@factiii/stack 0.1.2 → 0.1.8

package/dist/plugins/pipelines/aws/index.js

@@ -85,13 +85,23 @@ const index_js_1 = require("../../../scanfix/index.js");
 // Import plugin-specific scanfix arrays
 const aws_cli_js_1 = require("./scanfix/aws-cli.js");
 const config_js_1 = require("./scanfix/config.js");
+const credentials_js_1 = require("./scanfix/credentials.js");
+const vpc_js_1 = require("./scanfix/vpc.js");
+const security_groups_js_1 = require("./scanfix/security-groups.js");
+const ec2_js_1 = require("./scanfix/ec2.js");
+const rds_js_1 = require("./scanfix/rds.js");
+const s3_js_1 = require("./scanfix/s3.js");
+const ecr_js_1 = require("./scanfix/ecr.js");
+const ses_js_1 = require("./scanfix/ses.js");
+const iam_js_1 = require("./scanfix/iam.js");
+const db_replication_js_1 = require("./scanfix/db-replication.js");
 // Import environment-specific operations
 const dev_js_1 = require("./dev.js");
 const prod_js_1 = require("./prod.js");
 // Import configs
-const ec2_js_1 = __importDefault(require("./configs/ec2.js"));
+const ec2_js_2 = __importDefault(require("./configs/ec2.js"));
 const free_tier_js_1 = __importDefault(require("./configs/free-tier.js"));
-// Import SSH helper
+// Import SSH helpers
 const ssh_helper_js_1 = require("../../../utils/ssh-helper.js");
 class AWSPipeline {
     // ============================================================
@@ -120,13 +130,24 @@ class AWSPipeline {
             region: 'us-east-1',
         },
     };
-    // Schema for factiiiAuto.yml (auto-detected)
+    // Schema for factiiiAuto.yml (auto-detected + provisioned resource IDs)
     static autoConfigSchema = {
         aws_cli_installed: 'boolean',
+        aws_vpc_id: 'string',
+        aws_subnet_public_id: 'string',
+        aws_subnet_private_ids: 'string[]',
+        aws_sg_ec2_id: 'string',
+        aws_sg_rds_id: 'string',
+        aws_ec2_instance_id: 'string',
+        aws_ec2_public_ip: 'string',
+        aws_rds_endpoint: 'string',
+        aws_rds_db_name: 'string',
+        aws_s3_bucket: 'string',
+        aws_ecr_registry: 'string',
     };
     /**
      * Determine if this plugin should be loaded for this project
-     * Loads if config has AWS settings, prod environment uses AWS, or on init
+     * Loads if any environment has pipeline: 'aws' or aws config
      */
     static async shouldLoad(_rootDir, config) {
         // Dynamic import to avoid circular dependencies
@@ -135,27 +156,26 @@ class AWSPipeline {
         for (const env of Object.values(environments)) {
             // Load if environment explicitly uses 'aws' pipeline
             if (env.pipeline === 'aws') {
-                // Verify it has real AWS config (not EXAMPLE values)
-                if (env.access_key_id && !env.access_key_id.startsWith('EXAMPLE-')) {
-                    return true;
-                }
+                return true;
+            }
+            // Load if environment has AWS-specific config
+            if (env.config && ['ec2', 'free-tier', 'standard', 'enterprise'].includes(env.config)) {
+                return true;
             }
-            // Check if domain looks like AWS (IP or AWS domain)
-            if (env.domain && !env.domain.startsWith('EXAMPLE-')) {
-                const isAwsDomain = /^(\d{1,3}\.){3}\d{1,3}$/.test(env.domain) ||
-                    env.domain.includes('.compute.amazonaws.com') ||
-                    env.domain.includes('.amazonaws.com') ||
-                    env.domain.includes('.aws');
-                if (isAwsDomain)
-                    return true;
+            // Load if environment has access_key_id
+            if (env.access_key_id) {
+                return true;
             }
         }
-        // On init (no config or EXAMPLE values), load as default prod option
-        return Object.keys(config).length === 0;
+        // Also load if top-level aws config exists
+        if (config.aws?.config || config.aws?.access_key_id) {
+            return true;
+        }
+        return false;
     }
     // Available configurations
     static configs = {
-        ec2: ec2_js_1.default,
+        ec2: ec2_js_2.default,
         'free-tier': free_tier_js_1.default,
     };
     static helpText = {
@@ -178,28 +198,70 @@ class AWSPipeline {
     /**
      * Check how this pipeline can reach a given stage
      * This is the core routing logic for the pipeline
+     *
+     * Only claims environments where pipeline: 'aws' or aws config exists.
+     * For staging/prod: checks SSH key first, falls back to workflow.
      */
     static canReach(stage, config) {
+        // Check if this stage has environments owned by this pipeline
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { getEnvironmentsForStage } = require('../../../utils/config-helpers.js');
+        const envs = getEnvironmentsForStage(config, stage);
+        const envValues = Object.values(envs);
         switch (stage) {
             case 'dev':
-                // Dev is always reachable locally
+                // Dev is always reachable locally (for AWS CLI checks)
                 return { reachable: true, via: 'local' };
             case 'secrets':
-                // Secrets require AWS credentials
-                if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
-                    return { reachable: false, reason: 'Missing AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)' };
+                // Secrets stage: check if AWS credentials are available
+                // Check Ansible Vault first (same pattern as factiii pipeline)
+                if (config.ansible?.vault_path) {
+                    // eslint-disable-next-line @typescript-eslint/no-require-imports
+                    const os = require('os');
+                    const vaultPasswordFile = config.ansible.vault_password_file?.replace(/^~/, os.homedir());
+                    // eslint-disable-next-line @typescript-eslint/no-require-imports
+                    const fsCheck = require('fs');
+                    const hasPasswordFile = vaultPasswordFile && fsCheck.existsSync(vaultPasswordFile);
+                    const hasPasswordEnv = !!process.env.ANSIBLE_VAULT_PASSWORD || !!process.env.ANSIBLE_VAULT_PASSWORD_FILE;
+                    if (hasPasswordFile || hasPasswordEnv) {
+                        return { reachable: true, via: 'local' };
+                    }
                 }
-                return { reachable: true, via: 'api' };
+                // Fallback: check env vars directly
+                if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+                    return { reachable: true, via: 'api' };
+                }
+                return { reachable: false, reason: 'Missing AWS credentials. Configure Ansible Vault or set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY env vars.' };
             case 'staging':
             case 'prod':
-                // On server (in workflow): run locally
-                if (process.env.GITHUB_ACTIONS === 'true') {
+                // Only handle environments that belong to this pipeline
+                if (envValues.length === 0) {
+                    return { reachable: false, reason: 'No ' + stage + ' environment configured' };
+                }
+                const hasAwsEnv = envValues.some(e => e.pipeline === 'aws' || e.config || e.access_key_id);
+                if (!hasAwsEnv) {
+                    return { reachable: false, reason: 'No AWS environment for ' + stage };
+                }
+                // On server: run locally
+                if (process.env.GITHUB_ACTIONS === 'true' || process.env.FACTIII_ON_SERVER === 'true') {
                     return { reachable: true, via: 'local' };
                 }
-                // On dev machine: need to trigger workflow or SSH directly
-                return { reachable: true, via: 'workflow' };
+                // Check for SSH key (direct SSH from dev machine)
+                {
+                    const sshKey = (0, ssh_helper_js_1.findSshKeyForStage)(stage);
+                    if (sshKey) {
+                        return { reachable: true, via: 'ssh' };
+                    }
+                }
+                // Fallback: use GitHub workflow
+                if (process.env.GITHUB_TOKEN) {
+                    return { reachable: true, via: 'workflow' };
+                }
+                // AWS provisioning fixes run locally on dev machine (AWS CLI)
+                // Even without SSH key, we can reach 'prod' for provisioning
+                return { reachable: true, via: 'local' };
             default:
-                return { reachable: false, reason: `Unknown stage: ${stage}` };
+                return { reachable: false, reason: 'Unknown stage: ' + stage };
         }
     }
     /**
@@ -227,6 +289,16 @@ class AWSPipeline {
         // Plugin-specific fixes
         ...aws_cli_js_1.awsCliFixes,
         ...config_js_1.configFixes,
+        ...credentials_js_1.credentialsFixes,
+        ...vpc_js_1.vpcFixes,
+        ...security_groups_js_1.securityGroupFixes,
+        ...ec2_js_1.ec2Fixes,
+        ...rds_js_1.rdsFixes,
+        ...s3_js_1.s3Fixes,
+        ...ecr_js_1.ecrFixes,
+        ...ses_js_1.sesFixes,
+        ...iam_js_1.iamFixes,
+        ...db_replication_js_1.dbReplicationFixes,
     ];
     // ============================================================
     // STATIC HELPER METHODS

package/dist/plugins/pipelines/aws/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/plugins/pipelines/aws/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAAyC;AAWzC,kCAAkC;AAClC,wDAKmC;AAEnC,wCAAwC;AACxC,qDAAmD;AACnD,mDAAkD;AAElD,yCAAyC;AACzC,qCAAqC;AACrC,uCAAmF;AAEnF,iBAAiB;AACjB,8DAAyC;AACzC,0EAAoD;AAGpD,oBAAoB;AACpB,gEAAuD;AAIvD,MAAM,WAAW;IACf,+DAA+D;IAC/D,kBAAkB;IAClB,+DAA+D;IAE/D,MAAM,CAAU,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,CAAU,IAAI,GAAG,cAAc,CAAC;IACtC,MAAM,CAAU,QAAQ,GAAe,UAAU,CAAC;IAClD,MAAM,CAAU,OAAO,GAAG,OAAO,CAAC;IAElC;;;OAGG;IACH,MAAM,CAAU,iBAAiB,GAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE3E;;OAEG;IACH,MAAM,CAAU,aAAa,GAAa,QAAQ,CAAC;IAEnD,gCAAgC;IAChC,MAAM,CAAU,eAAe,GAAa,EAAE,CAAC;IAE/C,yCAAyC;IACzC,MAAM,CAAU,YAAY,GAA4B;QACtD,GAAG,EAAE;YACH,MAAM,EAAE,KAAK,EAAE,gDAAgD;YAC/D,aAAa,EAAE,sBAAsB;YACrC,MAAM,EAAE,WAAW;SACpB;KACF,CAAC;IAEF,6CAA6C;IAC7C,MAAM,CAAU,gBAAgB,GAA2B;QACzD,iBAAiB,EAAE,SAAS;KAC7B,CAAC;IAEF;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,MAAqB;QAC7D,gDAAgD;QAChD,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,kCAAkC,GAAC,CAAC;QAEjF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,qDAAqD;YACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAC3B,qDAAqD;gBACrD,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,oDAAoD;YACpD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,MAAM,WAAW,GACf,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;oBAC1C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC;oBAC7C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACrC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC9B,IAAI,WAAW;oBAAE,OAAO,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,2BAA2B;IAC3B,MAAM,CAAC,OAAO,GAAiC;QAC7C,GAAG,EAAE,gBAAS;QACd,WAAW,EAAE,sBAAc;KAC5B,CAAC;IAEF,MAAM,CAAC,QAAQ,GAA2B;QACxC,GAAG,EAAE;;;;;;;8DAOqD;QAE1D,qBAAqB,EAAE;;;8DAGmC;KAC3D,CAAC;IAEF,+DAA+D;IAC/D,4BAA4B;IAC5B,+DAA+D;IAE/D;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,KAAY,EAAE,MAAqB;QACjD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,KAAK;gBACR,kCAAkC;gBAClC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAE3C,KAAK,SAAS;gBACZ,kCAAkC;gBAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;oBACzE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC;gBAC5G,CAAC;gBACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YAEzC,KAAK,SAAS,CAAC;YACf,KAAK,MAAM;gBACT,uCAAuC;gBACvC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;oBAC1C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;gBAC3C,CAAC;gBACD,2DAA2D;gBAC3D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YAE9C;gBACE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,KAAK,EAAE,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,WAAmB;QACzC,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,wDAAwD;IACxD,+DAA+D;IAC/D,sCAAsC;IACtC,8CAA8C;IAC9C,+DAA+D;IAE/D,MAAM,CAAU,KAAK,GAAG;QACtB,2BAA2B;QAC3B,GAAG,IAAA,yBAAc,EAAC,KAAK,EAAE,KAAK,CAAC;QAE/B,8DAA8D;QAC9D,GAAG,IAAA,yBAAc,EAAC,MAAM,CAAC;QACzB,GAAG,IAAA,uBAAY,EAAC,MAAM,CAAC;QACvB,GAAG,IAAA,sBAAW,EAAC,MAAM,CAAC;QACtB,IAAA,2BAAgB,EAAC,MAAM,EAAE,MAAM,CAAC;QAEhC,wBAAwB;QACxB,GAAG,wBAAW;QACd,GAAG,uBAAW;KACf,CAAC;IAEF,+DAA+D;IAC/D,wBAAwB;IACxB,+DAA+D;IAE/D;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,QAAgB;QAEhB,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAA4B,EAAE,OAAe;QAChE,OAAO,MAAM,IAAA,uBAAO,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,+DAA+D;IAC/D,mBAAmB;IACnB,+DAA+D;IAEvD,OAAO,CAAgB;IACvB,UAAU,CAA2B;IAE7C,YAAY,MAAqB;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QAEtB,uDAAuD;QACvD,MAAM,UAAU,GAAI,MAAM,EAAE,GAAG,EAAE,MAAwB,IAAI,KAAK,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAY,EAAE,UAAgD,EAAE;QAChF,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC7B,wCAAwC;YACxC,oDAAoD;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iCAAiC,KAAK,EAAE,EAAE,CAAC;QAC9E,CAAC;QAED,kCAAkC;QAClC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,KAAK,EAAE,EAAE,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAqB,EACrB,WAAmB,EACnB,UAAoC,EAAE;QAEtC,OAAO,IAAA,2BAAqB,EAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,WAAmB;QACrD,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAA,kBAAS,GAAE,CAAC;QACrB,CAAC;aAAM,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YAClE,OAAO,IAAA,oBAAU,EAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAqB,EAAE,WAAmB;QACvD,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAA,wBAAQ,EAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,kCAAkC,GAAC,CAAC;YACjF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC;YAE/D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YACvE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC;gBACtC,MAAM,WAAW,CAAC,OAAO,CACvB,SAAS,EACT;iDACuC,QAAQ;SAChD,CACA,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;;AAGH,kBAAe,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/plugins/pipelines/aws/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAAyC;AAWzC,kCAAkC;AAClC,wDAKmC;AAEnC,wCAAwC;AACxC,qDAAmD;AACnD,mDAAkD;AAClD,6DAA4D;AAC5D,6CAA4C;AAC5C,qEAAkE;AAClE,6CAA4C;AAC5C,6CAA4C;AAC5C,2CAA0C;AAC1C,6CAA4C;AAC5C,6CAA4C;AAC5C,6CAA4C;AAC5C,mEAAiE;AAEjE,yCAAyC;AACzC,qCAAqC;AACrC,uCAAmF;AAEnF,iBAAiB;AACjB,8DAAyC;AACzC,0EAAoD;AAGpD,qBAAqB;AACrB,gEAA2E;AAI3E,MAAM,WAAW;IACf,+DAA+D;IAC/D,kBAAkB;IAClB,+DAA+D;IAE/D,MAAM,CAAU,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,CAAU,IAAI,GAAG,cAAc,CAAC;IACtC,MAAM,CAAU,QAAQ,GAAe,UAAU,CAAC;IAClD,MAAM,CAAU,OAAO,GAAG,OAAO,CAAC;IAElC;;;OAGG;IACH,MAAM,CAAU,iBAAiB,GAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE3E;;OAEG;IACH,MAAM,CAAU,aAAa,GAAa,QAAQ,CAAC;IAEnD,gCAAgC;IAChC,MAAM,CAAU,eAAe,GAAa,EAAE,CAAC;IAE/C,yCAAyC;IACzC,MAAM,CAAU,YAAY,GAA4B;QACtD,GAAG,EAAE;YACH,MAAM,EAAE,KAAK,EAAE,gDAAgD;YAC/D,aAAa,EAAE,sBAAsB;YACrC,MAAM,EAAE,WAAW;SACpB;KACF,CAAC;IAEF,wEAAwE;IACxE,MAAM,CAAU,gBAAgB,GAA2B;QACzD,iBAAiB,EAAE,SAAS;QAC5B,UAAU,EAAE,QAAQ;QACpB,oBAAoB,EAAE,QAAQ;QAC9B,sBAAsB,EAAE,UAAU;QAClC,aAAa,EAAE,QAAQ;QACvB,aAAa,EAAE,QAAQ;QACvB,mBAAmB,EAAE,QAAQ;QAC7B,iBAAiB,EAAE,QAAQ;QAC3B,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,QAAQ;QACzB,aAAa,EAAE,QAAQ;QACvB,gBAAgB,EAAE,QAAQ;KAC3B,CAAC;IAEF;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,MAAqB;QAC7D,gDAAgD;QAChD,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,kCAAkC,GAAC,CAAC;QAEjF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,qDAAqD;YACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,8CAA8C;YAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,wCAAwC;YACxC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B;IAC3B,MAAM,CAAC,OAAO,GAAiC;QAC7C,GAAG,EAAE,gBAAS;QACd,WAAW,EAAE,sBAAc;KAC5B,CAAC;IAEF,MAAM,CAAC,QAAQ,GAA2B;QACxC,GAAG,EAAE;;;;;;;8DAOqD;QAE1D,qBAAqB,EAAE;;;8DAGmC;KAC3D,CAAC;IAEF,+DAA+D;IAC/D,4BAA4B;IAC5B,+DAA+D;IAE/D;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,KAAY,EAAE,MAAqB;QACjD,8DAA8D;QAC9D,iEAAiE;QACjE,MAAM,EAAE,uBAAuB,EAAE,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAwB,CAAC;QAE7D,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,KAAK;gBACR,uDAAuD;gBACvD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAE3C,KAAK,SAAS;gBACZ,wDAAwD;gBACxD,+DAA+D;gBAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;oBAC/B,iEAAiE;oBACjE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1F,iEAAiE;oBACjE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC9B,MAAM,eAAe,GAAG,iBAAiB,IAAI,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;oBACnF,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;oBACzG,IAAI,eAAe,IAAI,cAAc,EAAE,CAAC;wBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;oBAC3C,CAAC;gBACH,CAAC;gBACD,oCAAoC;gBACpC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;oBACvE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;gBACzC,CAAC;gBACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,6GAA6G,EAAE,CAAC;YAErJ,KAAK,SAAS,CAAC;YACf,KAAK,MAAM;gBACT,wDAAwD;gBACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,yBAAyB,EAAE,CAAC;gBACjF,CAAC;gBACD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC3F,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,KAAK,EAAE,CAAC;gBACzE,CAAC;gBAED,yBAAyB;gBACzB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;oBACtF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;gBAC3C,CAAC;gBAED,kDAAkD;gBAClD,CAAC;oBACC,MAAM,MAAM,GAAG,IAAA,kCAAkB,EAAC,KAAK,CAAC,CAAC;oBACzC,IAAI,MAAM,EAAE,CAAC;wBACX,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;oBACzC,CAAC;gBACH,CAAC;gBAED,gCAAgC;gBAChC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;oBAC7B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;gBAC9C,CAAC;gBAED,8DAA8D;gBAC9D,6DAA6D;gBAC7D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAE3C;gBACE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,GAAG,KAAK,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,WAAmB;QACzC,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,wDAAwD;IACxD,+DAA+D;IAC/D,sCAAsC;IACtC,8CAA8C;IAC9C,+DAA+D;IAE/D,MAAM,CAAU,KAAK,GAAG;QACtB,2BAA2B;QAC3B,GAAG,IAAA,yBAAc,EAAC,KAAK,EAAE,KAAK,CAAC;QAE/B,8DAA8D;QAC9D,GAAG,IAAA,yBAAc,EAAC,MAAM,CAAC;QACzB,GAAG,IAAA,uBAAY,EAAC,MAAM,CAAC;QACvB,GAAG,IAAA,sBAAW,EAAC,MAAM,CAAC;QACtB,IAAA,2BAAgB,EAAC,MAAM,EAAE,MAAM,CAAC;QAEhC,wBAAwB;QACxB,GAAG,wBAAW;QACd,GAAG,uBAAW;QACd,GAAG,iCAAgB;QACnB,GAAG,iBAAQ;QACX,GAAG,uCAAkB;QACrB,GAAG,iBAAQ;QACX,GAAG,iBAAQ;QACX,GAAG,eAAO;QACV,GAAG,iBAAQ;QACX,GAAG,iBAAQ;QACX,GAAG,iBAAQ;QACX,GAAG,sCAAkB;KACtB,CAAC;IAEF,+DAA+D;IAC/D,wBAAwB;IACxB,+DAA+D;IAE/D;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,QAAgB;QAEhB,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAA4B,EAAE,OAAe;QAChE,OAAO,MAAM,IAAA,uBAAO,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,+DAA+D;IAC/D,mBAAmB;IACnB,+DAA+D;IAEvD,OAAO,CAAgB;IACvB,UAAU,CAA2B;IAE7C,YAAY,MAAqB;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QAEtB,uDAAuD;QACvD,MAAM,UAAU,GAAI,MAAM,EAAE,GAAG,EAAE,MAAwB,IAAI,KAAK,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAY,EAAE,UAAgD,EAAE;QAChF,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC7B,wCAAwC;YACxC,oDAAoD;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iCAAiC,KAAK,EAAE,EAAE,CAAC;QAC9E,CAAC;QAED,kCAAkC;QAClC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,KAAK,EAAE,EAAE,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAqB,EACrB,WAAmB,EACnB,UAAoC,EAAE;QAEtC,OAAO,IAAA,2BAAqB,EAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,WAAmB;QACrD,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAA,kBAAS,GAAE,CAAC;QACrB,CAAC;aAAM,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YAClE,OAAO,IAAA,oBAAU,EAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAqB,EAAE,WAAmB;QACvD,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAA,wBAAQ,EAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,kCAAkC,GAAC,CAAC;YACjF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC;YAE/D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YACvE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC;gBACtC,MAAM,WAAW,CAAC,OAAO,CACvB,SAAS,EACT;iDACuC,QAAQ;SAChD,CACA,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;;AAGH,kBAAe,WAAW,CAAC"}

package/dist/plugins/pipelines/aws/scanfix/credentials.d.ts

@@ -0,0 +1,9 @@
+/**
+ * AWS Credential Fixes
+ *
+ * Handles AWS account setup guidance, credential validation,
+ * and region configuration checks.
+ */
+import type { Fix } from '../../../../types/index.js';
+export declare const credentialsFixes: Fix[];
+//# sourceMappingURL=credentials.d.ts.map

package/dist/plugins/pipelines/aws/scanfix/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAiB,GAAG,EAAE,MAAM,4BAA4B,CAAC;AAGrE,eAAO,MAAM,gBAAgB,EAAE,GAAG,EA4JjC,CAAC"}

package/dist/plugins/pipelines/aws/scanfix/credentials.js

@@ -0,0 +1,196 @@
+"use strict";
+/**
+ * AWS Credential Fixes
+ *
+ * Handles AWS account setup guidance, credential validation,
+ * and region configuration checks.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.credentialsFixes = void 0;
+const aws_helpers_js_1 = require("../utils/aws-helpers.js");
+exports.credentialsFixes = [
+    // ============================================================
+    // DEV STAGE - AWS CLI and account setup
+    // ============================================================
+    {
+        id: 'aws-account-not-setup',
+        stage: 'dev',
+        severity: 'critical',
+        description: 'AWS CLI not installed or not configured',
+        scan: async (config, _rootDir) => {
+            // Only check if AWS pipeline is configured
+            const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
+            if (!awsConfig.accessKeyId && !config.aws)
+                return false;
+            // Check if AWS CLI is installed
+            if (!(0, aws_helpers_js_1.isAwsCliInstalled)())
+                return true;
+            // Check if credentials are configured (can call STS)
+            const accountId = (0, aws_helpers_js_1.getAwsAccountId)(awsConfig.region);
+            return !accountId;
+        },
+        fix: null,
+        manualFix: [
+            'Setup AWS CLI:',
+            '',
+            '1. Create an AWS account at https://aws.amazon.com (free tier available)',
+            '',
+            '2. Install AWS CLI:',
+            '   Windows: winget install Amazon.AWSCLI',
+            '   macOS:   brew install awscli',
+            '   Linux:   curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && unzip awscliv2.zip && sudo ./aws/install',
+            '',
+            '3. Create an IAM user in AWS Console:',
+            '   IAM → Users → Create user → Attach AdministratorAccess policy',
+            '   → Security credentials → Create access key',
+            '',
+            '4. Configure AWS CLI:',
+            '   aws configure',
+            '   (Enter Access Key ID, Secret Access Key, region)',
+        ].join('\n'),
+    },
+    {
+        id: 'aws-region-configured',
+        stage: 'dev',
+        severity: 'warning',
+        description: 'AWS region not configured in factiii.yml',
+        scan: async (config, _rootDir) => {
+            // Only check if AWS pipeline is configured
+            const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
+            const environments = extractEnvironments(config);
+            const hasAwsEnv = Object.values(environments).some((e) => e.pipeline === 'aws');
+            if (!hasAwsEnv && !config.aws)
+                return false;
+            const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
+            // Check if region is explicitly set (not just default)
+            return !awsConfig.region || awsConfig.region === 'us-east-1' && !config.aws?.region;
+        },
+        fix: null,
+        manualFix: 'Set aws.region in factiii.yml under the prod environment or top-level aws block',
+    },
+    // ============================================================
+    // SECRETS STAGE - Credential validation
+    // ============================================================
+    {
+        id: 'aws-credentials-missing',
+        stage: 'secrets',
+        severity: 'critical',
+        description: 'AWS credentials not available (env vars or Ansible Vault)',
+        scan: async (config, _rootDir) => {
+            // Only check if AWS pipeline is configured
+            const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
+            const environments = extractEnvironments(config);
+            const hasAwsEnv = Object.values(environments).some((e) => e.pipeline === 'aws');
+            if (!hasAwsEnv && !config.aws)
+                return false;
+            // Check env vars
+            if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+                return false;
+            }
+            // Check if Ansible Vault has AWS credentials
+            if (config.ansible?.vault_path) {
+                try {
+                    const { AnsibleVaultSecrets } = await Promise.resolve().then(() => __importStar(require('../../../../utils/ansible-vault-secrets.js')));
+                    const vault = new AnsibleVaultSecrets({
+                        vault_path: config.ansible.vault_path,
+                        vault_password_file: config.ansible.vault_password_file,
+                    });
+                    const result = await vault.checkSecrets(['aws_access_key_id', 'aws_secret_access_key']);
+                    if (result.status?.aws_access_key_id && result.status?.aws_secret_access_key) {
+                        return false;
+                    }
+                }
+                catch {
+                    // Vault not accessible
+                }
+            }
+            return true;
+        },
+        fix: null,
+        manualFix: [
+            'Configure AWS credentials via one of:',
+            '',
+            '  Option A: Environment variables',
+            '    export AWS_ACCESS_KEY_ID=AKIA...',
+            '    export AWS_SECRET_ACCESS_KEY=...',
+            '',
+            '  Option B: AWS CLI configuration',
+            '    aws configure',
+            '',
+            '  Option C: Ansible Vault (recommended)',
+            '    Add aws_access_key_id and aws_secret_access_key to your vault file',
+            '    npx factiii secrets edit',
+        ].join('\n'),
+    },
+    {
+        id: 'aws-credentials-invalid',
+        stage: 'secrets',
+        severity: 'warning',
+        description: 'AWS credentials are invalid or expired',
+        scan: async (config, _rootDir) => {
+            // Only check if AWS CLI is installed and credentials exist
+            if (!(0, aws_helpers_js_1.isAwsCliInstalled)())
+                return false;
+            if (!process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_SECRET_ACCESS_KEY) {
+                // No env vars - might be using aws configure or vault
+                // Try to validate anyway
+            }
+            const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
+            const accountId = (0, aws_helpers_js_1.getAwsAccountId)(awsConfig.region);
+            // If we can't get account ID, credentials are invalid
+            // But only flag if we actually have credentials configured
+            if (!accountId) {
+                // Check if aws configure has credentials
+                try {
+                    const { execSync } = await Promise.resolve().then(() => __importStar(require('child_process')));
+                    const result = execSync('aws configure get aws_access_key_id 2>/dev/null || echo ""', {
+                        encoding: 'utf8',
+                        stdio: ['pipe', 'pipe', 'pipe'],
+                    }).trim();
+                    // Only flag as invalid if credentials exist but don't work
+                    return result.length > 0;
+                }
+                catch {
+                    return false;
+                }
+            }
+            return false;
+        },
+        fix: null,
+        manualFix: 'Check AWS credentials: aws sts get-caller-identity\nIf expired, regenerate in AWS Console: IAM → Users → Security credentials',
+    },
+];
+//# sourceMappingURL=credentials.js.map

package/dist/plugins/pipelines/aws/scanfix/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/credentials.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,4DAA2F;AAE9E,QAAA,gBAAgB,GAAU;IACrC,+DAA+D;IAC/D,wCAAwC;IACxC,+DAA+D;IAC/D;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2CAA2C;YAC3C,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YAExD,gCAAgC;YAChC,IAAI,CAAC,IAAA,kCAAiB,GAAE;gBAAE,OAAO,IAAI,CAAC;YAEtC,qDAAqD;YACrD,MAAM,SAAS,GAAG,IAAA,gCAAe,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,CAAC,SAAS,CAAC;QACpB,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE;YACT,gBAAgB;YAChB,EAAE;YACF,0EAA0E;YAC1E,EAAE;YACF,qBAAqB;YACrB,0CAA0C;YAC1C,iCAAiC;YACjC,2IAA2I;YAC3I,EAAE;YACF,uCAAuC;YACvC,kEAAkE;YAClE,+CAA+C;YAC/C,EAAE;YACF,uBAAuB;YACvB,kBAAkB;YAClB,qDAAqD;SACtD,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2CAA2C;YAC3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,qCAAqC,GAAC,CAAC;YACpF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAChD,CAAC,CAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CACnD,CAAC;YACF,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YAE5C,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACvC,uDAAuD;YACvD,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;QACtF,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,iFAAiF;KAC7F;IAED,+DAA+D;IAC/D,wCAAwC;IACxC,+DAA+D;IAC/D;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2DAA2D;QACxE,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2CAA2C;YAC3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,qCAAqC,GAAC,CAAC;YACpF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAChD,CAAC,CAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CACnD,CAAC;YACF,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YAE5C,iBAAiB;YACjB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6CAA6C;YAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,4CAA4C,GAAC,CAAC;oBAC3F,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC;wBACpC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;wBACrC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB;qBACxD,CAAC,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;oBACxF,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;wBAC7E,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE;YACT,uCAAuC;YACvC,EAAE;YACF,mCAAmC;YACnC,sCAAsC;YACtC,sCAAsC;YACtC,EAAE;YACF,mCAAmC;YACnC,mBAAmB;YACnB,EAAE;YACF,yCAAyC;YACzC,wEAAwE;YACxE,8BAA8B;SAC/B,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,wCAAwC;QACrD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2DAA2D;YAC3D,IAAI,CAAC,IAAA,kCAAiB,GAAE;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBACzE,sDAAsD;gBACtD,yBAAyB;YAC3B,CAAC;YAED,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,IAAA,gCAAe,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,sDAAsD;YACtD,2DAA2D;YAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,yCAAyC;gBACzC,IAAI,CAAC;oBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,wDAAa,eAAe,GAAC,CAAC;oBACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,4DAA4D,EAAE;wBACpF,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;qBAChC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACV,2DAA2D;oBAC3D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,+HAA+H;KAC3I;CACF,CAAC"}

package/dist/plugins/pipelines/aws/scanfix/db-replication.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AWS DB Replication Fixes
+ *
+ * Prereq checks for DB replication between staging (Mac Mini) and prod (RDS).
+ * Ensures PostgreSQL client is available on EC2 and RDS is reachable.
+ *
+ * Actual sync commands are in the AWS pipeline index.ts as plugin commands:
+ * - `db sync-to-prod`: pg_dump Mac Mini → SCP to EC2 → pg_restore into RDS
+ * - `db sync-to-staging`: pg_dump RDS via EC2 → SCP to Mac Mini → pg_restore
+ */
+import type { Fix } from '../../../../types/index.js';
+export declare const dbReplicationFixes: Fix[];
+//# sourceMappingURL=db-replication.d.ts.map

package/dist/plugins/pipelines/aws/scanfix/db-replication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-replication.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/db-replication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAiB,GAAG,EAAE,MAAM,4BAA4B,CAAC;AAwCrE,eAAO,MAAM,kBAAkB,EAAE,GAAG,EAuFnC,CAAC"}

package/dist/plugins/pipelines/aws/scanfix/db-replication.js

@@ -0,0 +1,136 @@
+"use strict";
+/**
+ * AWS DB Replication Fixes
+ *
+ * Prereq checks for DB replication between staging (Mac Mini) and prod (RDS).
+ * Ensures PostgreSQL client is available on EC2 and RDS is reachable.
+ *
+ * Actual sync commands are in the AWS pipeline index.ts as plugin commands:
+ * - `db sync-to-prod`: pg_dump Mac Mini → SCP to EC2 → pg_restore into RDS
+ * - `db sync-to-staging`: pg_dump RDS via EC2 → SCP to Mac Mini → pg_restore
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dbReplicationFixes = void 0;
+const aws_helpers_js_1 = require("../utils/aws-helpers.js");
+/**
+ * Find RDS instance endpoint
+ */
+function findRdsEndpoint(projectName, region) {
+    const dbId = 'factiii-' + projectName + '-db';
+    const result = (0, aws_helpers_js_1.awsExecSafe)('aws rds describe-db-instances --db-instance-identifier ' + dbId +
+        ' --query "DBInstances[0].Endpoint.Address" --output text', region);
+    if (!result || result === 'None' || result === 'null')
+        return null;
+    return result.replace(/"/g, '');
+}
+/**
+ * Check if AWS is configured for this project
+ */
+function isAwsConfigured(config) {
+    if (config.aws)
+        return true;
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { extractEnvironments } = require('../../../../utils/config-helpers.js');
+    const environments = extractEnvironments(config);
+    return Object.values(environments).some((e) => e.pipeline === 'aws');
+}
+/**
+ * Get prod environment config
+ */
+function getProdEnv(config) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { extractEnvironments } = require('../../../../utils/config-helpers.js');
+    const environments = extractEnvironments(config);
+    return environments.prod ?? environments.production ?? null;
+}
+exports.dbReplicationFixes = [
+    {
+        id: 'aws-rds-ec2-pg-client-missing',
+        stage: 'prod',
+        severity: 'warning',
+        description: 'PostgreSQL client not installed on EC2 (needed for DB sync)',
+        scan: async (config) => {
+            if (!isAwsConfigured(config))
+                return false;
+            const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
+            const projectName = (0, aws_helpers_js_1.getProjectName)(config);
+            // Only check if RDS exists
+            const endpoint = findRdsEndpoint(projectName, region);
+            if (!endpoint)
+                return false;
+            // Check if pg_dump is available on EC2 via SSH
+            const prodEnv = getProdEnv(config);
+            if (!prodEnv?.domain || prodEnv.domain.startsWith('EXAMPLE-'))
+                return false;
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { sshExec } = require('../../../../utils/ssh-helper.js');
+                const result = await sshExec(prodEnv, 'which pg_dump 2>/dev/null || echo "not_found"');
+                return result.trim() === 'not_found';
+            }
+            catch {
+                return false; // Can't SSH — skip
+            }
+        },
+        fix: async (config) => {
+            const prodEnv = getProdEnv(config);
+            if (!prodEnv?.domain) {
+                console.log('   Production domain not configured');
+                return false;
+            }
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { sshExec } = require('../../../../utils/ssh-helper.js');
+                console.log('   Installing PostgreSQL 15 client on EC2...');
+                await sshExec(prodEnv, 'sudo apt-get update -qq && sudo apt-get install -y postgresql-client-15');
+                console.log('   PostgreSQL client installed');
+                return true;
+            }
+            catch (e) {
+                console.log('   Failed to install pg client: ' + (e instanceof Error ? e.message : String(e)));
+                return false;
+            }
+        },
+        manualFix: 'SSH to EC2 and run: sudo apt-get install -y postgresql-client-15',
+    },
+    {
+        id: 'aws-rds-connectivity',
+        stage: 'prod',
+        severity: 'critical',
+        description: 'EC2 cannot connect to RDS (check security groups)',
+        scan: async (config) => {
+            if (!isAwsConfigured(config))
+                return false;
+            const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
+            const projectName = (0, aws_helpers_js_1.getProjectName)(config);
+            const endpoint = findRdsEndpoint(projectName, region);
+            if (!endpoint)
+                return false;
+            const prodEnv = getProdEnv(config);
+            if (!prodEnv?.domain || prodEnv.domain.startsWith('EXAMPLE-'))
+                return false;
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { sshExec } = require('../../../../utils/ssh-helper.js');
+                // Check if pg_isready is available first
+                const hasPg = await sshExec(prodEnv, 'which pg_isready 2>/dev/null || echo "not_found"');
+                if (hasPg.trim() === 'not_found')
+                    return false; // Can't test without pg client
+                const result = await sshExec(prodEnv, 'pg_isready -h ' + endpoint + ' -p 5432 2>&1');
+                return !result.includes('accepting connections');
+            }
+            catch {
+                return false;
+            }
+        },
+        fix: null,
+        manualFix: [
+            'EC2 cannot reach RDS. Check:',
+            '1. RDS security group allows port 5432 from EC2 security group',
+            '2. RDS is in the same VPC as EC2',
+            '3. RDS instance status is "available"',
+            '4. Test: ssh to EC2, run: pg_isready -h <rds-endpoint> -p 5432',
+        ].join('\n'),
+    },
+];
+//# sourceMappingURL=db-replication.js.map

package/dist/plugins/pipelines/aws/scanfix/db-replication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-replication.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/db-replication.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAGH,4DAAoF;AAEpF;;GAEG;AACH,SAAS,eAAe,CAAC,WAAmB,EAAE,MAAc;IAC1D,MAAM,IAAI,GAAG,UAAU,GAAG,WAAW,GAAG,KAAK,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,4BAAW,EACxB,yDAAyD,GAAG,IAAI;QAChE,0DAA0D,EAC1D,MAAM,CACP,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,MAAqB;IAC5C,IAAI,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,iEAAiE;IACjE,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CACrC,CAAC,CAAU,EAAE,EAAE,CAAE,CAA2B,CAAC,QAAQ,KAAK,KAAK,CAChE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,iEAAiE;IACjE,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,UAAU,IAAI,IAAI,CAAC;AAC9D,CAAC;AAEY,QAAA,kBAAkB,GAAU;IACvC;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,6DAA6D;QAC1E,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACtD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAE3C,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAE5B,+CAA+C;YAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC;YAE5E,IAAI,CAAC;gBACH,iEAAiE;gBACjE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;gBACvF,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,CAAC,mBAAmB;YACnC,CAAC;QACH,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACrD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC;gBACH,iEAAiE;gBACjE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;gBAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,yEAAyE,CAAC,CAAC;gBAClG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/F,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,SAAS,EAAE,kEAAkE;KAC9E;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mDAAmD;QAChE,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACtD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAE3C,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAE5B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC;YAE5E,IAAI,CAAC;gBACH,iEAAiE;gBACjE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;gBAC/D,yCAAyC;gBACzC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,kDAAkD,CAAC,CAAC;gBACzF,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,WAAW;oBAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;gBAE/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,QAAQ,GAAG,eAAe,CAAC,CAAC;gBACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE;YACT,8BAA8B;YAC9B,gEAAgE;YAChE,kCAAkC;YAClC,uCAAuC;YACvC,gEAAgE;SACjE,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;CACF,CAAC"}

package/dist/plugins/pipelines/aws/scanfix/ec2.d.ts

@@ -0,0 +1,10 @@
+/**
+ * AWS EC2 Fixes
+ *
+ * Provisions EC2 key pair, instance, and Elastic IP.
+ * Uses Ubuntu 22.04 AMI, t2.micro (free tier), public subnet.
+ * Key pair private key is stored in Ansible Vault.
+ */
+import type { Fix } from '../../../../types/index.js';
+export declare const ec2Fixes: Fix[];
+//# sourceMappingURL=ec2.d.ts.map

package/dist/plugins/pipelines/aws/scanfix/ec2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ec2.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/ec2.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAiB,GAAG,EAAE,MAAM,4BAA4B,CAAC;AAmGrE,eAAO,MAAM,QAAQ,EAAE,GAAG,EA2LzB,CAAC"}