step_functions.aws.txt

                                  ┏━━━━━━━━━━━━━━━━━━━━┓
                                  ┃   STEP_FUNCTIONS   ┃
                                  ┗━━━━━━━━━━━━━━━━━━━━┛

VERSION ==>                       #2025-03-14

SUMMARY ==>                       #Machine: version, alias, progressive deployment, encryption
                                  #Express: pricing, scalable, duration, missing features, nesting
                                  #Definition: lint, UI edit, graph
                                  #Execution: async|sync, events, debug, redrive top|child, logging, tracing
                                  #Input|output: transform, context, variables
                                  #Error: error output, execution|task timeout, catch, retry, abort, fail
                                  #States: type, start, next, choices, pass, wait, end
                                  #Iterate: parallel, map items, inline|distributed, child machine|execution, tolerated fails, maxConcurrency, batch
                                  #Iterate on S3: read (OBJECTs, JSON, CSV, INVENTORY), write
                                  #Task: HTTP, AWS generic|optimized, nested, activity, job, async
                                  #Query language: JSONata, JSONPath, intrisic functions
                                  #API Gateway, EventBridge, local

                                  ┌─────────┐
                                  │   API   │
                                  └─────────┘

NAME ==>                          #Sometimes abbreviated as SFN

SERVICE                           #'states'
SERVICE_DOMAIN                    #'[sync-]states.amazonaws.com'
                                  #'sync' is when using StartSyncExecution()

FORMAT ==>                        #JSON REQ|RES with REQ.Action|Version

PAGINATION ==>                    #Uses REQ.maxResults (def 100, max 1000) + REQ|RES.nextToken
                                  #ValidateStateMachineDefinition(): REQ.maxResults (def|max 100), no REQ|RES.nextToken, RES.truncated BOOL
                                  #No pagination: ListTagsForResource()
                                  #No pagination in SDK: ListStateMachineVersions|Aliases(), ValidateStateMachineDefinition()

EVENTUAL CONSISTENCY ==>          #Create|update|delete take up to a few minutes

                                  ┌─────────┐
                                  │   SDK   │
                                  └─────────┘

@aws-sdk/client-sfn               #

                                  ┌─────────┐
                                  │   CLI   │
                                  └─────────┘

aws stepfunctions ...             #

                                  ┌────────────────┐
                                  │   THROTTLING   │
                                  └────────────────┘

THROTTLING ==>                    #Per ACCOUNT + REGION
                                  #All soft. Many are REGION-specific
                                  #Following means RATE_LIMIT (burst BURST_LIMIT) (see token bucket algorithm doc)
                                  # 1/s (burst 0): TestState()
                                  # 1/s (burst 100):
                                  #   - Create*|Publish*|Update*|Delete*()
                                  #   - ValidateStateMachineDefinition()
                                  #   - ListStateMachineVersions|Aliases(), ListMapRuns(), ListTagsForResource()
                                  # 1/s (burst 200): Describe*(), [Un]tagResource()
                                  # 5/s (burst 100): ListStateMachines()
                                  # 5/s (burst 200): ListExecutions()
                                  # 10/s (burst 100): ListActivities()
                                  # 15/s (burst 300): DescribeExecution()
                                  # 20/s (burst 200): DescribeStateMachine()
                                  # 20/s (burst 400): GetExecutionHistory()
                                  # 200/s (burst 1000): StopExecution()
                                  # 300/s (burst 1300): RedriveExecution()
                                  # 500/s (burst 3000): GetActivityTask(), SendTask*()
                                  # 1300/s (burst 300): StartExecution()
                                  # None: StartSyncExecution()

                                  ┌────────────────────────┐
                                  │   THROTTLING METRICS   │
                                  └────────────────────────┘

AWS/States/ProvisionedRefillRate  #RATE_LIMIT
AWS/States/ProvisionedBucketSize  #BURST_LIMIT
AWS/States/ConsumedCapacity       #NUM of requests per second
AWS/States/ThrottledEvents        #NUM of throttled requests

DVAR APIName                      #'ACTION'. With above METRICs

                                  ┌────────────────────────────┐
                                  │   THROTTLING METRICS IAC   │
                                  └────────────────────────────┘

StateTransitionMetric.metric
 ('METRIC', CMETRIC_OPTS)
 ->CMETRIC                        #Must pass CMETRIC_OPTS.dimensionsMap { APIName: 'ACTION' }
StateTransitionMetric.metricMETRIC
 (CMETRIC_OPTS)->CMETRIC          #Same, except uses statistic 'Sum' for ThrottledEvents

                                  ┌─────────────┐
                                  │   PRICING   │
                                  └─────────────┘

PRICING ==>                       #Not Express: 1$ per 4e4 STATE_EXECs
                                  #  - free: 4e3
                                  #Express:
                                  #  - 1$ per 1e6 EXECs
                                  #  - 1$ per 1e6 EXECs with 1s duration and 64MB memory
                                  #     - proportional to duration
                                  #        - rounded up by 100ms per EXEC
                                  #        - 2x cheaper after 1000h, 4x after 5000h
                                  #     - proportional to memory
                                  #        - memory is sum of:
                                  #           - 50MB
                                  #           - DEFINITION
                                  #           - max(INPUT, OUTPUT)
                                  #           - for each child MACHINE run: max(INPUT, OUTPUT)
                                  #        - rounded up by 64MB per EXEC
                                  #  - "EXEC" is either top|child
                                  #     - i.e. include ITERs
                                  #ENCRYPT: no KMS charge if type 'AWS_OWNED_KEY'
                                  #Recommendations:
                                  #  - Express much cheaper
                                  #     - especially if STEPs are fast and use low memory
                                  #  - with Express, what matters more:
                                  #     - if <= 1s * 64MB: NUM of EXECs
                                  #     - else: duration and memory
                                  #  - Step Functions Express is roughly same price as Lambda
                                  #  - NUM of ITERs can multiply cost, for both Express and not
                                  #  - use BATCHs

EXEC.billingDetails               #EXEC_BILLING
EXEC_BILLING
 .billedDurationInMilliseconds    #NUM of ms charged, after rounding up
EXEC_BILLING.billedMemoryUsedInMB #NUM of MB charged, after rounding up

                                  ┌─────────────────────┐
                                  │   PRICING METRICS   │
                                  └─────────────────────┘

AWS/States/
 ExpressExecutionBilledDuration   #NUM of ms charged, after rounding up
AWS/States/ExpressExecutionMemory #NUM of MB charged, before rounding up
AWS/States/
 ExpressExecutionBilledMemory     #NUM of MB charged, after rounding up

DVAR StateMachineArn              #'MACHINE_ARN'. With above METRICs
                                  #MACHINE is also a TELEMETRY_ENTITY

                                  ┌──────────┐
                                  │   AUTH   │
                                  └──────────┘

AWSStepFunctionsFullAccess        #AWS managed POLICY. Allows all 'states:*' PACTIONs
AWSStepFunctionsConsoleFullAccess #Same but also allows:
                                  #  - iam:PassRole on ROLE 'service-role/StatesExecutionRole*'
                                  #  - iam:ListRoles
                                  #  - lambda:ListFunctions
                                  #Meant for browsing Step Functions UI
AWSStepFunctionsReadOnlyAccess    #Allows all read-only 'states:*' PACTIONs

                                  ┌─────────────┐
                                  │   MACHINE   │
                                  └─────────────┘

MACHINE                           #Also called "workflow"
                                  #Creation is idempotent (if same REQ)
                                  #Update must specify at least either MACHINE.definition|roleArn (even if unchanged)
                                  #Delete aborts ongoing EXECs and wait for them to fail
                                  #Delete also delete VERSIONs|ALIASs
                                  #Max 1e5 (soft up to 2.5e5) per ACCOUNT

MACHINE.stateMachineArn           #In output: 'MACHINE_ARN'. 'arn:aws:states:REGION:ACCOUNT_ID:stateMachine:MACHINE'
                                  #In input: 'QUALIFIED_MACHINE_ARN'
MACHINE.name                      #'MACHINE'
                                  #Max 80 chars, [:alnum:]-_
MACHINE.creationDate              #DATE_NUM

MACHINE.status                    #'ACTIVE' or 'DELETING'

CONTEXT.StateMachine.Id           #'MACHINE_ARN'
CONTEXT.StateMachine.Name         #'MACHINE'

                                  ┌────────────────┐
                                  │   MACHINE UI   │
                                  └────────────────┘

WORKFLOW STUDIO ==>               #UI to view|edit a MACHINE, as a graph
                                  #Can create|deploy as a CloudFormation STACK

                                  ┌─────────────────────┐
                                  │   MACHINE TOOLKIT   │
                                  └─────────────────────┘

WORKFLOW STUDIO ==>               #Can be accessed from Explorer or from a .asl.json|y[a]ml
                                  #A few features are missing when accessed this way

                                  ┌─────────────────┐
                                  │   MACHINE API   │
                                  └─────────────────┘

CreateStateMachine()              #Req: MACHINE + NEW_VERSION
                                  #  - no creationDate, label, status
                                  #  - no stateMachineArn
                                  #  - only one with tags
                                  #Res: VERSION
                                  #  - no updateDate, revisionId
UpdateStateMachine()              #Req: MACHINE + NEW_VERSION
                                  #  - no creationDate, label, status
                                  #  - no name, type
                                  #Res: VERSION
                                  #  - no stateMachineArn, creationDate
ListStateMachines()               #Req: empty
                                  #Res: stateMachines MACHINE_ARR
                                  #  - only stateMachineArn, name, creationDate, type
DescribeStateMachine()            #Req:
                                  #  - MACHINE: only stateMachineArn
                                  #  - MACHINE_GET
                                  #Res:
                                  #  - MACHINE
                                  #  - VERSION: no stateMachineVersionArn, updateDate
DescribeStateMachineForExecution()#Req:
                                  #  - [ITEM_]EXEC: only executionArn
                                  #  - MACHINE_GET
                                  #Res:
                                  #  - MACHINE: no creationDate, status, type
                                  #  - VERSION: no stateMachineVersionArn, description
                                  #  - ITEM_EXEC: only mapRunArn
DeleteStateMachine()              #Req: MACHINE
                                  #  - only stateMachineArn
                                  #Res: empty

                                  ┌─────────────────┐
                                  │   MACHINE IAC   │
                                  └─────────────────┘

AWS::StepFunctions::StateMachine  #RESPROPs: StateMachineName
                                  #RESATTRs: Arn, Name

new StateMachine
 (...CARGS, CMACHINE_OPTS)
 ->CMACHINE                       #
StateMachine.fromStateMachineArn
 (...CARGS, 'MACHINE_ARN')
 ->ICMACHINE                      #
StateMachine.fromStateMachineName
 (...CARGS, 'MACHINE')->ICMACHINE #

CMACHINE_OPTS.stateMachineName    #MACHINE.name
ICMACHINE.activityName            #'MACHINE'[_STR_TK]
ICMACHINE.activityArn             #'MACHINE_ARN'[_STR_TK]
CMACHINE_OPTS.removalPolicy       #Passed to CZRESOURCE.applyRemovalPolicy()
                                  #Def: RemovalPolicy.DESTROY

JsonPath.stateMachineId          $#'$$.StateMachine.Id'
JsonPath.stateMachineName        $#'$$.StateMachine.Name'

                                  ┌─────────────────┐
                                  │   MACHINE SAM   │
                                  └─────────────────┘

AWS::Serverless::StateMachine     #Expands to MACHINE
                                  #Optionally expands to:
                                  #  - ROLE
                                  #  - VERSION, ALIAS
                                  #  - API Gateway first-class integration: API, ROUTE, INTEGRATION, IRESP, RESP, ROLE
                                  #Includes RESPROPs: Name
                                  #Includes RESATTRs: Name
                                  #Missing feature: ENCRYPT

                                  ┌──────────────────────┐
                                  │   MACHINE COMPOSER   │
                                  └──────────────────────┘

MACHINE ENHANCED COMPONENT ==>    #Includes MACHINE + POLICYs, as AWS::Serverless::StateMachine
                                  #Can switch to Workflow studio
                                  #  - to edit MACHINE and its DEFINITION
                                  #  - a few features are missing when accessed this way

                                  ┌──────────────────┐
                                  │   MACHINE LINT   │
                                  └──────────────────┘

DIAG_ERROR
 STATE_MACHINE_NAME_EMPTY         #MACHINE.name must be set
DIAG_ERROR
 STATE_MACHINE_NAME_TOO_LONG      #MACHINE.name must be <= 80 chars
DIAG_ERROR
 STATE_MACHINE_NAME_INVALID       #MACHINE.name must be valid
DIAG_ERROR
 STATE_MACHINE_NAME_ALREADY_EXISTS#MACHINE with same name must not already exists

                                  ┌─────────────────────┐
                                  │   MACHINE TOOLKIT   │
                                  └─────────────────────┘

MACHINE CRUD ==>                  #Can be done in "Explorer"

                                  ┌──────────────────┐
                                  │   MACHINE ROLE   │
                                  └──────────────────┘

MACHINE|TEST_IN.roleArn           #'ROLE_ARN'. Required
                                  #Must be assumable by Principal.Service 'states.amazonaws.com'

EVENT_INFO.roleArn                #'ROLE_ARN'
                                  #With EVENT_TYPE ExecutionStarted

                                  ┌───────────────────────┐
                                  │   MACHINE ROLE AUTH   │
                                  └───────────────────────┘

PACTION iam:PassRole              #Must be allowed on current PRINCIPAL

                                  ┌─────────────────────┐
                                  │   MACHINE ROLE UI   │
                                  └─────────────────────┘

ROLE 'service-role
 /StatesExecutionRole*'           #Created by Workflow studio for common MACHINE.roleArn use cases

                                  ┌──────────────────────┐
                                  │   MACHINE ROLE IAC   │
                                  └──────────────────────┘

AWS::StepFunctions::StateMachine  #RESPROPs: RoleArn
                                  #MACHINE must DependsOn ROLE

CMACHINE[_OPTS].role              #ICROLE. MACHINE.roleArn
                                  #Def: new one assumable by Principal.Service 'states.amazonaws.com'
                                  #CMACHINE (not ICMACHINE) is YGRANTABLE|KGRANTABLE using this ROLE

ICMACHINE.grant
 (YGRANTABLE, 'PACTION',...)
 ->CGRANT                         #Allows PACTION on Resource MACHINE_ARN
ICMACHINE.grantRead(YGRANTABLE)   #Allows PACTIONs:
 ->CGRANT                         #  - states:ListStateMachines|ListExecutions on MACHINE
                                  #  - states:DescribeStateMachine|ListActivities on any MACHINE
                                  #  - states:Describe[StateMachineFor]Execution|GetExecutionHistory on any EXEC in this MACHINE
                                  #  - states:DescribeActivity on any ACTIVITY

CCUSTOM_TASK.taskPolicies         #CSTATEMENT_ARR allowed to MACHINE.roleArn

                                  ┌──────────────────────┐
                                  │   MACHINE ROLE SAM   │
                                  └──────────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs:
                                  #  - Role
                                  #     - def: automatically creates ROLE 'MACHINERole'
                                  #        - assumable by Principal.Service 'states.amazonaws.com'
                                  #  (for default RESPROP Role)
                                  #  - RolePath, PermissionsBoundary: same as AWS::IAM::Role
                                  #  - Policies SAM_POLICIES: like AWS::Serverless::Function (see its doc)

                                  ┌─────────────┐
                                  │   VERSION   │
                                  └─────────────┘

VERSION                           #Public immutable version of a MACHINE
                                  #Previous VERSIONs not automatically deleted
                                  #PublishStateMachineVersion() is idempotent (if same REQ)
                                  #Delete waits for ongoing EXECs to complete (and does not abort them)
                                  #Cannot delete if there is an associated ALIAS
                                  #Max 1e3 (soft) per MACHINE

VERSION.stateMachineVersionArn    #'VERSION_ARN'. 'MACHINE_ARN:VERSION_NUM'
VERSION.stateMachineArn           #'MACHINE_ARN'
VERSION_NUM                       #Automatically incremented by PublishStateMachineVersion(), starting at 1
                                  #Similar to a git commit `hash`
                                  #ListStateMachineVersions() sorts by it

VERSION.description
NEW_VERSION.versionDescription    #STR. Max 256 chars
VERSION.creationDate              #DATE_NUM
VERSION.updateDate                #DATE_NUM

VERSION.revisionId                #'REVISION_ID' (see aws_network doc)
                                  #Is 'INITIAL' after create, before first update
                                  #Each MACHINE update creates a new private one
                                  #PublishStateMachineVersion() makes it public

NEW_VERSION.publish               #BOOL (def: false). Calls PublishStateMachineVersion()

EVENT_INFO.stateMachineVersionArn #'VERSION_ARN'
                                  #With EVENT_TYPE ExecutionStarted

                                  ┌──────────────────┐
                                  │   VERSION AUTH   │
                                  └──────────────────┘

PACTION
 states:PublishStateMachineVersion#Required for NEW_VERSION.publish true

                                  ┌─────────────────┐
                                  │   VERSION API   │
                                  └─────────────────┘

PublishStateMachineVersion()      #Req: VERSION
                                  #  - no stateMachineVersionArn, *Date
                                  #  - only one with description
                                  #Res: VERSION
                                  #  - only stateMachineVersionArn, creationDate
ListStateMachineVersions()        #Req: MACHINE
                                  #  - only stateMachineArn
                                  #Res: stateMachineVersions VERSION_ARR
                                  #  - only stateMachineVersionArn, creationDate
DeleteStateMachineVersion()       #Req: VERSION
                                  #  - only stateMachineVersionArn
                                  #Res: empty
CreateStateMachine()
UpdateStateMachine()
DescribeStateMachine()            #Return VERSION too (see above)

                                  ┌─────────────────┐
                                  │   VERSION IAC   │
                                  └─────────────────┘

AWS::StepFunctions::              #RESPROPs:
 StateMachineVersion              #  - StateMachineArn, Description
                                  #  - StateMachineRevisionId
                                  #     - to create a new VERSION everytime MACHINE changes, can set to !GetAtt MACHINE.StateMachineRevisionId
                                  #     - to point to a fixed VERSION, set a specific REVISION_ID instead
                                  #RESATTRs: Arn
                                  #With Cloud Control, cannot update (replace only)

AWS::StepFunctions::StateMachine  #Includes RESATTR: StateMachineRevisionId

CMACHINE.stateMachineRevisionId   #'REVISION_ID'_CSATTR

                                  ┌─────────────────┐
                                  │   VERSION SAM   │
                                  └─────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs: AutoPublishAlias 'ALIAS' (def: none):
                                  #  - creates VERSION:
                                  #     - 'RESOURCE' is 'MACHINEVersion'
                                  #     - RESOURCE.DeletionPolicy|UpdateReplacePolicy 'Retain'

                                  ┌─────────────────────┐
                                  │   VERSION METRICS   │
                                  └─────────────────────┘

AWS/States/VersionCount           #NUM of VERSIONs
                                  #DVAR ResourceArn 'VERSION_NUM'

DVAR Version                      #'VERSION_NUM'. With AWS/States/Execution*

                                  ┌───────────┐
                                  │   ALIAS   │
                                  └───────────┘

ALIAS                             #'ALIAS' pointing to a VERSION
                                  #Can change its target, similar to a git tag
                                  #Create|update is idempotent (if same REQ)
                                  #Delete does not delete any associated VERSION
                                  #Max 100 (soft) per MACHINE

ALIAS.stateMachineAliasArn        #'ALIAS_ARN'. 'MACHINE_ARN:ALIAS'
ALIAS.name                        #'ALIAS'
                                  #Should avoid being a 'NUM', to prevent confusion with 'VERSION_NUM'
                                  #Max 80 chars, [:alnum:]-_.
ALIAS.description                 #STR
                                  #Max 256 chars
ALIAS.creationDate                #DATE_NUM
ALIAS.updateDate                  #DATE_NUM

EVENT_INFO.stateMachineAliasArn   #'ALIAS_ARN'
                                  #With EVENT_TYPE ExecutionStarted

QUALIFIER                         #'VERSION_NUM|ALIAS'
QUALIFIED_MACHINE_ARN             #'MACHINE_ARN[:QUALIFIER]' (def: latest VERSION)

                                  ┌────────────────┐
                                  │   ALIAS AUTH   │
                                  └────────────────┘

COND_KEY                          #'VERSION_NUM|ALIAS'
 states:StateMachineQualifier     #Only with DeleteStateMachineVersion(), *Alias*(), DescribeStateMachine(),
                                  #Start[Sync]Execution|ListExecutions()

                                  ┌───────────────┐
                                  │   ALIAS API   │
                                  └───────────────┘

CreateStateMachineAlias()         #Req: ALIAS
                                  #  - no stateMachineAliasArn, *Date
                                  #Res: ALIAS
                                  #  - only stateMachineAliasArn, creationDate
UpdateStateMachineAlias()         #Req: ALIAS
                                  #  - no name, *Date
                                  #Res: ALIAS
                                  #  - only updateDate
ListStateMachineAliases()         #Req: MACHINE
                                  #  - only stateMachineArn
                                  #Res: stateMachineAliases ALIAS_ARR
                                  #  - only stateMachineAliasArn, creationDate
DescribeStateMachineAlias()       #Req: ALIAS
                                  #  - only stateMachineAliasArn
                                  #Res: ALIAS
DeleteStateMachineAlias()         #Req: ALIAS
                                  #  - only stateMachineAliasArn
                                  #Res: empty

                                  ┌───────────────┐
                                  │   ALIAS IAC   │
                                  └───────────────┘

AWS::StepFunctions::              #RESPROPs: Name, Description, RoutingConfiguration
 StateMachineAlias                #RESATTRs: Arn

                                  ┌───────────────┐
                                  │   ALIAS SAM   │
                                  └───────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs:
                                  #  - AutoPublishAlias 'ALIAS' (def: none): creates ALIAS:
                                  #     - 'RESOURCE' is 'MACHINEAliasALIAS'
                                  #  (if AutoPublishAlias set)
                                 =#  - UseAliasAsEventTarget BOOL (def: false):
                                  #     - in first-class INTEGRATION created by Events.EVENT Type 'Api'
                                  #     - make it execute ALIAS (instead of latest VERSION)
                                  #     - by setting EXEC.stateMachineArn 'ALIAS_ARN' (instead of 'MACHINE_ARN')

                                  ┌───────────────────┐
                                  │   ALIAS METRICS   │
                                  └───────────────────┘

AWS/States/AliasCount             #NUM of ALIASs
                                  #DVAR ResourceArn 'ALIAS_ARN'

DVAR Alias                        #'ALIAS_ARN'. With AWS/States/Execution*

                                  ┌────────────────┐
                                  │   DEPLOYMENT   │
                                  └────────────────┘

ALIAS.routingConfiguration        #ALIAS_ROUTING_ARR. Randomly execute one of several VERSIONs
                                  #Min 1 item, max 2 items, i.e. meant for transitioning between 2 VERSIONs
ALIAS_ROUTING
 .stateMachineVersionArn          #'VERSION_ARN'
ALIAS_ROUTING.weight              #NUM. 0 to 100
                                  #Sum of all ALIAS_ROUTING.weight must be 100

ALIAS_DEPLOY                      #Alternative to ALIAS_ROUTING, which automates it
                                  #When ALIAS created, progressively shift traffic from previous VERSION to new one
                                  #Can only be set from IaC
ALIAS_DEPLOY
 .StateMachineVersionArn          #'VERSION_ARN'
ALIAS_DEPLOY.Type                 #How many increments to shift traffic:
                                  #  - 'ALL_AT_ONCE' ("blue/green"): 1
                                  #  - 'CANARY': 2
                                  #  - 'LINEAR' ("rolling"): multiple
ALIAS_DEPLOY.Interval             #NUM (max 35h) of minutes between 2 increments
ALIAS_DEPLOY.Percentage           #1-99 percentage of traffic increase with each increment (except last one)
ALIAS_DEPLOY.Alarms               #CloudWatch 'ALARM'_ARR. Rollback if any has StateValue 'ALARM'
                                  #Max 100 items

                                  ┌────────────────────┐
                                  │   DEPLOYMENT IAC   │
                                  └────────────────────┘

AWS::StepFunctions::
 StateMachineAlias                #RESPROPs: DeploymentPreference ALIAS_DEPLOY

                                  ┌────────────────────┐
                                  │   DEPLOYMENT SAM   │
                                  └────────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs:
                                  #  - AutoPublishAlias 'ALIAS' (def: none): sets ALIAS_DEPLOY with Type 'ALL_AT_ONCE'
                                  #  (if AutoPublishAlias set)
                                  #  - DeploymentPreference ALIAS_DEPLOY

                                  ┌─────────────┐
                                  │   EXPRESS   │
                                  └─────────────┘

MACHINE.type                      #Either 'STANDARD' (def) or 'EXPRESS'

DMAP_CONF.ExecutionType           #Same but for child MACHINE

RECOMMENDATIONS ==>               #Pros:
                                  #  - cheaper when STEPs are fast and use low memory
                                  #  - more scalable when lots of EXECs|STATE_EXECs
                                  #Cons:
                                  #  - fewer features
                                  #  - 5m timeout
                                  #  - must be idempotent
                                  #I.e. best for EXECs that are short and|or used a lot
                                  #Can use ITEM_EXECs or OPTIMIZED_NESTED_EXEC to:
                                  #  - keep parent as STANDARD
                                  #  - while making specific parts of it as EXPRESS

EXCLUSIVE FEATURES ==>            #Different pricing (see above), usually cheaper
                                  #  - including EXEC_BILLING and AWS/States/Express* METRICs
                                  #More scalable:
                                  #  - no max EXECs at once
                                  #  - no STATE_EXECs throttling
                                  #  - less throttling on StartExecution(): 6000 (burst 6000)
                                  #StartSyncExecution()

SHORTER TASKS ==>                 #Def|max DMACHINE.TimeoutSeconds: only 5m

IDEMPOTENCY ==>                   #Logic must be idempotent because:
                                  #  - creating an EXEC is not idempotent
                                  #  - EXEC is sometimes run twice (at-least-once guarantee)

MISSING INFO|HISTORY ==>          #Cannot retrieve EXEC, i.e.:
                                  #  - DescribeStateMachineForExecution(), ListExecutions()
                                  #  - DescribeExecution(): except for ITEM_EXEC
                                  #No EVENTs
                                  #  - can use MACHINE_LOGGING instead (def level: 'ALL' instead)

SIMPLER TASKS ==>                 #No OPTIMIZED_SERVICE_TASK, ASYNC_TASK nor ACTIVITY_TASK

INLINE MAP ONLY ==>               #No DMAP_CONF.Mode 'DISTRIBUTED'

NO ABORT|REDRIVE ==>              #No StopExecution()
                                  #No REDRIVE:
                                  #  - no REDRIVE for top-level EXECs: no RedriveExecution()
                                  #  - but can re-run failed ITERs by passing STATE_MAP_ARN to StartExecution()
                                  #     - however, already successful STATEs in a failed ITER are re-run
                                  #  - no ITEM_EXEC.redriveDate nor CONTEXT.Execution.RedriveCount

INTEGRATIONS ==>                  #No EventBridge EVENT 'Step Functions Execution Status Change'

EXEC_ARN                          #'arn:aws:states:REGION:ACCOUNT_ID:express:MACHINE:EXEC:EXPRESS_MID' instead
ITEM_EXEC_ARN                     #'arn:aws:states:REGION:ACCOUNT_ID:express:MACHINE/STATE_MAP_LABEL:EXEC:EXPRESS_MID' instead

                                  ┌────────────────┐
                                  │   EXPRESS UI   │
                                  └────────────────┘

EVENT HISTORY ==>                 #Even though Express has no EVENTs, UI still shows a similar History page,
                                  #providing MACHINE_LOGGING is enabled

                                  ┌─────────────────┐
                                  │   EXPRESS IAC   │
                                  └─────────────────┘

AWS::StepFunctions::StateMachine  #Includes RESPROPs: StateMachineType

CMACHINE[_OPTS].stateMachineType  #MACHINE.type

CSTATE_MAP_OPTS.mapExecutionType  #DMAP_CONF.ExecutionType

                                  ┌─────────────────┐
                                  │   EXPRESS SAM   │
                                  └─────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs: Type

                                  ┌────────────────┐
                                  │   DEFINITION   │
                                  └────────────────┘

MACHINE.definition                #DEFINITION. 'DMACHINE_JSON'
                                  #Format is ASL (Amazon States Language)
                                  #  - has a spec, i.e. abstract enough to have other implementors than Step Functions API
                                  #  - extension is .asl.json|y[a]ml
                                  #Max 1MB

D*                                #Fields in 'DMACHINE_JSON'
DMACHINE.Version                  #Always '1.0' (def)
                                  #Only for top-level MACHINE

DMACHINE.Comment                  #STR. Description

                                  ┌───────────────────┐
                                  │   DEFINITION UI   │
                                  └───────────────────┘

GRAPH ==>                         #UI shows DEFINITION as a graph
                                  #Can be exported as SVG|PNG

WORKFLOW STUDIO ==>               #Shows DEFINITION as a graph
                                  #Can be exported as SVG|PNG

STARTER TEMPLATE ==>              #Scaffold common use cases

                                  ┌────────────────────┐
                                  │   DEFINITION IAC   │
                                  └────────────────────┘

AWS::StepFunctions::StateMachine  #Include RESPROP either:
                                  #  - DefinitionString 'DMACHINE_JSON'
                                  #  - DefinitionS3Location OBJ: Bucket 'BUCKET', Key 'OBJECT', Version 'VERSION_MID'
                                  #     - contains 'DMACHINE_JSON' or 'DMACHINE_YAML'
                                  #     - can use `aws cloudformation package` or `sam package`
                                  #  - Definition DMACHINE_OBJ
                                  #  - DefinitionSubstitutions.KEY STR:
                                  #     - replace any '${KEY}' by STR
                                  #     - inside contents of Definition*
                                  #     - can be used to pass !RFUNCs to Definition*, which does not allow it otherwise

CMACHINE_OPTS
 .definitionSubstitutions         #OBJ. RESPROP DefinitionSubstitutions

CMACHINE_OPTS.definitionBody      #MACHINE.definition. Can be:
                                  #  - DefinitionBody.fromString('DMACHINE_JSON')
                                  #     - passed to RESPROP DefinitionString
                                  #  - DefinitionBody.fromFile('DEFINITION_PATH'[, HFOPTS])
                                  #     - uses a HFASSET
                                  #     - passed to RESPROP DefinitionS3Location
                                  #  - DefinitionBody.fromChainable(CTREE)
                                  #     - passed to RESPROP DefinitionString
                                  #Can use CDK --hotswap (except with DefinitionBody.fromFile())

EXPORT ==>                        #In UI, can export MACHINE's DEFINITION as CloudFormation|SAM template, or to Infrastructure Composer

CMACHINE_OPTS.comment             #DMACHINE.Comment
                                  #Must use DefinitionBody.fromChainable()

                                  ┌────────────────────┐
                                  │   DEFINITION SAM   │
                                  └────────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs:
                                  #  - DefinitionUri: S3_URL or OBJ
                                  #     - transformed to AWS::StepFunctions::StateMachine RESPROP DefinitionS3Location
                                  #     - can use `aws cloudformation package` or `sam package`
                                  #  - Definition DMACHINE_OBJ
                                  #     - transformed to AWS::StepFunctions::StateMachine RESPROP DefinitionString
                                  #  - DefinitionSubstitutions:
                                  #     - same as above
                                  #     - also allows having !RFUNC in Definition* by automatically:
                                  #        - replacing it by '${KEY}'
                                  #        - setting DefinitionSubstitutions.KEY !RFUNC

HOT RELOADING ==>                 #Supported by `sam sync` (see its doc)
                                  #  - contents is cached using DEFINITION (DefinitionS3Location|DefinitionUri's contents)

                                  ┌─────────────────────────┐
                                  │   DEFINITION COMPOSER   │
                                  └─────────────────────────┘

MACHINE ENHANCED COMPONENT ==>    #Can use external file for AWS::Serverless::StateMachine RESPROP DefinitionUri

                                  ┌─────────────────────┐
                                  │   DEFINITION LINT   │
                                  └─────────────────────┘

DIAG_ERROR
 INVALID_JSON_DESCRIPTION
statelint
asl-validator                     #DEFINITION must be valid JSON

DIAG_ERROR MISSING_DESCRIPTION
statelint
asl-validator                     #DEFINITION must not be empty

DIAG_ERROR
 SCHEMA_VALIDATION_FAILED
statelint
asl-validator                     #DEFINITION must have no syntax error

cfn-lint E3601                    #DEFINITION must have no syntax error
                                  #Works with DefinitionSubstitutions

                                  ┌────────────────────────┐
                                  │   DEFINITION TOOLKIT   │
                                  └────────────────────────┘

DOWNLOAD DEFINITION ==>           #Can be done in "Explorer"

VISUALIZE DEFINITION ==>          #Can visualize DEFINITION as a graph

DEFINITION TEMPLATES ==>          #Can be used for scaffolding either starter template, or small DEFINITION parts ("snippets")

                                  ┌──────────────┐
                                  │   VALIDATE   │
                                  └──────────────┘

VALIDATE_REQ                      #Validate DEFINITION for syntax errors
VALIDATE_REQ.definition|type      #MACHINE.*
VALIDATE_REQ.diagnostic           #Minimum DIAG.severity (def: 'ERROR', i.e. no WARNINGs)

VALIDATE_RES.result               #'OK' or 'FAIL'. Whether any DIAG with severity 'ERROR'

VALIDATE_RES.diagnostics          #DIAG_ARR. Paginated
                                  #'CODE|MESSAGE' might change in the future, i.e. should not rely on current list
                                  #The full list is documented in this doc
DIAG.code                         #'DIAG_CODE'
DIAG.message                      #'MESSAGE'
DIAG.severity                     #Either:
                                  #  - 'ERROR': prevents Create|UpdateStateMachine()
                                  #  - 'WARNING': does not prevent Create|UpdateStateMachine()
DIAG.location                     #STR. VAR's location, as JSON pointer, e.g. '/States/STATE/Output'

                                  ┌──────────────────┐
                                  │   VALIDATE API   │
                                  └──────────────────┘

ValidateStateMachineDefinition()  #Req: VALIDATE_REQ
                                  #Res: VALIDATE_RES

                                  ┌───────────────┐
                                  │   STATELINT   │
                                  └───────────────┘

statelint PATH ...                #Validate DEFINITION files
                                  #Version 0.8 (2024-11-21)

                                  ┌──────────────────┐
                                  │   STATELINT UI   │
                                  └──────────────────┘

WORKFLOW STUDIO ==>               #Lints, autocompletes and prettifies

                                  ┌───────────────────────┐
                                  │   STATELINT TOOLKIT   │
                                  └───────────────────────┘

LINTING ==>                       #Lints, autocompletes and prettifies

                                  ┌───────────────────────┐
                                  │   ASL VALIDATOR CLI   │
                                  └───────────────────────┘

asl-validator                     #Version 3.14.0

COMPARISON WITH STATELINT ==>     #Pros:
                                  #  - covers more errors
                                  #  - better maintained
                                  #  - npm, not Ruby
                                  #  - can be used programmatically
                                  #I.e. prefer asl-validator over statelint

COMPARISON WITH API ==>           #Comparison with ValidateStateMachineDefinition()
                                  #Pro: run locally, no API calls
                                  #Con: their checks overlap, but they each some unique ones
                                  #I.e. should use both

asl-validator                     #CLI. Validates DEFINITION for syntax errors
                                  #Under-the-hood, uses both detailed JSON schemas and some custom logic
--json-definition                 #'DMACHINE_JSON'
--json-path                       #'PATH' to DEFINITION
--yaml-definition
--yaml-path                       #Same as YAML

--silent                          #BOOL (def: false). Only exit code, no stdout|stderr

                                  ┌───────────────────────┐
                                  │   ASL VALIDATOR SDK   │
                                  └───────────────────────┘

VALIDATOR
 (CMACHINE_OBJ[, VALIDATOR_OPTS])
 ->VALIDATOR_RES                  #Programmatic

VALIDATOR_RES.isValid             #BOOL. Whether no VALIDATOR_ERROR_OBJs

VALIDATOR_RES.errorsText
 (['DELIM'])->STR                 #'CODE: MESSAGE\n...', printed on stderr by CLI

VALIDATOR_RES.errors              #VALIDATOR_ERROR_OBJ_ARR
VALIDATOR_ERROR_OBJ['Error code'] #'CODE'
VALIDATOR_ERROR_OBJ.Message       #'MESSAGE'
VALIDATOR_ERROR_OBJ.schemaError
 .instancePath|schemaPath         #AJV_ERROR_OBJ.*

                                  ┌───────────────┐
                                  │   EXECUTION   │
                                  └───────────────┘

EXEC                              #Execution of a MACHINE
                                  #Create is idempotent (if same REQ and another is ongoing)
                                  #Max 1e6 (soft) EXECs at once per ACCOUNT + REGION
                                  #  - else throw 'States.ExecutionLimitExceeded'
EXEC.executionArn                 #'EXEC_ARN'. 'arn:aws:states:REGION:ACCOUNT_ID:execution:MACHINE:EXEC'
EXEC.name                         #'EXEC' (def: random UUID)
                                  #Max 80 chars, [:alnum:]-_
EXEC.startDate                    #DATE_NUM
EXEC.stopDate                     #DATE_NUM

EXEC.stateMachineArn              #In input: 'QUALIFIED_MACHINE_ARN'
                                  #In output: 'MACHINE_ARN'
EXEC.stateMachineVersionArn       #'VERSION_ARN' (if specified)
EXEC.stateMachineAliasArn         #'ALIAS_ARN' (if specified)

SYNC EXECUTION ==>                #When using StartSyncExecution()
                                  #Similar to StartExecution() + waiting for completion + returning DescribeExecution()
                                  #EXEC.stateMachineArn must be 'MACHINE_ARN', not 'QUALIFIED_MACHINE_ARN'

EXEC.status                       #One of:
                                  #  - PENDING_REDRIVE
                                  #  - RUNNING
                                  #  - SUCCEEDED
                                  #  - FAILED
                                  #  - TIMED_OUT
                                  #  - ABORTED

CONTEXT.Execution.Id              #'EXEC_ARN'
CONTEXT.Execution.Name            #'EXEC'
CONTEXT.Execution.StartTime       #EXEC.startDate, as 'DATE'

EVENT_TYPE ExecutionStarted
EVENT_TYPE ExecutionSucceeded
EVENT_TYPE ExecutionFailed
EVENT_TYPE ExecutionAborted       #On EXEC start|end

                                  ┌──────────────────┐
                                  │   EXECUTION UI   │
                                  └──────────────────┘

WORKFLOW STUDIO ==>               #Can start an EXEC
                                  #Not when accessed from Infrastructure Composer

                                  ┌───────────────────┐
                                  │   EXECUTION API   │
                                  └───────────────────┘

StartExecution()                  #Req: EXEC
                                  #  - only stateMachineArn, name, input, traceHeader
                                  #Res: EXEC
                                  #  - only executionArn, startDate
StartSyncExecution()              #Req:
                                  #  - EXEC: only stateMachineArn, name, input, traceHeader
                                  #  - EXEC_GET
                                  #Res: EXEC
                                  #  - no mapRunArn, redrive*, stateMachineVersionArn|stateMachineAliasArn
                                  #  - only one with billingDetails
ListExecutions()                  #Req: [ITEM_]EXEC
                                  #  - only either EXEC.stateMachineArn or ITEM_EXEC.mapRunArn
                                  #  - only status -> statusFilter
                                  #  - only one with redriveFilter
                                  #Res: executions [ITEM_]EXEC_ARR
                                  #  - no cause, error, input*|output*, redriveStatus[Reason], traceHeader
                                  #  - only one with itemCount
DescribeExecution()               #Req:
                                  #  - [ITEM_]EXEC: only executionArn
                                  #  - EXEC_GET
                                  #Res: [ITEM_]EXEC
StopExecution()                   #Req: [ITEM_]EXEC
                                  #  - only executionArn, cause, error
                                  #Res: [ITEM_]EXEC
                                  #  - only stopDate

                                  ┌───────────────────┐
                                  │   EXECUTION IAC   │
                                  └───────────────────┘

JsonPath.executionId             $#'$$.Execution.Id'
JsonPath.executionName           $#'$$.Execution.Name'
JsonPath.executionStartTime      $#'$$.Execution.StartTime'

ICMACHINE.grantExecution
 (YGRANTABLE, 'PACTION',...)      #Allows PACTION on any EXEC in this MACHINE
 ->CGRANT                         #I.e. Resource 'arn:aws:states:REGION:ACCOUNT_ID:execution:MACHINE:*'

ICMACHINE
 .grantStart[Sync]Execution
 (YGRANTABLE)->CGRANT             #Allows PACTION 'states:Start[Sync]Execution' to MACHINE
ICMACHINE.grantRead(YGRANTABLE)
 ->CGRANT                         #See above

                                  ┌───────────────────────┐
                                  │   EXECUTION SAM CLI   │
                                  └───────────────────────┘

sam remote invoke ['MACHINE']     #Calls StartExecution()
                                  #Def: guessed if only one possible in current STACK

--event|-e                        #REQ.Input (def: '{}')
--event-file                      #Same but as 'FILE' or '-' (stdin)

--parameter                       #'PARAM=VAL ...'. REQ.*
                                  #Def EXEC.name: 'sam_remote_invoke_DATE'
                                  #Always sets EXEC.stateMachineArn

--output                          #Either:
                                  #  - 'text' (def): prints OUTPUT on stdout, ERROR_OUTPUT on stderr
                                  #  - 'json': prints both on stdout

                                  ┌───────────────────┐
                                  │   EXECUTION SAM   │
                                  └───────────────────┘

StepFunctionsExecutionPolicy_v2   #SAM POLICY_TEMPLATE (see its doc) that allows:
                                  #  - PACTION states:Start[Sync]Execution
                                  #  - on 'MACHINE'
                                  #     - using POLICY_TEMPLATE_PARAMS.StateMachineName

AWS::Serverless::Connector        #Can be used with:
                                  #  - Source: Lambda FUNCTION (RESOURCE_REF.RoleName)
                                  #  - Destination: MACHINE (RESOURCE_REF.Arn + RESOURCE_REF.Name)
                                  #  - Permissions 'Read' and|or 'Write'
                                  #Transformed to a MPOLICY on 'ROLE':
                                  #  - allowing on MACHINE (from Arn):
                                  #     - Read: states:ListExecutions|DescribeStateMachine
                                  #     - Write: states:Start[Sync]Execution
                                  #  - allowing on EXECUTION/* (from Name):
                                  #     - Read: states:DescribeExecution|DescribeStateMachineForExecution|GetExecutionHistory
                                  #     - Write: states:StopExecution

                                  ┌───────────────────────┐
                                  │   EXECUTION METRICS   │
                                  └───────────────────────┘

AWS/States/ExecutionTime          #EXEC duration (in ms)
                                  #cdk-monitoring-constructs:
                                  #  - p50|90|99: METRIC, summary WIDGET, MALARM DurationP50|90|99 > CXALARM_OPTS.maxDuration
AWS/States/ExecutionsStarted      #NUM of EXECs started
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM MinStartedExecutionCount < CXALARM_OPTS.minRunningTasks
AWS/States/ExecutionsSucceeded    #NUM of EXECs succeeded
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/States/ExecutionsAborted      #NUM of EXECs aborted
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM AbortedExecutionCount > CXALARM_OPTS.maxErrorCount
AWS/States/ExecutionsFailed       #NUM of EXECs failed
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM FailedExecutionCount > CXALARM_OPTS.maxErrorCount
                                  #  - rate/s: METRIC, WIDGET, MALARM FailedExecutionRate > CXALARM_OPTS.maxErrorRate

AWS/States/OpenExecutionCount     #NUM of ongoing EXECs
                                  #Very approximate, e.g. if <1e4, might show 0
                                  #  - i.e. should use STAT 'Maximum'
AWS/States/OpenExecutionLimit     #Max allowed NUM of ongoing EXECs

DVAR StateMachineArn              #'MACHINE_ARN'. With above METRICs
                                  #MACHINE is also a TELEMETRY_ENTITY

                                  ┌───────────────────────────┐
                                  │   EXECUTION METRICS IAC   │
                                  └───────────────────────────┘

ICMACHINE.metric
 ('METRIC'[, CMETRIC_OPTS])
 ->CMETRIC                        #Sets DVAR StateMachineArn, statistic 'Sum'
ICMACHINE.metricMETRIC            #Same except 'METRIC' omits 'Execution' prefix, e.g. CACTIVITY.metricTime()
 ([CMETRIC_OPTS])->CMETRIC        #Also uses statistic 'Average' for ExecutionTime

CFACADE.monitorStepFunction       #For AWS/States/Execution*
 (CXMONITORING_OPTS)              #See cdk-monitoring-constructs doc
CXMONITORING_OPTS.stateMachine    #ICMACHINE

                                  ┌───────────────────────┐
                                  │   EXECUTION LOGGING   │
                                  └───────────────────────┘

CLOUDTRAIL ==>                    #StartSyncExecution() is logged with CloudTrail as data EVENTs
                                  #MACHINE is LOG_RESOURCE

                                  ┌─────────────────────────────────┐
                                  │   EXECUTION EVENTBRIDGE EVENT   │
                                  └─────────────────────────────────┘

EVENT_TYPE 'Step Functions
 Execution Status Change'         #EventBridge EVENT emitted when EXEC created or EXEC.status changes
SOURCE                            #'aws.states'
EVENT.Resources                   #'EXEC_ARN'_ARR (single item)
DETAIL.executionArn|name|startDate
 |stopDate|stateMachineArn|status
 |input|output                    #EXEC.*
DETAIL.inputDetails|outputDetails
 .included                        #BOOL. Whether DETAIL.input|output excluded due to 248KB limit

                                  ┌───────────────────────┐
                                  │   EXECUTION TOOLKIT   │
                                  └───────────────────────┘

START EXECUTION ==>               #Can be done in "Explorer"

                                  ┌────────────┐
                                  │   EVENTS   │
                                  └────────────┘

EVENTS_REQ                        #Paginated
EVENTS_REQ.executionArn           #'[ITEM_]EXEC_ARN'

EVENT                             #Part of an EXEC, mostly lifecycle of STATEs
                                  #Max 2.5e4 EVENTs per [ITEM_]EXEC
                                  #  - i.e. using ITEM_EXECs can help avoid limit in parent EXEC
                                  #Only for last 90 days
EVENT.id                          #EVENT_MID. Serial NUM
                                  #Initial implied EVENT_MID is 0
EVENT.previousEventId             #EVENT_MID, if any

EVENT.timestamp                   #DATE_NUM
EVENTS_REQ.reverseOrder           #BOOL. If false (def), oldest first

EVENT.type                        #'EVENT_TYPE' (PascalCase)
                                  #Available ones documented in this doc
EVENT.EVENT_TYPEEventDetails      #EVENT_TYPE-specific EVENT_INFO
                                  #undefined with some EVENT_TYPEs
                                  #EVENT_TYPEEventDetails property name:
                                  #  - camelCase
                                  #  - STATE_TYPEStateEntered|StateExitedEventDetails -> stateEntered|stateExitedEventDetails

                                  ┌───────────────┐
                                  │   EVENTS UI   │
                                  └───────────────┘

TIMELINE ==>                      #Table view shows the EVENTs timeline

                                  ┌────────────────┐
                                  │   EVENTS API   │
                                  └────────────────┘

GetExecutionHistory()             #Req: EVENTS_REQ
                                  #Res: events EVENT_ARR

                                  ┌────────────────┐
                                  │   EVENTS IAC   │
                                  └────────────────┘

ICMACHINE.grantRead(YGRANTABLE)
 ->CGRANT                         #See above

                                  ┌───────────┐
                                  │   DEBUG   │
                                  └───────────┘

TEST_IN                           #Executes a single STATE, for debugging purpose
                                  #Does not support:
                                  #  - STATE_MAP|PARALLEL
                                  #  - ACTIVITY_TASK
                                  #  - ASYNC_TASK
                                  #  - JOB_TASK

TEST_IN.inspectionLevel           #Fields to omit in TEST_OUT.*. One of:
                                  #  - 'TRACE': none
                                  #  - 'DEBUG': TEST_DATA.request|response
                                  #  - 'INFO' (def): TEST_DATA.*
TEST_OUT.inspectionData           #TEST_DATA

TEST_OUT.status                   #One of:
                                  #  - 'SUCCEEDED': no ERROR
                                  #  - 'RETRIABLE': ERROR but would RETRY
                                  #  - 'CAUGHT_ERROR': ERROR but caught
                                  #  - 'FAILED': other ERROR

                                  ┌──────────────┐
                                  │   DEBUG UI   │
                                  └──────────────┘

WORKFLOW STUDIO ==>               #Can start a TEST_IN
                                  #Not when accessed from Infrastructure Composer

                                  ┌───────────────┐
                                  │   DEBUG API   │
                                  └───────────────┘

TestState()                       #Req: TEST_IN
                                  #Res: TEST_OUT

                                  ┌───────────┐
                                  │   INPUT   │
                                  └───────────┘

INPUT                             #VAL passed to each STATE
                                  #INPUT to first STATE is EXEC.input
                                  #INPUT to other STATEs is previous STATE's OUTPUT
                                  #JSON values only
                                  #Max 256KB (else throw 'States.DataLimitExceeded')

EXEC.input                        #Initial 'INPUT_JSON' (def: '{}')
TEST_IN|TEST_DATA|ACTIVITY_TASK
 .input                           #State 'INPUT_JSON' (def: '{}')

TRANSFORM INPUT ==>               #By default, INPUT is not transformed, i.e. kept as is

$states.input                    %#INPUT
                                 %#Before DSTATE.Arguments transformed it
DSTATE.Arguments                 %#DOEXPR (def: keep as is). Transforms INPUT
                                 %#Only with STATE_TASK|MAP|PARALLEL
TEST_DATA.afterArguments         %#'INPUT_JSON' after DSTATE.Arguments

DSTATE.InputPath                 $#DSEXPR. Transforms INPUT
                                 $#null is same as empty OBJ
                                 $#Not with STATE_FAIL
DSTATE.Parameters                $#DOEXPR. Transforms INPUT
                                 $#Done after InputPath
                                 $#Only with STATE_TASK|PARALLEL|PASS
TEST_DATA
 .afterInputPath|afterParameters $#'INPUT_JSON' after DSTATE.InputPath|Parameters

CONTEXT.Execution.Input           #INPUT OBJ

EVENT_INFO.input                  #'INPUT_JSON'
                                  #With EVENT_TYPEs:
                                  #  - ExecutionStarted
                                  #  - STATE_TYPEStateEntered
                                  #  - ActivityScheduled
EVENTS_REQ.includeExecutionData   #BOOL (def: true). If false, do not set EVENT_INFO.input*|output*

                                  ┌───────────────┐
                                  │   INPUT IAC   │
                                  └───────────────┘

CSTATE_OPTS.arguments            %#DSTATE.Arguments
CSTATE_OPTS.inputPath            $#DSTATE.InputPath
CSTATE_OPTS.parameters           $#DSTATE.Parameters

JsonPath.DISCARD                 $#null, for its special meaning with DSTATE.InputPath|ResultPath|OutputPath

JsonPath.executionInput          $#'$$.Execution.Input'

                                  ┌────────────┐
                                  │   OUTPUT   │
                                  └────────────┘

OUTPUT                            #VAL (def: INPUT) returned by each STATE
                                  #OUTPUT from final STATE is EXEC's output
                                  #JSON values only
                                  #Max 256KB (else throw 'States.DataLimitExceeded')

TRANSFORM OUTPUT ==>              #By default, OUTPUT is not transformed, i.e. kept as is

TEST_DATA.result                  #'OUTPUT_JSON' before DSTATE.Output|ResultSelector

$states.result                   %#OUTPUT
                                 %#Before DSTATE.Output transformed it
                                 %#Only in DSTATE.Output|Assign
                                 %#Only with STATE_TASK|MAP|PARALLEL
DSTATE.Output                    %#DOEXPR (def: keep as is). Transforms OUTPUT
                                 %#Not with STATE_FAIL

DSTATE.ResultSelector            $#DOEXPR. Transforms OUTPUT
                                 $#Only with STATE_TASK|MAP|PARALLEL
DSTATE.ResultPath                $#DZEXPR. Sets OUTPUT as {...INPUT, DZEXPR: OUTPUT}
                                 $#If INPUT.DZEXPR already exists, overrides it
                                 $#null sets OUTPUT as {...INPUT}
                                 $#'$' sets OUTPUT as {...OUTPUT}
                                 $#Cannot use CONTEXT nor $DVAR
                                 $#Done after ResultSelector
                                 $#Throws 'States.ResultPathMatchFailure' if some DSEXPR does not match
                                 $#Only with STATE_TASK|MAP|PARALLEL|PASS
DSTATE.OutputPath                $#DSEXPR. Transforms OUTPUT
                                 $#null is same as empty OBJ
                                 $#Done after ResultPath
                                 $#Not with STATE_FAIL
TEST_DATA.afterResultSelector
 |afterResultPath                $#'OUTPUT_JSON' after DSTATE.ResultSelector|ResultPath

EXEC.output                       #Final 'OUTPUT_JSON'. Not if ERROR_OUTPUT
TEST_OUT|ASYNC_TASK_SUCCESS.output#State 'OUTPUT_JSON'. Not if ERROR_OUTPUT

EVENT_INFO.output                 #'OUTPUT_JSON'
                                  #With EVENT_TYPEs:
                                  #  - ExecutionSucceeded
                                  #  - STATE_TYPEStateExited
                                  #  - TaskSubmitted, TaskSucceeded
                                  #  - ActivitySucceeded
EVENTS_REQ.includeExecutionData   #BOOL (def: true). If false, do not set EVENT_INFO.input*|output*

                                  ┌────────────────┐
                                  │   OUTPUT IAC   │
                                  └────────────────┘

CSTATE_OPTS.outputs              %#DSTATE.Output
CSTATE_OPTS.resultSelector
 |resultPath|outputPath          $#DSTATE.*

                                  ┌─────────────┐
                                  │   CONTEXT   │
                                  └─────────────┘

CONTEXT                           #'OBJ_JSON' passed to each STATE

$states.context                  %#CONTEXT
$$...                            $#Like $... but root value is CONTEXT instead

                                  ┌─────────────────┐
                                  │   CONTEXT IAC   │
                                  └─────────────────┘

JsonPath.entireContext           $#'$$'

                                  ┌───────────────┐
                                  │   VARIABLES   │
                                  └───────────────┘

DSTATE.Assign.DVAR                #VAL. "State machine variable"
                                  #Sets $DVAR in any later STATE (not current STATE)
                                  #Run right after OUTPUT is obtained
                                 %#  - before DSTATE.Output
                                 $#  - before DSTATE.ResultSelector
                                  #Can only reference $DVAR inside JSONPath|JSONata
                                 %#$DVAR cannot be set inside a query
                                 %#Other variables assigned inside a query ($VAR := VAL) can only be used inside that query
                                  #Child MACHINEs:
                                  #  - have their own DVAR scope
                                  #  - can use upper scope's DVARs
                                  #     - except STATE_MAP with DMAP_CONF.Mode 'DISTRIBUTED'
                                  #  - cannot set upper scope's DVARs
                                  #  - cannot use lower|sibling scopes' DVARs
                                  #DVAR:
                                  #  - max 80 chars
                                  #  - ID_Continue: letters-like, numbers-like, _, diacretics, U+200C U+200D (zero-width space)
                                  #  - first char: ID_Start: letters-like
                                  #Max 256KB per STATE, 10MB per EXEC (else throw 'States.DataLimitExceeded')
                                  #Not with STATE_SUCCEED|FAIL

TEST_IN.variables                 #Initial '{DVAR: VAL,...}_JSON'
TEST_DATA.variables               #Final '{DVAR: VAL,...}_JSON'

EVENT_INFO.assignedVariables.DVAR #'VAL'
                                  #With EVENT_TYPE STATE_TYPEStateExited

MACHINE.variableReferences.STATE  #'DVAR'_ARR used by this STATE
                                  #If none, undefined (not empty ARR)

                                  ┌───────────────────┐
                                  │   VARIABLES IAC   │
                                  └───────────────────┘

CSTATE_OPTS.assign                #DSTATE.Assign

                                  ┌───────────┐
                                  │   STATE   │
                                  └───────────┘

DMACHINE.States.STATE             #DSTATE. Also called "step". Like `case` in a `switch` statement
                                  #Parent|child|siblings MACHINEs cannot reuse same 'STATE' names
                                  #'STATE' name max 80 chars
                                  #Required

TEST_IN.definition                #'DSTATE_JSON'
                                  #Max 1MB

CONTEXT.State.Name                #'STATE'

DSTATE.Type                       #'STATE_TYPE'. Required
DSTATE_*.*                        #STATE_TYPE-specific properties, e.g. DSTATE_CHOICE.Default

DSTATE.Comment                    #STR. Description

                                  ┌──────────────┐
                                  │   STATE UI   │
                                  └──────────────┘

WORKFLOW STUDIO ==>               #Can view|edit STATEs

                                  ┌───────────────┐
                                  │   STATE IAC   │
                                  └───────────────┘

CSTATE[_OPTS]                     #Inherited by all CSTATE*[_OPTS]

CSTATE.stateId
CSTATE_OPTS.stateName             #'STATE' (def: 'CONSTRUCT' name)

CSTATE_OPTS.comment               #DSTATE.Comment

JsonPath.stateName               $#'$$.State.Name'

CSTATE.toStateJson                #Can be overridden as a workaround to set some DSTATE.* not supported yet by CDK
                                  #Must `extend` from the specific class (e.g. `Succeed`)
                                  #Must then return {...super.toStateJson(...), ...DSTATE_OBJ}

new CustomState(...CARGS, OPTS)   #Custom user-defined CSTATE
                                  #Meant as an even more advanced workaround than CSTATE.toStateJson
                                  #Cannot use CSTATE_OPTS.*
OPTS.stateJson                    #DSTATE_OBJ

                                  ┌────────────────┐
                                  │   STATE LINT   │
                                  └────────────────┘

DIAG_ERROR DUPLICATE_STATE_NAME
statelint
asl-validator                     #Child STATEs must not reuse same names

DIAG_ERROR INVALID_STATE_NAME     #'STATE' name must be valid
asl-validator                     #'STATE' name must be max 80 chars

                                  ┌──────────┐
                                  │   FLOW   │
                                  └──────────┘

DMACHINE.StartAt                  #'STATE'. First STATE
                                  #Required

DSTATE.Next                       #'STATE'. Next STATE
                                  #Cannot target a 'STATE' in parent|child MACHINEs
                                  #Not with STATE_PASS|FAIL|CHOICE, or if DSTATE.End true. Required otherwise
TEST_OUT.nextState                #'STATE' or undefined

DSTATE.Type                       #'Succeed'. STATE is STATE_SUCCEED
                                  #End MACHINE successfully
                                  #Continue parent MACHINEs

DSTATE.End                        #BOOL (def: false). If true, same as using DSTATE.Next towards STATE_SUCCEED except:
                                  #  - pro: cheaper since no additional STATE
                                  #  - con: no conditional logic, i.e. not on DCHOICE.*
                                  #Not with STATE_CHOICE|SUCCEED|FAIL
                                  #Together with STATE_SUCCEED|FAIL, called "terminal STATE" (of a MACHINE)

CONTEXT.State.EnteredTime         #'DATE' on STATE start

EVENT_TYPE STATE_TYPEStateEntered #On STATE start
EVENT_TYPE STATE_TYPEStateExited  #On STATE success
                                  #Not with STATE_FAIL
EVENT_INFO.name                   #'STATE' name
                                  #With EVENT_TYPEs STATE_TYPEStateEntered|Exited

STATE_EXEC                        #Starting executing a STATE
                                  #Each RETRY counts as 1 STATE_EXEC
                                  #Each ITER has its own count of STATE_EXECs
                                  #Max 5e3/s RATE_LIMIT, 5e3 BURST_LIMIT (REGION-specific, soft) (see token bucket algorithm doc) per ACCOUNT + REGION

                                  ┌──────────────┐
                                  │   FLOW IAC   │
                                  └──────────────┘

new Succeed
 (...CARGS[, CSTATE_SUCCEED_OPTS])#CSTATE_SUCCEED

JsonPath.stateEnteredTime        $#'$$.State.EnteredTime'

CTREE                             #Tree of CSTATEs
                                  #Starts with 1 CSTATE and ends with 1|n CTREEs
                                  #For a single DMACHINE, i.e. does not include parent|child DMACHINEs of STATE_MAP|PARALLELs
CTREE.next(CTREE2)->CCHAIN        #Make CTREE's end go to CTREE2's start, using DSTATE.Next
                                  #If CTREE has several ends, all go to CTREE2's start, i.e. converge
                                  #DSTATE.End true automatically set on terminal STATEs

CSTATE                            #Is a CTREE with a single STATE, i.e. starts|ends with itself

CCHAIN                            #CTREE, usually with several STATEs
Chain.start(CTREE)->CCHAIN        #Re-uses CTREE's start|ends as is
Chain.sequence(CTREE, CTREE2)
 ->CCHAIN                         #Re-uses CTREE's start and CTREE2's ends
Chain.custom                      #Uses CSTATE as start
 (CSTATE, CTREE_ARR, CTREE2)      #Uses each CTREE as an end
 ->CCHAIN                         #'CONSTRUCT' name re-uses CTREE2's

CFRAGMENT                         #CTREE for advanced use cases
                                  #Must define it and `extend` from `StateMachineFragment`
CFRAGMENT.startState              #CSTATE. CTREE's start. Must be set in constructor
CFRAGMENT.endStates               #CSTATE_ARR. CTREE's ends. Must be set in constructor
CFRAGMENT.prefixStates([STR])     #Prepends STR (def: 'CONSTRUCT: ') to 'STATE' name in all CSTATEs
 ->CFRAGMENT                      #Done deeply, using CFRAGMENT's CONSTRUCT tree
                                  #Meant for namespacing, to make CFRAGMENT re-usable as a component

State.findReachable[End]States    #Find all next STATEs, deeply
 (CSTATE[, OPTS])->CSTATE2_ARR    #Using DSTATE|DCHOICE.Next and DSTATE_CHOICE.Default
                                  #If 'End', only terminal STATEs
OPTS.includeErrorHandlers         #BOOL (def: false). Also follow DCATCH.Next

                                  ┌──────────────────┐
                                  │   FLOW METRICS   │
                                  └──────────────────┘

AWS/States/ExecutionThrottled     #NUM of throttled STATE_EXECs
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM ThrottledExecutionCount > CXALARM_OPTS.maxErrorCount

DVAR StateMachineArn              #'MACHINE_ARN'. With above METRIC
                                  #MACHINE is also a TELEMETRY_ENTITY

AWS/States/ProvisionedRefillRate
AWS/States/ProvisionedBucketSize
AWS/States/ConsumedCapacity
AWS/States/ThrottledEvents        #Same as above

DVAR ServiceMetric                #Must be 'StateTransition' with the above 4 METRICs to show STATE_EXEC throttling

                                  ┌──────────────────────┐
                                  │   FLOW METRICS IAC   │
                                  └──────────────────────┘

ICMACHINE.metricThrottled
 ([CMETRIC_OPTS])->CMETRIC        #Sets DVAR StateMachineArn, statistic 'Sum'

StateTransitionMetric.metric
 ('METRIC'[, CMETRIC_OPTS])
 ->CMETRIC                        #Sets DVAR ServiceMetric 'StateTransition'
StateTransitionMetric.metricMETRIC
 (CMETRIC_OPTS)->CMETRIC          #Same, except uses statistic 'Sum' for ThrottledEvents

                                  ┌───────────────┐
                                  │   FLOW LINT   │
                                  └───────────────┘

DIAG_ERROR
 MISSING_TRANSITION_TARGET
statelint
asl-validator                     #DSTATE.Next must point to existing 'STATE'

statelint
asl-validator                     #Every 'STATE' must be a target for a transition from another one

DIAG_ERROR MISSING_END_STATE
statelint
asl-validator                     #>= 1 terminal STATE

asl-validator                     #Child|parent DMACHINEs cannot point to each other's STATEs

                                  ┌────────────┐
                                  │   CHOICE   │
                                  └────────────┘

DSTATE.Type                       #'Choice'. STATE is STATE_CHOICE
                                  #Like a `switch` statement

DSTATE_CHOICE.Default             #'STATE'
                                  #Def: throw 'States.Runtime'

DSTATE_CHOICE.Choices             #DCHOICE_ARR
                                  #Cannot be empty
DCHOICE.Next                      #Like DSTATE.Next. Required
DCHOICE.Comment                   #STR. Description

DCHOICE.Assign                    #Like DSTATE_CHOICE.Assign
                                  #DSTATE_CHOICE.Assign is not used if any DCHOICE matches (even if it has no DCHOICE.Assign)

                                  ┌────────────────┐
                                  │   CHOICE IAC   │
                                  └────────────────┘

new Choice                        #CSTATE_CHOICE
 (...CARGS[, CSTATE_CHOICE_OPTS]) #Not supported yet: DCHOICE.Assign

CSTATE_CHOICE.otherwise(CTREE)
 ->CSTATE_CHOICE                  #DSTATE_CHOICE.Default

CSTATE_CHOICE.when
 (CCOND, CTREE[, WHEN_OPTS])
 ->CSTATE_CHOICE                  #Adds a DCHOICE
WHEN_OPTS.comment                 #DCHOICE.Comment
WHEN_OPTS.assign                  #DCHOICE.Assign

CSTATE_CHOICE.afterwards([OPTS])  #CCHAIN's start is CSTATE_CHOICE, ends are each DCHOICE + DSTATE_CHOICE.Default
 ->CCHAIN                         #Meant to call .next():
                                  #  - on every possible choice: all converge to same next STATE
                                  #  - as opposed to individual ones: each having different next STATEs
                                  #I.e. like a `finally` statement
                                  #Can do it using either:
                                  #  - CSTATE_CHOICE.afterwards().next(...)
                                  #  - CCHAIN.next(CSTATE_CHOICE.afterwards()).next(...)
OPTS.includeErrorHandlers         #BOOL (def: false). Also include DCATCH.Next
OPTS.includeOtherwise             #BOOL (def: false). Also include DSTATE_CHOICE.Default when not set yet
                                  #I.e. sets it when CCHAIN.next(CTREE) called
                                  #Must not be called if DSTATE_CHOICE.Default already exists

                                  ┌─────────────────┐
                                  │   CHOICE LINT   │
                                  └─────────────────┘

DIAG_ERROR
 MISSING_TRANSITION_TARGET
statelint
asl-validator                     #DSTATE_CHOICE.Default and DCHOICE.Next must point to existing 'STATE'

                                  ┌───────────────┐
                                  │   CONDITION   │
                                  └───────────────┘

DCHOICE.Condition                %#BOOL_DOEXPR. Required
DCHOICE.Output                   %#OUTPUT_DOEXPR (def: keep as is). Transforms OUTPUT

DCHOICE.*                        $#DCOND, i.e. condition deciding whether to pick DCHOICE
DCHOICE.Variable                 $#DSEXPR. VAL to compare

DCOND.Not                        $#DCOND2
DCOND.And|Or                     $#DCOND_ARR
                                 $#Cannot be empty

DCOND.IsPresent                  $#BOOL. VAL !== undefined
DCOND.IsNull                     $#BOOL. VAL === null

DCOND.IsBoolean                  $#BOOL. VAL is a BOOL
DCOND.BooleanEquals              $#BOOL[_DZEXPR]. VAL === BOOL

DCOND.IsNumeric                  $#BOOL. VAL is a NUM
DCOND.NumericEquals              $#NUM[_DZEXPR]. VAL === NUM
DCOND
.NumericLess|GreaterThan[Equals] $#NUM[_DZEXPR]. VAL < <= > >= NUM

DCOND.IsString                   $#BOOL. VAL is a STR
DCOND.StringEquals               $#STR[_DZEXPR]. VAL === STR
DCOND.StringMatches              $#'GLOB'. VAL matches GLOB
                                 $#GLOB can only use *
                                 $#Must \-escape * \
DCOND
 .StringLess|GreaterThan[Equals] $#STR[_DZEXPR]. VAL < <= > >= STR

DCOND.IsTimestamp                $#BOOL. VAL is a DATE
DCOND.TimestampEquals            $#'DATE'[_DZEXPR]. VAL === DATE
DCOND.TimestampLess
 |GreaterThan[Equals]            $#'DATE'[_DZEXPR]. VAL < <= > >= DATE

                                  ┌───────────────────┐
                                  │   CONDITION IAC   │
                                  └───────────────────┘

Condition.jsonata('BOOL_DOEXPR') %#To set as DCHOICE.Condition
WHEN_OPTS.outputs                %#DCHOICE.Output

Condition.*                      $#DCOND

Condition.not(CCOND)->CCOND2     $#
Condition.and|or(CCOND,...)
 ->CCOND2                        $#

Condition.is[Not]*(CSEXPR)
 ->CCOND                         $#
Condition.*Equals|Than
 (CSEXPR, VAL)->CCOND            $#
Condition.stringMatches
 (CSEXPR, STR)->CCOND            $#

                                  ┌───────────┐
                                  │   ERROR   │
                                  └───────────┘

ERROR                             #STATEs can throw ERRORs
                                  #In addition to ERRORs documented in this doc, any STATE might fail due to network ERRORs
                                  #ERRORs are propagated to parent STATE|MACHINEs
                                  #When ERROR reaches top-level MACHINE, makes EXEC fail with ERROR_OUTPUT

ERROR_OUTPUT.Error                #'ERROR_CODE'. Can be undefined
                                  #Max 256 chars
ERROR_OUTPUT.Cause                #'MESSAGE'. Can be undefined
                                  #Max 32KB

EXEC|TEST_OUT|ASYNC_TASK_FAILURE
 .error|cause                     #ERROR_OUTPUT.*

ABORTING ==>                      #Stops ongoing STATEs. Happens if:
                                  #  - StopExecution()
                                  #  - sibling STATE_PARALLEL branch fails
                                  #  - STATE_MAP ITEM fails (see DSTATE_MAP.ToleratedFailure* below)

EVENT_INFO.error|cause            #ERROR_OUTPUT.*
                                  #With EVENT_TYPEs:
                                  #  - *Failed (except MapIterationFailed, MapStateFailed, ParallelStateFailed)
                                  #  - *TimedOut
                                  #  - ExecutionAborted

                                  ┌───────────────┐
                                  │   ERROR IAC   │
                                  └───────────────┘

Errors.ERROR_CODE                 #'States.ERROR_CODE'
                                  #Uppercased, e.g. Errors.HEARTBEAT_TIMEOUT -> 'States.HeartbeatTimeout'

                                  ┌──────────┐
                                  │   FAIL   │
                                  └──────────┘

DSTATE.Type                       #'Fail'. STATE is STATE_FAIL
                                  #End MACHINE with failure (ERROR_OUTPUT), including parent ones

DSTATE_FAIL.Error                 #'ERROR_CODE'[_DFEXPR] (def: none). ERROR_OUTPUT.Error
                                  #Should not use 'States.*' (reserved) except to propagate it
DSTATE_FAIL.Cause                 #'MESSAGE'[_DFEXPR] (def: none). ERROR_OUTPUT.Cause

                                  ┌──────────────┐
                                  │   FAIL IAC   │
                                  └──────────────┘

new Fail
 (...CARGS[, CSTATE_FAIL_OPTS])   #CSTATE_FAIL

CSTATE_FAIL_OPTS.error|cause      #DSTATE_FAIL.*

                                  ┌───────────────────────┐
                                  │   TIMEOUT EXECUTION   │
                                  └───────────────────────┘

DMACHINE.TimeoutSeconds           #NUM (def|max: 1y). Timeout for an EXEC
                                  #After NUMs, throw 'States.Timeout'
                                  #Recommended: should be explicitly set
                                  #With TEST_IN: always 5m
                                  #Only for top-level MACHINE

EXEC.status                       #Can be 'TIMED_OUT'

MAP_COUNT.timedOut                #NUM timed out

EVENT_TYPE ExecutionTimedOut      #On EXEC timeout

                                  ┌───────────────────────────┐
                                  │   TIMEOUT EXECUTION IAC   │
                                  └───────────────────────────┘

CMACHINE_OPTS.timeout             #DURATION. DMACHINE.TimeoutSeconds
                                  #Must use DefinitionBody.fromChainable()

                                  ┌───────────────────────────────┐
                                  │   TIMEOUT EXECUTION METRICS   │
                                  └───────────────────────────────┘

AWS/States/ExecutionsTimedOut     #NUM of EXECs timed out
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM TimedOutExecutionCount > CXALARM_OPTS.maxErrorCount

DVAR StateMachineArn              #'MACHINE_ARN'. With above METRICs
                                  #MACHINE is also a TELEMETRY_ENTITY

                                  ┌───────────────────────────────────┐
                                  │   TIMEOUT EXECUTION METRICS IAC   │
                                  └───────────────────────────────────┘

ICMACHINE.metricTimedOut
 ([CMETRIC_OPTS])->CMETRIC        #Sets DVAR StateMachineArn, statistic 'Sum'

                                  ┌──────────────────┐
                                  │   TIMEOUT TASK   │
                                  └──────────────────┘

DSTATE_TASK.TimeoutSeconds        #NUM[_DZEXPR] (in secs, def: 1m, max: 1y)
                                  #Like DMACHINE.TimeoutSeconds, but on STATE_TASK

EVENT_TYPE TaskTimedOut           #On TASK timeout

EVENT_INFO.timeoutInSeconds       #DSTATE_TASK.TimeoutSeconds. With EVENT_TYPEs TaskScheduled

                                  ┌──────────────────────┐
                                  │   TIMEOUT TASK IAC   │
                                  └──────────────────────┘

CSTATE_TASK_OPTS.taskTimeout      #DSTATE_TASK.TimeoutSeconds
                                  #Value must be Timeout.duration(DURATION)

                                  ┌───────────┐
                                  │   CATCH   │
                                  └───────────┘

DSTATE.Catch                      #DCATCH_ARR. On error, execute some logic
                                  #Only with STATE_TASK|MAP|PARALLEL
DCATCH.Next                       #Like DSTATE.Next. Required
DCATCH.Comment                    #STR. Description

DCATCH.ErrorEquals                #'ERROR_CODE'_ARR. Required, not empty
ERROR_CODE 'States.ALL'           #Special ERROR_CODE, matching any ERROR_CODE
                                  #  - except 'States.DataLimitExceeded' and 'States.Runtime'
                                  #Only in DCATCH|DRETRY.ErrorEquals
                                  #Must be in last DCATCH|DRETRY of its ARR

DCATCH's INPUT ==>                #Always STATE's INPUT, as opposed to previous DCATCH's ERROR_OUTPUT

DCATCH.Output                    %#ERROR_OUTPUT_DOEXPR (def: keep as is). Transforms ERROR_OUTPUT
$states.errorOutput              %#ERROR_OUTPUT
                                 %#Before DSTATE.Output transformed it
                                 %#Only in DCATCH.Output|Assign
                                 %#Only with STATE_TASK|MAP|PARALLEL
DCATCH.ResultPath                $#Like DSTATE.ResultPath, but on ERROR_OUTPUT

DCATCH.Assign                     #Like DSTATE.Assign

                                  ┌───────────────┐
                                  │   CATCH IAC   │
                                  └───────────────┘

CSTATE.addCatch
 (CTREE[, CCATCH_OPTS])           #Add a DCATCH
 ->CSTATE                         #Does not support yet DCATCH.Comment

CCATCH_OPTS.errors                #DCATCH.ErrorEquals (def: ['States.ALL'])
                                  #'States.ALL' always sorted to be at the end

CCATCH_OPTS.outputs              %#DCATCH.Output
CCATCH_OPTS.resultPath           $#DCATCH.ResultPath

CCATCH_OPTS.assign                #DCATCH.Assign

                                  ┌───────────┐
                                  │   RETRY   │
                                  └───────────┘

DSTATE.Retry                      #DRETRY_ARR. Retry STATE if throws
                                  #If a retry succeeds:
                                  #  - STATE does not throw anymore
                                  #  - CATCHs not run
                                  #Def: no retry
                                  #Retries the whole STATE, even the parts that succeeded
                                  #  - i.e. with STATE_MAP|PARALLEL, successful ITERs are retried
                                  #     - i.e. must be idempotent
                                  #Only with STATE_TASK|MAP|PARALLEL

DRETRY.ErrorEquals                #Same as DCATCH.ErrorEquals

DRETRY.MaxAttempts                #NUM (def: 3). Max NUM of retries
                                  #Can be 0 to not retry
DRETRY.IntervalSeconds            #NUM (in secs, def: 1). Initial delay
DRETRY.BackoffRate                #NUM (def: 2). Multiplies delay after each retry
DRETRY.JitterStrategy             #'NONE' (def) or 'FULL'. Applies random jitter to delay, which helps spread the load
DRETRY.MaxDelaySeconds            #NUM (def: none). Max delay
                                  #If reached, continues to retry, but with this delay

CONTEXT.State.RetryCount          #NUM of ongoing retries

                                  ┌───────────────┐
                                  │   RETRY IAC   │
                                  └───────────────┘

CSTATE.addRetry(CRETRY_OPTS)
 ->CSTATE                         #Add a DRETRY

CRETRY_OPTS.errors                #DRETRY.ErrorEquals (def: ['States.ALL'])
                                  #'States.ALL' always sorted to be at the end

CRETRY_OPTS.maxAttempts
 |backoffRate|jitterStrategy      #DRETRY.*
CRETRY_OPTS.interval|maxDelay     #DURATION. DRETRY.*

JsonPath.stateRetryCount         $#'$$.State.RetryCount'

                                  ┌─────────────────┐
                                  │   REDRIVE TOP   │
                                  └─────────────────┘

REDRIVE                           #Retry an EXEC that failed
                                  #For any failure, including timeout
                                  #Does not repeat already successful STATEs
                                  #  - i.e. restart from where it stopped
                                  #Resets timeouts and RETRYs
                                  #Uses the exact same EXEC.* parameters
                                  #Must have failed in last 14 days

REDRIVE.executionArn              #'EXEC_ARN'. Same one, i.e. does not create a new EXEC_ARN
REDRIVE.clientToken               #STR. Idempotency token (see aws_network doc)
                                  #Valid for 15m

ITEM_EXEC.redriveFilter           #'REDRIVEN|NOT_REDRIVEN'. Whether >= 1 REDRIVE started
EXEC|MAP_RUN.redriveCount         #NUM of REDRIVEs started
EXEC|MAP_RUN.redriveDate          #DATE_NUM of last REDRIVE. null if none
EXEC.redriveStatus                #One of:
                                  #  - 'REDRIVABLE': can do a REDRIVE on [ITEM_]EXEC
                                  #  - 'REDRIVABLE_BY_MAP_RUN': can do a REDRIVE on ITEM_EXECs, not EXEC
                                  #  - 'NOT_REDRIVABLE': cannot do a REDRIVE on [ITEM_]EXEC, e.g. due to either:
                                  #     - did not fail
                                  #     - hit max limits
EXEC.redriveStatusReason          #'MESSAGE' if redriveStatus 'NOT_REDRIVABLE'
ITEM_EXEC.status                  #Is 'PENDING_REDRIVE' when waiting due to MAP_RUN.maxConcurrency

MAP_COUNT.pendingRedrive          #NUM waiting to REDRIVE
MAP_COUNT.failuresNotRedrivable   #NUM that tried to REDRIVE but could not

CONTEXT.Execution.RedriveCount    #EXEC.redriveCount
CONTEXT.Execution.RedriveTime     #EXEC.redriveData, as 'DATE'

EVENT_TYPE ExecutionRedriven      #On REDRIVE
EVENT_INFO.redriveCount           #EXEC.redriveCount
                                  #With EVENT_TYPE ExecutionRedriven

                                  ┌─────────────────────┐
                                  │   REDRIVE TOP API   │
                                  └─────────────────────┘

RedriveExecution()                #Req: REDRIVE
                                  #Res: EXEC
                                  #  - only redriveDate

                                  ┌─────────────────────┐
                                  │   REDRIVE TOP IAC   │
                                  └─────────────────────┘

CDK ==>                          $#Does not support '$$.Execution.Redrive*' yet

                                  ┌─────────────────────────┐
                                  │   REDRIVE TOP METRICS   │
                                  └─────────────────────────┘

AWS/States/ExecutionsRedriven     #NUM of REDRIVEs
AWS/States/
 RedrivenExecutionsSucceeded      #NUM of REDRIVEs succeeded
AWS/States/
 RedrivenExecutionsAborted        #NUM of REDRIVEs aborted
AWS/States/
 RedrivenExecutionsTimedOut       #NUM of REDRIVEs timed out
AWS/States/
 RedrivenExecutionsFailed         #NUM of REDRIVEs failed

DVAR StateMachineArn              #'MACHINE_ARN'. With above METRICs
                                  #MACHINE is also a TELEMETRY_ENTITY

                                  ┌───────────────────┐
                                  │   REDRIVE CHILD   │
                                  └───────────────────┘

REDRIVE ITERS ==>                 #REDRIVE includes all ITERs
                                  #  - cannot target one specific individual ITER
                                  #Does not repeat:
                                  #  - already successful ITERs
                                  #  - already successful STATEs in a failed ITER
                                  #  - unless EXEC failed with 'States.DataLimitExceeded|Runtime'

EVENT_TYPE MapRunRedriven         #When MAP_RUN repeated as part of a REDRIVE
                                  #Max 1e3 REDRIVEs per MAP_RUN
EVENT_INFO.redriveCount           #MAP_RUN.redriveCount
                                  #With EVENT_TYPE MapRunRedriven
EVENT_INFO.mapRunArn              #'MAP_RUN_ARN'
                                  #With EVENT_TYPE MapRunRedriven

                                  ┌──────────┐
                                  │   PASS   │
                                  └──────────┘

DSTATE.Type                       #'Pass'. STATE is STATE_PASS
                                  #Noop. Potential goals: set OUTPUT, set DVARs, apply parent STATE_MAP

DSTATE_PASS.Output               %#OUTPUT_DOEXPR (def: INPUT). Transforms OUTPUT, like other STATEs
DSTATE_PASS.Result               $#OUTPUT (def: INPUT). Sets OUTPUT
                                 $#Cannot use DSEXPR|DFUNCs

                                  ┌──────────────┐
                                  │   PASS IAC   │
                                  └──────────────┘

new Pass
 (...CARGS[, CSTATE_PASS_OPTS])   #CSTATE_PASS

CSTATE_PASS_OPTS.outputs         %#DSTATE_PASS.Output
CSTATE_PASS_OPTS.result          $#DSTATE_PASS.Result, among:
                                 $#  - Result.fromString(STR)
                                 $#  - Result.fromNumber(NUM)
                                 $#  - Result.fromBoolean(BOOL)
                                 $#  - Result.fromObject(OBJ)
                                 $#  - Result.fromArray(ARR)

                                  ┌───────────────┐
                                  │   PASS LINT   │
                                  └───────────────┘

DIAG_WARNING
 PASS_RESULT_IS_STATIC            #Must not use DSEXPR in DSTATE_PASS.Result

                                  ┌───────────────┐
                                  │   ITERATION   │
                                  └───────────────┘

ITER                              #Run of a child MACHINE, i.e. either:
                                  #  - STATE_PARALLEL branch
                                  #  - STATE_MAP ITEM
                                  #When a MACHINE fails, child MACHINEs are aborted

                                  ┌──────────────┐
                                  │   PARALLEL   │
                                  └──────────────┘

DSTATE.Type                       #'Parallel'. STATE is STATE_PARALLEL
                                  #Executes multiple child MACHINEs in parallel, with same INPUT
                                  #OUTPUT is ARR of their OUTPUTs
                                  #Can also be used to wrap a single branch:
                                  #  - to allow adding a DCATCH|DRETRY on multiple STATEs at once
                                  #If any child MACHINE throws, other childs are aborted
                                  #On error, throws 'States.BranchFailed'

DSTATE_PARALLEL.Branches          #DMACHINE_ARR. Required

EVENT_TYPE ParallelStateStarted   #On STATE_PARALLEL's ITERs start
EVENT_TYPE ParallelStateSucceeded #On STATE_PARALLEL's ITERs success
EVENT_TYPE ParallelStateAborted   #On STATE_PARALLEL abort
EVENT_TYPE ParallelStateFailed    #On STATE_PARALLEL failure

                                  ┌──────────────────┐
                                  │   PARALLEL IAC   │
                                  └──────────────────┘

new Parallel
 (...CARGS[,CSTATE_PARALLEL_OPTS])#CSTATE_PARALLEL

CSTATE_PARALLEL.branch(CTREE,...)
 ->CSTATE_PARALLEL                #Add a DSTATE_PARALLEL.Branches[*]

CCHAIN.toSingleState
 (...CARGS[,CSTATE_PARALLEL_OPTS])#Turn CCHAIN into a DSTATE_PARALLEL with a single branch
 ->CSTATE_PARALLEL                #Meant to allow adding a DCATCH|DRETRY on multiple STATEs at once
CFRAGMENT.toSingleState
 (...CARGS[,CSTATE_PARALLEL_OPTS])#Same with CFRAGMENT
 ->CSTATE_PARALLEL                #Also calls CFRAGMENT.prefixStates(CSTATE_PARALLEL_OPTS.prefixStates)

                                  ┌──────────────┐
                                  │   MAP MAIN   │
                                  └──────────────┘

DSTATE.Type                       #'Map'. STATE is STATE_MAP
                                  #Executes one child MACHINEs per ITEM (of an ARR), in parallel
                                  #OUTPUT is ARR of their OUTPUTs

EVENT_TYPE MapStateStarted        #On STATE_MAP's ITERs start
EVENT_TYPE MapStateSucceeded      #On STATE_MAP's ITERs success
EVENT_TYPE MapStateAborted        #On STATE_MAP abort
EVENT_TYPE MapStateFailed         #On STATE_MAP failure

                                  ┌───────────────────┐
                                  │   MAP MAIN AUTH   │
                                  └───────────────────┘

PACTION states:StartExecution     #Must be allowed for MACHINE.roleArn, on itself, i.e. Resource MACHINE_ARN
                                  #Not needed if DMAP_CONF.Mode 'INLINE'
PACTION states:DescribeExecution  #Must be allowed for MACHINE.roleArn, on any EXEC on itself,
 |StopExecution                   #i.e. Resource 'arn:aws:states:REGION:ACCOUNT_ID:execution:MACHINE:*'
                                  #Not needed if DMAP_CONF.Mode 'INLINE'

                                  ┌──────────────────┐
                                  │   MAP MAIN IAC   │
                                  └──────────────────┘

new [Distributed]Map              #CSTATE_MAP
 (...CARGS[, CSTATE_MAP_OPTS])    #If INLINE, automatically allows states:*Execution as described above

                                  ┌───────────────────┐
                                  │   MAP MAIN LINT   │
                                  └───────────────────┘

DIAG_ERROR TOO_DEEPLY_NESTED      #Must not hit child STATE max depth
                                  #The limit is undocumented

                                  ┌───────────────┐
                                  │   MAP LABEL   │
                                  └───────────────┘

DSTATE_MAP.Label                  #'STATE_MAP_LABEL' (def: random ID). STATE_MAP name
                                  #Used by MACHINE|EXEC, as opposed to 'STATE' which is used inside DEFINITION
                                  #Must be unique per MACHINE
                                  #Max 40 chars, [:alnum:]-_

STATE_MAP_ARN                     #'MACHINE_ARN/STATE_MAP_LABEL'. STATE_MAP's child MACHINE
MACHINE.stateMachineArn           #In input (read, not write), can be a 'STATE_MAP_ARN' to target child MACHINE
MACHINE.label                     #'STATE_MAP_LABEL', when using a STATE_MAP_ARN

                                  ┌───────────────────┐
                                  │   MAP LABEL IAC   │
                                  └───────────────────┘

CSTATE_MAP_OPTS.label             #DSTATE_MAP.Label

                                  ┌────────────────────┐
                                  │   MAP LABEL LINT   │
                                  └────────────────────┘

DIAG_ERROR DUPLICATE_LABEL_NAME   #'STATE_MAP_LABEL' must be unique per MACHINE

DIAG_ERROR INVALID_LABEL_NAME     #'STATE_MAP_LABEL' must be valid

                                  ┌──────────────┐
                                  │   MAP MODE   │
                                  └──────────────┘

DMACHINE.ProcessorConfig.Mode     #DMAP_CONF
                                  #Only on a child MACHINE inside DSTATE_MAP.ItemProcessor
DMAP_CONF.Mode                    #Either 'INLINE' (def) or 'DISTRIBUTED'

INLINE EXCLUSIVE FEATURES ==>     #Initial STATE_EXEC of each ITEM is free (unless Express)
                                  #Can reference upper scope's DVARs (see above)
                                  #Does not require additional PACTIONs states:*Execution (see above)

INLINE MISSING FEATURES ==>       #Max 40 ITEMs
                                  #BATCH
                                  #DREADER|DWRITER
                                  #MAP_RUN and ITEM_EXEC
                                  #  - i.e. its EVENTs are included in the max 2.5e4 quota of parent EXEC
                                  #DMAP_CONF.ExecutionType
                                  #DMAP_CONF.ToleratedFailure*
                                  #STATE_MAP_LABEL|STATE_MAP_ARN

                                  ┌──────────────────┐
                                  │   MAP MODE IAC   │
                                  └──────────────────┘

new [Distributed]Map(...)         #DMAP_CONF.Mode is 'INLINE|DISTRIBUTED' depending on whether 'Distributed'

                                  ┌───────────────┐
                                  │   MAP ITEMS   │
                                  └───────────────┘

ORDER ==>                        %#Arguments -> ItemReader -> Items -> ItemSelector -> ItemBatcher
                                 $#InputPath -> ItemReader -> ItemsPath -> ItemSelector -> ItemBatcher

DSTATE_MAP.ItemProcessor          #DMACHINE, performed on each ITEM

DSTATE_MAP.Items                 %
DSTATE_MAP.ItemsPath             $#DZEXPR selecting ITEM_ARR
                                  #Def: INPUT, i.e. must be an ARR then
                                  #Max 1e4 ITEMs

DSTATE_MAP.ItemSelector           #DOEXPR, transforming each ITEM
                                  #Def: keep ITEM as is
CONTEXT.Map.Item.Index            #NUM (0-based)
                                  #Only in DSTATE_MAP.ItemSelector
CONTEXT.Map.Item.Value            #VAL. ITEM's value
                                  #Uses both:
                                 %#  - DSTATE_MAP.Arguments|Items
                                 $#  - DSTATE_MAP.InputPath|ItemsPath
                                  #Only in DSTATE_MAP.ItemSelector

DSTATE_MAP.**                     #In any DZEXPR|DOEXPR, does not use ITEM_ARR, ITEM nor DSTATE_MAP.Item*:
                                 %#  - $states.input is INPUT
                                 %#     - i.e. uses only DSTATE_MAP.Arguments's result
                                 $#  - $ is INPUT
                                 $#     - i.e. uses only DSTATE_MAP.InputPath's result

                                  ┌───────────────────┐
                                  │   MAP ITEMS IAC   │
                                  └───────────────────┘

CSTATE_MAP.itemProcessor(CTREE)
 ->CSTATE_MAP                     #DSTATE_MAP.ItemProcessor

CSTATE_MAP_OPTS.items            %#DSTATE_MAP.Items. Must be either:
                                 %#  - ProvideItems.jsonArray(ITEM_ARR) (items can be 'D*EXPR')
                                 %#  - ProvideItems.jsonata('ITEM_ARR_DZEXPR')
CSTATE_MAP_OPTS.itemsPath        $#DSTATE_MAP.ItemsPath
CSTATE_MAP_OPTS.itemSelector      #DSTATE_MAP.ItemSelector

                                  ┌────────────────┐
                                  │   MAP CONFIG   │
                                  └────────────────┘

MAP_RUN|DSTATE_MAP.MaxConcurrency #NUM[_DZEXPR] (def: 0, i.e. unlimited) of MACHINEs to run at once
                                  #Can be 1 for serial

MAP_RUN|DSTATE_MAP                #When > NUM[_DZEXPR] (def: 0) ITEMs throw:
 .ToleratedFailureCount           #  - abort every ITEM (i.e. its child MACHINE)
                                  #  - make DSTATE_MAP throw 'States.ExceedToleratedFailureThreshold'
                                  #Else, ITEMs that throw:
                                  #  - do not make parent MACHINE throw
                                  #  - produce ERROR_OUTPUTs
MAP_RUN|DSTATE_MAP
 .ToleratedFailurePercentage      #Same but as NUM[_DZEXPR] 0-100 percentage (def: 0)

                                  ┌────────────────────┐
                                  │   MAP CONFIG IAC   │
                                  └────────────────────┘

CSTATE_MAP_OPTS.maxConcurrency
 |toleratedFailurePercentage
 |toleratedFailureCount           #DSTATE_MAP.*

                                  ┌───────────────┐
                                  │   MAP BATCH   │
                                  └───────────────┘

DSTATE_MAP.ItemBatcher            #DBATCH. Pass BATCHs to each MACHINE, i.e. groups of multiple ITEMs
                                  #INPUT becomes {Items ITEM_ARR, BatchInput VAL}
                                  #OUTPUT is ARR of each MACHINE's OUTPUT, i.e. one output element per BATCH
                                  #Def: no BATCHs
                                  #Goal: reduce cost (price, Lambda startup, etc.) associated with high NUM of ITEMs

DBATCH.MaxItemsPerBatch           #Max NUM[_DZEXPR] of ITEMs per BATCH
DBATCH.MaxInputBytesPerBatch      #Max NUM[_DZEXPR] (in bytes, def|max 256KB) total size per BATCH
                                  #Must be explicitly set if no MaxItemsPerBatch
                                  #Combined with MaxItemsPerBatch (if any)

DBATCH.BatchInput                 #DOEXPR (def: undefined), to set as INPUT.BatchInput

                                  ┌───────────────────┐
                                  │   MAP BATCH IAC   │
                                  └───────────────────┘

CSTATE_MAP_OPTS.itemBatcher       #Value must be: new ItemBatch(OPTS), using OPTS.max*PerBatch|batchInput

                                  ┌─────────────┐
                                  │   MAP RUN   │
                                  └─────────────┘

MAP_RUN                           #STATE_MAP in a given EXEC
                                  #Throttled at 1e3 at once
MAP_RUN.mapRunArn                 #'MAP_RUN_ARN'. 'arn:aws:states:REGION:ACCOUNT_ID:mapRun:MACHINE/STATE_MAP_LABEL:MAP_RUN_MID'
MAP_RUN.startDate                 #DATE_NUM
MAP_RUN.stopDate                  #DATE_NUM

MAP_RUN.executionArn              #'EXEC_ARN'
MAP_RUN.stateMachineArn           #'MACHINE_ARN'

MAP_RUN.status                    #One of: 'RUNNING', 'SUCCEEDED', 'ABORTED', 'FAILED'

EVENT_TYPE MapRunStarted          #On MAP_RUN start
EVENT_INFO.mapRunArn              #'MAP_RUN_ARN'
                                  #With EVENT_TYPE MapRunStarted
EVENT_TYPE MapRunSucceeded
EVENT_TYPE MapRunAborted
EVENT_TYPE MapRunFailed           #On MAP_RUN end

                                  ┌─────────────────┐
                                  │   MAP RUN API   │
                                  └─────────────────┘

UpdateMapRun()                    #Req: MAP_RUN
                                  #  - no *Date, status, executionArn, redrive*, *Counts
                                  #Res: empty
ListMapRuns()                     #Req: MAP_RUN
                                  #  - only executionArn
                                  #Res: mapRuns MAP_RUN_ARR
                                  #  - only mapRunArn, executionArn, startDate, stopDate
                                  #  - only one with stateMachineArn
DescribeMapRun()                  #Req: MAP_RUN
                                  #  - only mapRunArn
                                  #Res: MAP_RUN

                                  ┌────────────────────┐
                                  │   MAP ITEMS EXEC   │
                                  └────────────────────┘

ITEM_EXEC                         #ITEM in a given MAP_RUN
ITEM_EXEC.executionArn            #ITEM_EXEC_ARN. 'arn:aws:states:REGION:ACCOUNT_ID:execution:MACHINE/STATE_MAP_LABEL:EXEC'
ITEM_EXEC.mapRunArn               #'MAP_RUN_ARN'
ITEM_EXEC.*                       #Like EXEC.*

MAP_RUN.itemCounts                #MAP_COUNT. NUM of ITEMs
MAP_RUN.executionCounts           #MAP_COUNT. NUM of ITEM_EXECs, i.e. including RETRYs and REDRIVEs
MAP_COUNT.total                   #NUM
ITEM_EXEC.itemCount               #Same as MAP_RUN.itemCounts.total
MAP_COUNT.pending                 #NUM started but not running
MAP_COUNT.running                 #NUM ongoing
MAP_COUNT.succeeded               #NUM successfully completed
MAP_COUNT.aborted                 #NUM aborted
MAP_COUNT.failed                  #NUM errored

EVENT_TYPE MapIterationStarted    #On ITEM start
EVENT_INFO.length                 #NUM of ITEMs
                                  #With EVENT_TYPE MapStateStarted
EVENT_TYPE MapIterationSucceeded
EVENT_TYPE MapIterationAborted
EVENT_TYPE MapIterationFailed     #On ITEM end
EVENT_INFO.index                  #Index NUM of ITEM
                                  #With EVENT_TYPEs MapIteration*
EVENT_INFO.name                   #'STATE_MAP'
                                  #With EVENT_TYPEs MapIteration*

                                  ┌─────────────────────────┐
                                  │   MAP ITEMS EXEC AUTH   │
                                  └─────────────────────────┘

MAP_RUN_ARN                       #Used as Resource for ListExecutions() when returning ITEM_EXECs (i.e. ITEM_EXEC.mapRunArn set)

ITEM_EXEC_ARN                     #Used as Resource when targetting ITEM_EXECs with Describe[StateMachineFor]Execution(),
                                  #StopExecution(), RedriveExecution(), GetExecutionHistory()

                                  ┌────────────────────────┐
                                  │   MAP ITEMS EXEC API   │
                                  └────────────────────────┘

DescribeStateMachineForExecution()#Can return ITEM_EXEC's child MACHINE
ListExecutions()
DescribeExecution()
StopExecution()
GetExecutionHistory()             #Can operate on ITEM_EXECs by specifying an ITEM_EXEC_ARN

                                  ┌─────────────────┐
                                  │   MAP S3 READ   │
                                  └─────────────────┘

DSTATE_MAP.ItemReader             #DREADER. Set INPUT using S3 OBJECTs
                                  #On error, throws:
                                  #  - 'States.Permissions': auth-related
                                  #  - 'States.ItemReaderFailed': else

DREADER.Arguments                %
DREADER.Parameters               $#DREADER_PARAMS, as DOEXPR
DREADER_PARAMS.Bucket             #S3 'BUCKET'
                                  #Must be in same ACCOUNT|REGION as MACHINE
DREADER.ReaderConfig              #DREADER_CONF
DREADER_CONF.MaxItems             #NUM[_DZEXPR] (def|max: 1e8). Only use first NUM items

DREADER.Resource                  #'arn:aws:states:::s3:listObjectsV2'. Does ListObjectsV2()
DREADER_PARAMS.Prefix             #'PREFIX'. S3 OBJECT prefix
                                  #New INPUT is response's OBJECTS.Contents OBJECT_ARR
                                  #Excludes proper FOLDERs, i.e. 'OBJECT' ends with delimiter (e.g. /) and has empty contents
                                  #See also S3 JOB_LAMBDA, as an alternative

DREADER.Resource                  #'arn:aws:states:::s3:getObject'. Alternative, doing GetObject() instead
DREADER_PARAMS.Key                #S3 'OBJECT'
                                  #New INPUT is ARR items contained in OBJECT
DREADER_CONF.InputType            #'JSON', 'CSV' or 'MANIFEST'
                                  #Only if DEADER_PARAMS.Key used

DREADER_CONF.InputType 'JSON'     #OBJ_ARR
                                  #Max 8MB
                                  #Max 256KB after DSTATE_MAP.Item* applied

DREADER_CONF.InputType 'JSONL'    #Same but as JSON Lines (see its doc)

DREADER_CONF.InputType 'CSV'      #Values are always considered STRs
                                  #Same limits as JSON
DREADER_CONF.CSVHeaderLocation    #Whether OBJ keys are specified:
                                  #  - 'FIRST_ROW' (def): as first CSV row
                                  #  - 'GIVEN': with DREADER_CONF.CSVHeaders
                                  #OBJ keys max 10KB
DREADER_CONF.CSVHeaders           #'KEY'_ARR
DREADER_CONF.CSVDelimiter         #'COMMA' (def), 'PIPE', 'SEMICOLON', 'SPACE', 'TAB'

DREADER_CONF.InputType 'MANIFEST' #S3 INVENTORY MANIFEST
                                  #New INPUT is INVENTORY_LINE_ARR
                                  #Max 10GB
                                  #Max 256KB after DSTATE_MAP.Item* applied

                                  ┌────────────────────┐
                                  │   MAP S3 READ UI   │
                                  └────────────────────┘

WORKFLOW STUDIO ==>               #Can view|edit DREADERs

                                  ┌──────────────────────┐
                                  │   MAP S3 READ AUTH   │
                                  └──────────────────────┘

PACTION s3:ListBucket             #If DREADER_PARAMS.Prefix, must be allowed:
                                  #  - on MACHINE.roleArn
                                  #  - Resource BUCKET
                                  #  - COND_KEY s3:prefix 'PREFIX'

PACTION s3:GetObject              #If DREADER_PARAMS.Key, must be allowed:
                                  #  - on MACHINE.roleArn
                                  #  - Resource:
                                  #     - if JSON|CSV: OBJECT
                                  #     - if MANIFEST:
                                  #        - arn:aws:s3:::DEST_PREFIX/SOURCE_BUCKET/INVENTORY/YYYY-MM-DDTHH-MMZ/manifest.json
                                  #        - arn:aws:s3:::DEST_PREFIX/SOURCE_BUCKET/INVENTORY/data/*

                                  ┌─────────────────────┐
                                  │   MAP S3 READ IAC   │
                                  └─────────────────────┘

CSTATE_MAP_OPTS.itemReader        #CREADER. DSTATE_MAP.ItemReader

new S3ObjectsItemReader(OPTS)     #CREADER
                                  #Automatically allows PACTIONs described as above except:
                                  #  - no COND_KEY s3:prefix
                                  #  - Resource '*' if OPTS.bucketNamePath (instead of OPTS.bucket)
OPTS.bucket                       #ICBUCKET. DREADER_PARAMS.Bucket
OPTS.bucketNamePath               #Alternative, as 'BUCKET'
OPTS.maxItems                     #DREADER_CONF.MaxItems
OPTS.prefix                       #DREADER_PARAMS.Prefix

new S3JsonItemReader(OPTS)        #CREADER
new S3CSVItemReader(OPTS)         #Automatically allows PACTIONs described as above
new S3ManifestItemReader(OPTS)    #  - except uses Resource 'BUCKET_ARN:*', allows any OBJECT
OPTS.bucket[NamePath]|maxItems    #Same as above
OPTS.key                          #DREADER_PARAMS.Key
OPTS.csvHeaders                   #DREADER_CONF.CSV*. Either:
                                  #  - CsvHeaders.useFirstRow()
                                  #  - CsvHeaders.use('KEY'_ARR)
OPTS.csvDelimiter                 #DREADER_CONF.*

                                  ┌──────────────────┐
                                  │   MAP S3 WRITE   │
                                  └──────────────────┘

DSTATE_MAP.ResultWriter           #DWRITER. Write each OUTPUT item as a JSON S3 OBJECT, using PutObject()
                                  #Order is:
                                 %#  - ResultWriter -> Output
                                 $#  - ResultWriter -> ResultSelector -> ResultPath -> OutputPath
                                  #On error, throws:
                                  #  - 'States.Permissions': auth-related
                                  #  - 'States.ResultWriterFailed': else

DWRITER.Resource                  #Always 'arn:aws:states:::s3:putObject'
                                  #Can be omitted, in which case DWRITER_CONF is still applied

DWRITER.Arguments                %
DWRITER.Parameters               $#DWRITER_PARAMS, as DOEXPR
DWRITER_PARAMS.Bucket             #'BUCKET'
                                  #Must be in same ACCOUNT|REGION as MACHINE
DWRITER_PARAMS.Prefix             #'PREFIX'. OBJECT prefix

DWRITER.WriterConfig              #DWRITER_CONF
DWRITER_CONF.OutputType           #'JSON' (def) or 'JSONL' (JSON Lines, see its doc)
DWRITER_CONF.Transformation       #What the new OUTPUT is:
                                  #  - 'NONE' (def if DWRITER): EXEC_ARR
                                  #     - always used if some EXEC failed
                                  #  - 'COMPACT' (def if no DWRITER): same as old OUTPUT
                                  #  - 'FLATTEN': same as COMPACT, but flattens ARRs if OUTPUTs are ARRs themselves

DWRITER_OUTPUT                    #No size limit on initial total OUTPUT (can be > 256KB)
DWRITER_OUTPUT.MapRunArn          #'MAP_RUN_ARN'
DWRITER_OUTPUT.ResultWriterDetails#DWRITER_PARAMS_OUTPUT
DWRITER_PARAMS_OUTPUT.Bucket      #'BUCKET'

DWRITER_PARAMS_OUTPUT.Key         #'DWRITER_MANIFEST_PATH'
PREFIX/UUID/manifest.json         #DWRITER_MANIFEST_PATH, containing DWRITER_MANIFEST
PREFIX/UUID/*_NUM.json            #NUM starts at 0. Rotates to a new file every 5GB
PREFIX/UUID/SUCCEEDED_NUM.json    #Successful OUTPUTs
PREFIX/UUID/FAILED_NUM.json       #Failed OUTPUTs
PREFIX/UUID/PENDING_NUM.json      #Aborted OUTPUTs

MAP_COUNT.resultsWritten          #NUM that completed using DWRITER

                                  ┌───────────────────────┐
                                  │   MAP S3 WRITE AUTH   │
                                  └───────────────────────┘

PACTION s3:PutObject|GetObject    #Must be allowed:
 |ListMultipartUploadParts        #  - on MACHINE.roleArn
 |AbortMultipartUpload            #  - Resource BUCKET/PREFIX/*

                                  ┌──────────────────────┐
                                  │   MAP S3 WRITE IAC   │
                                  └──────────────────────┘

CSTATE_MAP_OPTS.resultWriter      #CWRITER. DSTATE_MAP.ResultWriter
new ResultWriter(OPTS)            #CWRITER
                                  #Automatically allows PACTIONs as described above
OPTS.bucket                       #ICBUCKET. DWRITER_PARAMS.Bucket
OPTS.prefix                       #DWRITER_PARAMS.Prefix

                                  ┌──────────┐
                                  │   WAIT   │
                                  └──────────┘

DSTATE.Type                       #'Wait'. STATE is STATE_WAIT
                                  #Wait for a specific duration
                                  #For more complex wait logic, see ACTIVITY_TASK, JOB_TASK and ASYNC_TASK

DSTATE_WAIT.Timestamp             #'DATE'[_DZEXPR]
                                  #If in the past, no wait
DSTATE_WAIT.Seconds               #NUM[_DZEXPR]. Alternative to Timestamp

EVENT_TYPE WaitStateAborted       #On STATE_WAIT abort

                                  ┌──────────────┐
                                  │   WAIT IAC   │
                                  └──────────────┘

new Wait
 (...CARGS[, CSTATE_WAIT_OPTS])   #CSTATE_WAIT

CSTATE_WAIT_OPTS.time             #DPASS.Timestamp|Seconds, either:
                                  #  - WaitTime.timestamp('DATE')
                                  #  - WaitTime.duration(DURATION)

                                  ┌───────────────┐
                                  │   TASK MAIN   │
                                  └───────────────┘

DSTATE.Type                       #'Task'. STATE is STATE_TASK
                                  #On error, throws:
                                  #  - 'States.Permissions': auth-related
                                  #  - 'States.TaskFailed': else (except 'States.Timeout')

DSTATE_TASK.Resource              #'ARN'. Available ones documented below
                                  #Must be in same REGION
                                  #Can be in different ACCOUNT (see below)
                                  #Required

EVENT_TYPE TaskScheduled          #On TASK schedule
EVENT_TYPE TaskStarted            #On TASK start success
EVENT_TYPE TaskStartFailed        #On TASK start failure
EVENT_TYPE TaskSubmitted          #On TASK submit success
EVENT_TYPE TaskSubmitFailed       #On TASK submit failure
EVENT_TYPE TaskSucceeded          #On TASK end success
EVENT_TYPE TaskStateAborted       #On TASK end abort
EVENT_TYPE TaskFailed             #On TASK end failure

EVENT_INFO.resource               #DSTATE_TASK.Resource
                                  #With EVENT_TYPEs Task* (except TaskState*)
EVENT_INFO.resourceType           #'RESTYPE' of DSTATE_TASK.Resource
                                  #With EVENT_TYPEs Task* (except TaskState*)
EVENT_INFO.region                 #'REGION' of DSTATE_TASK.Resource
                                  #With EVENT_TYPE TaskScheduled
EVENT_INFO.parameters             #'INPUT_OBJ'
                                  #With EVENT_TYPE TaskScheduled

                                  ┌────────────────────┐
                                  │   TASK MAIN AUTH   │
                                  └────────────────────┘

DSTATE_TASK.Credentials.RoleArn   #'ROLE_ARN'[_DFEXPR] assumed by MACHINE.roleArn
                                  #I.e. like MACHINE.roleArn but only during a specific STATE_TASK
                                  #Must be assumable by MACHINE.roleArn
                                  #Required when DSTATE_TASK.Resource is in another ACCOUNT:
                                  #  - must be a ROLE in that other ACCOUNT
                                  #  - trust POLICY should use COND_KEY sts:ExternalId MACHINE_ARN

EVENT_INFO.taskCredentials.roleArn#'ROLE_ARN'. With EVENT_TYPE TaskScheduled

CONTEXT.Execution.RoleArn         #MACHINE.roleArn or DSTATE_TASK.Credentials.RoleArn

                                  ┌───────────────────┐
                                  │   TASK MAIN IAC   │
                                  └───────────────────┘

CSTATE_TASK                       #Base class for STATE_TASKs
                                  #Must instantiate C*TASK instead, which are child classes
                                  #  - e.g. CLAMBDA_TASK, CSQS_TASK, etc.
                                  #  - all inherit CSTATE_TASK[_OPTS].*

CCUSTOM_TASK                      #Custom user-defined CSTATE_TASK
                                  #Must define it and `extend` from `TaskBase`
                                  #Only needed as a workaround if CDK is missing some features
CCUSTOM_TASK._renderTask          #FUNC()->DSTATE_TASK_OBJ. Required

CSTATE_TASK_OPTS.credentials.role #DSTATE_TASK.Credentials.RoleArn
                                  #Value must be TaskRole.fromRole(ICROLE)
                                  #Allows MACHINE.roleArn to assume it
                                  #  - if a DZEXPR was passed: allows MACHINE.roleArn to assume any ROLE instead,
                                  #    not just Credentials.RoleArn ROLE_ARN

JsonPath.executionRoleArn        $#'$$.Execution.RoleArn'

                                  ┌───────────────────────────┐
                                  │   TASK MAIN METRICS IAC   │
                                  └───────────────────────────┘

CCUSTOM_TASK.taskMetrics          #CTASK_METRICS
CTASK_METRICS.metricDimensions    #DOBJ set when calling CCUSTOM_TASK.metric*()

CTASK_METRICS.metricPrefixSingular#'...'. Allows calling CCUSTOM_TASK.metric...SUFFIX()
                                  #  - for METRIC 'AWS/States/...SUFFIX'
                                  #  - SUFFIX is RunTime, ScheduleTime or Time
CTASK_METRICS.metricPrefixPlural  #Same but SUFFIX is Scheduled, Started, Succeeded, Failed or [Heartbeat]TimedOut

                                  ┌────────────────────┐
                                  │   TASK MAIN LINT   │
                                  └────────────────────┘

DIAG_ERROR INVALID_RESOURCE       #DSTATE_TASK.Resource must be valid

asl-validator --no-arn-check      #BOOL (def: false). !VALIDATOR_OPTS.checkArn
VALIDATOR_OPTS.checkArn           #BOOL. If true (def), validates that DTASK_RESOURCE is an ARN

                                  ┌───────────────┐
                                  │   TASK HTTP   │
                                  └───────────────┘

DSTATE_TASK.Resource              #'arn:aws:states:::http:invoke'. HTTP_TASK
                                  #Call an HTTP request
                                  #Throttles 300/s RATE_LIMIT, 300 BURST_LIMIT (soft) (see token bucket algorithm doc) per ACCOUNT + REGION

DSTATE_TASK.TimeoutSeconds        #Like above but def|max 1m
                                  #Throws 'States.Http.Socket' instead

INPUT.ApiEndpoint                 #'URL'. Required
INPUT.Method                      #'HTTP_METHOD', uppercased. Required
INPUT.Headers                     #HEADERS_OBJ. Values can ARRs
                                  #Only for custom headers
                                  #  - not standard HTTP header nor 'x-amz[n]-*'
                                  #  - else throws 'States.RuntimeError'
INPUT.QueryParameters             #QUERY_OBJ. Values can be ARRs
                                  #Automatically URL encodes

INPUT.RequestBody                 #VAL
INPUT.Transform                   #Automatically encode VAL:
 .RequestBodyEncoding             #  - 'NONE': none if STR, else JSON
                                  #  - 'URL_ENCODED': URL encoding
                                  #      - must also set INPUT.headers['content-type'] 'application/x-www-form-urlencoded'
INPUT.Transform                   #When RequestBodyEncoding 'URL_ENCODED', how to encode ARRs:
 .RequestEncodingOptions          #  - 'INDICES' (def): ARR[NUM]=VAL&ARR[NUM2]=VAL2&...
                                  #  - 'BRACKETS': ARR[]=VAL&ARR[]=VAL2&...
                                  #  - 'REPEAT': ARR=VAL&ARR=VAL2&...
                                  #  - 'COMMAS': ARR=VAL,VAL2,...

TEST_DATA.request                 #TEST_REQ
TEST_REQ.url                      #'URL'
TEST_REQ.protocol                 #'http[s]'
TEST_REQ.method                   #'HTTP_METHOD'
TEST_REQ.headers                  #'HEADERS_OBJ'
TEST_REQ.body                     #'VAL'

INPUT.Authentication.ConnectionArn#EventBridge CONN_ARN. Required
                                  #I.e. should not need to put credentials inside INPUT.*
                                  #  - note: EventBridge CONN uses Secrets Manager under-the-hood
                                  #On error, throws 'Events.ConnectionResource.ERROR'
                                  #If both CONN and INPUT.* sets the same HTTP header, query param or body
                                  #  - merged, with CONN having priority
                                  #  - throws 'States.RuntimeError' if request body and both are STRs
INPUT.InvocationConfig
 .ConnectionArn                   #Same but when using a PRIVATE_CONN

TEST_IN.revealSecrets             #BOOL. If false (def), HTTP_TASK omits credentials in TEST_DATA.request|response
                                  #I.e. only if TEST_IN.inspectionLevel 'TRACE'

OUTPUT.*                          #Undocumented, so the following is a guess
OUTPUT.StatusCode                 #STATUS_NUM
OUTPUT.StatusMessage              #'STATUS'
OUTPUT.Headers                    #HEADERS_OBJ
                                  #Throws 'States.RuntimeError' if Content-Type [S] is application/octet-stream or image|video|audio/*
OUTPUT.ResponseBody               #STR
                                  #Throws 'States.RuntimeError' if binary

ERROR_OUTPUT.error                #'States.Http.StatusCode.4**|5**'
                                  #I.e. fails TASK if 4**|5**

TEST_DATA.response                #TEST_RES
TEST_RES.protocol                 #'http[s]'
TEST_RES.statusCode               #'STATUS_NUM'
TEST_RES.statusMessage            #'STATUS'
TEST_RES.headers                  #'HEADERS_OBJ'
TEST_RES.body                     #'VAL'

                                  ┌──────────────────┐
                                  │   TASK HTTP UI   │
                                  └──────────────────┘

WORKFLOW STUDIO ==>               #Can view|edit HTTP_TASKs

                                  ┌────────────────────┐
                                  │   TASK HTTP AUTH   │
                                  └────────────────────┘

PACTION states:InvokeHTTPEndpoint #Must be allowed to MACHINE.roleArn for Resource MACHINE_ARN to use HTTP_TASK
COND_KEY states:HTTPMethod        #'HTTP_METHOD'. Only with states:InvokeHttpEndpoint
COND_KEY states:HTTPEndpoint      #'URL'. Only with states:InvokeHttpEndpoint

PACTION events:
 RetrieveConnectionCredentials    #Must be allowed to MACHINE.roleArn for Resource CONN_ARN to use HTTP_TASK

PACTION secretsmanager:
 GetSecretValue|DescribeSecret    #Must be allowed to MACHINE.roleArn for Resource SECRET 'events!connection/*' to use HTTP_TASK

PACTION states:RevealSecrets      #Must be allowed on current PRINCIPAL if TEST_IN.revealSecrets true

                                  ┌───────────────────┐
                                  │   TASK HTTP IAC   │
                                  └───────────────────┘

new HttpInvoke(...CARGS[, OPTS])  #CSTATE_TASK that is an HTTP_TASK
 ->CHTTP_TASK                     #Automatically allows PACTIONs as described above except:
                                  #  - states:InvokeHTTPEndpoint allowed on any MACHINE, although only for a specific 'URL'
                                  #  - no COND_KEY HttpMethod
                                  #  - does not allow states:RevealSecrets

OPTS.*                            #CSTATE_TASK_OPTS.*

OPTS.apiRoot                      #'ORIGIN' of INPUT.ApiEndpoint
OPTS.apiEndpoint                  #CTASK_INPUT. 'PATH' of INPUT.ApiEndpoint
OPTS.method                       #CTASK_INPUT. INPUT.Method
OPTS.headers                      #CTASK_INPUT. INPUT.Headers
OPTS.queryStringParameters        #CTASK_INPUT. INPUT.QueryParameters

OPTS.body                         #CTASK_INPUT. INPUT.RequestBody
OPTS.urlEncodingFormat            #STR. Either:
                                  #  - INPUT.Transform.RequestBodyEncoding 'NONE'
                                  #  - INPUT.Transform.RequestEncodingOptions or 'DEFAULT' (same as 'INDICES')

OPTS.connection                   #EventBridge ICONN. INPUT.Authentication.ConnectionArn

                                  ┌───────────────────────┐
                                  │   TASK HTTP LOGGING   │
                                  └───────────────────────┘

CLOUDTRAIL ==>                    #HTTP_TASK requests are logged with CloudTrail as data EVENTs
                                  #MACHINE is LOG_RESOURCE

CLOUDTRAIL_SMETADATA.httpMethod   #'HTTP_METHOD'
CLOUDTRAIL_SMETADATA.httpEndpoint #'URL'

                                  ┌──────────────────────────┐
                                  │   TASK SERVICE GENERIC   │
                                  └──────────────────────────┘

DSTATE_TASK.Resource              #'arn:aws:states:::aws-sdk:SERVICE_TASK_ACTION[.SERVICE_TASK_PATTERN]'
                                  #"SDK integration". GENERIC_SERVICE_TASK
                                  #SERVICE_TASK that runs any AWS SERVICE ACTION

SERVICE_TASK_ACTION               #Any 'SERVICE:ACTION'
                                  #Recent SERVICE|ACTIONs take up to 3 months to be supported
                                  #'SERVICE':
                                  #  - lowercased
                                  #  - see online doc for specific 'SERVICE' name, since it sometimes differs
                                  #     - e.g. for Step Functions itself it is 'sfn'
                                  #     - at https://docs.aws.amazon.com/step-functions/latest/dg/supported-services-awssdk.html#supported-services-awssdk-list
                                  #ACTION is always camelCase'd

INPUT.*                           #ACTION's PARAMS.*, using the JavaScript SDK's names and shape

OUTPUT.*                          #ACTION's RES.*, using the JavaScript SDK's names and shape

ERROR_OUTPUT.error                #'SERVICE.CODE[Exception]', e.g. 'AcmPca.ResourceNotFoundException'
                                  #'Exception' is only appended if CODE does not already end with it
                                  #'SERVICE':
                                  #  - PascalCase'd
                                  #  - see online doc for specific 'SERVICE' name, since it sometimes differs
                                  #     - e.g. for Step Functions itself is is 'Sfn'
                                  #     - see link above

                                  ┌──────────────────────────────┐
                                  │   TASK SERVICE GENERIC IAC   │
                                  └──────────────────────────────┘

new CallAwsService
 (...CARGS[, OPTS])->CAWS_TASK    #CSTATE_TASK that is a GENERIC_SERVICE_TASK

OPTS.*                            #CSTATE_TASK_OPTS.*

OPTS.service                      #'SERVICE'
OPTS.action                       #'ACTION', camelcase'd

OPTS.parameters                   #INPUT.* (def: {})
                                  #Is a DOEXPR

OPTS.iamAction                    #'PACTION' to allow to MACHINE.roleArn
                                  #Def: 'SERVICE:ACTION'
OPTS.iamResources                 #'RESOURCE'_ARR to allow to MACHINE.roleArn on that PACTION
                                  #Required
OPTS.additionalIamStatements      #Additional CSTATEMENT_ARR (def: []) to allow to MACHINE.roleArn

                                  ┌────────────────────────────────────────────┐
                                  │   TASK SERVICE GENERIC CROSS-REGIONS IAC   │
                                  └────────────────────────────────────────────┘

new CallAwsServiceCrossRegion     #Same as CallAwsService() but cross-REGION
 (...CARGS[, OPTS])->CAWS_TASK    #Actually implemented as a LAMBDA_TASK with a FUNCTION that calls the JavaScript SDK
                                  #Uses a singleton FUNCTION with 30s timeout
                                  #Automatically allows lambda:InvokeFunction for MACHINE.roleArn on that FUNCTION
                                  #OPTS.*iam* PACTIONs are allowed on FUNC_VERSION.Role instead

OPTS.*                            #Same as CallAwsService()

OPTS.region|endpoint              #COPTS.*

OPTS.retryOnServiceExceptions     #Same as LambdaInvoke() (see Lambda doc)

                                  ┌────────────────────────────┐
                                  │   TASK SERVICE OPTIMIZED   │
                                  └────────────────────────────┘

DSTATE_TASK.Resource              #'arn:aws:states:::SERVICE_TASK_ACTION[.SERVICE_TASK_PATTERN]'
                                  #"Optimized integration". OPTIMIZED_SERVICE_TASK
                                  #Like GENERIC_SERVICE_TASK but optimized for a specific SERVICE + ACTION
                                  #E.g. automatically JSON serializes specific PARAM.* or parses RES.*
                                  #Only specific ones, documented in their respective docs
                                  #  - including Lambda, the most commonly used one

SERVICE_TASK_ACTION               #Available ones depend on SERVICE, but usually similar to 'SERVICE:ACTION'

INPUT.*                           #SERVICE_TASK_ACTION-specific, but usually mostly correspond to an ACTION's PARAMS.*

OUTPUT.*                          #Same for ACTION's RES.*

                                  ┌────────────────────────────────┐
                                  │   TASK SERVICE OPTIMIZED IAC   │
                                  └────────────────────────────────┘

new CLASS(...CARGS[, OPTS])       #CSTATE_TASK that is an OPTIMIZED_SERVICE_TASK
 ->C..._TASK                      #SERVICE_TASK_ACTION-specific, documented in their respective docs

OPTS.*                            #CSTATE_TASK_OPTS.*

OPTS.*                            #Converted to INPUT.*
                                  #Can always be DFEXPRs

                                  ┌─────────────────────┐
                                  │   TASK SERVICE UI   │
                                  └─────────────────────┘

WORKFLOW STUDIO ==>               #Can view|edit SERVICE_TASKs

                                  ┌──────────────────────┐
                                  │   TASK SERVICE IAC   │
                                  └──────────────────────┘

TaskInput.from*(VAL)              #CTASK_INPUT. Just wraps its argument as is
                                  #Used as a type for some SERVICE_TASK's INPUT.* values
TaskInput.fromText(STR)           #
TaskInput.fromObject(OBJ)         #
TaskInput.fromJsonPathAt
 ('DFEXPR')                      $#

                                  ┌───────────────────────────┐
                                  │   TASK SERVICE COMPOSER   │
                                  └───────────────────────────┘

MACHINE ENHANCED COMPONENT ==>    #Can add SERVICE_TASK by linking UI components
                                  #Must first add RESPROP DefinitionSubstitutions.KEY and use it as value in SERVICE-specific INPUT
                                  #E.g. for Lambda: INPUT.FunctionName '${KEY}'

                                  ┌──────────────────────────┐
                                  │   TASK SERVICE METRICS   │
                                  └──────────────────────────┘

AWS/States/                       #Duration (in ms) of SERVICE_TASKs
 ServiceIntegrationRunTime        #cdk-monitoring-constructs:
                                  #  - p50|90|99: METRIC, summary WIDGET, MALARM DurationP50|90|99 > CXALARM_OPTS.maxDuration
AWS/States/                       #Duration (in ms) of SERVICE_TASKs, scheduling time only
 ServiceIntegrationScheduleTime   #cdk-monitoring-constructs:
                                  #  - p50|90|99: METRIC, summary WIDGET
                                  #     - must use new StepFunctionServiceIntegrationMetricFactory(CMETRIC_FACTORY, CXMONITORING_OPTS)
                                  #         .metricServiceIntegrationScheduleTimeP50|90|99InMillis()
AWS/States/ServiceIntegrationTime #Duration (is ms) of SERVICE_TASKs, excluding scheduling
                                  #cdk-monitoring-constructs:
                                  #  - p50|90|99: METRIC, summary WIDGET
                                  #     - must use new StepFunctionServiceIntegrationMetricFactory(CMETRIC_FACTORY, CXMONITORING_OPTS)
                                  #         .metricServiceIntegrationTimeP50|90|99InMillis()

AWS/States/                       #NUM of SERVICE_TASKs scheduled
 ServiceIntegrationsScheduled     #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/States/                       #NUM of SERVICE_TASKs started
 ServiceIntegrationsStarted       #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/States/                       #NUM of SERVICE_TASKs successful
 ServiceIntegrationsSucceeded     #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/States/                       #NUM of SERVICE_TASKs failed
 ServiceIntegrationsFailed        #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM FailedServiceIntegrationsCount > CXALARM_OPTS.maxErrorCount
                                  #  - rate/s: METRIC, WIDGET, MALARM FailedServiceIntegrationsRate > CXALARM_OPTS.maxErrorRate
AWS/States/                       #NUM of SERVICE_TASKs timed out
 ServiceIntegrationsTimedOut      #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM TimedOutServiceIntegrationsCount > CXALARM_OPTS.maxErrorCount

DVAR ServiceIntegrationResourceArn#DSTATE_TASK.Resource. With AWS/States/ServiceIntegration*

                                  ┌──────────────────────────────┐
                                  │   TASK SERVICE METRICS IAC   │
                                  └──────────────────────────────┘

CFACADE.monitorStepFunction       #For AWS/States/ServiceIntegration*
 ServiceIntegration               #Not covered by CFACADE.monitorScope()
 (CXMONITORING_OPTS)              #See cdk-monitoring-constructs doc
CXMONITORING_OPTS
 .serviceIntegrationResourceArn   #DSTATE_TASK.Resource

                                  ┌─────────────────────────┐
                                  │   TASK SERVICE NESTED   │
                                  └─────────────────────────┘

states:startExecution             #OPTIMIZED_NESTED_EXEC. OPTIMIZED_SERVICE_TASK that calls StartExecution()
                                  #Nested EXEC
                                  #Difference from child MACHINEs (and their ITEM_EXECs):
                                  #  - MACHINEs and EXECs are completely separate
                                  #  - meant for re-using sub-MACHINEs as components
                                  #Can be:
                                  #  - ASYNC_TASK
                                  #  - JOB_TASK:
                                  #     - polls with DescribeExecution, aborts with StopExecution()
                                  #     - SERVICE_TASK_PATTERN is either '.sync' or '.sync:2'

INPUT.*                           #EXEC.* (PascalCase'd) except no includedData|traceHeader

INPUT.AWS_STEP_FUNCTIONS_         #Must be set to CONTEXT.Execution.Id
 STARTED_BY_EXECUTION_ID          #This allows nested EXEC to know about its parent
                                  #This seems to be currently only used in UI, to show link to parent

OUTPUT.*                          #EXEC.* (PascalCase'd)
                                  #If JOB_TASK, EXEC.Input|Output is:
                                  #  - 'OBJ_JSON' if '.sync'
                                  #  - OBJ if '.sync:2'

                                  ┌──────────────────────────────┐
                                  │   TASK SERVICE NESTED AUTH   │
                                  └──────────────────────────────┘

PACTION states:StartExecution     #Must be allowed for MACHINE.roleArn on MACHINE2

PACTION states:DescribeExecution  #If JOB_TASK, must be allowed for MACHINE.roleArn on any EXEC of MACHINE2
 |StopExecution                   #I.e. on 'arn:aws:states:REGION:ACCOUNT_ID:execution:MACHINE2:*'
PACTION events:PutTargets|PutRule #If JOB_TASK, must be allowed for MACHINE.roleArn
 |DescribeRule                    #on EventBridge RULE 'StepFunctionsGetEventsForStepFunctionsExecutionRule'

                                  ┌─────────────────────────────┐
                                  │   TASK SERVICE NESTED IAC   │
                                  └─────────────────────────────┘

new StepFunctionsStartExecution   #CSTATE_TASK for OPTIMIZED_NESTED_EXEC
 (...CARGS, OPTS)->CNESTED_TASK   #Automatically allows PACTIONs as described above

OPTS.*                            #CSTATE_TASK_OPTS.*

OPTS.stateMachine                 #ICMACHINE. INPUT.StateMachineArn
OPTS.input                        #CTASK_INPUT (def: '$'). INPUT.Input
OPTS.associateWithParent          #BOOL (def: false). Adds INPUT.AWS_STEP_FUNCTIONS_STARTED_BY_EXECUTION_ID
                                  #OPTS.input must use TaskInput.fromObject()
OPTS.name                         #INPUT.Name

                                  ┌─────────────────────────────┐
                                  │   TASK SERVICE NESTED SAM   │
                                  └─────────────────────────────┘

AWS::Serverless::Connector        #Can be used with:
                                  #  - Source: MACHINE (RESOURCE_REF.RoleName)
                                  #  - Destination: MACHINE2 (RESOURCE_REF.Arn + RESOURCE_REF.Name)
                                  #  - Permissions 'Read' and|or 'Write'
                                  #Transformed to a MPOLICY on 'ROLE':
                                  #  - allowing on MACHINE2 (from Arn):
                                  #     - Write: states:StartExecution
                                  #  - allowing on EXECUTION/* (from Name):
                                  #     - Read: states:DescribeExecution
                                  #     - Write: states:StopExecution
                                  #  - allowing on RULE 'StepFunctionsGetEventsForStepFunctionsExecutionRule':
                                  #     - Read: states:DescribeRule
                                  #     - Write: states:PutRule|PutTargets

                                  ┌──────────────────────────────────┐
                                  │   TASK SERVICE NESTED COMPOSER   │
                                  └──────────────────────────────────┘

MACHINE ENHANCED COMPONENT ==>    #Includes nested MACHINE

                                  ┌───────────────────────────┐
                                  │   TASK ACTIVITY DECLARE   │
                                  └───────────────────────────┘

ACTIVITY                          #Sets of ACTIVITY_TASKs
                                  #Create is idempotent
                                  #Max 1e5 (soft up to 1.5e5) per ACCOUNT
ACTIVITY.activityArn              #'ACTIVITY_ARN'. 'arn:aws:states:REGION:ACCOUNT_ID:activity:ACTIVITY'
ACTIVITY.name                     #'ACTIVITY'
                                  #Max 80 chars, [:alnum:]-_
ACTIVITY.creationDate             #DATE_NUM

                                  ┌───────────────────────────────┐
                                  │   TASK ACTIVITY DECLARE API   │
                                  └───────────────────────────────┘

CreateActivity()                  #Req: ACTIVITY
                                  #  - no activityArn
                                  #  - only one with tags
                                  #Res: ACTIVITY
                                  #  - no name, encryptionConfiguration
ListActivities()                  #Req: empty
                                  #Res: activities ACTIVITY_ARR
                                  #  - no encryptionConfiguration
DescribeActivity()                #Req: ACTIVITY
                                  #  - only activityArn
                                  #Res: ACTIVITY
DeleteActivity()                  #Req: ACTIVITY
                                  #  - only activityArn
                                  #Res: empty

                                  ┌───────────────────────────────┐
                                  │   TASK ACTIVITY DECLARE IAC   │
                                  └───────────────────────────────┘

AWS::StepFunctions::Activity      #RESPROPs: Name
                                  #RESATTRs: Arn, Name

new Activity
 (...CARGS[, CACTIVITY_OPTS])     #CACTIVITY
Activity.fromActivityArn
 (...CARGS, 'ACTIVITY_ARN')
 ->ICACTIVITY                     #
Activity.fromActivityName
 (...CARGS, 'ACTIVITY')
 ->ICACTIVITY                     #

CACTIVITY_OPTS.activityName       #ACTIVITY.name (def: CID)
ICACTIVITY.activityName           #'ACTIVITY'[_STR_TK]
ICACTIVITY.activityArn            #'ACTIVITY_ARN'[_STR_TK]

ICMACHINE.grantRead(YGRANTABLE)
 ->CGRANT                         #See above

                                  ┌─────────────────────────┐
                                  │   TASK ACTIVITY STATE   │
                                  └─────────────────────────┘

DSTATE_TASK.Resource              #'ACTIVITY_ARN'

                                  ┌─────────────────────────────┐
                                  │   TASK ACTIVITY STATE IAC   │
                                  └─────────────────────────────┘

new StepFunctionsInvokeActivity   #CSTATE_TASK that is an ACTIVITY_TASK
 (...CARGS, OPTS)->CACTIVITY_TASK #Automatically allows kms:* (as described below) if ENCRYPT.kmsKeyId set

OPTS.*                            #CSTATE_TASK_OPTS.*

OPTS.activity                     #ICACTIVITY

                                  ┌───────────────────────┐
                                  │   TASK ACTIVITY RUN   │
                                  └───────────────────────┘

ACTIVITY_TASK                     #TASK started|ended on a user-controlled compute
                                  #E.g. serverless, long running, local
                                  #Can also be used for custom wait logic
                                  #Created when a DSTATE_TASK with Resource 'ACTIVITY_ARN' is run

ACTIVITY_TASK_GET                 #Get an ACTIVITY_TASK
                                  #Until ACTIVITY_TASK created, long polls for it
                                  #  - after 1m, returns ACTIVITY_TASK.taskToken empty STR
                                  #  - then must retry
                                  #Max 1e3 at once
ACTIVITY_TASK_GET.activityArn     #'ACTIVITY_ARN'

ACTIVITY_TASK_GET.workerName      #'ACTIVITY_WORKER'. Only used for logging purpose, with EVENT_INFO.workerName

MULTITHREADING ==>                #When API initiates responding with ACTIVITY_TASK, a network error might prevent it from completing
                                  #When this happens, GetActivityTask() long poll continues until 1m timeout
                                  #I.e. for better performance, it is recommended to have many parallel GetActivityTask() calls at once
                                  #  - so that the above only happens to a small percentage of the ongoing pollers

EVENT_TYPE ActivityScheduled      #
EVENT_INFO.resource               #'ACTIVITY_ARN'
                                  #With EVENT_TYPE ActivityScheduled
EVENT_TYPE ActivityScheduleFailed #
EVENT_TYPE ActivityStarted        #
EVENT_INFO.workerName             #'ACTIVITY_WORKER'
                                  #With EVENT_TYPE ActivityStarted
EVENT_TYPE ActivitySucceeded
EVENT_TYPE ActivityFailed         #

DSTATE_TASK.TimeoutSeconds        #Like above but starts once ACTIVITY_TASK_GET completed
EVENT_TYPE ActivityTimedOut       #Like EVENT_TYPE TaskTimedOut, but only for ACTIVITY_TASK
EVENT_INFO.timeoutInSeconds       #DSTATE_TASK.TimeoutSeconds. With EVENT_TYPE ActivityScheduled

                                  ┌───────────────────────────┐
                                  │   TASK ACTIVITY RUN API   │
                                  └───────────────────────────┘

GetActivityTask()                 #Req: ACTIVITY_TASK_GET
                                  #Res: ACTIVITY_TASK

                                  ┌───────────────────────────┐
                                  │   TASK ACTIVITY RUN IAC   │
                                  └───────────────────────────┘

CACTIVITY.grant
 (YGRANTABLE, 'PACTION',...)
 ->CGRANT                         #Allow PACTION on Resource ACTIVITY_ARN

                                  ┌───────────────────────────────┐
                                  │   TASK ACTIVITY RUN METRICS   │
                                  └───────────────────────────────┘

AWS/States/ActivityRunTime        #Duration (in ms) of ACTIVITY_TASKs
                                  #cdk-monitoring-constructs:
                                  #  - p50|90|99: METRIC, summary WIDGET, MALARM DurationP50|90|99 > CXALARM_OPTS.maxDuration
AWS/States/ActivityScheduleTime   #Duration (in ms) of ACTIVITY_TASKs, scheduling time only
                                  #cdk-monitoring-constructs:
                                  #  - p50|90|99: METRIC, summary WIDGET
                                  #     - must use new StepFunctionActivityMetricFactory(CMETRIC_FACTORY, CXMONITORING_OPTS)
                                  #         .metricActivityScheduleTimeP50|90|99InMillis()
AWS/States/ActivityTime           #Duration (is ms) of ACTIVITY_TASKs, excluding scheduling
                                  #cdk-monitoring-constructs:
                                  #  - p50|90|99: METRIC, summary WIDGET
                                  #     - must use new StepFunctionActivityMetricFactory(CMETRIC_FACTORY, CXMONITORING_OPTS)
                                  #         .metricActivityTimeP50|90|99InMillis()

AWS/States/ActivitiesScheduled    #NUM of ACTIVITY_TASKs scheduled
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/States/ActivitiesStarted      #NUM of ACTIVITY_TASKs started
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/States/ActivitiesSucceeded    #NUM of ACTIVITY_TASKs successful
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
AWS/States/ActivitiesFailed       #NUM of ACTIVITY_TASKs failed
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM FailedActivitiesCount > CXALARM_OPTS.maxErrorCount
                                  #  - rate/s: METRIC, WIDGET, MALARM FailedActivitiesRate > CXALARM_OPTS.maxErrorRate
AWS/States/ActivitiesTimedOut     #NUM of ACTIVITY_TASKs timed out
                                  #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET, MALARM TimedOutActivitiesCount > CXALARM_OPTS.maxErrorCount

DVAR ActivityArn                  #'ACTIVITY_ARN'. With AWS/States/Activit*
                                  #ACTIVITY is also a TELEMETRY_ENTITY

                                  ┌───────────────────────────────────┐
                                  │   TASK ACTIVITY RUN METRICS IAC   │
                                  └───────────────────────────────────┘

CACTIVITY[_TASK].metric
 ('METRIC'[, CMETRIC_OPTS])
 ->CMETRIC                        #Sets DVAR ActivityArn, statistic 'Sum'
CACTIVITY[_TASK].metricMETRIC     #Same except 'METRIC' omits 'Activity' prefix, e.g. CACTIVITY[_TASK].metricRunTime()
 ([CMETRIC_OPTS])->CMETRIC        #Also uses statistic 'Average' for *Time

CFACADE                           #For AWS/States/Activit*
 .monitorStepFunctionActivity     #Not covered by CFACADE.monitorScope()
 (CXMONITORING_OPTS)              #See cdk-monitoring-constructs doc
CXMONITORING_OPTS.activity        #ICACTIVITY

                                  ┌───────────────────────────────┐
                                  │   TASK ACTIVITY RUN LOGGING   │
                                  └───────────────────────────────┘

CLOUDTRAIL ==>                    #ACTIVITY_TASK_GET is logged with CloudTrail as data EVENTs
                                  #ACTIVITY is LOG_RESOURCE

                                  ┌──────────────┐
                                  │   TASK JOB   │
                                  └──────────────┘

SERVICE_TASK_PATTERN sync         #When used, makes a SERVICE_TASK a "Job pattern" (JOB_TASK)
                                  #Means the TASK waits for the SERVICE_TASK_ACTION's underlying async logic (JOB) to complete
                                  #Automatically:
                                  #  - polls for completion
                                  #  - then returns final output
                                  #  - e.g. with OPTIMIZED_NESTED_EXEC, uses DescribeExecution()
                                  #Only with OPTIMIZED_SERVICE_TASKs, and only some of them
                                  #If TASK is aborted, cancels JOB using SERVICE_TASK_ACTION-specific logic
                                  #  - e.g. with OPTIMIZED_NESTED_EXEC, uses StopExecution()

StepFunctionsGetEventsFor...Rule  #EventBridge RULE automatically created by JOB_TASK
                                  #Used as a complement to polling, to trigger completion as soon as it happens
                                  #Only for specific SERVICE_TASK_ACTIONs
                                  #Not if cross-ACCOUNT
                                  #Documented in each service

EVENT_TYPE *Scheduled|*Started    #When JOB_TASK starts
EVENT_TYPE *Submitted             #When JOB starts

                                  ┌───────────────────┐
                                  │   TASK JOB AUTH   │
                                  └───────────────────┘

PACTIONS ==>                      #MACHINE.roleArn must be allowed additional SERVICE_TASK_ACTION-specific PACTIONs to:
                                  #  - start the JOB
                                  #  - poll for JOB completion
                                  #  - cancel the JOB
                                  #Documented in each service

PACTION events:PutTargets|PutRule
 |DescribeRule                    #Must be allowed for MACHINE.roleArn on EventBridge RULE 'StepFunctionsGetEventsFor...Rule'

                                  ┌────────────────┐
                                  │   TASK ASYNC   │
                                  └────────────────┘

ASYNC_TASK                        #"Callback pattern". TASK that signals its completion manually
                                  #Do so by calling SendTask*()
                                  #Not with HTTP_TASKs
                                  #Cannot be cross-ACCOUNT
ASYNC_TASK_*.taskToken            #'ASYNC_TASK_MID'. To send with SendTask*()

ACTIVITY_TASK.taskToken           #'ASYNC_TASK_MID'. ACTIVITY_TASKs are always ASYNC_TASKs

SERVICE_TASK_PATTERN              #Make a SERVICE_TASK an ASYNC_TASK
 waitForTaskToken                 #Always wait for SERVICE_TASK_ACTION to complete
                                  #Some SERVICE_TASK_ACTIONs support it, others not
CONTEXT.Task.Token                #'ASYNC_TASK_MID'

DSTATE_TASK.TimeoutSeconds        #Still applies (see above), i.e. ASYNC_TASK can last max 1y

JOB_TASK                          #Can combine ASYNC_TASK + JOB_TASK by both:
                                  #  - using SERVICE_TASK_PATTERN sync
                                  #  - passing CONTEXT.Task.Token as INPUT
                                  #It behaves like JOB_TASK
                                  #Except can optionally call sendTask*() to stop polling and signal TASK's completion

EVENT_TYPE *Scheduled             #When ASYNC_TASK starts
EVENT_TYPE *Started               #When consumer gets the ASYNC_TASK_MID:
                                  #  - ACTIVITY_TASK: GetActivityTask()
                                  #  - SERVICE_TASK: right after *Scheduled
EVENT_TYPE *Submitted             #When initial consumer logic done:
                                  #  - ACTIVITY_TASK: right after *Started
                                  #  - SERVICE_TASK: SERVICE_TASK_ACTION success

                                  ┌─────────────────────┐
                                  │   TASK ASYNC AUTH   │
                                  └─────────────────────┘

PACTION states:                   #Must be allowed
 SendTaskSuccess|Failure|Heartbeat#E.g. if ASYNC_TASK, the compute instance must be allowed to call SendTask*()

                                  ┌────────────────────┐
                                  │   TASK ASYNC API   │
                                  └────────────────────┘

SendTaskSuccess()                 #Req: ASYNC_TASK_SUCCESS
                                  #Res: empty
SendTaskFailure()                 #Req: ASYNC_TASK_FAILURE
                                  #Res: empty

                                  ┌────────────────────┐
                                  │   TASK ASYNC IAC   │
                                  └────────────────────┘

CSTATE_TASK_OPTS                  #SERVICE_TASK_PATTERN among:
 .integrationPattern              #  - 'REQUEST_RESPONSE' (def): none
                                  #  - 'WAIT_FOR_TASK_TOKEN': 'waitForTaskToken'
                                  #  - 'RUN_JOB': 'sync'
                                  #Cannot be used with CCUSTOM_TASK: must set DSTATE_TASK.Resource using CCUSTOM_TASK._renderTask instead

JsonPath.taskToken               $#'$$.Task.Token'

ICMACHINE.grantTaskResponse
 (YGRANTABLE)->CGRANT             #Allows PACTION 'states:SendTaskSuccess|SendTaskFailure|SendTaskHeartbeat' to MACHINE

                                  ┌────────────────────┐
                                  │   TASK ASYNC SAM   │
                                  └────────────────────┘

StepFunctionsCallbackPolicy       #SAM POLICY_TEMPLATE (see its doc) that allows:
                                  #  - PACTION states:SendTaskFailure|SendTaskHeartbeat|SendTaskSuccess
                                  #  - on 'MACHINE'
                                  #     - using POLICY_TEMPLATE_PARAMS.StateMachineName

                                  ┌────────────────────┐
                                  │   TASK HEARTBEAT   │
                                  └────────────────────┘

DSTATE_TASK.HeartbeatSeconds      #NUM[_DZEXPR] (in secs, def: none). Heartbeat timeout, reset after each heartbeat
                                  #On timeout, throws 'States.Timeout'
                                  #  - see above for related EVENTs and METRICs
                                  #Must be < DTASK_TASK.TimeoutSeconds
                                  #Only for ASYNC_TASKs
                                  #With ACTIVITY_TASK: starts once ACTIVITY_TASK_GET completed

ERROR_CODE                        #Special ERROR_CODE in DCATCH|DRETRY.ErrorEquals to catch heatbeat timeout
 'States.HeartbeatTimeout'        #'States.Timeout' can still be used, since it is the one actually thrown

RECOMMENDED ==>                   #Because:
                                  #  - aborted ASYNC_TASKs (including ACTIVITY_TASKs) keep running
                                  #  - but SendTaskHeartbeat() fails if TASK was aborted
                                  #  - i.e. allows terminating ASYNC_TASKs on abort

EVENT_INFO.heartbeatInSeconds     #DSTATE_TASK.HeartbeatSeconds
                                  #With EVENT_TYPEs ActivityScheduled, TaskScheduled

                                  ┌────────────────────────┐
                                  │   TASK HEARTBEAT API   │
                                  └────────────────────────┘

SendTaskHeartbeat()               #Req: ASYNC_TASK_HEARTBEAT
                                  #Res: empty

                                  ┌────────────────────────┐
                                  │   TASK HEARTBEAT IAC   │
                                  └────────────────────────┘

CSTATE_TASK_OPTS.heartbeatTimeout #DSTATE_TASK.HeartbeatSeconds
                                  #Value must be Timeout.duration(DURATION)

ICMACHINE.grantTaskResponse
 (YGRANTABLE)->CGRANT             #See above

                                  ┌────────────────────────────┐
                                  │   TASK HEARTBEAT METRICS   │
                                  └────────────────────────────┘

AWS/States/                       #NUM of ACTIVITY_TASKs timed out due to heartbeat
 ActivitiesHeartbeatTimedOut      #cdk-monitoring-constructs:
                                  #  - sum: METRIC, summary WIDGET
DVAR ActivityArn                  #See above

                                  ┌────────────────────────────────┐
                                  │   TASK HEARTBEAT METRICS IAC   │
                                  └────────────────────────────────┘

CACTIVITY[_TASK]
 .metricHeartbeatTimedOut
 ([CMETRIC_OPTS])->CMETRIC        #Sets DVAR ActivityArn, statistic 'Sum'

                                  ┌────────────────┐
                                  │   ENCRYPTION   │
                                  └────────────────┘

MACHINE.encryptionConfiguration   #ENCRYPT. Encrypts at rest:
                                  #  - 'DMACHINE_JSON'
                                  #  - EVENTs
                                  #  - EXEC.input|output
                                  #  - EXEC.error|cause (if set)
ACTIVITY.encryptionConfiguration  #ENCRYPT. Encrypts at rest:
                                  #  - ACTIVITY_TASK.input|output
                                  #  - ACTIVITY_TASK.error|cause (if set)

ENCRYPT.type                      #Either:
                                  #  - 'AWS_OWNED_KEY' (def): AWS managed KMS KEY
                                  #  - 'CUSTOMER_MANAGED_KMS_KEY': ENCRYPT.kmsKeyId
ENCRYPT.kmsKeyId                  #KMS 'KEY_ARN' or (if same ACCOUNT) 'KEY_MID'

ENCRYPT
 .kmsDataKeyReusePeriodSeconds    #NUM of secs (min 1m, def 5m, max 15m) to re-use KMS data key, for performance and cost

MACHINE_GET.includedData          #Whether to return MACHINE.definition: 'ALL_DATA' (yes, def) or 'METADATA_ONLY' (no)
                                  #Meant when ENCRYPT.kmsKeyId used and caller does not have KMS permission
EXEC_GET.includedData             #Same but with EXEC.input|output|error|cause
EXEC.inputDetails|outputDetails
 .included                        #Same as BOOL

                                  ┌─────────────────────┐
                                  │   ENCRYPTION AUTH   │
                                  └─────────────────────┘

PACTION                           #If ENCRYPT.kmsKeyId, must be allowed for MACHINE.roleArn on Resource KEY
 kms:Decrypt|GenerateDataKey      #COND_KEY:
                                  #  - MACHINE: COND_KEY kms:EncryptionContext:aws:states:stateMachineArn MACHINE_ARN
                                  #  - ACTIVITY: COND_KEY kms:EncryptionContext:aws:states:activityArn ACTIVITY_ARN

                                  ┌────────────────────┐
                                  │   ENCRYPTION IAC   │
                                  └────────────────────┘

AWS::StepFunctions::
 StateMachine|Activity            #Includes RESPROPs: EncryptionConfiguration

CMACHINE.encryptionConnfiguration #ENCRYPT. Can be:
CACTIVITY[_OPTS]                  #  - new AwsOwnedEncryptionConfiguration()
 .encryptionConfiguration         #  - new CustomerManagedEncryptionConfiguration(IKEY[, DURATION])
                                  #Automatically allows kms:* as described above

                                  ┌─────────────┐
                                  │   LOGGING   │
                                  └─────────────┘

MACHINE.loggingConfiguration      #MACHINE_LOGGING. Log EVENTs to CloudWatch Logs
                                  #MACHINE is also a LOGGING_ENTITY
MACHINE_LOGGING.destinations[0]
 .cloudWatchLogsLogGroup          #'LOG_GROUP_ARN'
 .logGroupArn                     #'LOG_GROUP' must start with '/aws/vendedlogs/states' and end with ':*'

MACHINE_LOGGING.level             #Which EVENT_TYPEs are logged among:
                                  #  - 'OFF' (def): none
                                  #  - 'FATAL': ExecutionAborted|Failed|TimedOut
                                  #  - 'ERROR': *Aborted|Failed|TimedOut, FailStateEntered
                                  #  - 'ALL': all

MACHINE_LOGGING
 .includeExecutionData            #Like EVENTS_REQ.includeExecutionData

EVENT_INFO.input|output
 |assignedVariablesDetails        #BOOL. Whether EVENT_INFO.input|output|assignedVariables truncated at 248KB
 .truncated                       #With same EVENT_TYPEs as EVENT_INFO.input|output|assignedVariables

                                  ┌──────────────────┐
                                  │   LOGGING AUTH   │
                                  └──────────────────┘

PACTION logs:CreateLogDelivery
 |GetLogDelivery
 |UpdateLogDelivery
 |DeleteLogDelivery
 |ListLogDeliveries
 |PutResourcePolicy
 |DescribeResourcePolicies
 |DescribeLogGroups               #Must be allowed on Resource '*' for MACHINE.roleArn
PACTION                           #Must be allowed for MACHINE.roleArn
 logs:CreateLogStream|PutLogEvents#On Resource LOG_STREAM, but which LOG_STREAM is used is not documented

PACTION kms:GenerateDataKey       #If ENCRYPT.kmsKeyId, must be allowed on:
                                  #  - Resource KEY_ARN
                                  #  - Principal MACHINE.roleArn
                                  #  - COND_KEY kms:EncryptionContext:SourceArn 'arn:aws:logs:REGION:ACCOUNT_ID:*'
PACTION kms:Decrypt               #If ENCRYPT.kmsKeyId, must be allowed on:
                                  #  - Resource '*'
                                  #  - Principal.Service 'delivery.logs.amazonaws.com'

                                  ┌─────────────────────┐
                                  │   LOGGING SAM CLI   │
                                  └─────────────────────┘

sam logs                          #Can search logs on a MACHINE (see CloudWatch logs doc)

                                  ┌─────────────────┐
                                  │   LOGGING IAC   │
                                  └─────────────────┘

AWS::StepFunctions::StateMachine  #Includes RESPROPs: LoggingConfiguration

CMACHINE_OPTS.logs                #CMACHINE_LOGGING. MACHINE.loggingConfiguration
                                  #Automatically allows logs:* and kms:* as described above
                                  #Does not allow PACTION logs:CreateLogStream|PutLogEvents
CMACHINE_LOGGING.destination      #ICLOG_GROUP. MACHINE_LOGGING.destinations[0].cloudWatchLogsLogGroup.logGroupArn
CMACHINE_LOGGING.level            #MACHINE_LOGGING.level. Def 'ERROR' if CMACHINE_OPTS.logs set, 'OFF' else
CMACHINE_LOGGING
 .includeExecutionData            #MACHINE_LOGGING.*

                                  ┌─────────────────┐
                                  │   LOGGING SAM   │
                                  └─────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs: Logging

                                  ┌──────────────────────┐
                                  │   LOGGING COMPOSER   │
                                  └──────────────────────┘

MACHINE ENHANCED COMPONENT ==>    #Includes MACHINE_LOGGING

                                  ┌──────────────────┐
                                  │   LOGGING LINT   │
                                  └──────────────────┘

cdk-nag StepFunctionStateMachine
 AllLogsToCloudWatch              #MACHINE_LOGGING must be enabled, with level 'ALL'

                                  ┌─────────────┐
                                  │   TRACING   │
                                  └─────────────┘

MACHINE
 .tracingConfiguration.enabled    #BOOL (def: false). Enables X-Ray

EXEC.traceHeader                  #STR. X-Ray header

                                  ┌──────────────────┐
                                  │   TRACING AUTH   │
                                  └──────────────────┘

PACTION xray:PutTraceSegments
 |PutTelemetryRecords
 |GetSamplingRules
 |GetSamplingTargets              #Must be allowed for MACHINE.roleArn on Resource '*'

                                  ┌─────────────────┐
                                  │   TRACING IAC   │
                                  └─────────────────┘

AWS::StepFunctions::StateMachine  #Includes RESPROPs: TracingConfiguration

CMACHINE_OPTS.tracingEnabled      #MACHINE.tracingConfiguration.enabled
                                  #Automatically allows xray:* as described above

                                  ┌─────────────────┐
                                  │   TRACING SAM   │
                                  └─────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs: Tracing

                                  ┌─────────────────────┐
                                  │   TRACING LINTING   │
                                  └─────────────────────┘

cfn-lint-serverless
 aws_sfn_state_machine_tracing
 WS5000                           #MACHINE.TracingConfiguration.Enabled must be true
cdk-nag
 StepFunctionStateMachineXray     #Same

                                  ┌────────────────────┐
                                  │   QUERY LANGUAGE   │
                                  └────────────────────┘

DMACHINE.QueryLanguage            #'JSONPath' (def) or 'JSONata'
                                  #Prefer JSONata: simpler, more features, better maintained, recommended by AWS
                                  #Inherited by child MACHINEs
                                  #Only for top-level MACHINE

DSTATE.QueryLanguage              #'JSONPath|JSONata'. Override for a given STATE
                                  #Cannot set 'JSONPath' if DMACHINE.QueryLanguage is 'JSONata'
                                  #Not inherited by child MACHINEs

                                  ┌────────────────────────┐
                                  │   QUERY LANGUAGE IAC   │
                                  └────────────────────────┘

CMACHINE_OPTS.queryLanguage       #DMACHINE.*

CSTATE_OPTS.queryLanguage         #DSTATE.*
State.jsonPath|jsonata(...)       #Same as new State(...) but sets CSTATE_OPTS.queryLanguage
                                  #State is actually the child class, e.g. Succeed.jsonPath|jsonata(...)
                                  #  - including STATE_TASK, e.g. StepFunctionsStartExecution.jsonPath|jsonata(...)

                                  ┌─────────────┐
                                  │   JSONATA   │
                                  └─────────────┘

NOTATION ==>                     %#Notation for JSONata-specific documentation

DSEXPR|DZEXPR|DFEXPR|DOEXPR      %#All mean the same thing: any value can be "{% ... %}" where ... is a JSONata query
                                 %#  - either top-level value, or nested one
                                 %#Substituted with its result
                                 %#If no match, or on error, throws 'States.QueryEvaluationError'

$states.*                        %#Special DVARs, documented below
                                 %#Cannot be set
                                 %#Every query must start with either $states or $DVAR
                                 %#  - not with $$ nor implicit|explicit $
                                 %#     - e.g. $$.VAR, $.VAR or VAR
                                 %#  - but can use nested implicit|explicit $
                                 %#     - e.g. $states.input[VAR = true] or $states.input[$.VAR = true]

EVENT_TYPE EvaluationFailed      %#On JSONata query error
EVENT_INFO.state                 %#'STATE' name
                                 %#With EVENT_TYPE EvaluationFailed
EVENT_INFO.location              %#JSONata ERROR.location
                                 %#With EVENT_TYPE EvaluationFailed

                                  ┌─────────────────┐
                                  │   JSONATA IAC   │
                                  └─────────────────┘

DSEXPR|DZEXPR|DFEXPR|DOEXPR      %#Can use as is, anywhere it is allowed
                                 %#Some properties require a specific method:
                                 %#  - DSTATE_WAIT.Seconds: WaitTime.seconds(NUM_CZEXPR)
                                 %#  - DSTATE_TASK.TimeoutSeconds|HeartbeatSeconds: Timeout.jsonata('DZEXPR')

                                  ┌──────────────────┐
                                  │   JSONATA LINT   │
                                  └──────────────────┘

statelint                        %#Currently ignores JSONata fields, i.e. does not lint them, but does not fail either

asl-validator                    %#Validates JSONata fields, but not JSONata syntax itself

                                  ┌──────────────┐
                                  │   JSONPATH   │
                                  └──────────────┘

NOTATION ==>                     $#Notation for JSONPath-specific documentation

$...                             $#JSONPath (see its doc)
                                 $#Root value is INPUT (after transforming)
                                 $#Exception: root value is OUTPUT (after transforming) in *.Assign (except DSTATE_CHOICE|WAIT.Assign)
                                 $#Cannot use [(EXPR)] and [?(EXPR)]
                                 $#If no match, throws 'States.Runtime'

DSEXPR                           $#"Path". '$...' or '$$...'
                                 $#Substituted with its result, which can be any JSON type
DZEXPR                           $#"Reference path". DSEXPR but result must be a single value
                                 $#Can only use .VAR [NUM]
                                 $#No * .. [...,...] [...:...:...]
VAL[_DZEXPR|_DFEXPR]             $#Means VAL can be a DZEXPR|DFEXPR, providing key is appended with 'Path'
                                 $#E.g. DSTATE_TASK.TimeoutSecondsPath NUM_DZEXPR

DFEXPR                           $#DSEXPR or 'DFUNC(...)'
DOEXPR                           $#"Payload template". OBJ where top|nested PROPs:
                                 $#  - value can be DFEXPR
                                 $#  - providing key is 'PROP.$' (which becomes 'PROP')

                                  ┌──────────────────┐
                                  │   JSONPATH IAC   │
                                  └──────────────────┘

JsonPath.*                       $#C*EXPR, to use anywhere 'D*EXPR' is expected
                                 $#Throws on JSONPath syntax error (validation is fairly basic)
                                 $#Are STR_TK, which are resolved to 'D*EXPR'
                                 $#If VAL[_DZEXPR]: must append 'Path' to key
                                 $#  - for DCOND.*: must append 'JsonPath' instead
                                 $#If inside a DOEXPR: must not append '.$', as it automatically done instead
                                 $#Some properties require a specific method:
                                 $#  - DSTATE_WAIT.Seconds: WaitTime.secondsPath(NUM_CZEXPR)
                                 $#  - DSTATE_TASK.Credentials.RoleArn: TaskRole.fromRoleArnJsonPath('ROLE_ARN'_CZEXPR)
                                 $#  - DSTATE_TASK.TimeoutSeconds|HeartbeatSeconds: Timeout.at('DZEXPR')
                                 $#Not supported yet for:
                                 $#  - DBATCH.BatchInput
                                 $#  - DSTATE_PARALLEL.Parameters.*
                                 $#  - DSTATE_MAP.Parameters.* (if DISTRIBUTED)

ALTERNATIVE ==>                  $#Instead of using C*EXPR, can use raw format, i.e.:
                                 $#  - value 'D*EXPR'
                                 $#  - key appended with '.$' (if inside DOEXPR) or 'Path' (if VAL[_DZEXPR])
                                 $#Exceptions: C*EXPR is required for:
                                 $#  - DCOND
                                 $#  - specific methods above, like WaitTime.secondPath()
                                 $#  - '$$.Task.Token' when using ASYNC_TASK

JsonPath.isEncodedJsonPath(STR)
 ->BOOL                          $#Whether STR is a C*EXPR

JsonPath.stringAt('DFEXPR')      $#'DFEXPR'

JsonPath.entirePayload           $#'$'

                                  ┌───────────────────┐
                                  │   JSONPATH LINT   │
                                  └───────────────────┘

statelint                        $#Valid JSONPath in DSEXPR|DZEXPR|DFEXPR (not inside DOEXPR)
asl-validator                    $#Same but also inside DOEXPR

DIAG_WARNING NO_PATH
statelint
asl-validator                    $#If VAL is DZEXPR, key must be appended with 'Path'

DIAG_WARNING NO_DOLLAR
statelint
asl-validator                    $#DOEXPR key must be 'PROP.$' if value is DFEXPR

asl-validator                    $#Must not define both 'PROP' and 'PROP.$'|'PROPPAth'

                                  ┌──────────────────────────────────────┐
                                  │   JSONPATH LINT ASL-PATH-VALIDATOR   │
                                  └──────────────────────────────────────┘

asl-validator --no-path-check    $#BOOL (def: false). !VALIDATOR_OPTS.checkPaths
VALIDATOR_OPTS.checkPaths        $#BOOL. If true (def), check D*EXPRs using asl-path-validator

asl-path-validator               $#Version 0.16.1

PATH_VALIDATOR                   $#Validates D*EXPR for syntax error, as used by DEFINITION
 ('D*EXPR', 'D*EXPR_TYPE')       $#Also validates DFUNCs
 ->PATH_VALIDATOR_RES            $#'D*EXPR_TYPE' can be:
                                 $#  - 'result_path': DZEXPR, no $DVAR (for OUTPUT.ResultPath)
                                 $#  - 'reference_path': DZEXPR
                                 $#  - 'path': DSEXPR
                                 $#  - 'payload_template': DFEXPR
PATH_VALIDATOR_RES.isValid       $#BOOL
PATH_VALIDATOR_RES.code          $#'CODE'
PATH_VALIDATOR_RES.message       $#'MESSAGE'

registerAll(AJV, OPTS)           $#Adds SCHEMA.format 'asl_D*EXPR_TYPE' to AJV
OPTS.silent                      $#BOOL. If false (def), report errors with AJV's AOPTS.logger.error()
OPTS.format_names.D*EXPR_TYPE    $#'FORMAT' (def: 'asl_D*EXPR_TYPE'). Customize 'FORMAT' name

                                  ┌───────────────────────┐
                                  │   INTRISIC FUNCTION   │
                                  └───────────────────────┘

$FUNC(...)                       %#Additional $FUNCs available

States.DFUNC([ARG[_DFEXPR],...]) $#"Intrinsic function", among the following
                                 $#If no DFEXPR, ARG:
                                 $#  - cannot be ARR, OBJ
                                 $#  - if STR, must be '-quoted, and \-escape any ' { } \
                                 $#On syntax error, throws 'States.Runtime'

MathAdd(NUM, NUM2)->NUM3         $#NUM + NUM2

Format(STR, VAL,...)->STR        $#Replaces any {} with each VAL
                                 $#VAL must be STR|NUM|BOOL|null, not OBJ|ARR
StringSplit(STR, "CHAR")
 ->STR2_ARR                      $#STR.split("CHAR")

JsonMerge(OBJ, OBJ2, false)->OBJ3$#Shallow merge

Array(VAL,...)->ARR              $#
$range(NUM, NUM2, NUM3)->ARR     %
ArrayRange(NUM, NUM2, NUM3)->ARR $#From NUM (included) to NUM2 (included) with step NUM3
                                 $#ARR max length 1e3
ArrayLength(ARR)->NUM            $#ARR.length
ArrayGetItem(ARR, NUM)->VAL      $#ARR[NUM]
ArrayContains(ARR, VAL)->BOOL    $#ARR.includes()
ArrayUnique(ARR)->ARR            $#[...new Set(ARR)]
$partition(ARR, NUM)->ARR_ARR    %
ArrayPartition(ARR, NUM)
 ->ARR_ARR                       $#Chunks into sub-ARRs of length NUM

StringToJson('JSON')->VAL        $#JSON.parse()
JsonToString(DSEXPR)->'JSON'     $#JSON.stringify()
Base64Encode(STR)->'BASE64'      $#STR max 1e4 chars
Base64Decode('BASE64')->STR      $#STR max 1e4 chars

$hash(STR, 'ALGO')->'HASH'       %
Hash(STR, 'ALGO')->'HASH'        $#ALGO can be 'MD5' or 'SHA-1|256|384|512'
                                 $#STR max 1e4 chars

$random([SEED_INT])->NUM         %
MathRandom(INT, INT2[, SEED_INT])
 ->INT3                          $#From INT (included) to INT2 (included). Pseudo-random
$uuid()->'UUIDv4'                %
UUID()->'UUIDv4'                 $#

$eval(...)                       %#Not available
$parse('JSON')->VAL              %#JSON parsing

                                  ┌───────────────────────────┐
                                  │   INTRISIC FUNCTION IAC   │
                                  └───────────────────────────┘

JsonPath.DFUNC(ARG,...)          $#'States.DFUNC(...)'
                                 $#DFUNC is camelCase'd
                                 $#ARG can be STR, NUM or C*EXPR
                                 $#  - STR is automatically escaped

JsonPath.numberAt('DFEXPR')      $#Same but returned as NUM_TK
                                 $#Must be passed to JsonPath.DFUNC() if ARG is NUM
JsonPath.listAt('DSEXPR')        $#Same for ARR (using an ARR_TK)
JsonPath.objectAt('DFEXPR')      $#Same for OBJ (using a RV)

                                  ┌──────────┐
                                  │   TAGS   │
                                  └──────────┘

TAGS.resourceArn                  #'MACHINE_ARN|ACTIVITY_ARN'
                                  #For MACHINEs, apply to all VERSIONs
TAGS.tags
MACHINE|ACTIVITY.tags             #TAG_PAIRS

                                  ┌───────────────┐
                                  │   TAGS AUTH   │
                                  └───────────────┘

COND_KEY aws:ResourceTag/TAG      #Can apply to EXEC too

                                  ┌──────────────┐
                                  │   TAGS API   │
                                  └──────────────┘

TagResource()                     #Req: TAGS
                                  #Res: empty
ListTagsForResource()             #Req: TAGS
                                  #  - only resourceArn
                                  #Res: TAGS
                                  #  - no resourceArn
UntagResource()                   #Req: TAGS
                                  #  - tags -> tagKeys 'TAG'_ARR
                                  #Res: empty

                                  ┌──────────────┐
                                  │   TAGS IAC   │
                                  └──────────────┘

AWS::StepFunctions::
 StateMachine|Activity            #Includes RESPROPs: Tags TAG_PAIRS

                                  ┌──────────────┐
                                  │   TAGS SAM   │
                                  └──────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs:
                                  #  - Tags OBJ
                                  #  - PropagateTags BOOL: whether Tags targets:
                                  #     - false (def): MACHINE
                                  #     - true: all generated RESOURCEs

                                  ┌─────────────────┐
                                  │   API GATEWAY   │
                                  └─────────────────┘

INTEGRATION.integrationSubtype   -#Can be 'StepFunctions-Start[Sync]Execution|StopExecution'
                                  #I.e. first-class INTEGRATION (see API Gateway doc)

                                  ┌──────────────────────┐
                                  │   API GATEWAY AUTH   │
                                  └──────────────────────┘

INTEGRATION.credentialsArn       -#See API Gateway doc

                                  ┌─────────────────────┐
                                  │   API GATEWAY IAC   │
                                  └─────────────────────┘

new HttpStepFunctionsIntegration -#CINTEGRATION with:
 ('CONSTRUCT'[, OPTS])            #  - INTEGRATION.type 'AWS_PROXY'
                                  #  - INTEGRATION.subtype 'StepFunctions-...' (i.e. first-class)
                                  #     - def: 'StepFunctions-StartExecution'
                                  #INTEGRATION.credentials is a new ROLE
                                  #  - assumabled by Service.Principal 'apigateway.amazonaws.com'
                                  #  - allowed PACTION 'states:...Execution' to MACHINE
OPTS.stateMachine                -#ICMACHINE
OPTS.subtype|parameterMapping    -#Like CANY_INTEGRATION_OPTS.*

PARAMS.*                         -#Passed as EXEC.*
                                  #No need to set EXEC.StateMachineArn: automatically set
                                  #If StopExecution(), should set OPTS.parameterMapping with:
                                  #  new ParameterMapping().custom('ExecutionArn', '$request.querystring.executionArn')

new StepFunctionsRestApi         =#Like new RestApi(...) but with CAPI_OPTS.defaultIntegration StepFunctionsIntegration.startExecution()
 (...CARGS, OPTS)                 #Uses 'ANY' HTTP_METHOD
OPTS.*                           =#CAPI_OPTS.*
OPTS.*                           =#Passed to HttpStepFunctionsIntegration(..., OPTS)
                                  #OPTS.credentialsRole -> OPTS.role
OPTS.stateMachine                =#ICMACHINE

StepFunctionsIntegration         =#CINTEGRATION with:
 .startExecution                  #  - INTEGRATION.type 'AWS_PROXY'
 (ICMACHINE[, OPTS])              #  - INTEGRATION.uri for StartSyncExecution() (i.e. not first-class)
                                  #INTEGRATION.credentials is a new ROLE
                                  #  - assumabled by Service.Principal 'apigateway.amazonaws.com'
                                  #  - allowed PACTION 'states:StartSyncExecution' to MACHINE

OPTS.*                           =#CINTEGRATION_OOPTS (see API Gateway doc)

INTEGRATION.requestTemplates     =#Automatically set to pass following INPUT.*
INPUT.path.PATHVAR               =#'VAL'
                                  #Only if OPTS.path true (def)
INPUT.header                     =#HEADERS_OBJ
                                  #Only if OPTS.headers true (def: false)
INPUT.querystring                =#QUERY_OBJ
                                  #Only if OPTS.querystring true (def)
INPUT.body                       =#JSON VAL. Request body
INPUT.authorizer                 =#CONTEXT.authorizer
                                  #Only if OPTS.authorizer true (def: false)
INPUT.requestContext.VAR         =#CONTEXT.VAR2
                                  #Only if OPTS.requestContext.VAR true (def: false)
                                  #'VAR2' is 'VAR' as is except
                                  #  - identity.VAR -> VAR
                                  #  - authorizer.principalId -> authorizerPrincipalId
                                  #Some VARs not available, see source code at:
                                  #  https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-apigateway/lib/integrations/stepfunctions.ts#L300

IRESPS ==>                       =#Automatically set:
                                  #  - 200: OUTPUT
                                  #  - 400: {error: 'Bad request!'}
                                  #  - 500: ERROR_OUTPUT
                                  #     - including if EXEC failed
                                  #All with Content-Type: application/json [S]
                                  #Sets INTEGRATION.passthroughBehavior 'NEVER'

RRESPS ==>                       =#Automatically set for 200|400|500 with Content-Type: application/json [S]
                                  #Only if OPTS.useDefaultMethodResponses true (def)

DEPLOYMENT ==>                   =#New DEPLOYMENT when the following changes:
                                  #  - CMACHINE: 'MACHINE' name
                                  #  - ICMACHINE: MACHINE 'NID'
                                  #Unless CAPI_OPTS.deploy false

                                  ┌─────────────────────┐
                                  │   API GATEWAY SAM   │
                                  └─────────────────────┘

AWS::Serverless::StateMachine    =#Includes RESPROPs: Events.EVENT: Type 'Api', Properties:
                                  #  - RestApiId API Gateway API_MID
                                  #     - must be AWS::Serverless::Api not AWS::ApiGateway::RestApi
                                  #     - API must be defined in same TEMPLATE
                                  #     - def: create one named 'ServerlessRestApi'
                                  #  - Method 'HTTP_METHOD' (required)
                                  #     - using OPATHDEF.HTTP_METHOD
                                  #  - Path '/PATH' (required)
                                  #     - using OPATHS./PATH
                                  #  - UnescapeMappingTemplate BOOL (def: false)
                                  #     - replace any \-escaped ' in INPUT by ' (without \)
                                  #     - required when INPUT might contain '
                                  #  - Auth.*: like AWS::Serverless::Api RESPROP Auth.* but only:
                                  #     - ApiKeyRequired
                                  #     - ResourcePolicy
                                  #     - DefaultAuthorizer -> Authorizer
                                  #     - Authorizers[*].AuthorizationScopes -> AuthorizationScopes
                                  #Transformed to:
                                  #  - ROUTE
                                  #  - INTEGRATION:
                                  #     - type 'AWS'
                                  #     - uri 'arn:aws:apigateway:REGION:states:actions/StartExecution'
                                  #     - httpMethod 'POST'
                                  #     - requestTemplates['application/json']:
                                  #        - passes request body as EXEC.input
                                  #        - automatically sets EXEC.stateMachineArn
                                  #     - using OOPERATION.x-amazon-apigateway-integration.*
                                  #  - IRESPs|RESPs:
                                  #     - 200|400, passed as is
                                  #     - using OOPERATION.x-amazon-apigateway-integration.* and ORESPONSES
                                  #  - ROLE 'MACHINE{EVENT}Role'
                                  #     - used as INTEGRATION.credentials
                                  #     - assumable by Principal.Service 'apigateway.amazonaws.com'
                                  #     - allowed states:StartExecution on MACHINE|ALIAS

                                  ┌──────────────────────────┐
                                  │   API GATEWAY COMPOSER   │
                                  └──────────────────────────┘

API ENHANCED COMPONENT ==>       =#Can connect to MACHINE to create first-class INTEGRATION
                                  #Using AWS::Serverless::StateMachine RESPROP Events.EVENT: Type 'Api'

                                  ┌────────────────────────┐
                                  │   EVENTBRIDGE SOURCE   │
                                  └────────────────────────┘

PIPE.Enrichment                   #'MACHINE_ARN'. Calls StartSyncExecution()
                                  #Input is EXEC.input
                                  #Must be Express

                                  ┌─────────────────────────────┐
                                  │   EVENTBRIDGE SOURCE AUTH   │
                                  └─────────────────────────────┘

PACTION states:StartSyncExecution #Must be allowed on MACHINE for PIPE.RoleArn

                                  ┌────────────────────────────┐
                                  │   EVENTBRIDGE SOURCE IAC   │
                                  └────────────────────────────┘

new StepFunctionsEnrichment       #CPIPE_ENRICH
 (ICMACHINE[, OPTS])              #Automatically allows permissions as described above
OPTS.inputTransformation          #CPIPE_INPUT

                                  ┌────────────────────────┐
                                  │   EVENTBRIDGE TARGET   │
                                  └────────────────────────┘

TARGET.Arn                        #'MACHINE_ARN'. Calls StartExecution()
                                  #Input is EXEC.input

PIPE.Target                       #Same, but calling Start[Sync]Execution()
                                  #Max batch size: 256KB (i.e. normal limit)
PIPE_DEST.StepFunctionStateMachine#Either:
 Parameters.InvocationType        #  - 'REQUEST_RESPONSE' (def): StartSyncExecution()
                                  #  - 'FIRE_AND_FORGET': StartExecution()

SCHEDULE_TARGET.Arn               #Same, calling StartExecution()
                                  #Cannot use Express

                                  ┌─────────────────────────────┐
                                  │   EVENTBRIDGE TARGET AUTH   │
                                  └─────────────────────────────┘

PACTION
 states:Start[Sync]Execution      #Must be allowed on MACHINE for TARGET|PIPE|SCHEDULE_TARGET.RoleArn

                                  ┌────────────────────────────┐
                                  │   EVENTBRIDGE TARGET IAC   │
                                  └────────────────────────────┘

AWS::Pipes::Pipe                  #Includes RESPROPs: TargetParameters: StepFunctionStateMachineParameters

new SfnStateMachine(ICMACHINE
 [, CMACHINE_TARGET_OPTS])        #CTARGET
CMACHINE_TARGET_OPTS.*            #CTARGET_OPTS.*
CMACHINE_TARGET_OPTS.input        #CTARGET_INPUT
CMACHINE_TARGET_OPTS.role         #ICROLE (def: new singleton ROLE)
                                  #Automatically allows permissions as described above

new SfnStateMachine               #CPIPE_TARGET
 (ICMACHINE, OPTS)                #Adds permissions as described above
OPTS.inputTransformation          #CPIPE_INPUT
OPTS.invocationType               #PIPE_DEST.StepFunctionStateMachineParameters.InvocationType (def: 'FIRE_AND_FORGET')

new StepFunctionsStartExecution
 (ICMACHINE                       #CSCHEDULE_TARGET
 [, CMACHINE_STARGET_OPTS])       #Adds permissions as described above
CMACHINE_STARGET_OPTS.*           #CSTARGET_OPTS.*

                                  ┌────────────────────────────┐
                                  │   EVENTBRIDGE TARGET SAM   │
                                  └────────────────────────────┘

AWS::Serverless::StateMachine     #Includes RESPROPs: Events.EVENT:
                                  #  - Type 'EventBridgeRule|Schedule[V2]': same as AWS::Serverless::Function (see its doc) but:
                                  #     - creates RULE with TARGET MACHINE and its related ROLE 'MACHINERole'
                                  #     (Type 'EventBridgeRule')
                                  #     - def Properties.Target.Id: 'RULEStepFunctionsTarget'
                                  #     (Type 'Schedule')
                                  #     - no Properties: Target, RoleArn

AWS::Serverless::Connector        #Can be used with:
                                  #  - Source: RULE (RESOURCE_REF.RoleName)
                                  #  - Destination: MACHINE (RESOURCE_REF.Arn)
                                  #  - Permissions 'Write'
                                  #Transformed to a MPOLICY on 'ROLE':
                                  #  - allowing states:StartExecution
                                  #  - on MACHINE

                                  ┌─────────────────────────────────┐
                                  │   EVENTBRIDGE TARGET COMPOSER   │
                                  └─────────────────────────────────┘

RULE ENHANCED COMPONENT ==>       #Can connect to MACHINE to create TARGET + TARGET.RoleArn ROLE

SCHEDULE ENHANCED COMPONENT ==>   #Can connect to MACHINE to create SCHEDULE_TARGET + SCHEDULE_TARGET.RoleArn ROLE

                                  ┌───────────┐
                                  │   LOCAL   │
                                  └───────────┘

amazon/aws-stepfunctions-local    #Docker image to emulate Step Functions locally
                                  #Not well maintained
                                  #Does not support all features, and does not document which
                                  #Supports ASYNC_TASK

--endpoint-url|-endpointUrl       #'ORIGIN', e.g. 'http://localhost:PORT'
                                  #Must bind -p PORT:PORT

ENVVAR AWS_ACCOUNT_ID
--aws-account|-account            #
ENVVAR AWS_ACCESS_KEY_ID          #
ENVVAR AWS_SECRET_ACCESS_KEY      #
ENVVAR AWS_DEFAULT_REGION
--aws-region|-region              #

ENVVAR WAIT_TIME_SCALE
--wait-time-scale|-waitTimeScale  #NUM to multiply wait durations

./aws/states/LOG_GROUP
 /EXEC_ARN.log                    #EVENTs

ENVVAR *_ENDPOINT                 #'ORIGIN' to call for specific SERVICE *
--*-endpoint|-*Endpoint           #SERVICE can be LAMBDA, SQS, SNS, BATCH, DYNAMODB, ECS, GLUE, SAGE_MAKER
                                  #Def: not mocked, i.e. calls the normal endpoint

ENVVAR SFN_MOCK_CONFIG            #'PATH.json' to MCONF, to mock STATEs [ERROR_]OUTPUTs
                                  #Usually named MockConfigFile.json

MCONF.StateMachines.MACHINE       #MCONF_MACHINE. Matched only for MACHINE named 'MACHINE'
MCONF_MACHINE.TestCases.TEST      #MCONF_TEST. Matched only when EXEC.stateMachineArn ends with '#TEST'
MCONF_TEST.STATE                  #'MRES'. Matched only for STATE named 'STATE'

MCONF.MockedResponses.MRES.WHEN   #MRES. Mock STATE: returns specific [ERROR_]OUTPUT instead
                                  #WHEN is 'NUM[-NUM2]', i.e. used on the NUMth call
MRES.Return                       #OUTPUT
MRES.Throw                        #ERROR_OUTPUT