact this class is wrapping
+     *
+     * @internal
+     */
+    readonly _artifact: cp.Artifact;
+    private constructor();
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/artifact-map.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.CodePipelineFileSet=exports.ArtifactMap=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var crypto=()=>{var tmp=require("crypto");return crypto=()=>tmp,tmp},cp=()=>{var tmp=require("../../../aws-codepipeline");return cp=()=>tmp,tmp},blueprint_1=()=>{var tmp=require("../blueprint");return blueprint_1=()=>tmp,tmp},helpers_internal_1=()=>{var tmp=require("../helpers-internal");return helpers_internal_1=()=>tmp,tmp};class ArtifactMap{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.ArtifactMap",version:"2.252.0"};artifacts=new Map;usedNames=new Set;toCodePipeline(x){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_FileSet(x)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.toCodePipeline),error}if(x instanceof CodePipelineFileSet)return x._artifact;let ret=this.artifacts.get(x);if(!ret){const artifactName=this.makeUniqueName(`${x.producer.id}.${x.id}`);this.usedNames.add(artifactName),this.artifacts.set(x,ret=new(cp()).Artifact(artifactName))}return ret}makeUniqueName(baseName){let i=1;baseName=sanitizeArtifactName(baseName);let name=baseName;for(;this.usedNames.has(name);)name=`${baseName}${++i}`;return name}}exports.ArtifactMap=ArtifactMap;function sanitizeArtifactName(x){let sani=x.replace(/[^A-Za-z0-9_]/g,"_");const maxLength=100;if(sani.length>maxLength){const fingerprint=crypto().createHash("sha256").update(sani).digest("hex").slice(0,8);sani=sani.slice(0,maxLength-fingerprint.length)+fingerprint}return sani}class CodePipelineFileSet extends blueprint_1().FileSet{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.CodePipelineFileSet",version:"2.252.0"};static fromArtifact(artifact){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_codepipeline_Artifact(artifact)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromArtifact),error}return new CodePipelineFileSet(artifact)}_artifact;constructor(artifact){super(artifact.artifactName??"Imported",helpers_internal_1().PipelineGraph.NO_STEP),this._artifact=artifact}}exports.CodePipelineFileSet=CodePipelineFileSet;

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/codebuild-step.d.ts

@@ -0,0 +1,259 @@
+import * as codebuild from '../../../aws-codebuild';
+import type * as ec2 from '../../../aws-ec2';
+import type * as iam from '../../../aws-iam';
+import type { Duration } from '../../../core';
+import type { ShellStepProps } from '../blueprint';
+import { ShellStep } from '../blueprint';
+/**
+ * Construction props for a CodeBuildStep
+ */
+export interface CodeBuildStepProps extends ShellStepProps {
+    /**
+     * Name for the generated CodeBuild project
+     *
+     * @default - Automatically generated
+     */
+    readonly projectName?: string;
+    /**
+     * Additional configuration that can only be configured via BuildSpec
+     *
+     * You should not use this to specify output artifacts; those
+     * should be supplied via the other properties of this class, otherwise
+     * CDK Pipelines won't be able to inspect the artifacts.
+     *
+     * Set the `commands` to an empty array if you want to fully specify
+     * the BuildSpec using this field.
+     *
+     * The BuildSpec must be available inline--it cannot reference a file
+     * on disk.
+     *
+     * @default - BuildSpec completely derived from other properties
+     */
+    readonly partialBuildSpec?: codebuild.BuildSpec;
+    /**
+     * The VPC where to execute the SimpleSynth.
+     *
+     * @default - No VPC
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * Which subnets to use.
+     *
+     * Only used if 'vpc' is supplied.
+     *
+     * @default - All private subnets.
+     */
+    readonly subnetSelection?: ec2.SubnetSelection;
+    /**
+     * Caching strategy to use.
+     *
+     * @default - No cache
+     */
+    readonly cache?: codebuild.Cache;
+    /**
+     * Policy statements to add to role used during the synth
+     *
+     * Can be used to add acces to a CodeArtifact repository etc.
+     *
+     * @default - No policy statements added to CodeBuild Project Role
+     */
+    readonly rolePolicyStatements?: iam.PolicyStatement[];
+    /**
+     * Custom execution role to be used for the CodeBuild project
+     *
+     * @default - A role is automatically created
+     */
+    readonly role?: iam.IRole;
+    /**
+     * Custom execution role to be used for the Code Build Action
+     *
+     * @default - A role is automatically created
+     */
+    readonly actionRole?: iam.IRole;
+    /**
+     * Changes to environment
+     *
+     * This environment will be combined with the pipeline's default
+     * environment.
+     *
+     * @default - Use the pipeline's default build environment
+     */
+    readonly buildEnvironment?: codebuild.BuildEnvironment;
+    /**
+     * Which security group to associate with the script's project network interfaces.
+     * If no security group is identified, one will be created automatically.
+     *
+     * Only used if 'vpc' is supplied.
+     *
+     * @default - Security group will be automatically created.
+     */
+    readonly securityGroups?: ec2.ISecurityGroup[];
+    /**
+     * The number of minutes after which AWS CodeBuild stops the build if it's
+     * not complete. For valid values, see the timeoutInMinutes field in the AWS
+     * CodeBuild User Guide.
+     *
+     * @default Duration.hours(1)
+     */
+    readonly timeout?: Duration;
+    /**
+     * ProjectFileSystemLocation objects for CodeBuild build projects.
+     *
+     * A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint,
+     * and type of a file system created using Amazon Elastic File System.
+     *
+     * @default - no file system locations
+     */
+    readonly fileSystemLocations?: codebuild.IFileSystemLocation[];
+    /**
+     * Information about logs for CodeBuild projects. A CodeBuild project can create logs in Amazon CloudWatch Logs, an S3 bucket, or both.
+     *
+     * @default - no log configuration is set
+     */
+    readonly logging?: codebuild.LoggingOptions;
+}
+/**
+ * Run a script as a CodeBuild Project
+ *
+ * The BuildSpec must be available inline--it cannot reference a file
+ * on disk. If your current build instructions are in a file like
+ * `buildspec.yml` in your repository, extract them to a script
+ * (say, `build.sh`) and invoke that script as part of the build:
+ *
+ * ```ts
+ * new pipelines.CodeBuildStep('Synth', {
+ *   commands: ['./build.sh'],
+ * });
+ * ```
+ */
+export declare class CodeBuildStep extends ShellStep {
+    /**
+     * Name for the generated CodeBuild project
+     *
+     * @default - No value specified at construction time, use defaults
+     */
+    readonly projectName?: string;
+    /**
+     * The VPC where to execute the SimpleSynth.
+     *
+     * @default - No value specified at construction time, use defaults
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * Which subnets to use.
+     *
+     * @default - No value specified at construction time, use defaults
+     */
+    readonly subnetSelection?: ec2.SubnetSelection;
+    /**
+     * Caching strategy to use.
+     *
+     * @default - No cache
+     */
+    readonly cache?: codebuild.Cache;
+    /**
+     * Policy statements to add to role used during the synth
+     *
+     * @default - No value specified at construction time, use defaults
+     */
+    readonly rolePolicyStatements?: iam.PolicyStatement[];
+    /**
+     * Custom execution role to be used for the CodeBuild project
+     *
+     * @default - No value specified at construction time, use defaults
+     */
+    readonly role?: iam.IRole;
+    /**
+     * Custom execution role to be used for the Code Build Action
+     *
+     * @default - A role is automatically created
+     */
+    readonly actionRole?: iam.IRole;
+    /**
+     * Build environment
+     *
+     * @default - No value specified at construction time, use defaults
+     */
+    readonly buildEnvironment?: codebuild.BuildEnvironment;
+    /**
+     * Which security group to associate with the script's project network interfaces.
+     *
+     * @default - No value specified at construction time, use defaults
+     */
+    readonly securityGroups?: ec2.ISecurityGroup[];
+    /**
+     * The number of minutes after which AWS CodeBuild stops the build if it's
+     * not complete. For valid values, see the timeoutInMinutes field in the AWS
+     * CodeBuild User Guide.
+     *
+     * @default Duration.hours(1)
+     */
+    readonly timeout?: Duration;
+    /**
+     * ProjectFileSystemLocation objects for CodeBuild build projects.
+     *
+     * A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint,
+     * and type of a file system created using Amazon Elastic File System.
+     *
+     * @default - no file system locations
+     */
+    readonly fileSystemLocations?: codebuild.IFileSystemLocation[];
+    /**
+     * Information about logs for CodeBuild projects. A CodeBuilde project can create logs in Amazon CloudWatch Logs, an S3 bucket, or both.
+     *
+     * @default - no log configuration is set
+     */
+    readonly logging?: codebuild.LoggingOptions;
+    private _project?;
+    private _partialBuildSpec?;
+    private readonly exportedVariables;
+    private exportedVarsRendered;
+    constructor(id: string, props: CodeBuildStepProps);
+    /**
+     * CodeBuild Project generated for the pipeline
+     *
+     * Will only be available after the pipeline has been built.
+     */
+    get project(): codebuild.IProject;
+    /**
+     * The CodeBuild Project's principal
+     */
+    get grantPrincipal(): iam.IPrincipal;
+    /**
+     * Additional configuration that can only be configured via BuildSpec
+     *
+     * Contains exported variables
+     *
+     * @default - Contains the exported variables
+     */
+    get partialBuildSpec(): codebuild.BuildSpec | undefined;
+    /**
+     * Reference a CodePipeline variable defined by the CodeBuildStep.
+     *
+     * The variable must be set in the shell of the CodeBuild step when
+     * it finishes its `post_build` phase.
+     *
+     * @param variableName the name of the variable for reference.
+     * @example
+     * // Access the output of one CodeBuildStep in another CodeBuildStep
+     * declare const pipeline: pipelines.CodePipeline;
+     *
+     * const step1 = new pipelines.CodeBuildStep('Step1', {
+     *   commands: ['export MY_VAR=hello'],
+     * });
+     *
+     * const step2 = new pipelines.CodeBuildStep('Step2', {
+     *   env: {
+     *     IMPORTED_VAR: step1.exportedVariable('MY_VAR'),
+     *   },
+     *   commands: ['echo $IMPORTED_VAR'],
+     * });
+     */
+    exportedVariable(variableName: string): string;
+    /**
+     * Set the internal project value
+     *
+     * @internal
+     */
+    _setProject(project: codebuild.IProject): void;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/codebuild-step.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.CodeBuildStep=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var buildspecs_1=()=>{var tmp=require("./private/buildspecs");return buildspecs_1=()=>tmp,tmp},outputs_1=()=>{var tmp=require("./private/outputs");return outputs_1=()=>tmp,tmp},codebuild=()=>{var tmp=require("../../../aws-codebuild");return codebuild=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},blueprint_1=()=>{var tmp=require("../blueprint");return blueprint_1=()=>tmp,tmp};class CodeBuildStep extends blueprint_1().ShellStep{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.CodeBuildStep",version:"2.252.0"};projectName;vpc;subnetSelection;cache;rolePolicyStatements;role;actionRole;buildEnvironment;securityGroups;timeout;fileSystemLocations;logging;_project;_partialBuildSpec;exportedVariables=new Set;exportedVarsRendered=!1;constructor(id,props){super(id,props);try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_CodeBuildStepProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,CodeBuildStep),error}this.projectName=props.projectName,this.buildEnvironment=props.buildEnvironment,this._partialBuildSpec=props.partialBuildSpec,this.vpc=props.vpc,this.subnetSelection=props.subnetSelection,this.cache=props.cache,this.role=props.role,this.actionRole=props.actionRole,this.rolePolicyStatements=props.rolePolicyStatements,this.securityGroups=props.securityGroups,this.timeout=props.timeout,this.fileSystemLocations=props.fileSystemLocations,this.logging=props.logging}get project(){if(!this._project)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CallPipeline`,"Call pipeline.buildPipeline() before reading this property");return this._project}get grantPrincipal(){return this.project.grantPrincipal}get partialBuildSpec(){this.exportedVarsRendered=!0;const varsBuildSpec=this.exportedVariables.size>0?codebuild().BuildSpec.fromObject({version:"0.2",env:{"exported-variables":Array.from(this.exportedVariables)}}):void 0;return(0,buildspecs_1().mergeBuildSpecs)(varsBuildSpec,this._partialBuildSpec)}exportedVariable(variableName){if(this.exportedVarsRendered&&!this.exportedVariables.has(variableName))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`ExportvariablePipelineAlreadyProduced`,"exportVariable(): Pipeline has already been produced, cannot call this function anymore");return this.exportedVariables.add(variableName),(0,outputs_1().makeCodePipelineOutput)(this,variableName)}_setProject(project){this._project=project}}exports.CodeBuildStep=CodeBuildStep;

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline-action-factory.d.ts

@@ -0,0 +1,110 @@
+import type { Construct } from 'constructs';
+import type { ArtifactMap } from './artifact-map';
+import type { CodeBuildOptions, CodePipeline } from './codepipeline';
+import type { StackOutputsMap } from './stack-outputs-map';
+import type * as cb from '../../../aws-codebuild';
+import type * as cp from '../../../aws-codepipeline';
+/**
+ * Options for the `CodePipelineActionFactory.produce()` method.
+ */
+export interface ProduceActionOptions {
+    /**
+     * Scope in which to create constructs
+     */
+    readonly scope: Construct;
+    /**
+     * Name the action should get
+     */
+    readonly actionName: string;
+    /**
+     * RunOrder the action should get
+     */
+    readonly runOrder: number;
+    /**
+     * If this step is producing outputs, the variables namespace assigned to it
+     *
+     * Pass this on to the Action you are creating.
+     *
+     * @default - Step doesn't produce any outputs
+     */
+    readonly variablesNamespace?: string;
+    /**
+     * Helper object to translate FileSets to CodePipeline Artifacts
+     */
+    readonly artifacts: ArtifactMap;
+    /**
+     * An input artifact that CodeBuild projects that don't actually need an input artifact can use
+     *
+     * CodeBuild Projects MUST have an input artifact in order to be added to the Pipeline. If
+     * the Project doesn't actually care about its input (it can be anything), it can use the
+     * Artifact passed here.
+     *
+     * @default - A fallback artifact does not exist
+     */
+    readonly fallbackArtifact?: cp.Artifact;
+    /**
+     * The pipeline the action is being generated for
+     */
+    readonly pipeline: CodePipeline;
+    /**
+     * If this action factory creates a CodeBuild step, default options to inherit
+     *
+     * @default - No CodeBuild project defaults
+     */
+    readonly codeBuildDefaults?: CodeBuildOptions;
+    /**
+     * Whether or not this action is inserted before self mutation.
+     *
+     * If it is, the action should take care to reflect some part of
+     * its own definition in the pipeline action definition, to
+     * trigger a restart after self-mutation (if necessary).
+     *
+     * @default false
+     */
+    readonly beforeSelfMutation?: boolean;
+    /**
+     * Helper object to produce variables exported from stack deployments.
+     *
+     * If your step references outputs from a stack deployment, use
+     * this to map the output references to Codepipeline variable names.
+     *
+     * Note - Codepipeline variables can only be referenced in action
+     * configurations.
+     *
+     */
+    readonly stackOutputsMap: StackOutputsMap;
+}
+/**
+ * Factory for explicit CodePipeline Actions
+ *
+ * If you have specific types of Actions you want to add to a
+ * CodePipeline, write a subclass of `Step` that implements this
+ * interface, and add the action or actions you want in the `produce` method.
+ *
+ * There needs to be a level of indirection here, because some aspects of the
+ * Action creation need to be controlled by the workflow engine (name and
+ * runOrder). All the rest of the properties are controlled by the factory.
+ */
+export interface ICodePipelineActionFactory {
+    /**
+     * Create the desired Action and add it to the pipeline
+     */
+    produceAction(stage: cp.IStage, options: ProduceActionOptions): CodePipelineActionFactoryResult;
+}
+/**
+ * The result of adding actions to the pipeline
+ */
+export interface CodePipelineActionFactoryResult {
+    /**
+     * How many RunOrders were consumed
+     *
+     * If you add 1 action, return the value 1 here.
+     */
+    readonly runOrdersConsumed: number;
+    /**
+     * If a CodeBuild project got created, the project
+     *
+     * @default - This factory did not create a CodeBuild project
+     */
+    readonly project?: cb.IProject;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline-action-factory.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline-source.d.ts

@@ -0,0 +1,330 @@
+import type { CodePipelineActionFactoryResult, ProduceActionOptions, ICodePipelineActionFactory } from './codepipeline-action-factory';
+import type * as codecommit from '../../../aws-codecommit';
+import type { Artifact, IStage } from '../../../aws-codepipeline';
+import type { Action, CodeCommitTrigger, GitHubTrigger, S3Trigger } from '../../../aws-codepipeline-actions';
+import type * as iam from '../../../aws-iam';
+import type { IBucket } from '../../../aws-s3';
+import { SecretValue } from '../../../core';
+import type { IRepositoryRef } from '../../../interfaces/generated/aws-ecr-interfaces.generated';
+import { Step } from '../blueprint';
+/**
+ * Factory for CodePipeline source steps
+ *
+ * This class contains a number of factory methods for the different types
+ * of sources that CodePipeline supports.
+ */
+export declare abstract class CodePipelineSource extends Step implements ICodePipelineActionFactory {
+    /**
+     * Returns a GitHub source, using OAuth tokens to authenticate with
+     * GitHub and a separate webhook to detect changes. This is no longer
+     * the recommended method. Please consider using `connection()`
+     * instead.
+     *
+     * Pass in the owner and repository in a single string, like this:
+     *
+     * ```ts
+     * pipelines.CodePipelineSource.gitHub('owner/repo', 'main');
+     * ```
+     *
+     * Authentication will be done by a secret called `github-token` in AWS
+     * Secrets Manager (unless specified otherwise).
+     *
+     * If you rotate the value in the Secret, you must also change at least one property
+     * on the Pipeline, to force CloudFormation to re-read the secret.
+     *
+     * The token should have these permissions:
+     *
+     * * **repo** - to read the repository
+     * * **admin:repo_hook** - if you plan to use webhooks (true by default)
+     *
+     * If you need access to symlinks or the repository history, use a source of type
+     * `connection` instead.
+     */
+    static gitHub(repoString: string, branch: string, props?: GitHubSourceOptions): CodePipelineSource;
+    /**
+     * Returns an S3 source.
+     *
+     * @param bucket The bucket where the source code is located.
+     * @param props The options, which include the key that identifies the source code file and
+     * and how the pipeline should be triggered.
+     *
+     * @example
+     * declare const bucket: s3.Bucket;
+     * pipelines.CodePipelineSource.s3(bucket, 'path/to/file.zip');
+     */
+    static s3(bucket: IBucket, objectKey: string, props?: S3SourceOptions): CodePipelineSource;
+    /**
+     * Returns an ECR source.
+     *
+     * @param repository The repository that will be watched for changes.
+     * @param props The options, which include the image tag to be checked for changes.
+     *
+     * @example
+     * declare const repository: ecr.IRepository;
+     * pipelines.CodePipelineSource.ecr(repository, {
+     *   imageTag: 'latest',
+     * });
+     */
+    static ecr(repository: IRepositoryRef, props?: ECRSourceOptions): CodePipelineSource;
+    /**
+     * Returns a CodeStar connection source. A CodeStar connection allows AWS CodePipeline to
+     * access external resources, such as repositories in GitHub, GitHub Enterprise or
+     * BitBucket.
+     *
+     * To use this method, you first need to create a CodeStar connection
+     * using the AWS console. In the process, you may have to sign in to the external provider
+     * -- GitHub, for example -- to authorize AWS to read and modify your repository.
+     * Once you have done this, copy the connection ARN and use it to create the source.
+     *
+     * Example:
+     *
+     * ```ts
+     * pipelines.CodePipelineSource.connection('owner/repo', 'main', {
+     *   connectionArn: 'arn:aws:codestar-connections:us-east-1:222222222222:connection/7d2469ff-514a-4e4f-9003-5ca4a43cdc41', // Created using the AWS console
+     * });
+     * ```
+     *
+     * If you need access to symlinks or the repository history, be sure to set
+     * `codeBuildCloneOutput`.
+     *
+     * @param repoString A string that encodes owner and repository separated by a slash (e.g. 'owner/repo'). The provided string must be resolvable at runtime.
+     * @param branch The branch to use.
+     * @param props The source properties, including the connection ARN.
+     *
+     * @see https://docs.aws.amazon.com/dtconsole/latest/userguide/welcome-connections.html
+     */
+    static connection(repoString: string, branch: string, props: ConnectionSourceOptions): CodePipelineSource;
+    /**
+     * Returns a CodeCommit source.
+     *
+     * If you need access to symlinks or the repository history, be sure to set
+     * `codeBuildCloneOutput`.
+     *
+     *
+     * @param repository The CodeCommit repository.
+     * @param branch The branch to use.
+     * @param props The source properties.
+     *
+     * @example
+     * declare const repository: codecommit.IRepository;
+     * pipelines.CodePipelineSource.codeCommit(repository, 'main');
+     */
+    static codeCommit(repository: codecommit.IRepository, branch: string, props?: CodeCommitSourceOptions): CodePipelineSource;
+    readonly isSource = true;
+    produceAction(stage: IStage, options: ProduceActionOptions): CodePipelineActionFactoryResult;
+    protected abstract getAction(output: Artifact, actionName: string, runOrder: number, variablesNamespace?: string): Action;
+    /**
+     * Return an attribute of the current source revision
+     *
+     * These values can be passed into the environment variables of pipeline steps,
+     * so your steps can access information about the source revision.
+     *
+     * Pipeline synth step has some source attributes predefined in the environment.
+     * If these suffice, you don't need to use this method for the synth step.
+     * @see https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html
+     *
+     * What attributes are available depends on the type of source. These attributes
+     * are supported:
+     *
+     * - GitHub, CodeCommit, and CodeStarSourceConnection
+     *   - `AuthorDate`
+     *   - `BranchName`
+     *   - `CommitId`
+     *   - `CommitMessage`
+     * - GitHub, CodeCommit and ECR
+     *   - `RepositoryName`
+     * - GitHub and CodeCommit
+     *   - `CommitterDate`
+     * - GitHub
+     *   - `CommitUrl`
+     * - CodeStarSourceConnection
+     *   - `FullRepositoryName`
+     * - S3
+     *   - `ETag`
+     *   - `VersionId`
+     * - ECR
+     *   - `ImageDigest`
+     *   - `ImageTag`
+     *   - `ImageURI`
+     *   - `RegistryId`
+     *
+     * @see https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-variables.html#reference-variables-list
+     * @example
+     * // Access the CommitId of a GitHub source in the synth
+     * const source = pipelines.CodePipelineSource.gitHub('owner/repo', 'main');
+     *
+     * const pipeline = new pipelines.CodePipeline(scope, 'MyPipeline', {
+     *   synth: new pipelines.ShellStep('Synth', {
+     *     input: source,
+     *     commands: [],
+     *     env: {
+     *       'COMMIT_ID': source.sourceAttribute('CommitId'),
+     *     }
+     *   })
+     * });
+     */
+    sourceAttribute(name: string): string;
+}
+/**
+ * Options for GitHub sources
+ */
+export interface GitHubSourceOptions {
+    /**
+     * A GitHub OAuth token to use for authentication.
+     *
+     * It is recommended to use a Secrets Manager `Secret` to obtain the token:
+     *
+     * ```ts
+     * const oauth = cdk.SecretValue.secretsManager('my-github-token');
+     * ```
+     *
+     * The GitHub Personal Access Token should have these scopes:
+     *
+     * * **repo** - to read the repository
+     * * **admin:repo_hook** - if you plan to use webhooks (true by default)
+     *
+     * @see https://docs.aws.amazon.com/codepipeline/latest/userguide/GitHub-create-personal-token-CLI.html
+     *
+     * @default - SecretValue.secretsManager('github-token')
+     */
+    readonly authentication?: SecretValue;
+    /**
+     * How AWS CodePipeline should be triggered
+     *
+     * With the default value "WEBHOOK", a webhook is created in GitHub that triggers the action.
+     * With "POLL", CodePipeline periodically checks the source for changes.
+     * With "None", the action is not triggered through changes in the source.
+     *
+     * To use `WEBHOOK`, your GitHub Personal Access Token should have
+     * **admin:repo_hook** scope (in addition to the regular **repo** scope).
+     *
+     * @default GitHubTrigger.WEBHOOK
+     */
+    readonly trigger?: GitHubTrigger;
+    /**
+     * The action name used for this source in the CodePipeline
+     *
+     * @default - The repository string
+     */
+    readonly actionName?: string;
+}
+/**
+ * Options for S3 sources
+ */
+export interface S3SourceOptions {
+    /**
+     * How should CodePipeline detect source changes for this Action.
+     * Note that if this is S3Trigger.EVENTS, you need to make sure to include the source Bucket in a CloudTrail Trail,
+     * as otherwise the CloudWatch Events will not be emitted.
+     *
+     * @default S3Trigger.POLL
+     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/log-s3-data-events.html
+     */
+    readonly trigger?: S3Trigger;
+    /**
+     * The action name used for this source in the CodePipeline
+     *
+     * @default - The bucket name
+     */
+    readonly actionName?: string;
+    /**
+     * The role that will be assumed by the pipeline prior to executing
+     * the `S3Source` action.
+     *
+     * @default - a new role will be generated
+     */
+    readonly role?: iam.IRole;
+}
+/**
+ * Options for ECR sources
+ */
+export interface ECRSourceOptions {
+    /**
+     * The image tag that will be checked for changes.
+     *
+     * @default latest
+     */
+    readonly imageTag?: string;
+    /**
+     * The action name used for this source in the CodePipeline
+     *
+     * @default - The repository name
+     */
+    readonly actionName?: string;
+}
+/**
+ * Configuration options for CodeStar source
+ */
+export interface ConnectionSourceOptions {
+    /**
+     * The ARN of the CodeStar Connection created in the AWS console
+     * that has permissions to access this GitHub or BitBucket repository.
+     *
+     * @example 'arn:aws:codestar-connections:us-east-1:123456789012:connection/12345678-abcd-12ab-34cdef5678gh'
+     * @see https://docs.aws.amazon.com/codepipeline/latest/userguide/connections-create.html
+     */
+    readonly connectionArn: string;
+    /**
+     * If this is set, the next CodeBuild job clones the repository (instead of CodePipeline downloading the files).
+     *
+     * This provides access to repository history, and retains symlinks (symlinks would otherwise be
+     * removed by CodePipeline).
+     *
+     * **Note**: if this option is true, only CodeBuild jobs can use the output artifact.
+     *
+     * @default false
+     * @see https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-CodestarConnectionSource.html#action-reference-CodestarConnectionSource-config
+     */
+    readonly codeBuildCloneOutput?: boolean;
+    /**
+     * Controls automatically starting your pipeline when a new commit
+     * is made on the configured repository and branch. If unspecified,
+     * the default value is true, and the field does not display by default.
+     *
+     * @default true
+     * @see https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-CodestarConnectionSource.html
+     */
+    readonly triggerOnPush?: boolean;
+    /**
+     * The action name used for this source in the CodePipeline
+     *
+     * @default - The repository string
+     */
+    readonly actionName?: string;
+}
+/**
+ * Configuration options for a CodeCommit source
+ */
+export interface CodeCommitSourceOptions {
+    /**
+     * How should CodePipeline detect source changes for this Action.
+     *
+     * @default CodeCommitTrigger.EVENTS
+     */
+    readonly trigger?: CodeCommitTrigger;
+    /**
+     * Role to be used by on commit event rule.
+     * Used only when trigger value is CodeCommitTrigger.EVENTS.
+     *
+     * @default a new role will be created.
+     */
+    readonly eventRole?: iam.IRole;
+    /**
+     * If this is set, the next CodeBuild job clones the repository (instead of CodePipeline downloading the files).
+     *
+     * This provides access to repository history, and retains symlinks (symlinks would otherwise be
+     * removed by CodePipeline).
+     *
+     * **Note**: if this option is true, only CodeBuild jobs can use the output artifact.
+     *
+     * @default false
+     * @see https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-CodeCommit.html
+     */
+    readonly codeBuildCloneOutput?: boolean;
+    /**
+     * The action name used for this source in the CodePipeline
+     *
+     * @default - The repository name
+     */
+    readonly actionName?: string;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline.d.ts

@@ -0,0 +1,440 @@
+import type { Construct } from 'constructs';
+import * as cb from '../../../aws-codebuild';
+import * as cp from '../../../aws-codepipeline';
+import type * as ec2 from '../../../aws-ec2';
+import * as iam from '../../../aws-iam';
+import type * as s3 from '../../../aws-s3';
+import type { Duration } from '../../../core';
+import type { IFileSetProducer } from '../blueprint';
+import type { DockerCredential } from '../docker-credentials';
+import { PipelineBase } from '../main';
+/**
+ * Properties for a `CodePipeline`
+ */
+export interface CodePipelineProps {
+    /**
+     * Type of the pipeline.
+     *
+     * @default - PipelineType.V2 if the feature flag `CODEPIPELINE_DEFAULT_PIPELINE_TYPE_TO_V2`
+     * is true, PipelineType.V1 otherwise
+     *
+     * @see https://docs.aws.amazon.com/codepipeline/latest/userguide/pipeline-types-planning.html
+     */
+    readonly pipelineType?: cp.PipelineType;
+    /**
+     * The build step that produces the CDK Cloud Assembly
+     *
+     * The primary output of this step needs to be the `cdk.out` directory
+     * generated by the `cdk synth` command.
+     *
+     * If you use a `ShellStep` here and you don't configure an output directory,
+     * the output directory will automatically be assumed to be `cdk.out`.
+     */
+    readonly synth: IFileSetProducer;
+    /**
+     * The name of the CodePipeline pipeline
+     *
+     * @default - Automatically generated
+     */
+    readonly pipelineName?: string;
+    /**
+     * Create KMS keys for the artifact buckets, allowing cross-account deployments
+     *
+     * The artifact buckets have to be encrypted to support deploying CDK apps to
+     * another account, so if you want to do that or want to have your artifact
+     * buckets encrypted, be sure to set this value to `true`.
+     *
+     * Be aware there is a cost associated with maintaining the KMS keys.
+     *
+     * @default false
+     */
+    readonly crossAccountKeys?: boolean;
+    /**
+     * CDK CLI version to use in self-mutation step
+     *
+     * If you want to lock the CDK CLI version used in the pipeline, by steps
+     * that are automatically generated for you, specify the version here.
+     *
+     * We recommend you do not specify this value, as not specifying it always
+     * uses the latest CLI version which is backwards compatible with old versions.
+     *
+     * If you do specify it, be aware that this version should always be equal to or higher than the
+     * version of the CDK framework used by the CDK app, when the CDK commands are
+     * run during your pipeline execution. When you change this version, the *next
+     * time* the `SelfMutate` step runs it will still be using the CLI of the the
+     * *previous* version that was in this property: it will only start using the
+     * new version after `SelfMutate` completes successfully. That means that if
+     * you want to update both framework and CLI version, you should update the
+     * CLI version first, commit, push and deploy, and only then update the
+     * framework version.
+     *
+     * @default - Latest version
+     */
+    readonly cliVersion?: string;
+    /**
+     * CDK CLI version to use in asset publishing steps
+     *
+     * If you want to lock the `cdk-assets` version used in the pipeline, by steps
+     * that are automatically generated for you, specify the version here.
+     *
+     * We recommend you do not specify this value, as not specifying it always
+     * uses the latest CLI version which is backwards compatible with old versions.
+     *
+     * @see https://www.npmjs.com/package/cdk-assets
+     * @default - Latest version
+     */
+    readonly cdkAssetsCliVersion?: string;
+    /**
+     * Whether the pipeline will update itself
+     *
+     * This needs to be set to `true` to allow the pipeline to reconfigure
+     * itself when assets or stages are being added to it, and `true` is the
+     * recommended setting.
+     *
+     * You can temporarily set this to `false` while you are iterating
+     * on the pipeline itself and prefer to deploy changes using `cdk deploy`.
+     *
+     * @default true
+     */
+    readonly selfMutation?: boolean;
+    /**
+     * Enable Docker for the self-mutate step
+     *
+     * Set this to true if the pipeline itself uses Docker container assets
+     * (for example, if you use `LinuxBuildImage.fromAsset()` as the build
+     * image of a CodeBuild step in the pipeline).
+     *
+     * You do not need to set it if you build Docker image assets in the
+     * application Stages and Stacks that are *deployed* by this pipeline.
+     *
+     * Configures privileged mode for the self-mutation CodeBuild action.
+     *
+     * If you are about to turn this on in an already-deployed Pipeline,
+     * set the value to `true` first, commit and allow the pipeline to
+     * self-update, and only then use the Docker asset in the pipeline.
+     *
+     * @default false
+     */
+    readonly dockerEnabledForSelfMutation?: boolean;
+    /**
+     * Enable Docker for the 'synth' step
+     *
+     * Set this to true if you are using file assets that require
+     * "bundling" anywhere in your application (meaning an asset
+     * compilation step will be run with the tools provided by
+     * a Docker image), both for the Pipeline stack as well as the
+     * application stacks.
+     *
+     * A common way to use bundling assets in your application is by
+     * using the `aws-cdk-lib/aws-lambda-nodejs` library.
+     *
+     * Configures privileged mode for the synth CodeBuild action.
+     *
+     * If you are about to turn this on in an already-deployed Pipeline,
+     * set the value to `true` first, commit and allow the pipeline to
+     * self-update, and only then use the bundled asset.
+     *
+     * @default false
+     */
+    readonly dockerEnabledForSynth?: boolean;
+    /**
+     * Customize the CodeBuild projects created for this pipeline
+     *
+     * @default - All projects run non-privileged build, SMALL instance, LinuxBuildImage.STANDARD_7_0
+     */
+    readonly codeBuildDefaults?: CodeBuildOptions;
+    /**
+     * Additional customizations to apply to the synthesize CodeBuild projects
+     *
+     * @default - Only `codeBuildDefaults` are applied
+     */
+    readonly synthCodeBuildDefaults?: CodeBuildOptions;
+    /**
+     * Additional customizations to apply to the asset publishing CodeBuild projects
+     *
+     * @default - Only `codeBuildDefaults` are applied
+     */
+    readonly assetPublishingCodeBuildDefaults?: CodeBuildOptions;
+    /**
+     * Additional customizations to apply to the self mutation CodeBuild projects
+     *
+     * @default - Only `codeBuildDefaults` are applied
+     */
+    readonly selfMutationCodeBuildDefaults?: CodeBuildOptions;
+    /**
+     * Publish assets in multiple CodeBuild projects
+     *
+     * If set to false, use one Project per type to publish all assets.
+     *
+     * Publishing in parallel improves concurrency and may reduce publishing
+     * latency, but may also increase overall provisioning time of the CodeBuild
+     * projects.
+     *
+     * Experiment and see what value works best for you.
+     *
+     * @default true
+     */
+    readonly publishAssetsInParallel?: boolean;
+    /**
+     * A list of credentials used to authenticate to Docker registries.
+     *
+     * Specify any credentials necessary within the pipeline to build, synth, update, or publish assets.
+     *
+     * @default []
+     */
+    readonly dockerCredentials?: DockerCredential[];
+    /**
+     * An existing Pipeline to be reused and built upon.
+     *
+     * [disable-awslint:ref-via-interface]
+     *
+     * @default - a new underlying pipeline is created.
+     */
+    readonly codePipeline?: cp.Pipeline;
+    /**
+     * Reuse the same cross region support stack for all pipelines in the App.
+     *
+     * @default - true (Use the same support stack for all pipelines in App)
+     */
+    readonly reuseCrossRegionSupportStacks?: boolean;
+    /**
+     * The IAM role to be assumed by this Pipeline
+     *
+     * @default - A new role is created
+     */
+    readonly role?: iam.IRole;
+    /**
+     * Deploy every stack by creating a change set and executing it
+     *
+     * When enabled, creates a "Prepare" and "Execute" action for each stack. Disable
+     * to deploy the stack in one pipeline action.
+     *
+     * @default true
+     */
+    readonly useChangeSets?: boolean;
+    /**
+     * Enable KMS key rotation for the generated KMS keys.
+     *
+     * By default KMS key rotation is disabled, but will add
+     * additional costs when enabled.
+     *
+     * @default - false (key rotation is disabled)
+     */
+    readonly enableKeyRotation?: boolean;
+    /**
+     * An existing S3 Bucket to use for storing the pipeline's artifact.
+     *
+     * @default - A new S3 bucket will be created.
+     */
+    readonly artifactBucket?: s3.IBucket;
+    /**
+     * A map of region to S3 bucket name used for cross-region CodePipeline.
+     * For every Action that you specify targeting a different region than the Pipeline itself,
+     * if you don't provide an explicit Bucket for that region using this property,
+     * the construct will automatically create a Stack containing an S3 Bucket in that region.
+     * Passed directly through to the {@link cp.Pipeline}.
+     *
+     * @default - no cross region replication buckets.
+     */
+    readonly crossRegionReplicationBuckets?: {
+        [region: string]: s3.IBucket;
+    };
+    /**
+     * Use pipeline service role for actions if no action role configured
+     *
+     * @default - false
+     */
+    readonly usePipelineRoleForActions?: boolean;
+}
+/**
+ * Options for customizing a single CodeBuild project
+ */
+export interface CodeBuildOptions {
+    /**
+     * Partial build environment, will be combined with other build environments that apply
+     *
+     * @default - Non-privileged build, SMALL instance, LinuxBuildImage.STANDARD_7_0
+     */
+    readonly buildEnvironment?: cb.BuildEnvironment;
+    /**
+     * Policy statements to add to role
+     *
+     * @default - No policy statements added to CodeBuild Project Role
+     */
+    readonly rolePolicy?: iam.PolicyStatement[];
+    /**
+     * Partial buildspec, will be combined with other buildspecs that apply
+     *
+     * The BuildSpec must be available inline--it cannot reference a file
+     * on disk.
+     *
+     * @default - No initial BuildSpec
+     */
+    readonly partialBuildSpec?: cb.BuildSpec;
+    /**
+     * Which security group(s) to associate with the project network interfaces.
+     *
+     * Only used if 'vpc' is supplied.
+     *
+     * @default - Security group will be automatically created.
+     */
+    readonly securityGroups?: ec2.ISecurityGroup[];
+    /**
+     * The VPC where to create the CodeBuild network interfaces in.
+     *
+     * @default - No VPC
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * Which subnets to use.
+     *
+     * Only used if 'vpc' is supplied.
+     *
+     * @default - All private subnets.
+     */
+    readonly subnetSelection?: ec2.SubnetSelection;
+    /**
+     * Caching strategy to use.
+     *
+     * @default - No cache
+     */
+    readonly cache?: cb.Cache;
+    /**
+     * The number of minutes after which AWS CodeBuild stops the build if it's
+     * not complete. For valid values, see the timeoutInMinutes field in the AWS
+     * CodeBuild User Guide.
+     *
+     * @default Duration.hours(1)
+     */
+    readonly timeout?: Duration;
+    /**
+     * ProjectFileSystemLocation objects for CodeBuild build projects.
+     *
+     * A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint,
+     * and type of a file system created using Amazon Elastic File System.
+     * Requires a vpc to be set and privileged to be set to true.
+     *
+     * @default - no file system locations
+     */
+    readonly fileSystemLocations?: cb.IFileSystemLocation[];
+    /**
+     * Information about logs for CodeBuild projects. A CodeBuild project can create logs in Amazon CloudWatch Logs, an S3 bucket, or both.
+     *
+     * @default - no log configuration is set
+     */
+    readonly logging?: cb.LoggingOptions;
+}
+/**
+ * A CDK Pipeline that uses CodePipeline to deploy CDK apps
+ *
+ * This is a `Pipeline` with its `engine` property set to
+ * `CodePipelineEngine`, and exists for nicer ergonomics for
+ * users that don't need to switch out engines.
+ */
+export declare class CodePipeline extends PipelineBase {
+    private readonly props;
+    /**
+     * Whether SelfMutation is enabled for this CDK Pipeline
+     */
+    readonly selfMutationEnabled: boolean;
+    /**
+     * Allow pipeline service role used for actions if no action role configured
+     * instead of creating a new role for each action
+     */
+    readonly usePipelineRoleForActions: boolean;
+    private _pipeline?;
+    private artifacts;
+    private _synthProject?;
+    private _selfMutationProject?;
+    private readonly useChangeSets;
+    private _myCxAsmRoot?;
+    private readonly dockerCredentials;
+    private readonly cachedFnSub;
+    private stackOutputs;
+    /**
+     * Asset roles shared for publishing
+     */
+    private readonly assetCodeBuildRoles;
+    /**
+     * This is set to the very first artifact produced in the pipeline
+     */
+    private _fallbackArtifact?;
+    private _cloudAssemblyFileSet?;
+    private readonly singlePublisherPerAssetType;
+    private readonly cliVersion?;
+    private readonly cdkAssetsCliVersion;
+    constructor(scope: Construct, id: string, props: CodePipelineProps);
+    /**
+     * The CodeBuild project that performs the Synth
+     *
+     * Only available after the pipeline has been built.
+     */
+    get synthProject(): cb.IProject;
+    /**
+     * The CodeBuild project that performs the SelfMutation
+     *
+     * Will throw an error if this is accessed before `buildPipeline()`
+     * is called, or if selfMutation has been disabled.
+     */
+    get selfMutationProject(): cb.IProject;
+    /**
+     * The CodePipeline pipeline that deploys the CDK app
+     *
+     * Only available after the pipeline has been built.
+     */
+    get pipeline(): cp.Pipeline;
+    protected doBuildPipeline(): void;
+    private get myCxAsmRoot();
+    /**
+     * Scope for Assets-related resources.
+     *
+     * Purely exists for construct tree backwards compatibility with legacy pipelines
+     */
+    private get assetsScope();
+    private pipelineStagesAndActionsFromGraph;
+    /**
+     * Do additional things after the action got added to the pipeline
+     *
+     * Some minor state manipulation of CodeBuild projects and pipeline
+     * artifacts.
+     */
+    private postProcessNode;
+    /**
+     * Make an action from the given node and/or step
+     */
+    private actionFromNode;
+    /**
+     * Take a Step and turn it into a CodePipeline Action
+     *
+     * There are only 3 types of Steps we need to support:
+     *
+     * - Shell (generic)
+     * - ManualApproval (generic)
+     * - CodePipelineActionFactory (CodePipeline-specific)
+     *
+     * The rest is expressed in terms of these 3, or in terms of graph nodes
+     * which are handled elsewhere.
+     */
+    private actionFromStep;
+    private createChangeSetAction;
+    private executeChangeSetAction;
+    private executeDeploymentAction;
+    private selfMutateAction;
+    private publishAssetsAction;
+    private nodeTypeFromNode;
+    private codeBuildDefaultsFor;
+    private roleFromPlaceholderArn;
+    /**
+     * Non-template config files for CodePipeline actions
+     *
+     * Currently only supports tags.
+     */
+    private writeTemplateConfiguration;
+    /**
+     * This role is used by both the CodePipeline build action and related CodeBuild project. Consolidating these two
+     * roles into one, and re-using across all assets, saves significant size of the final synthesized output.
+     * Modeled after the CodePipeline role and 'CodePipelineActionRole' roles.
+     * Generates one role per asset type to separate file and Docker/image-based permissions.
+     */
+    private obtainAssetCodeBuildRole;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/confirm-permissions-broadening.d.ts

@@ -0,0 +1,33 @@
+import type { CodePipelineActionFactoryResult, ICodePipelineActionFactory, ProduceActionOptions } from './codepipeline-action-factory';
+import type { IStage } from '../../../aws-codepipeline';
+import type * as sns from '../../../aws-sns';
+import type { Stage } from '../../../core';
+import { Step } from '../blueprint';
+/**
+ * Properties for a `PermissionsBroadeningCheck`
+ */
+export interface PermissionsBroadeningCheckProps {
+    /**
+     * The CDK Stage object to check the stacks of
+     *
+     * This should be the same Stage object you are passing to `addStage()`.
+     */
+    readonly stage: Stage;
+    /**
+     * Topic to send notifications when a human needs to give manual confirmation
+     *
+     * @default - no notification
+     */
+    readonly notificationTopic?: sns.ITopic;
+}
+/**
+ * Pause the pipeline if a deployment would add IAM permissions or Security Group rules
+ *
+ * This step is only supported in CodePipeline pipelines.
+ */
+export declare class ConfirmPermissionsBroadening extends Step implements ICodePipelineActionFactory {
+    private readonly props;
+    constructor(id: string, props: PermissionsBroadeningCheckProps);
+    produceAction(stage: IStage, options: ProduceActionOptions): CodePipelineActionFactoryResult;
+    private getOrCreateSecCheck;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/confirm-permissions-broadening.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ConfirmPermissionsBroadening=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},cpa=()=>{var tmp=require("../../../aws-codepipeline-actions");return cpa=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},blueprint_1=()=>{var tmp=require("../blueprint");return blueprint_1=()=>tmp,tmp},application_security_check_1=()=>{var tmp=require("../private/application-security-check");return application_security_check_1=()=>tmp,tmp};class ConfirmPermissionsBroadening extends blueprint_1().Step{props;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.ConfirmPermissionsBroadening",version:"2.252.0"};constructor(id,props){super(id),this.props=props;try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_PermissionsBroadeningCheckProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,ConfirmPermissionsBroadening),error}}produceAction(stage,options){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_codepipeline_IStage(stage),jsiiDeprecationWarnings().aws_cdk_lib_pipelines_ProduceActionOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.produceAction),error}const sec=this.getOrCreateSecCheck(options.pipeline);this.props.notificationTopic?.grantPublish(sec.cdkDiffProject);const variablesNamespace=constructs_1().Node.of(this.props.stage).addr,approveActionName=`${options.actionName}.Confirm`;return stage.addAction(new(cpa()).CodeBuildAction({runOrder:options.runOrder,actionName:`${options.actionName}.Check`,input:options.artifacts.toCodePipeline(options.pipeline.cloudAssemblyFileSet),project:sec.cdkDiffProject,variablesNamespace,environmentVariables:{STAGE_PATH:{value:constructs_1().Node.of(this.props.stage).path},STAGE_NAME:{value:stage.stageName},ACTION_NAME:{value:approveActionName},...this.props.notificationTopic?{NOTIFICATION_ARN:{value:this.props.notificationTopic.topicArn},NOTIFICATION_SUBJECT:{value:`Confirm permission broadening in ${this.props.stage.stageName}`}}:{}}})),stage.addAction(new(cpa()).ManualApprovalAction({actionName:approveActionName,runOrder:options.runOrder+1,additionalInformation:`#{${variablesNamespace}.MESSAGE}`,externalEntityLink:`#{${variablesNamespace}.LINK}`})),{runOrdersConsumed:2}}getOrCreateSecCheck(pipeline){const id="PipelinesSecurityCheck",existing=constructs_1().Node.of(pipeline).tryFindChild(id);if(existing){if(!(existing instanceof application_security_check_1().ApplicationSecurityCheck))throw new(core_1()).ValidationError((0,literal_string_1().lit)`Expected`,`Expected '${constructs_1().Node.of(existing).path}' to be 'ApplicationSecurityCheck' but was '${existing}'`,pipeline);return existing}return new(application_security_check_1()).ApplicationSecurityCheck(pipeline,id,{codePipeline:pipeline.pipeline})}}exports.ConfirmPermissionsBroadening=ConfirmPermissionsBroadening;

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/index.d.ts

@@ -0,0 +1,7 @@
+export * from './artifact-map';
+export * from './codebuild-step';
+export * from './confirm-permissions-broadening';
+export * from './codepipeline';
+export * from './codepipeline-action-factory';
+export * from './codepipeline-source';
+export * from './stack-outputs-map';

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/index.js

@@ -0,0 +1 @@
+"use strict";var __createBinding=exports&&exports.__createBinding||(Object.create?(function(o,m,k,k2){k2===void 0&&(k2=k);var desc=Object.getOwnPropertyDescriptor(m,k);(!desc||("get"in desc?!m.__esModule:desc.writable||desc.configurable))&&(desc={enumerable:!0,get:function(){return m[k]}}),Object.defineProperty(o,k2,desc)}):(function(o,m,k,k2){k2===void 0&&(k2=k),o[k2]=m[k]})),__exportStar=exports&&exports.__exportStar||function(m,exports2){for(var p in m)p!=="default"&&!Object.prototype.hasOwnProperty.call(exports2,p)&&__createBinding(exports2,m,p)};Object.defineProperty(exports,"__esModule",{value:!0});var _noFold;exports.ArtifactMap=void 0,Object.defineProperty(exports,_noFold="ArtifactMap",{enumerable:!0,configurable:!0,get:()=>{var value=require("./artifact-map").ArtifactMap;return Object.defineProperty(exports,_noFold="ArtifactMap",{enumerable:!0,configurable:!0,value}),value}}),exports.CodePipelineFileSet=void 0,Object.defineProperty(exports,_noFold="CodePipelineFileSet",{enumerable:!0,configurable:!0,get:()=>{var value=require("./artifact-map").CodePipelineFileSet;return Object.defineProperty(exports,_noFold="CodePipelineFileSet",{enumerable:!0,configurable:!0,value}),value}}),exports.CodeBuildStep=void 0,Object.defineProperty(exports,_noFold="CodeBuildStep",{enumerable:!0,configurable:!0,get:()=>{var value=require("./codebuild-step").CodeBuildStep;return Object.defineProperty(exports,_noFold="CodeBuildStep",{enumerable:!0,configurable:!0,value}),value}}),exports.ConfirmPermissionsBroadening=void 0,Object.defineProperty(exports,_noFold="ConfirmPermissionsBroadening",{enumerable:!0,configurable:!0,get:()=>{var value=require("./confirm-permissions-broadening").ConfirmPermissionsBroadening;return Object.defineProperty(exports,_noFold="ConfirmPermissionsBroadening",{enumerable:!0,configurable:!0,value}),value}}),exports.CodePipeline=void 0,Object.defineProperty(exports,_noFold="CodePipeline",{enumerable:!0,configurable:!0,get:()=>{var value=require("./codepipeline").CodePipeline;return Object.defineProperty(exports,_noFold="CodePipeline",{enumerable:!0,configurable:!0,value}),value}}),exports.CodePipelineSource=void 0,Object.defineProperty(exports,_noFold="CodePipelineSource",{enumerable:!0,configurable:!0,get:()=>{var value=require("./codepipeline-source").CodePipelineSource;return Object.defineProperty(exports,_noFold="CodePipelineSource",{enumerable:!0,configurable:!0,value}),value}}),exports.StackOutputsMap=void 0,Object.defineProperty(exports,_noFold="StackOutputsMap",{enumerable:!0,configurable:!0,get:()=>{var value=require("./stack-outputs-map").StackOutputsMap;return Object.defineProperty(exports,_noFold="StackOutputsMap",{enumerable:!0,configurable:!0,value}),value}});

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/private/buildspecs.d.ts

@@ -0,0 +1,4 @@
+import * as codebuild from '../../../../aws-codebuild';
+export declare function mergeBuildSpecs(a: codebuild.BuildSpec, b?: codebuild.BuildSpec): codebuild.BuildSpec;
+export declare function mergeBuildSpecs(a: codebuild.BuildSpec | undefined, b: codebuild.BuildSpec): codebuild.BuildSpec;
+export declare function mergeBuildSpecs(a?: codebuild.BuildSpec, b?: codebuild.BuildSpec): codebuild.BuildSpec | undefined;

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/private/buildspecs.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.mergeBuildSpecs=mergeBuildSpecs;var codebuild=()=>{var tmp=require("../../../../aws-codebuild");return codebuild=()=>tmp,tmp};function mergeBuildSpecs(a,b){return!a||!b?a??b:codebuild().mergeBuildSpecs(a,b)}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/private/codebuild-factory.d.ts

@@ -0,0 +1,120 @@
+import type { Construct, IDependable } from 'constructs';
+import * as codebuild from '../../../../aws-codebuild';
+import type * as codepipeline from '../../../../aws-codepipeline';
+import * as iam from '../../../../aws-iam';
+import type { FileSetLocation, ShellStep, StackOutputReference } from '../../blueprint';
+import { StepOutput } from '../../helpers-internal/step-output';
+import type { CodeBuildStep } from '../codebuild-step';
+import type { CodeBuildOptions } from '../codepipeline';
+import type { ICodePipelineActionFactory, ProduceActionOptions, CodePipelineActionFactoryResult } from '../codepipeline-action-factory';
+export interface CodeBuildFactoryProps {
+    /**
+     * Name for the generated CodeBuild project
+     *
+     * @default - Automatically generated
+     */
+    readonly projectName?: string;
+    /**
+     * Customization options for the project
+     *
+     * Will at CodeBuild production time be combined with the option
+     * defaults configured on the pipeline.
+     *
+     * @default - No special values
+     */
+    readonly projectOptions?: CodeBuildOptions;
+    /**
+     * Custom execution role to be used for the CodeBuild project
+     *
+     * @default - A role is automatically created
+     */
+    readonly role?: iam.IRole;
+    /**
+     * Custom execution role to be used for the Code Build Action
+     *
+     * @default - A role is automatically created
+     */
+    readonly actionRole?: iam.IRole;
+    /**
+     * If true, the build spec will be passed via the Cloud Assembly instead of rendered onto the Project
+     *
+     * Doing this has two advantages:
+     *
+     * - Bypass size restrictions: the buildspec on the project is restricted
+     *   in size, while buildspecs coming from an input artifact are not restricted
+     *   in such a way.
+     * - Bypass pipeline update: if the SelfUpdate step has to change the buildspec,
+     *   that just takes time. On the other hand, if the buildspec comes from the
+     *   pipeline artifact, no such update has to take place.
+     *
+     * @default false
+     */
+    readonly passBuildSpecViaCloudAssembly?: boolean;
+    /**
+     * Override the construct tree where the CodeBuild project is created.
+     *
+     * Normally, the construct tree will look like this:
+     *
+     *  ── Pipeline
+     *      └── 'MyStage'         <- options.scope
+     *           └── 'MyAction'   <- this is the CodeBuild project
+     *
+     * If this flag is set, the construct tree will look like this:
+     *
+     *  ── Pipeline
+     *      └── 'MyStage'                         <- options.scope
+     *           └── 'MyAction'                   <- just a scope
+     *                  └── 'BackwardsCompatName' <- CodeBuild project
+     *
+     * This is to maintain logicalID compatibility with the previous iteration
+     * of pipelines (where the Action was a construct that would create the Project).
+     *
+     * @default true
+     */
+    readonly additionalConstructLevel?: boolean;
+    /**
+     * Additional dependency that the CodeBuild project should take
+     *
+     * @default -
+     */
+    readonly additionalDependable?: IDependable;
+    readonly inputs?: FileSetLocation[];
+    readonly outputs?: FileSetLocation[];
+    readonly stepId?: string;
+    readonly commands: string[];
+    readonly installCommands?: string[];
+    readonly env?: Record<string, string>;
+    readonly envFromCfnOutputs?: Record<string, StackOutputReference>;
+    /**
+     * If given, override the scope from the produce call with this scope.
+     */
+    readonly scope?: Construct;
+    /**
+     * Whether or not the given CodeBuild project is going to be the synth step
+     *
+     * @default false
+     */
+    readonly isSynth?: boolean;
+    /**
+     * StepOutputs produced by this CodeBuild step
+     */
+    readonly producedStepOutputs?: StepOutput[];
+}
+/**
+ * Produce a CodeBuild project from a ShellStep and some CodeBuild-specific customizations
+ *
+ * The functionality here is shared between the `CodePipeline` translating a `ShellStep` into
+ * a CodeBuild project, as well as the `CodeBuildStep` straight up.
+ */
+export declare class CodeBuildFactory implements ICodePipelineActionFactory {
+    private readonly constructId;
+    private readonly props;
+    static fromShellStep(constructId: string, shellStep: ShellStep, additional?: Partial<CodeBuildFactoryProps>): ICodePipelineActionFactory;
+    static fromCodeBuildStep(constructId: string, step: CodeBuildStep, additional?: Partial<CodeBuildFactoryProps>): ICodePipelineActionFactory;
+    private _project?;
+    private stepId;
+    private constructor();
+    get project(): codebuild.IProject;
+    produceAction(stage: codepipeline.IStage, options: ProduceActionOptions): CodePipelineActionFactoryResult;
+}
+export declare function mergeCodeBuildOptions(...opts: Array<CodeBuildOptions | undefined>): CodeBuildOptions;

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/private/outputs.d.ts

@@ -0,0 +1,14 @@
+import type * as cp from '../../../../aws-codepipeline';
+import type { Step } from '../../blueprint/step';
+export declare function makeCodePipelineOutput(step: Step, variableName: string): string;
+/**
+ * If the step is producing outputs, determine a variableNamespace for it, and configure that on the outputs
+ */
+export declare function namespaceStepOutputs(step: Step, stage: cp.IStage, name: string): string | undefined;
+/**
+ * Generate a variable namespace from stage and action names
+ *
+ * Variable namespaces cannot have '.', but they can have '@'. Other than that,
+ * action names are more limited so they translate easily.
+ */
+export declare function namespaceName(stage: cp.IStage, name: string): string;

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/private/outputs.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.makeCodePipelineOutput=makeCodePipelineOutput,exports.namespaceStepOutputs=namespaceStepOutputs,exports.namespaceName=namespaceName;var core_1=()=>{var tmp=require("../../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},helpers_internal_1=()=>{var tmp=require("../../helpers-internal");return helpers_internal_1=()=>tmp,tmp};const CODEPIPELINE_ENGINE_NAME="codepipeline";function makeCodePipelineOutput(step,variableName){return new(helpers_internal_1()).StepOutput(step,CODEPIPELINE_ENGINE_NAME,variableName).toString()}function namespaceStepOutputs(step,stage,name){let ret;for(const output of helpers_internal_1().StepOutput.producedStepOutputs(step)){if(ret=namespaceName(stage,name),output.engineName!==CODEPIPELINE_ENGINE_NAME)throw new(core_1()).ValidationError((0,literal_string_1().lit)`FoundUnrecognizedOutputType`,`Found unrecognized output type: ${output.engineName}`,stage.pipeline);if(typeof output.engineSpecificInformation!="string")throw new(core_1()).ValidationError((0,literal_string_1().lit)`CodePipelineRequiresEngineSpecific`,`CodePipeline requires that 'engineSpecificInformation' is a string, got: ${JSON.stringify(output.engineSpecificInformation)}`,stage.pipeline);output.defineResolution(`#{${ret}.${output.engineSpecificInformation}}`)}return ret}function namespaceName(stage,name){return`${stage.stageName}/${name}`.replace(/[^a-zA-Z0-9@_-]/g,"@")}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/stack-outputs-map.d.ts

@@ -0,0 +1,13 @@
+import type { StackOutputReference } from '../blueprint';
+import type { PipelineBase } from '../main';
+/**
+ * Translate stack outputs to CodePipeline variable references
+ */
+export declare class StackOutputsMap {
+    private queries;
+    constructor(pipeline: PipelineBase);
+    /**
+     * Return the matching variable reference string for a StackOutputReference
+     */
+    toCodePipeline(x: StackOutputReference): string;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/codepipeline/stack-outputs-map.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.StackOutputsMap=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var pipeline_queries_1=()=>{var tmp=require("../helpers-internal/pipeline-queries");return pipeline_queries_1=()=>tmp,tmp},identifiers_1=()=>{var tmp=require("../private/identifiers");return identifiers_1=()=>tmp,tmp};class StackOutputsMap{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.StackOutputsMap",version:"2.252.0"};queries;constructor(pipeline){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_PipelineBase(pipeline)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,StackOutputsMap),error}this.queries=new(pipeline_queries_1()).PipelineQueries(pipeline)}toCodePipeline(x){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_StackOutputReference(x)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.toCodePipeline),error}return`#{${(0,identifiers_1().stackVariableNamespace)(this.queries.producingStack(x))}.${x.outputName}}`}}exports.StackOutputsMap=StackOutputsMap;

cdk/node_modules/aws-cdk-lib/pipelines/lib/docker-credentials.d.ts

@@ -0,0 +1,110 @@
+import * as ec2 from '../../aws-ec2';
+import type * as ecr from '../../aws-ecr';
+import * as iam from '../../aws-iam';
+import type * as secretsmanager from '../../aws-secretsmanager';
+/**
+ * Represents credentials used to access a Docker registry.
+ */
+export declare abstract class DockerCredential {
+    protected readonly usages?: DockerCredentialUsage[] | undefined;
+    /**
+     * Creates a DockerCredential for DockerHub.
+     * Convenience method for `customRegistry('https://index.docker.io/v1/', opts)`.
+     */
+    static dockerHub(secret: secretsmanager.ISecret, opts?: ExternalDockerCredentialOptions): DockerCredential;
+    /**
+     * Creates a DockerCredential for a registry, based on its domain name (e.g., 'www.example.com').
+     */
+    static customRegistry(registryDomain: string, secret: secretsmanager.ISecret, opts?: ExternalDockerCredentialOptions): DockerCredential;
+    /**
+     * Creates a DockerCredential for one or more ECR repositories.
+     *
+     * NOTE - All ECR repositories in the same account and region share a domain name
+     * (e.g., 0123456789012.dkr.ecr.eu-west-1.amazonaws.com), and can only have one associated
+     * set of credentials (and DockerCredential). Attempting to associate one set of credentials
+     * with one ECR repo and another with another ECR repo in the same account and region will
+     * result in failures when using these credentials in the pipeline.
+     */
+    static ecr(repositories: ecr.IRepository[], opts?: EcrDockerCredentialOptions): DockerCredential;
+    constructor(usages?: DockerCredentialUsage[] | undefined);
+    /**
+     * Determines if this credential is relevant to the input usage.
+     * @internal
+     */
+    _applicableForUsage(usage: DockerCredentialUsage): boolean;
+    /**
+     * Grant read-only access to the registry credentials.
+     * This grants read access to any secrets, and pull access to any repositories.
+     */
+    abstract grantRead(grantee: iam.IGrantable, usage: DockerCredentialUsage): void;
+    /**
+     * Creates and returns the credential configuration, to be used by `cdk-assets`
+     * to support the `docker-credential-cdk-assets` tool for `docker login`.
+     * @internal
+     */
+    abstract _renderCdkAssetsConfig(): DockerCredentialCredentialSource;
+}
+/** Options for defining credentials for a Docker Credential */
+export interface ExternalDockerCredentialOptions {
+    /**
+     * The name of the JSON field of the secret which contains the user/login name.
+     * @default 'username'
+     */
+    readonly secretUsernameField?: string;
+    /**
+     * The name of the JSON field of the secret which contains the secret/password.
+     * @default 'secret'
+     */
+    readonly secretPasswordField?: string;
+    /**
+     * An IAM role to assume prior to accessing the secret.
+     * @default - none. The current execution role will be used.
+     */
+    readonly assumeRole?: iam.IRole;
+    /**
+     * Defines which stages of the pipeline should be granted access to these credentials.
+     * @default - all relevant stages (synth, self-update, asset publishing) are granted access.
+     */
+    readonly usages?: DockerCredentialUsage[];
+}
+/** Options for defining access for a Docker Credential composed of ECR repos */
+export interface EcrDockerCredentialOptions {
+    /**
+     * An IAM role to assume prior to accessing the secret.
+     * @default - none. The current execution role will be used.
+     */
+    readonly assumeRole?: iam.IRole;
+    /**
+     * Defines which stages of the pipeline should be granted access to these credentials.
+     * @default - all relevant stages (synth, self-update, asset publishing) are granted access.
+     */
+    readonly usages?: DockerCredentialUsage[];
+}
+/** Defines which stages of a pipeline require the specified credentials */
+export declare enum DockerCredentialUsage {
+    /** Synth/Build */
+    SYNTH = "SYNTH",
+    /** Self-update */
+    SELF_UPDATE = "SELF_UPDATE",
+    /** Asset publishing */
+    ASSET_PUBLISHING = "ASSET_PUBLISHING"
+}
+/** Format for the CDK assets config. See the cdk-assets `DockerDomainCredentialSource` */
+interface DockerCredentialCredentialSource {
+    readonly secretsManagerSecretId?: string;
+    readonly secretsUsernameField?: string;
+    readonly secretsPasswordField?: string;
+    readonly ecrRepository?: boolean;
+    readonly assumeRoleArn?: string;
+}
+/**
+ * Creates a set of OS-specific buildspec installation commands for setting up the given
+ * registries and associated credentials.
+ *
+ * @param registries - Registries to configure credentials for. It is an error to provide
+ * multiple registries for the same domain.
+ * @param osType - (optional) Defaults to Linux.
+ * @returns An array of commands to configure cdk-assets to use these credentials.
+ */
+export declare function dockerCredentialsInstallCommands(usage: DockerCredentialUsage, registries?: DockerCredential[], osType?: ec2.OperatingSystemType | 'both'): string[];
+export {};

cdk/node_modules/aws-cdk-lib/pipelines/lib/docker-credentials.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.DockerCredentialUsage=exports.DockerCredential=void 0,exports.dockerCredentialsInstallCommands=dockerCredentialsInstallCommands;var jsiiDeprecationWarnings=()=>{var tmp=require("../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var ec2=()=>{var tmp=require("../../aws-ec2");return ec2=()=>tmp,tmp},iam=()=>{var tmp=require("../../aws-iam");return iam=()=>tmp,tmp},core_1=()=>{var tmp=require("../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class DockerCredential{usages;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.DockerCredential",version:"2.252.0"};static dockerHub(secret,opts={}){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_secretsmanager_ISecret(secret),jsiiDeprecationWarnings().aws_cdk_lib_pipelines_ExternalDockerCredentialOptions(opts)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.dockerHub),error}return new ExternalDockerCredential("https://index.docker.io/v1/",secret,opts)}static customRegistry(registryDomain,secret,opts={}){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_secretsmanager_ISecret(secret),jsiiDeprecationWarnings().aws_cdk_lib_pipelines_ExternalDockerCredentialOptions(opts)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.customRegistry),error}return new ExternalDockerCredential(registryDomain,secret,opts)}static ecr(repositories,opts){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_EcrDockerCredentialOptions(opts)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.ecr),error}return new EcrDockerCredential(repositories,opts??{})}constructor(usages){this.usages=usages}_applicableForUsage(usage){return!this.usages||this.usages.includes(usage)}}exports.DockerCredential=DockerCredential;var DockerCredentialUsage;(function(DockerCredentialUsage2){DockerCredentialUsage2.SYNTH="SYNTH",DockerCredentialUsage2.SELF_UPDATE="SELF_UPDATE",DockerCredentialUsage2.ASSET_PUBLISHING="ASSET_PUBLISHING"})(DockerCredentialUsage||(exports.DockerCredentialUsage=DockerCredentialUsage={}));class ExternalDockerCredential extends DockerCredential{registryDomain;secret;opts;constructor(registryDomain,secret,opts){super(opts.usages),this.registryDomain=registryDomain,this.secret=secret,this.opts=opts}grantRead(grantee,usage){if(!this._applicableForUsage(usage))return;this.opts.assumeRole&&grantee.grantPrincipal.addToPrincipalPolicy(new(iam()).PolicyStatement({actions:["sts:AssumeRole"],resources:[this.opts.assumeRole.roleArn]}));const role=this.opts.assumeRole??grantee;this.secret.grantRead(role)}_renderCdkAssetsConfig(){return{[this.registryDomain]:{secretsManagerSecretId:this.secret.secretArn,secretsUsernameField:this.opts.secretUsernameField,secretsPasswordField:this.opts.secretPasswordField,assumeRoleArn:this.opts.assumeRole?.roleArn}}}}class EcrDockerCredential extends DockerCredential{repositories;opts;registryDomain;constructor(repositories,opts){if(super(opts.usages),this.repositories=repositories,this.opts=opts,repositories.length===0)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`SupplyLeastCreate`,"must supply at least one `ecr.IRepository` to create an `EcrDockerCredential`");this.registryDomain=core_1().Fn.select(0,core_1().Fn.split("/",repositories[0].repositoryUri))}grantRead(grantee,usage){if(!this._applicableForUsage(usage))return;this.opts.assumeRole&&grantee.grantPrincipal.addToPrincipalPolicy(new(iam()).PolicyStatement({actions:["sts:AssumeRole"],resources:[this.opts.assumeRole.roleArn]}));const role=this.opts.assumeRole??grantee;this.repositories.forEach(repo=>repo.grantPull(role))}_renderCdkAssetsConfig(){return{[this.registryDomain]:{ecrRepository:!0,assumeRoleArn:this.opts.assumeRole?.roleArn}}}}function dockerCredentialsInstallCommands(usage,registries,osType){const relevantRegistries=(registries??[]).filter(reg=>reg._applicableForUsage(usage));if(!relevantRegistries||relevantRegistries.length===0)return[];const cdkAssetsConfigFile={version:"1.0",domainCredentials:relevantRegistries.reduce(function(map,registry){return Object.assign(map,registry._renderCdkAssetsConfig()),map},{})},windowsCommands=["mkdir %USERPROFILE%\\.cdk",`echo '${JSON.stringify(cdkAssetsConfigFile)}' > %USERPROFILE%\\.cdk\\cdk-docker-creds.json`],linuxCommands=["mkdir $HOME/.cdk",`echo '${JSON.stringify(cdkAssetsConfigFile)}' > $HOME/.cdk/cdk-docker-creds.json`];return osType==="both"?[...windowsCommands.map(c=>`!WINDOWS!${c}`),...linuxCommands.map(c=>`!LINUX!${c}`)]:osType===ec2().OperatingSystemType.WINDOWS?windowsCommands:linuxCommands}

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/graph.d.ts

@@ -0,0 +1,145 @@
+export interface GraphNodeProps<A> {
+    readonly displayName?: string;
+    readonly data?: A;
+}
+export declare class GraphNode<A> {
+    readonly id: string;
+    static of<A>(id: string, data: A, displayName?: string): GraphNode<A>;
+    readonly dependencies: GraphNode<A>[];
+    readonly data?: A;
+    readonly displayName?: string;
+    private _parentGraph?;
+    constructor(id: string, props?: GraphNodeProps<A>);
+    /**
+     * A graph-wide unique identifier for this node. Rendered by joining the IDs
+     * of all ancestors with hyphens.
+     */
+    get uniqueId(): string;
+    /**
+     * The union of all dependencies of this node and the dependencies of all
+     * parent graphs.
+     */
+    get allDeps(): GraphNode<A>[];
+    dependOn(...dependencies: Array<GraphNode<A> | undefined>): void;
+    ancestorPath(upTo: GraphNode<A>): GraphNode<A>[];
+    rootPath(): GraphNode<A>[];
+    get root(): GraphNode<A>;
+    get rootGraph(): Graph<A>;
+    get parentGraph(): Graph<A> | undefined;
+    /**
+     * @internal
+     */
+    _setParentGraph(parentGraph: Graph<A>): void;
+    toString(): string;
+}
+/**
+ * A dependency set that is constructed over time
+ *
+ * It doesn't matter in what order sources and targets for the dependency
+ * relationship(s) get added. This class can serve as a synchronization
+ * point if the order in which graph nodes get added to the graph is not
+ * well-defined.
+ *
+ * You can think of a DependencyBuilder as a vertex that doesn't actually exist in the tree:
+ *
+ *     ┌────┐               ┌────┐
+ *     │ P1 │◀─┐         ┌──│ S1 │
+ *     └────┘  │   .─.   │  └────┘
+ *             ├──( B )◀─┤
+ *     ┌────┐  │   `─'   │  ┌────┐
+ *     │ P2 │◀─┘         └──│ S2 │
+ *     └────┘               └────┘
+ *
+ * Ultimately leads to: { S1 -> P1, S1 -> P2, S2 -> P1, S2 -> P2 }.
+ */
+export declare class DependencyBuilder<A> {
+    private readonly _producers;
+    private readonly _consumers;
+    /**
+     * Add a producer: make all nodes added by 'dependBy' depend on these
+     */
+    dependOn(...targets: GraphNode<A>[]): this;
+    /**
+     * Add a consumer: make these nodes depend on all nodes added by 'dependOn'.
+     */
+    dependBy(...sources: GraphNode<A>[]): this;
+    /**
+     * Whether there are any consumers (nodes added by 'dependBy') but no producers (nodes added by 'dependOn')
+     */
+    get hasUnsatisfiedConsumers(): boolean;
+    get consumers(): ReadonlyArray<GraphNode<A>>;
+    consumersAsString(): string;
+}
+/**
+ * A set of dependency builders identified by a given key.
+ */
+export declare class DependencyBuilders<K, A = any> {
+    private readonly builders;
+    for(key: K): DependencyBuilder<A>;
+    /**
+     * @deprecated Use 'for'
+     */
+    get(key: K): DependencyBuilder<A>;
+    unsatisfiedBuilders(): [K, DependencyBuilder<A>][];
+}
+export interface GraphProps<A> extends GraphNodeProps<A> {
+    /**
+     * Initial nodes in the workflow
+     */
+    readonly nodes?: GraphNode<A>[];
+}
+export declare class Graph<A> extends GraphNode<A> {
+    /**
+     * The 3rd parameter looks weird because it has to be structurally compatible with `GraphNode.of()`,
+     * but we want to add `displayName` at the end, really.
+     */
+    static of<A, B>(id: string, data: A, displayNameOrNodes?: string | GraphNode<B>[], displayName?: string): Graph<A | B>;
+    private readonly children;
+    constructor(name: string, props?: GraphProps<A>);
+    get nodes(): Set<GraphNode<A>>;
+    tryGetChild(name: string): GraphNode<A> | undefined;
+    containsId(id: string): boolean;
+    contains(node: GraphNode<A>): boolean;
+    add(...nodes: Array<GraphNode<A>>): void;
+    absorb(other: Graph<A>): void;
+    /**
+     * Return topologically sorted tranches of nodes at this graph level
+     */
+    sortedChildren(fail?: boolean): GraphNode<A>[][];
+    /**
+     * Return a topologically sorted list of non-Graph nodes in the entire subgraph
+     */
+    sortedLeaves(): GraphNode<A>[][];
+    render(): string;
+    renderDot(): string;
+    consoleLog(_indent?: number): void;
+    /**
+     * Return the union of all dependencies of the descendants of this graph
+     */
+    private deepDependencies;
+    /**
+     * Return all non-Graph nodes
+     */
+    allLeaves(): GraphNodeCollection<A>;
+}
+/**
+ * A collection of graph nodes
+ */
+export declare class GraphNodeCollection<A> {
+    readonly nodes: GraphNode<A>[];
+    constructor(nodes: Iterable<GraphNode<A>>);
+    /**
+     * Add one or more dependencies to all nodes in the collection
+     */
+    dependOn(...dependencies: Array<GraphNode<A> | undefined>): void;
+    /**
+     * Return the topographically first node in the collection
+     */
+    first(): GraphNode<A>;
+    /**
+     * Returns the graph node that's shared between these nodes
+     */
+    commonAncestor(): GraphNode<A>;
+    toString(): string;
+}
+export declare function isGraph<A>(x: GraphNode<A>): x is Graph<A>;

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/graph.js

@@ -0,0 +1,4 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.GraphNodeCollection=exports.Graph=exports.DependencyBuilders=exports.DependencyBuilder=exports.GraphNode=void 0,exports.isGraph=isGraph;var toposort_1=()=>{var tmp=require("./toposort");return toposort_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},javascript_1=()=>{var tmp=require("../private/javascript");return javascript_1=()=>tmp,tmp};class GraphNode{id;static of(id,data,displayName){return new GraphNode(id,{data,displayName})}dependencies=[];data;displayName;_parentGraph;constructor(id,props={}){this.id=id,this.displayName=props.displayName,this.data=props.data}get uniqueId(){return this.ancestorPath(this.root).map(x=>x.id).join("-")}get allDeps(){const fromParent=this.parentGraph?.allDeps??[];return Array.from(new Set([...this.dependencies,...fromParent]))}dependOn(...dependencies){if(dependencies.includes(this))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CannotAddDependencySelf`,`Cannot add dependency on self: ${this}`);this.dependencies.push(...dependencies.filter(javascript_1().isDefined))}ancestorPath(upTo){let x=this;const ret=[x];for(;x.parentGraph&&x.parentGraph!==upTo;)x=x.parentGraph,ret.unshift(x);return ret}rootPath(){let x=this;const ret=[x];for(;x.parentGraph;)x=x.parentGraph,ret.unshift(x);return ret}get root(){let x=this;for(;x.parentGraph;)x=x.parentGraph;return x}get rootGraph(){const root=this.root;if(!(root instanceof Graph))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`ExpectingGraphRoot`,`Expecting a graph as root, got: ${root}`);return root}get parentGraph(){return this._parentGraph}_setParentGraph(parentGraph){if(this._parentGraph)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`NodeAlreadyParent`,"Node already has a parent");this._parentGraph=parentGraph}toString(){return`${this.constructor.name}(${this.id})`}}exports.GraphNode=GraphNode;class DependencyBuilder{_producers=[];_consumers=[];dependOn(...targets){for(const target of targets){for(const source of this._consumers)source.dependOn(target);this._producers.push(target)}return this}dependBy(...sources){for(const source of sources){for(const target of this._producers)source.dependOn(target);this._consumers.push(source)}return this}get hasUnsatisfiedConsumers(){return this._consumers.length>0&&this._producers.length===0}get consumers(){return this._consumers}consumersAsString(){return this.consumers.map(c=>`${c}`).join(",")}}exports.DependencyBuilder=DependencyBuilder;class DependencyBuilders{builders=new Map;for(key){const b=this.builders.get(key);if(b)return b;const ret=new DependencyBuilder;return this.builders.set(key,ret),ret}get(key){return this.for(key)}unsatisfiedBuilders(){const ret=new Array;for(const[k,builder]of this.builders.entries())builder.hasUnsatisfiedConsumers&&ret.push([k,builder]);return ret}}exports.DependencyBuilders=DependencyBuilders;class Graph extends GraphNode{static of(id,data,displayNameOrNodes,displayName){const nodes=Array.isArray(displayNameOrNodes)?displayNameOrNodes:void 0,displayName_=Array.isArray(displayNameOrNodes)?displayName:displayNameOrNodes;return new Graph(id,{data,nodes,displayName:displayName_})}children=new Map;constructor(name,props={}){super(name,props),props.nodes&&this.add(...props.nodes)}get nodes(){return new Set(this.children.values())}tryGetChild(name){return this.children.get(name)}containsId(id){return this.tryGetChild(id)!==void 0}contains(node){return this.nodes.has(node)}add(...nodes){for(const node of nodes){if(this.children.has(node.id))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`NodeDuplicate`,`Node with duplicate id: ${node.id}`);node._setParentGraph(this),this.children.set(node.id,node)}}absorb(other){this.add(...other.nodes)}sortedChildren(fail=!0){const nodes=this.nodes,projectedDependencies=projectDependencies(this.deepDependencies(),node=>{for(;!nodes.has(node)&&node.parentGraph;)node=node.parentGraph;return nodes.has(node)?[node]:[]});return(0,toposort_1().topoSort)(nodes,projectedDependencies,fail)}sortedLeaves(){const descendantsMap=new Map;findDescendants(this);function findDescendants(node){const ret=[];if(node instanceof Graph)for(const child of node.nodes)ret.push(...findDescendants(child));else ret.push(node);return descendantsMap.set(node,ret),ret}const projectedDependencies=projectDependencies(this.deepDependencies(),node=>descendantsMap.get(node)??[]);return(0,toposort_1().topoSort)(new Set(projectedDependencies.keys()),projectedDependencies)}render(){const lines=new Array;return recurse(this,"",!0),lines.join(`
+`);function recurse(x,indent,last){const bullet=last?"\u2514\u2500":"\u251C\u2500",follow=last?"  ":"\u2502 ";if(lines.push(`${indent} ${bullet} ${x}${depString(x)}`),x instanceof Graph){let i=0;const sortedNodes=Array.prototype.concat.call([],...x.sortedChildren(!1));for(const child of sortedNodes)recurse(child,`${indent} ${follow} `,i++==x.nodes.size-1)}}function depString(node){return node.dependencies.length>0?` -> ${Array.from(node.dependencies).join(", ")}`:""}}renderDot(){const lines=new Array;lines.push("digraph G {"),lines.push('  # Arrows represent an "unlocks" relationship (opposite of dependency). So chosen'),lines.push("  # because the layout looks more natural that way."),lines.push("  # To represent subgraph dependencies, subgraphs are represented by BEGIN/END nodes."),lines.push("  # To render: `dot -Tsvg input.dot > graph.svg`, open in a browser."),lines.push('  node [shape="box"];');for(const child of this.nodes)recurse(child);return lines.push("}"),lines.join(`
+`);function recurse(node){let dependencySource;node instanceof Graph?(lines.push(`${graphBegin(node)} [shape="cds", style="filled", fillcolor="#b7deff"];`),lines.push(`${graphEnd(node)} [shape="cds", style="filled", fillcolor="#b7deff"];`),dependencySource=graphBegin(node)):(dependencySource=nodeLabel(node),lines.push(`${nodeLabel(node)};`));for(const dep of node.dependencies){const dst=dep instanceof Graph?graphEnd(dep):nodeLabel(dep);lines.push(`${dst} -> ${dependencySource};`)}if(node instanceof Graph&&node.nodes.size>0){for(const child of node.nodes)recurse(child);const sortedChildren=node.sortedChildren(!1);for(const first of sortedChildren[0]){const src=first instanceof Graph?graphBegin(first):nodeLabel(first);lines.push(`${graphBegin(node)} -> ${src};`)}for(const last of sortedChildren[sortedChildren.length-1]){const dst=last instanceof Graph?graphEnd(last):nodeLabel(last);lines.push(`${dst} -> ${graphEnd(node)};`)}}}function id(node){return node.rootPath().slice(1).map(n=>n.id).join(".")}function nodeLabel(node){return`"${id(node)}"`}function graphBegin(node){return`"BEGIN ${id(node)}"`}function graphEnd(node){return`"END ${id(node)}"`}}consoleLog(_indent=0){process.stdout.write(this.render()+`
+`)}deepDependencies(){const ret=new Map;for(const node of this.nodes)recurse(node);return ret;function recurse(node){let deps=ret.get(node);deps||ret.set(node,deps=new Set);for(let dep of node.dependencies)deps.add(dep);if(node instanceof Graph)for(const child of node.nodes)recurse(child)}}allLeaves(){const ret=[];return recurse(this),new GraphNodeCollection(ret);function recurse(node){if(node instanceof Graph)for(const child of node.nodes)recurse(child);else ret.push(node)}}}exports.Graph=Graph;class GraphNodeCollection{nodes;constructor(nodes){this.nodes=Array.from(nodes)}dependOn(...dependencies){for(const node of this.nodes)node.dependOn(...dependencies.filter(javascript_1().isDefined))}first(){const nodes=new Set(this.nodes),sorted=this.nodes[0].rootGraph.sortedLeaves();for(const tranche of sorted)for(const node of tranche)if(nodes.has(node))return node;throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CouldCalculateFirstNode`,`Could not calculate first node between ${this}`)}commonAncestor(){const paths=new Array;for(const x of this.nodes)paths.push(x.rootPath());if(paths.length===0)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CannotFindCommonAncestorEmpty`,"Cannot find common ancestor between an empty set of nodes");if(paths.length===1){const path=paths[0];if(path.length<2)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CannotFindAncestorNodeWithout`,`Cannot find ancestor of node without ancestor: ${path[0]}`);return path[path.length-2]}const originalPaths=[...paths];for(;paths.every(path=>paths[0].length>=2&&path.length>=2&&path[1]===paths[0][1]);)for(const path of paths)path.shift();if(paths.some(path=>path.length<2))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CouldDetermineSharedParent`,`Could not determine a shared parent between nodes: ${originalPaths.map(nodes=>nodes.map(n=>n.id).join("/"))}`);return paths[0][0]}toString(){return this.nodes.map(n=>`${n}`).join(", ")}}exports.GraphNodeCollection=GraphNodeCollection;function projectDependencies(dependencies,project){for(const node of dependencies.keys()){const projectedNodes=project(node);if(projectedNodes.length===1&&projectedNodes[0]===node)continue;const deps=(0,javascript_1().extract)(dependencies,node);for(const projectedNode of projectedNodes)(0,javascript_1().addAll)(dependencies.get(projectedNode),deps)}for(const[node,deps]of dependencies.entries()){const depset=new Set((0,javascript_1().flatMap)(deps,project));depset.delete(node),dependencies.set(node,depset)}return dependencies}function isGraph(x){return x instanceof Graph}

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/index.d.ts

@@ -0,0 +1,3 @@
+export * from './pipeline-graph';
+export * from './graph';
+export * from './step-output';

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/index.js

@@ -0,0 +1 @@
+"use strict";var __createBinding=exports&&exports.__createBinding||(Object.create?(function(o,m,k,k2){k2===void 0&&(k2=k);var desc=Object.getOwnPropertyDescriptor(m,k);(!desc||("get"in desc?!m.__esModule:desc.writable||desc.configurable))&&(desc={enumerable:!0,get:function(){return m[k]}}),Object.defineProperty(o,k2,desc)}):(function(o,m,k,k2){k2===void 0&&(k2=k),o[k2]=m[k]})),__exportStar=exports&&exports.__exportStar||function(m,exports2){for(var p in m)p!=="default"&&!Object.prototype.hasOwnProperty.call(exports2,p)&&__createBinding(exports2,m,p)};Object.defineProperty(exports,"__esModule",{value:!0});var _noFold;exports.PipelineGraph=void 0,Object.defineProperty(exports,_noFold="PipelineGraph",{enumerable:!0,configurable:!0,get:()=>{var value=require("./pipeline-graph").PipelineGraph;return Object.defineProperty(exports,_noFold="PipelineGraph",{enumerable:!0,configurable:!0,value}),value}}),exports.GraphNode=void 0,Object.defineProperty(exports,_noFold="GraphNode",{enumerable:!0,configurable:!0,get:()=>{var value=require("./graph").GraphNode;return Object.defineProperty(exports,_noFold="GraphNode",{enumerable:!0,configurable:!0,value}),value}}),exports.DependencyBuilder=void 0,Object.defineProperty(exports,_noFold="DependencyBuilder",{enumerable:!0,configurable:!0,get:()=>{var value=require("./graph").DependencyBuilder;return Object.defineProperty(exports,_noFold="DependencyBuilder",{enumerable:!0,configurable:!0,value}),value}}),exports.DependencyBuilders=void 0,Object.defineProperty(exports,_noFold="DependencyBuilders",{enumerable:!0,configurable:!0,get:()=>{var value=require("./graph").DependencyBuilders;return Object.defineProperty(exports,_noFold="DependencyBuilders",{enumerable:!0,configurable:!0,value}),value}}),exports.Graph=void 0,Object.defineProperty(exports,_noFold="Graph",{enumerable:!0,configurable:!0,get:()=>{var value=require("./graph").Graph;return Object.defineProperty(exports,_noFold="Graph",{enumerable:!0,configurable:!0,value}),value}}),exports.GraphNodeCollection=void 0,Object.defineProperty(exports,_noFold="GraphNodeCollection",{enumerable:!0,configurable:!0,get:()=>{var value=require("./graph").GraphNodeCollection;return Object.defineProperty(exports,_noFold="GraphNodeCollection",{enumerable:!0,configurable:!0,value}),value}}),exports.isGraph=void 0,Object.defineProperty(exports,_noFold="isGraph",{enumerable:!0,configurable:!0,get:()=>{var value=require("./graph").isGraph;return Object.defineProperty(exports,_noFold="isGraph",{enumerable:!0,configurable:!0,value}),value}}),exports.StepOutput=void 0,Object.defineProperty(exports,_noFold="StepOutput",{enumerable:!0,configurable:!0,get:()=>{var value=require("./step-output").StepOutput;return Object.defineProperty(exports,_noFold="StepOutput",{enumerable:!0,configurable:!0,value}),value}});

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/pipeline-graph.d.ts

@@ -0,0 +1,130 @@
+import { Graph, GraphNode } from './graph';
+import { PipelineQueries } from './pipeline-queries';
+import type { FileSet, StackAsset, StackDeployment } from '../blueprint';
+import { Step } from '../blueprint';
+import type { PipelineBase } from '../main/pipeline-base';
+export interface PipelineGraphProps {
+    /**
+     * Add a self-mutation step.
+     *
+     * @default false
+     */
+    readonly selfMutation?: boolean;
+    /**
+     * Publishes the template asset to S3.
+     *
+     * @default false
+     */
+    readonly publishTemplate?: boolean;
+    /**
+     * Whether to combine asset publishers for the same type into one step
+     *
+     * @default false
+     */
+    readonly singlePublisherPerAssetType?: boolean;
+    /**
+     * Add a "prepare" step for each stack which can be used to create the change
+     * set. If this is disabled, only the "execute" step will be included.
+     *
+     * @default true
+     */
+    readonly prepareStep?: boolean;
+}
+/**
+ * Logic to turn the deployment blueprint into a graph
+ *
+ * This code makes all the decisions on how to lay out the CodePipeline
+ */
+export declare class PipelineGraph {
+    readonly pipeline: PipelineBase;
+    /**
+     * A Step object that may be used as the producer of FileSets that should not be represented in the graph
+     */
+    static readonly NO_STEP: Step;
+    readonly graph: AGraph;
+    readonly cloudAssemblyFileSet: FileSet;
+    readonly queries: PipelineQueries;
+    private readonly added;
+    private readonly assetNodes;
+    private readonly assetNodesByType;
+    private readonly synthNode?;
+    private readonly selfMutateNode?;
+    private readonly stackOutputDependencies;
+    /** Mapping steps to depbuilders, satisfied by the step itself  */
+    private readonly nodeDependencies;
+    private readonly publishTemplate;
+    private readonly prepareStep;
+    private readonly singlePublisher;
+    private lastPreparationNode?;
+    private _fileAssetCtr;
+    private _dockerAssetCtr;
+    constructor(pipeline: PipelineBase, props?: PipelineGraphProps);
+    isSynthNode(node: AGraphNode): boolean;
+    private addBuildStep;
+    private addWave;
+    private addStage;
+    private addChangeSetNode;
+    private addPrePost;
+    private topLevelGraph;
+    /**
+     * Add a Node to a Graph for a given Step
+     *
+     * Adds all dependencies for that Node to the same Step as well.
+     */
+    private addStepNode;
+    /**
+     * Add dependencies that aren't in the pipeline yet
+     *
+     * Build steps reference as many sources (or other builds) as they want, which will be added
+     * automatically. Do that here. We couldn't do it earlier, because if there were dependencies
+     * between steps we didn't want to reparent those unnecessarily.
+     */
+    private addMissingDependencyNodes;
+    private publishAsset;
+    /**
+     * Simplify the stack name by removing the `Stage-` prefix if it exists.
+     */
+    private simpleStackName;
+}
+type GraphAnnotation = {
+    readonly type: 'group';
+} | {
+    readonly type: 'stack-group';
+    readonly stack: StackDeployment;
+} | {
+    readonly type: 'publish-assets';
+    readonly assets: StackAsset[];
+} | {
+    readonly type: 'step';
+    readonly step: Step;
+    isBuildStep?: boolean;
+} | {
+    readonly type: 'self-update';
+} | {
+    readonly type: 'prepare';
+    readonly stack: StackDeployment;
+} | ExecuteAnnotation | {
+    readonly type: {
+        error: 'you must add a default case to your switch';
+    };
+};
+interface ExecuteAnnotation {
+    readonly type: 'execute';
+    /**
+     * The stack to deploy
+     */
+    readonly stack: StackDeployment;
+    /**
+     * Whether or not outputs should be captured
+     */
+    readonly captureOutputs: boolean;
+    /**
+     * If this is executing a change set, or should do a direct deployment
+     *
+     * @default false
+     */
+    readonly withoutChangeSet?: boolean;
+}
+export type AGraphNode = GraphNode<GraphAnnotation>;
+export type AGraph = Graph<GraphAnnotation>;
+export {};

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/pipeline-queries.d.ts

@@ -0,0 +1,21 @@
+import type { StackOutputReference, StackDeployment, StackAsset, StageDeployment } from '../blueprint';
+import type { PipelineBase } from '../main/pipeline-base';
+/**
+ * Answer some questions about a pipeline blueprint
+ */
+export declare class PipelineQueries {
+    private readonly pipeline;
+    constructor(pipeline: PipelineBase);
+    /**
+     * Return the names of all outputs for the given stack that are referenced in this blueprint
+     */
+    stackOutputsReferenced(stack: StackDeployment): string[];
+    /**
+     * Find the stack deployment that is producing the given reference
+     */
+    producingStack(outputReference: StackOutputReference): StackDeployment;
+    /**
+     * All assets referenced in all the Stacks of a StageDeployment
+     */
+    assetsInStage(stage: StageDeployment): StackAsset[];
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/pipeline-queries.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.PipelineQueries=void 0;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class PipelineQueries{pipeline;constructor(pipeline){this.pipeline=pipeline}stackOutputsReferenced(stack){const steps=new Array;for(const wave of this.pipeline.waves){steps.push(...wave.pre,...wave.post);for(const stage of wave.stages){steps.push(...stage.pre,...stage.post);for(const stackDeployment of stage.stacks)steps.push(...stackDeployment.pre,...stackDeployment.changeSet,...stackDeployment.post)}}const ret=new Array;for(const step of steps)for(const outputRef of step.consumedStackOutputs)outputRef.isProducedBy(stack)&&ret.push(outputRef.outputName);return ret}producingStack(outputReference){for(const wave of this.pipeline.waves)for(const stage of wave.stages)for(const stack of stage.stacks)if(outputReference.isProducedBy(stack))return stack;throw new(core_1()).ValidationError((0,literal_string_1().lit)`StackProducingOutputPipeline`,`Stack '${outputReference.stackDescription}' (producing output '${outputReference.outputName}') is not in the pipeline; call 'addStage()' to add the stack's Stage to the pipeline`,this.pipeline)}assetsInStage(stage){const assets=new Map;for(const stack of stage.stacks)for(const asset of stack.assets)assets.set(asset.assetSelector,asset);return Array.from(assets.values())}}exports.PipelineQueries=PipelineQueries;

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/step-output.d.ts

@@ -0,0 +1,67 @@
+import type { IResolvable, IResolveContext } from '../../../core';
+import type { Step } from '../blueprint/step';
+/**
+ * A symbolic reference to a value produced by another step
+ *
+ * Generating and consuming outputs is engine-specific. Many engines will be
+ * able to support a feature like "outputs", but it's not guaranteed that
+ * all of them will.
+ *
+ * Outputs can only be generated by engine-specific steps (CodeBuildStep instead
+ * of ShellStep, etc), but can (currently) be consumed anywhere(*). When
+ * an engine-specific step generates an Output, it should put a well-known
+ * string and arbitrary data that is useful to the engine into the engine-specific
+ * fields on the StepOutput.
+ *
+ * The graph blueprint will take care of dependencies and ordering, the engine
+ * is responsible interpreting and rendering StepOutputs. The engine should call
+ * `defineResolution()` on all outputs.
+ *
+ * StepOutputs currently purposely aren't part of the public API because users
+ * shouldn't see the innards poking out. So, instead of keeping state on `Step`,
+ * we keep side-state here in a WeakMap which can be accessed via static members
+ * on `StepOutput`.
+ *
+ * (*) If we need to restrict this, we add the checking and erroring in the engine.
+ */
+export declare class StepOutput implements IResolvable {
+    /**
+     * Return true if the given IResolvable is a StepOutput
+     */
+    static isStepOutput(resolvable: IResolvable): resolvable is StepOutput;
+    /**
+     * Find all StepOutputs referenced in the given structure
+     */
+    static findAll(structure: any): StepOutput[];
+    /**
+     * Return the produced outputs for the given step
+     */
+    static producedStepOutputs(step: Step): StepOutput[];
+    /**
+     * Add produced outputs for the given step
+     */
+    static recordProducer(...outputs: StepOutput[]): void;
+    /**
+     * The step that produces this output
+     */
+    readonly step: Step;
+    /**
+     * Name of the engine for which this output is intended
+     */
+    readonly engineName: string;
+    /**
+     * Additional data on the output, to be interpreted by the engine
+     */
+    readonly engineSpecificInformation: any;
+    readonly creationStack: string[];
+    private resolution;
+    constructor(step: Step, engineName: string, engineSpecificInformation: any);
+    /**
+     * Define the resolved value for this StepOutput.
+     *
+     * Should be called by the engine.
+     */
+    defineResolution(value: any): void;
+    resolve(context: IResolveContext): any;
+    toString(): string;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/step-output.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.StepOutput=void 0;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};const STEP_OUTPUT_SYM=Symbol.for("@aws-cdk/pipelines.StepOutput"),PRODUCED_OUTPUTS_SYM=Symbol.for("@aws-cdk/pipelines.outputs");class StepOutput{static isStepOutput(resolvable){return!!resolvable[STEP_OUTPUT_SYM]}static findAll(structure){return findAllStepOutputs(structure)}static producedStepOutputs(step){return step[PRODUCED_OUTPUTS_SYM]??[]}static recordProducer(...outputs){for(const output of outputs){const step=output.step;let list=step[PRODUCED_OUTPUTS_SYM];list||(list=[],step[PRODUCED_OUTPUTS_SYM]=list),list.push(...outputs)}}step;engineName;engineSpecificInformation;creationStack=[];resolution=void 0;constructor(step,engineName,engineSpecificInformation){this.step=step,this.engineName=engineName,this.engineSpecificInformation=engineSpecificInformation,Object.defineProperty(this,STEP_OUTPUT_SYM,{value:!0})}defineResolution(value){this.resolution=value}resolve(context){if(this.resolution===void 0)throw new(core_1()).ValidationError((0,literal_string_1().lit)`OutputStepConfigured`,`Output for step ${this.step} not configured. Either the step is not in the pipeline, the step implementation did not call 'this.discoverReferencedOutputs()', or this engine does not support Outputs for this step.`,context.scope);return this.resolution}toString(){return core_1().Token.asString(this)}}exports.StepOutput=StepOutput;function findAllStepOutputs(structure){const ret=new Set;return recurse(structure),Array.from(ret);function checkToken(x){return x&&StepOutput.isStepOutput(x)?(ret.add(x),!0):x!==void 0}function recurse(x){if(x){if(core_1().Tokenization.isResolvable(x)){checkToken(x);return}if(Array.isArray(x)){checkToken(core_1().Tokenization.reverseList(x))||x.forEach(recurse);return}if(typeof x=="number"){checkToken(core_1().Tokenization.reverseNumber(x));return}if(typeof x=="string"){core_1().Tokenization.reverseString(x).tokens.forEach(checkToken);return}if(typeof x=="object")for(const[k,v]of Object.entries(x))recurse(k),recurse(v)}}}

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/toposort.d.ts

@@ -0,0 +1,3 @@
+import type { GraphNode } from './graph';
+export declare function printDependencyMap<A>(dependencies: Map<GraphNode<A>, Set<GraphNode<A>>>): void;
+export declare function topoSort<A>(nodes: Set<GraphNode<A>>, dependencies: Map<GraphNode<A>, Set<GraphNode<A>>>, fail?: boolean): GraphNode<A>[][];

cdk/node_modules/aws-cdk-lib/pipelines/lib/helpers-internal/toposort.js

@@ -0,0 +1,2 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.printDependencyMap=printDependencyMap,exports.topoSort=topoSort;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};function printDependencyMap(dependencies){const lines=["---"];for(const[k,vs]of dependencies.entries())lines.push(`${k} -> ${Array.from(vs)}`);console.log(lines.join(`
+`))}function topoSort(nodes,dependencies,fail=!0){const remaining=new Set(nodes),ret=[];for(;remaining.size>0;){const selectable=Array.from(remaining.values()).filter(e=>{if(!dependencies.has(e))throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`ValidationError`,`No key for ${e}`);return dependencies.get(e).size===0});if(selectable.sort((a,b)=>a.id<b.id?-1:b.id<a.id?1:0),selectable.length===0){const cycle=findCycle(dependencies);if(fail)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`DependencyCycleGraph`,`Dependency cycle in graph: ${cycle.map(n=>n.id).join(" => ")}`);selectable.push(cycle[0])}ret.push(selectable);for(const selected of selectable){remaining.delete(selected);for(const depSet of dependencies.values())depSet.delete(selected)}}return ret}function findCycle(deps){for(const node of deps.keys()){const cycle=recurse(node,[node]);if(cycle)return cycle}throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CycleFound`,"No cycle found. Assertion failure!");function recurse(node,path){for(const dep of deps.get(node)??[]){if(dep===path[0])return[...path,dep];const cycle=recurse(dep,[...path,dep]);if(cycle)return cycle}}}

cdk/node_modules/aws-cdk-lib/pipelines/lib/index.d.ts

@@ -0,0 +1,4 @@
+export * from './blueprint';
+export * from './codepipeline';
+export * from './main';
+export * from './docker-credentials';

cdk/node_modules/aws-cdk-lib/pipelines/lib/main/index.d.ts

@@ -0,0 +1 @@
+export * from './pipeline-base';

cdk/node_modules/aws-cdk-lib/pipelines/lib/main/index.js

@@ -0,0 +1 @@
+"use strict";var __createBinding=exports&&exports.__createBinding||(Object.create?(function(o,m,k,k2){k2===void 0&&(k2=k);var desc=Object.getOwnPropertyDescriptor(m,k);(!desc||("get"in desc?!m.__esModule:desc.writable||desc.configurable))&&(desc={enumerable:!0,get:function(){return m[k]}}),Object.defineProperty(o,k2,desc)}):(function(o,m,k,k2){k2===void 0&&(k2=k),o[k2]=m[k]})),__exportStar=exports&&exports.__exportStar||function(m,exports2){for(var p in m)p!=="default"&&!Object.prototype.hasOwnProperty.call(exports2,p)&&__createBinding(exports2,m,p)};Object.defineProperty(exports,"__esModule",{value:!0});var _noFold;exports.PipelineBase=void 0,Object.defineProperty(exports,_noFold="PipelineBase",{enumerable:!0,configurable:!0,get:()=>{var value=require("./pipeline-base").PipelineBase;return Object.defineProperty(exports,_noFold="PipelineBase",{enumerable:!0,configurable:!0,value}),value}});

cdk/node_modules/aws-cdk-lib/pipelines/lib/main/pipeline-base.d.ts

@@ -0,0 +1,94 @@
+import { Construct } from 'constructs';
+import type { Stage } from '../../../core';
+import type { AddStageOpts as StageOptions, WaveOptions, IFileSetProducer, FileSet } from '../blueprint';
+import { Wave } from '../blueprint';
+/**
+ * Properties for a `Pipeline`
+ */
+export interface PipelineBaseProps {
+    /**
+     * The build step that produces the CDK Cloud Assembly
+     *
+     * The primary output of this step needs to be the `cdk.out` directory
+     * generated by the `cdk synth` command.
+     *
+     * If you use a `ShellStep` here and you don't configure an output directory,
+     * the output directory will automatically be assumed to be `cdk.out`.
+     */
+    readonly synth: IFileSetProducer;
+}
+/**
+ * A generic CDK Pipelines pipeline
+ *
+ * Different deployment systems will provide subclasses of `Pipeline` that generate
+ * the deployment infrastructure necessary to deploy CDK apps, specific to that system.
+ *
+ * This library comes with the `CodePipeline` class, which uses AWS CodePipeline
+ * to deploy CDK apps.
+ *
+ * The actual pipeline infrastructure is constructed (by invoking the engine)
+ * when `buildPipeline()` is called, or when `app.synth()` is called (whichever
+ * happens first).
+ */
+export declare abstract class PipelineBase extends Construct {
+    /**
+     * Return whether the given object extends `PipelineBase`.
+     *
+     * We do attribute detection since we can't reliably use 'instanceof'.
+     */
+    static isPipeline(x: any): x is PipelineBase;
+    /**
+     * The build step that produces the CDK Cloud Assembly
+     */
+    readonly synth: IFileSetProducer;
+    /**
+     * The waves in this pipeline
+     */
+    readonly waves: Wave[];
+    /**
+     * The FileSet tha contains the cloud assembly
+     *
+     * This is the primary output of the synth step.
+     */
+    readonly cloudAssemblyFileSet: FileSet;
+    private built;
+    constructor(scope: Construct, id: string, props: PipelineBaseProps);
+    /**
+     * Deploy a single Stage by itself
+     *
+     * Add a Stage to the pipeline, to be deployed in sequence with other
+     * Stages added to the pipeline. All Stacks in the stage will be deployed
+     * in an order automatically determined by their relative dependencies.
+     */
+    addStage(stage: Stage, options?: StageOptions): import("../blueprint").StageDeployment;
+    /**
+     * Add a Wave to the pipeline, for deploying multiple Stages in parallel
+     *
+     * Use the return object of this method to deploy multiple stages in parallel.
+     *
+     * Example:
+     *
+     * ```ts
+     * declare const pipeline: pipelines.CodePipeline;
+     *
+     * const wave = pipeline.addWave('MyWave');
+     * wave.addStage(new MyApplicationStage(this, 'Stage1'));
+     * wave.addStage(new MyApplicationStage(this, 'Stage2'));
+     * ```
+     */
+    addWave(id: string, options?: WaveOptions): Wave;
+    /**
+     * Send the current pipeline definition to the engine, and construct the pipeline
+     *
+     * It is not possible to modify the pipeline after calling this method.
+     */
+    buildPipeline(): void;
+    /**
+     * Implemented by subclasses to do the actual pipeline construction
+     */
+    protected abstract doBuildPipeline(): void;
+    /**
+     * Automatically call 'build()' just before synthesis if the user hasn't explicitly called it yet
+     */
+    private buildJustInTime;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/main/pipeline-base.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.PipelineBase=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},blueprint_1=()=>{var tmp=require("../blueprint");return blueprint_1=()=>tmp,tmp};const PIPELINE_SYMBOL=Symbol.for("@aws-cdk/pipelines.PipelineBase");class PipelineBase extends constructs_1().Construct{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.pipelines.PipelineBase",version:"2.252.0"};static isPipeline(x){return x!==null&&typeof x=="object"&&PIPELINE_SYMBOL in x}synth;waves;cloudAssemblyFileSet;built=!1;constructor(scope,id,props){super(scope,id);try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_PipelineBaseProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,PipelineBase),error}if(Object.defineProperty(this,PIPELINE_SYMBOL,{value:!0}),props.synth instanceof blueprint_1().ShellStep&&!props.synth.primaryOutput&&props.synth.primaryOutputDirectory("cdk.out"),!props.synth.primaryOutput)throw new(core_1()).ValidationError((0,literal_string_1().lit)`SynthStep`,`synthStep ${props.synth} must produce a primary output, but is not producing anything. Configure the Step differently or use a different Step type.`,this);this.synth=props.synth,this.waves=[],this.cloudAssemblyFileSet=props.synth.primaryOutput,core_1().Aspects.of(this).add({visit:()=>this.buildJustInTime()},{priority:core_1().AspectPriority.MUTATING})}addStage(stage,options){try{jsiiDeprecationWarnings().aws_cdk_lib_Stage(stage),jsiiDeprecationWarnings().aws_cdk_lib_pipelines_AddStageOpts(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addStage),error}if(this.built)throw new(core_1()).ValidationError((0,literal_string_1().lit)`AddstageCanTStagesAnymore`,"addStage: can't add Stages anymore after buildPipeline() has been called",this);return this.addWave(stage.stageName).addStage(stage,options)}addWave(id,options){try{jsiiDeprecationWarnings().aws_cdk_lib_pipelines_WaveOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.addWave),error}if(this.built)throw new(core_1()).ValidationError((0,literal_string_1().lit)`AddwaveCanTWavesAnymore`,"addWave: can't add Waves anymore after buildPipeline() has been called",this);const wave=new(blueprint_1()).Wave(id,options);return this.waves.push(wave),wave}buildPipeline(){if(this.built)throw new(core_1()).ValidationError((0,literal_string_1().lit)`BuildAlreadyCalledCall`,"build() has already been called: can only call it once",this);this.doBuildPipeline(),this.built=!0}buildJustInTime(){this.built||this.buildPipeline()}}exports.PipelineBase=PipelineBase;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/application-security-check.d.ts

@@ -0,0 +1,47 @@
+import { Construct } from 'constructs';
+import * as codebuild from '../../../aws-codebuild';
+import type * as cp from '../../../aws-codepipeline';
+import type * as lambda from '../../../aws-lambda';
+/**
+ * Properties for an ApplicationSecurityCheck
+ */
+export interface ApplicationSecurityCheckProps {
+    /**
+     * The pipeline that will be automatically approved
+     *
+     * Will have a tag added to it.
+     */
+    readonly codePipeline: cp.Pipeline;
+}
+/**
+ * A construct containing both the Lambda and CodeBuild Project
+ * needed to conduct a security check on any given application stage.
+ *
+ * The Lambda acts as an auto approving mechanism that should only be
+ * triggered when the CodeBuild Project registers no security changes.
+ *
+ * The CodeBuild Project runs a security diff on the application stage,
+ * and exports the link to the console of the project.
+ */
+export declare class ApplicationSecurityCheck extends Construct {
+    /**
+     * A lambda function that approves a Manual Approval Action, given
+     * the following payload:
+     *
+     * {
+     *  "PipelineName": [CodePipelineName],
+     *  "StageName": [CodePipelineStageName],
+     *  "ActionName": [ManualApprovalActionName]
+     * }
+     */
+    readonly preApproveLambda: lambda.Function;
+    /**
+     * A CodeBuild Project that runs a security diff on the application stage.
+     *
+     * - If the diff registers no security changes, CodeBuild will invoke the
+     *   pre-approval lambda and approve the ManualApprovalAction.
+     * - If changes are detected, CodeBuild will exit into a ManualApprovalAction
+     */
+    readonly cdkDiffProject: codebuild.Project;
+    constructor(scope: Construct, id: string, props: ApplicationSecurityCheckProps);
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/application-security-check.js

@@ -0,0 +1,2 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ApplicationSecurityCheck=void 0;var constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},default_codebuild_image_1=()=>{var tmp=require("./default-codebuild-image");return default_codebuild_image_1=()=>tmp,tmp},codebuild=()=>{var tmp=require("../../../aws-codebuild");return codebuild=()=>tmp,tmp},iam=()=>{var tmp=require("../../../aws-iam");return iam=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},approve_lambda_generated_1=()=>{var tmp=require("../../../custom-resource-handlers/dist/pipelines/approve-lambda.generated");return approve_lambda_generated_1=()=>tmp,tmp};class ApplicationSecurityCheck extends constructs_1().Construct{preApproveLambda;cdkDiffProject;constructor(scope,id,props){super(scope,id),core_1().Tags.of(props.codePipeline).add("SECURITY_CHECK","ALLOW_APPROVE",{includeResourceTypes:["AWS::CodePipeline::Pipeline"]}),this.preApproveLambda=new(approve_lambda_generated_1()).ApproveLambdaFunction(this,"CDKPipelinesAutoApprove",{timeout:core_1().Duration.minutes(5)}),this.preApproveLambda.addToRolePolicy(new(iam()).PolicyStatement({actions:["codepipeline:GetPipelineState","codepipeline:PutApprovalResult"],conditions:{StringEquals:{"aws:ResourceTag/SECURITY_CHECK":"ALLOW_APPROVE"}},resources:["*"]}));const invokeLambda=`aws lambda invoke --function-name ${this.preApproveLambda.functionName} --invocation-type Event --cli-binary-format raw-in-base64-out --payload "$payload" lambda.out`,publishNotification=`aws sns publish --topic-arn $NOTIFICATION_ARN --subject "$NOTIFICATION_SUBJECT" --message "${["An upcoming change would broaden security changes in $PIPELINE_NAME.","Review and approve the changes in CodePipeline to proceed with the deployment.","","Review the changes in CodeBuild:","","$LINK","","Approve the changes in CodePipeline (stage $STAGE_NAME, action $ACTION_NAME):","","$PIPELINE_LINK"].join(`
+`)}"`;this.cdkDiffProject=new(codebuild()).Project(this,"CDKSecurityCheck",{environment:{buildImage:default_codebuild_image_1().CDKP_DEFAULT_CODEBUILD_IMAGE},buildSpec:codebuild().BuildSpec.fromObject({version:.2,phases:{build:{commands:["npm install -g aws-cdk",'export PIPELINE_NAME="$(node -pe \'`${process.env.CODEBUILD_INITIATOR}`.split("/")[1]\')"',`payload="$(node -pe 'JSON.stringify({ "PipelineName": process.env.PIPELINE_NAME, "StageName": process.env.STAGE_NAME, "ActionName": process.env.ACTION_NAME })' )"`,"ARN=$CODEBUILD_BUILD_ARN",'REGION="$(node -pe \'`${process.env.ARN}`.split(":")[3]\')"','ACCOUNT_ID="$(node -pe \'`${process.env.ARN}`.split(":")[4]\')"','PROJECT_NAME="$(node -pe \'`${process.env.ARN}`.split(":")[5].split("/")[1]\')"','PROJECT_ID="$(node -pe \'`${process.env.ARN}`.split(":")[6]\')"','export LINK="https://$REGION.console.aws.amazon.com/codesuite/codebuild/$ACCOUNT_ID/projects/$PROJECT_NAME/build/$PROJECT_NAME:$PROJECT_ID/?region=$REGION"','export PIPELINE_LINK="https://$REGION.console.aws.amazon.com/codesuite/codepipeline/pipelines/$PIPELINE_NAME/view?region=$REGION"',ifElse({condition:"cdk diff -a . --security-only --fail $STAGE_PATH/\\*",thenStatements:[invokeLambda,'export MESSAGE="No security-impacting changes detected."'],elseStatements:[`[ -z "\${NOTIFICATION_ARN}" ] || ${publishNotification}`,'export MESSAGE="Deployment would make security-impacting changes. Click the link below to inspect them, then click Approve if all changes are expected."']})]}},env:{"exported-variables":["LINK","MESSAGE"]}})}),this.cdkDiffProject.addToRolePolicy(new(iam()).PolicyStatement({actions:["sts:AssumeRole"],resources:["*"],conditions:{"ForAnyValue:StringEquals":{"iam:ResourceTag/aws-cdk:bootstrap-role":["deploy"]}}})),this.preApproveLambda.grantInvoke(this.cdkDiffProject)}}exports.ApplicationSecurityCheck=ApplicationSecurityCheck;const ifElse=({condition,thenStatements,elseStatements})=>{let statement=thenStatements.reduce((acc,ifTrue)=>`${acc} ${ifTrue};`,`if ${condition}; then`);return elseStatements&&(statement=elseStatements.reduce((acc,ifFalse)=>`${acc} ${ifFalse};`,`${statement} else`)),`${statement} fi`};

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/asset-manifest.d.ts

@@ -0,0 +1,159 @@
+import type { AssetManifest, AwsDestination, DockerImageDestination, DockerImageSource, FileDestination, FileSource } from '../../../cloud-assembly-schema';
+/**
+ * A manifest of assets
+ */
+export declare class AssetManifestReader {
+    private readonly manifest;
+    /**
+     * The default name of the asset manifest in a cdk.out directory
+     */
+    static readonly DEFAULT_FILENAME = "assets.json";
+    /**
+     * Load an asset manifest from the given file
+     */
+    static fromFile(fileName: string): AssetManifestReader;
+    /**
+     * Load an asset manifest from the given file or directory
+     *
+     * If the argument given is a directoy, the default asset file name will be used.
+     */
+    static fromPath(filePath: string): AssetManifestReader;
+    /**
+     * The directory where the manifest was found
+     */
+    readonly directory: string;
+    constructor(directory: string, manifest: AssetManifest);
+    /**
+     * Select a subset of assets and destinations from this manifest.
+     *
+     * Only assets with at least 1 selected destination are retained.
+     *
+     * If selection is not given, everything is returned.
+     */
+    select(selection?: DestinationPattern[]): AssetManifestReader;
+    /**
+     * Describe the asset manifest as a list of strings
+     */
+    list(): string[];
+    /**
+     * List of assets, splat out to destinations
+     */
+    get entries(): IManifestEntry[];
+}
+/**
+ * A single asset from an asset manifest'
+ */
+export interface IManifestEntry {
+    /**
+     * The identifier of the asset
+     */
+    readonly id: DestinationIdentifier;
+    /**
+     * The type of asset
+     */
+    readonly type: string;
+    /**
+     * Type-dependent source data
+     */
+    readonly genericSource: unknown;
+    /**
+     * Type-dependent destination data
+     */
+    readonly destination: AwsDestination;
+    /**
+     * A display name for this asset manifest entry, if given
+     */
+    readonly displayName?: string;
+}
+/**
+ * A manifest entry for a file asset
+ */
+export declare class FileManifestEntry implements IManifestEntry {
+    /** Identifier for this asset */
+    readonly id: DestinationIdentifier;
+    /** Source of the file asset */
+    readonly source: FileSource;
+    /** Destination for the file asset */
+    readonly destination: FileDestination;
+    /** Display name for the file asset */
+    readonly displayName?: string | undefined;
+    readonly genericSource: unknown;
+    readonly type = "file";
+    constructor(
+    /** Identifier for this asset */
+    id: DestinationIdentifier, 
+    /** Source of the file asset */
+    source: FileSource, 
+    /** Destination for the file asset */
+    destination: FileDestination, 
+    /** Display name for the file asset */
+    displayName?: string | undefined);
+}
+/**
+ * A manifest entry for a docker image asset
+ */
+export declare class DockerImageManifestEntry implements IManifestEntry {
+    /** Identifier for this asset */
+    readonly id: DestinationIdentifier;
+    /** Source of the file asset */
+    readonly source: DockerImageSource;
+    /** Destination for the file asset */
+    readonly destination: DockerImageDestination;
+    /** Display name for the file asset */
+    readonly displayName?: string | undefined;
+    readonly genericSource: unknown;
+    readonly type = "docker-image";
+    constructor(
+    /** Identifier for this asset */
+    id: DestinationIdentifier, 
+    /** Source of the file asset */
+    source: DockerImageSource, 
+    /** Destination for the file asset */
+    destination: DockerImageDestination, 
+    /** Display name for the file asset */
+    displayName?: string | undefined);
+}
+/**
+ * Identify an asset destination in an asset manifest
+ */
+export declare class DestinationIdentifier {
+    /**
+     * Identifies the asset, by source.
+     */
+    readonly assetId: string;
+    /**
+     * Identifies the destination where this asset will be published
+     */
+    readonly destinationId: string;
+    constructor(assetId: string, destinationId: string);
+    /**
+     * Return a string representation for this asset identifier
+     */
+    toString(): string;
+}
+/**
+ * A filter pattern for an destination identifier
+ */
+export declare class DestinationPattern {
+    /**
+     * Parse a ':'-separated string into an asset/destination identifier
+     */
+    static parse(s: string): DestinationPattern;
+    /**
+     * Identifies the asset, by source.
+     */
+    readonly assetId?: string;
+    /**
+     * Identifies the destination where this asset will be published
+     */
+    readonly destinationId?: string;
+    constructor(assetId?: string, destinationId?: string);
+    /**
+     * Whether or not this pattern matches the given identifier
+     */
+    matches(id: DestinationIdentifier): boolean;
+    /**
+     * Return a string representation for this asset identifier
+     */
+    toString(): string;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/asset-singleton-role.d.ts

@@ -0,0 +1,28 @@
+import type { Construct } from 'constructs';
+import * as iam from '../../../aws-iam';
+import type { PolicyStatement } from '../../../aws-iam';
+/**
+ * Role which will be reused across asset jobs
+ *
+ * Has some '*' resources to save IAM policy space, and will not
+ * actually add policies that look like policies that were already added.
+ */
+export declare class AssetSingletonRole extends iam.Role {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    private _rejectDuplicates;
+    private _assumeRoleStatement;
+    constructor(scope: Construct, id: string, props: iam.RoleProps);
+    addToPrincipalPolicy(statement: PolicyStatement): iam.AddToPrincipalPolicyResult;
+    /**
+     * Make sure the Role has sts:AssumeRole permissions to the given ARN
+     *
+     * Will add a new PolicyStatement to the Role if necessary, otherwise add resources to the existing
+     * PolicyStatement.
+     *
+     * Normally this would have been many `grantAssume()` calls (which would get deduplicated by the
+     * policy minimization logic), but we have to account for old pipelines that don't have policy
+     * minimization enabled.
+     */
+    addAssumeRole(roleArn: string): void;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/cached-fnsub.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Wrap a string in `Fn.sub`, but return the same `Fn.sub` value for the same string
+ *
+ * If we don't do this, every new `Fn.sub()` creates a new `IResolvable` instance
+ * which will stringify to a unique string value, and we can't dedupe the stringified
+ * values anymore.
+ *
+ * Potentially we could/should do deduplication in the token system itself, but
+ * we would have to be consistent about it and do it for all tokens, which has
+ * an unpredictable memory impact and I'm scared of making such a sweeping
+ * change. Hence, a local solution to a local problem.
+ */
+export declare class CachedFnSub {
+    private cache;
+    fnSub(x: string): string;
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/cached-fnsub.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.CachedFnSub=void 0;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp};class CachedFnSub{cache=new Map;fnSub(x){const existing=this.cache.get(x);if(existing)return existing;const ret=core_1().Fn.sub(x);return this.cache.set(x,ret),ret}}exports.CachedFnSub=CachedFnSub;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/cloud-assembly-internals.d.ts

@@ -0,0 +1,3 @@
+import type * as cxapi from '../../../cx-api';
+export declare function isAssetManifest(s: cxapi.CloudArtifact): s is cxapi.AssetManifestArtifact;
+export declare function isStackArtifact(a: cxapi.CloudArtifact): a is cxapi.CloudFormationStackArtifact;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/cloud-assembly-internals.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.isAssetManifest=isAssetManifest,exports.isStackArtifact=isStackArtifact;function isAssetManifest(s){return s.constructor.name==="AssetManifestArtifact"}function isStackArtifact(a){return a.constructor.name==="CloudFormationStackArtifact"}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/construct-internals.d.ts

@@ -0,0 +1,16 @@
+import type { IConstruct } from 'constructs';
+import { Construct } from 'constructs';
+import { App, Stage } from '../../../core';
+import type * as cxapi from '../../../cx-api';
+export declare function appOf(construct: IConstruct): App;
+export declare function assemblyBuilderOf(stage: Stage): cxapi.CloudAssemblyBuilder;
+export declare function pipelineSynth(stage: Stage): cxapi.CloudAssembly;
+/**
+ * Return the relative path from the app assembly to the scope's (nested) assembly
+ */
+export declare function embeddedAsmPath(scope: IConstruct): string;
+/**
+ * Determine the directory where the cloud assembly will be written, for use in a BuildSpec
+ */
+export declare function cloudAssemblyBuildSpecDir(scope: IConstruct): string;
+export declare function obtainScope(parent: Construct, id: string): Construct;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/construct-internals.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.appOf=appOf,exports.assemblyBuilderOf=assemblyBuilderOf,exports.pipelineSynth=pipelineSynth,exports.embeddedAsmPath=embeddedAsmPath,exports.cloudAssemblyBuildSpecDir=cloudAssemblyBuildSpecDir,exports.obtainScope=obtainScope;var path=()=>{var tmp=require("path");return path=()=>tmp,tmp},constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};function appOf(construct){const root=constructs_1().Node.of(construct).root;if(!core_1().App.isApp(root))throw new(core_1()).ValidationError((0,literal_string_1().lit)`ConstructCreatedApp`,`Construct must be created under an App, but is not: ${constructs_1().Node.of(construct).path}`,construct);return root}function assemblyBuilderOf(stage){return stage._assemblyBuilder}function pipelineSynth(stage){return stage.synth({validateOnSynthesis:!0})}function embeddedAsmPath(scope){const appAsmRoot=assemblyBuilderOf(appOf(scope)).outdir,stage=core_1().Stage.of(scope)??appOf(scope),stageAsmRoot=assemblyBuilderOf(stage).outdir;return path().relative(appAsmRoot,stageAsmRoot)||"."}function cloudAssemblyBuildSpecDir(scope){return assemblyBuilderOf(appOf(scope)).outdir}function obtainScope(parent,id){const existing=constructs_1().Node.of(parent).tryFindChild(id);return existing||new(constructs_1()).Construct(parent,id)}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/default-codebuild-image.d.ts

@@ -0,0 +1 @@
+export declare const CDKP_DEFAULT_CODEBUILD_IMAGE: import("../../../aws-codebuild").IBuildImage;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/default-codebuild-image.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.CDKP_DEFAULT_CODEBUILD_IMAGE=void 0;var aws_codebuild_1=()=>{var tmp=require("../../../aws-codebuild");return aws_codebuild_1=()=>tmp,tmp};exports.CDKP_DEFAULT_CODEBUILD_IMAGE=aws_codebuild_1().LinuxBuildImage.STANDARD_7_0;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/fs.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a file path on the current system to a file path that can be used on Linux
+ *
+ * Takes the current OS' file separator and replaces all of them with a '/'.
+ *
+ * Relevant if the current system is a Windows machine but is generating
+ * commands for a Linux CodeBuild image.
+ */
+export declare function toPosixPath(osPath: string, currentSep?: string): string;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/fs.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.toPosixPath=toPosixPath;var path=()=>{var tmp=require("path");return path=()=>tmp,tmp};function toPosixPath(osPath,currentSep){const regex=new RegExp(`\\${currentSep??path().sep}`,"g");return osPath.replace(regex,"/")}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/identifiers.d.ts

@@ -0,0 +1,12 @@
+import type { StackDeployment } from '../blueprint/stack-deployment';
+import type { GraphNode } from '../helpers-internal/graph';
+export declare function hash<A>(obj: A): string;
+export declare function actionName<A>(node: GraphNode<A>, parent: GraphNode<A>): string;
+export declare function stackVariableNamespace(stack: StackDeployment): string;
+/**
+ * Makes sure the given identifier length does not exceed N characters
+ *
+ * Replaces characters in the middle (to leave the start and end identifiable) and replaces
+ * them with a hash to prevent collissions.
+ */
+export declare function limitIdentifierLength(s: string, n: number): string;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/identifiers.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.hash=hash,exports.actionName=actionName,exports.stackVariableNamespace=stackVariableNamespace,exports.limitIdentifierLength=limitIdentifierLength;var crypto=()=>{var tmp=require("crypto");return crypto=()=>tmp,tmp};function hash(obj){const d=crypto().createHash("sha256");return d.update(JSON.stringify(obj)),d.digest("hex")}function actionName(node,parent){const names=node.ancestorPath(parent).map(n=>n.displayName??n.id).map(sanitizeName),totalMax=100;if(names.join(".").length<=totalMax)return names.join(".");const componentMin=15,dots=names.length-1,maxLength=Math.max(componentMin,Math.floor((totalMax-dots)/names.length)),trimmedNames=names.map(name=>limitIdentifierLength(name,maxLength));return limitIdentifierLength(trimmedNames.join("."),totalMax-2)}function stackVariableNamespace(stack){return limitIdentifierLength(stack.stackArtifactId,100)}function sanitizeName(x){return x.replace(/[^A-Za-z0-9.@\-_]+/g,"_")}function limitIdentifierLength(s,n){if(s.length<=n)return s;const h=hash(s).slice(0,8),mid=Math.floor((n-h.length)/2);return s.slice(0,mid)+h+s.slice(-mid)}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/javascript.d.ts

@@ -0,0 +1,17 @@
+export declare function addAll<A>(into: Set<A>, from: Iterable<A>): void;
+export declare function extract<A, B>(from: Map<A, B>, key: A): B | undefined;
+export declare function flatMap<A, B>(xs: Iterable<A>, fn: (x: A) => Iterable<B>): IterableIterator<B>;
+export declare function enumerate<A>(xs: Iterable<A>): IterableIterator<[number, A]>;
+export declare function expectProp<A extends object, B extends keyof A>(obj: A, key: B): NonNullable<A[B]>;
+export declare function flatten<A>(xs: Iterable<A[]>): IterableIterator<A>;
+export declare function filterEmpty(xs: Array<string | undefined>): string[];
+export declare function mapValues<A, B>(xs: Record<string, A>, fn: (x: A) => B): Record<string, B>;
+export declare function mkdict<A>(xs: Array<readonly [string, A]>): Record<string, A>;
+export declare function noEmptyObject<A>(xs: Record<string, A>): Record<string, A> | undefined;
+export declare function noUndefined<A>(xs: Record<string, A>): Record<string, NonNullable<A>>;
+export declare function maybeSuffix(x: string | undefined, suffix: string): string | undefined;
+/**
+ * Partition a collection by dividing it into two collections, one that matches the predicate and one that don't
+ */
+export declare function partition<T>(xs: T[], pred: (x: T) => boolean): [T[], T[]];
+export declare function isDefined<A>(x: A): x is NonNullable<A>;

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/javascript.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.addAll=addAll,exports.extract=extract,exports.flatMap=flatMap,exports.enumerate=enumerate,exports.expectProp=expectProp,exports.flatten=flatten,exports.filterEmpty=filterEmpty,exports.mapValues=mapValues,exports.mkdict=mkdict,exports.noEmptyObject=noEmptyObject,exports.noUndefined=noUndefined,exports.maybeSuffix=maybeSuffix,exports.partition=partition,exports.isDefined=isDefined;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};function addAll(into,from){for(const x of from)into.add(x)}function extract(from,key){const ret=from.get(key);return from.delete(key),ret}function*flatMap(xs,fn){for(const x of xs)for(const y of fn(x))yield y}function*enumerate(xs){let i=0;for(const x of xs)yield[i++,x]}function expectProp(obj,key){if(!obj[key])throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`ExpectingSet`,`Expecting '${String(key)}' to be set!`);return obj[key]}function*flatten(xs){for(const x of xs)for(const y of x)yield y}function filterEmpty(xs){return xs.filter(x=>x)}function mapValues(xs,fn){const ret={};for(const[k,v]of Object.entries(xs))ret[k]=fn(v);return ret}function mkdict(xs){const ret={};for(const[k,v]of xs)ret[k]=v;return ret}function noEmptyObject(xs){if(Object.keys(xs).length!==0)return xs}function noUndefined(xs){return mkdict(Object.entries(xs).filter(([_,v])=>isDefined(v)))}function maybeSuffix(x,suffix){if(x!==void 0)return`${x}${suffix}`}function partition(xs,pred){const yes=[],no=[];for(const x of xs)(pred(x)?yes:no).push(x);return[yes,no]}function isDefined(x){return x!==void 0}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/template-configuration.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Write template configuration to the given file
+ */
+export declare function writeTemplateConfiguration(filename: string, config: TemplateConfiguration): void;
+/**
+ * Template configuration in a CodePipeline
+ *
+ * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/continuous-delivery-codepipeline-cfn-artifacts.html#w2ab1c13c17c15
+ */
+export interface TemplateConfiguration {
+    readonly Parameters?: Record<string, string>;
+    readonly Tags?: Record<string, string>;
+    readonly StackPolicy?: {
+        readonly Statements: Array<Record<string, string>>;
+    };
+}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/template-configuration.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.writeTemplateConfiguration=writeTemplateConfiguration;var fs=()=>{var tmp=require("fs");return fs=()=>tmp,tmp};function writeTemplateConfiguration(filename,config){fs().writeFileSync(filename,JSON.stringify(config,void 0,2),{encoding:"utf-8"})}

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/toposort.d.ts

@@ -0,0 +1,13 @@
+export type KeyFunc<T> = (x: T) => string;
+export type DepFunc<T> = (x: T) => string[];
+/**
+ * Return a topological sort of all elements of xs, according to the given dependency functions
+ *
+ * Dependencies outside the referenced set are ignored.
+ *
+ * Not a stable sort, but in order to keep the order as stable as possible, we'll sort by key
+ * among elements of equal precedence.
+ *
+ * Returns tranches of elements of equal precedence.
+ */
+export declare function topologicalSort<T>(xs: Iterable<T>, keyFn: KeyFunc<T>, depFn: DepFunc<T>): T[][];

cdk/node_modules/aws-cdk-lib/pipelines/lib/private/toposort.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.topologicalSort=topologicalSort;var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};function topologicalSort(xs,keyFn,depFn){const remaining=new Map;for(const element of xs){const key=keyFn(element);remaining.set(key,{key,element,dependencies:depFn(element)})}const ret=new Array;for(;remaining.size>0;){const selectable=Array.from(remaining.values()).filter(e=>e.dependencies.every(d=>!remaining.has(d)));if(selectable.sort((a,b)=>a.key<b.key?-1:b.key<a.key?1:0),selectable.length===0)throw new(core_1()).UnscopedValidationError((0,literal_string_1().lit)`CouldDetermineOrderingBetween`,`Could not determine ordering between: ${Array.from(remaining.keys()).join(", ")}`);ret.push(selectable.map(s=>s.element));for(const selected of selectable)remaining.delete(selected.key)}return ret}