@meyicloud/meyi-insight-server 1.0.0

package/dist/features/sources/cloudtrail/controller.js

@@ -0,0 +1,421 @@
+import { buildCloudTrailCentralStackTemplate, ALL_AWS_ACTIVE_REGIONS } from "./template.js";
+import { resolveTenantId } from "../../../tenancy.js";
+function normalizeSourceType(value) {
+    const normalized = String(value || "")
+        .toLowerCase()
+        .trim()
+        .replace(/[\s-]+/g, "_");
+    if (normalized === "aws_cloudtrail" || normalized === "cloud_trail")
+        return "cloudtrail";
+    return normalized;
+}
+function isCloudTrailType(value) {
+    return normalizeSourceType(value) === "cloudtrail";
+}
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+function isLocalhostUrl(value) {
+    try {
+        const host = new URL(value).hostname.toLowerCase();
+        return host === "localhost" || host === "127.0.0.1" || host === "::1";
+    }
+    catch {
+        return /localhost|127\.0\.0\.1/i.test(value);
+    }
+}
+function buildPublicBaseUrl(req) {
+    const explicitBase = process.env.INSIGHT_PUBLIC_BASE_URL ||
+        process.env.PUBLIC_API_BASE_URL ||
+        process.env.APP_BASE_URL;
+    if (explicitBase)
+        return stripTrailingSlash(explicitBase);
+    const headerBase = String(req.headers["x-insight-public-base-url"] || "").trim();
+    if (headerBase && !isLocalhostUrl(headerBase)) {
+        return stripTrailingSlash(headerBase);
+    }
+    let proto = req.headers["x-forwarded-proto"] || req.protocol || "http";
+    if (proto.includes(","))
+        proto = proto.split(",")[0].trim();
+    const host = req.headers["x-forwarded-host"] || req.get("host") || "localhost";
+    if (!isLocalhostUrl(`http://${host}`) && proto === "http") {
+        proto = "https";
+    }
+    return stripTrailingSlash(`${proto}://${host}`);
+}
+function sanitizeAwsName(value, fallback, maxLength) {
+    const raw = String(value || "").trim();
+    const base = raw || fallback;
+    const cleaned = base.replace(/[^a-zA-Z0-9-_]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+    return (cleaned || fallback).slice(0, maxLength);
+}
+function buildAwsConsoleCreateStackUrl(input) {
+    const region = encodeURIComponent(input.region || "ap-south-1");
+    const stackName = encodeURIComponent(input.stackName);
+    if (input.templateUrl) {
+        const templateUrl = encodeURIComponent(input.templateUrl);
+        return `https://${region}.console.aws.amazon.com/cloudformation/home?region=${region}#/stacks/create/review?stackName=${stackName}&templateURL=${templateUrl}`;
+    }
+    return `https://${region}.console.aws.amazon.com/cloudformation/home?region=${region}#/stacks/create/template?stackName=${stackName}`;
+}
+function isAwsSupportedTemplateUrl(value) {
+    try {
+        const url = new URL(value);
+        const host = url.hostname.toLowerCase();
+        return (url.protocol === "https:" &&
+            (host === "s3.amazonaws.com" ||
+                /^s3[.-][a-z0-9-]+\.amazonaws\.com$/.test(host) ||
+                /\.s3[.-][a-z0-9-]+\.amazonaws\.com$/.test(host) ||
+                /\.s3\.amazonaws\.com$/.test(host)));
+    }
+    catch {
+        return false;
+    }
+}
+export function createCloudTrailSourceController(sourceService, connectorService) {
+    return {
+        /**
+         * GET /:id/aws/cloudtrail/setup
+         * Returns the persisted CloudTrail setup values for this source.
+         */
+        async getSetup(req, res) {
+            try {
+                const source = await sourceService.getById(req.params.id);
+                if (!source)
+                    return res.status(404).json({ ok: false, error: "Source not found" });
+                if (!isCloudTrailType(source.type)) {
+                    return res.status(400).json({ ok: false, error: "Source type must be cloudtrail" });
+                }
+                return res.json({
+                    ok: true,
+                    source: {
+                        id: source.id,
+                        name: source.name,
+                        type: normalizeSourceType(source.type),
+                    },
+                    setup: {
+                        awsRegion: String(source.awsRegion || "ap-south-1"),
+                        awsStackName: String(source.awsStackName || `meyi-cloudtrail-${source.id.slice(0, 8)}`),
+                        awsCreateNewTrail: source.awsCreateNewTrail !== false, // default true
+                        awsDeploymentStatus: String(source.awsDeploymentStatus || "not_started"),
+                        awsDeploymentStatusReason: source.awsDeploymentStatusReason ?? null,
+                        awsStackId: source.awsStackId ?? null,
+                    },
+                });
+            }
+            catch (e) {
+                return res.status(500).json({ ok: false, error: e.message || "Failed to load CloudTrail setup" });
+            }
+        },
+        /**
+         * GET /:id/aws/cloudtrail/console-deploy
+         * Persists region/stackName/createNewTrail and returns all URLs needed for AWS Console quick-create.
+         *
+         * New behaviour (connector-aware):
+         * - Organizations mode: auto-resolves all accounts from the management connector;
+         *   does NOT accept targetOUs/targetAccounts/targetRegions from the caller.
+         * - Standalone mode: validates that the given targetAccounts ID exists in the
+         *   tenant's connector list before proceeding.
+         */
+        async getConsoleDeploy(req, res) {
+            try {
+                const source = await sourceService.getById(req.params.id);
+                if (!source)
+                    return res.status(404).json({ ok: false, error: "Source not found" });
+                if (!isCloudTrailType(source.type)) {
+                    return res.status(400).json({ ok: false, error: "Source type must be cloudtrail" });
+                }
+                const tenantId = resolveTenantId(req);
+                const region = String(req.query.region || source.awsRegion || "ap-south-1").trim() || "ap-south-1";
+                const stackName = sanitizeAwsName(req.query.stackName || source.awsStackName, `meyi-cloudtrail-${source.id.slice(0, 8)}`, 128);
+                // createNewTrail: query param > stored value > default true
+                let createNewTrail;
+                if (req.query.createNewTrail !== undefined) {
+                    createNewTrail = String(req.query.createNewTrail).toLowerCase() !== "false";
+                }
+                else if (source.awsCreateNewTrail !== undefined) {
+                    createNewTrail = source.awsCreateNewTrail !== false;
+                }
+                else {
+                    createNewTrail = true;
+                }
+                // Deployment mode: query param > stored value > default 'Organizations'
+                const deploymentMode = String(req.query.deploymentMode || source.awsDeploymentMode || "Organizations").trim() || "Organizations";
+                // ── Connector-aware validation ────────────────────────────────────────
+                let targetAccounts = "";
+                let targetOUs = "";
+                let managementAccountId = null;
+                let managementAccountName = null;
+                if (deploymentMode === "Organizations") {
+                    // Auto-resolve via management connector — ignore any caller-supplied account targets
+                    if (connectorService && tenantId) {
+                        const requestedMgmtId = String(req.query.managementAccountId || "").trim();
+                        const allConnectors = await connectorService.list(tenantId);
+                        let mgmt = null;
+                        if (requestedMgmtId) {
+                            mgmt =
+                                allConnectors.find((c) => c.accountId === requestedMgmtId &&
+                                    c.managementAccountId &&
+                                    c.managementAccountId === c.accountId) || allConnectors.find((c) => c.accountId === requestedMgmtId);
+                        }
+                        if (!mgmt) {
+                            mgmt = await connectorService.getManagementConnector(tenantId);
+                        }
+                        if (!mgmt) {
+                            return res.status(400).json({
+                                ok: false,
+                                error: "No management account connector found. " +
+                                    "Complete AWS onboarding in the Connectors section first.",
+                            });
+                        }
+                        managementAccountId = mgmt.accountId ?? null;
+                        managementAccountName = mgmt.accountName ?? null;
+                    }
+                    // Accept the org root ID / OU IDs from the caller (required for SERVICE_MANAGED StackSet deployment)
+                    targetOUs = String(req.query.targetOUs ?? source.awsTargetOUs ?? "").trim();
+                    targetAccounts = ""; // never filter by account in org mode
+                }
+                else {
+                    // Standalone — validate the supplied account ID against the connector list
+                    const requestedAccount = String(req.query.targetAccounts ?? source.awsTargetAccounts ?? "").trim();
+                    if (!requestedAccount || !/^\d{12}$/.test(requestedAccount)) {
+                        return res.status(400).json({
+                            ok: false,
+                            error: "Standalone mode requires a valid 12-digit AWS account ID.",
+                        });
+                    }
+                    if (connectorService && tenantId) {
+                        const connector = await connectorService.findByAccountId(tenantId, requestedAccount);
+                        if (!connector) {
+                            return res.status(400).json({
+                                ok: false,
+                                error: `Account ${requestedAccount} is not in your connector list. ` +
+                                    "Only accounts that have been onboarded as connectors can be used for Standalone deployment.",
+                            });
+                        }
+                    }
+                    targetAccounts = requestedAccount;
+                    targetOUs = "";
+                }
+                // targetRegions: always deploy to all active regions (not user-specified)
+                const targetRegions = "";
+                await sourceService.updateCloudTrailSetup(source.id, {
+                    awsRegion: region,
+                    awsStackName: stackName,
+                    awsCreateNewTrail: createNewTrail,
+                    awsDeploymentMode: deploymentMode,
+                    awsTargetOUs: targetOUs || null,
+                    awsTargetAccounts: targetAccounts || null,
+                    awsTargetRegions: null, // always all active regions
+                });
+                const baseUrl = buildPublicBaseUrl(req);
+                const webhookPath = `/api/v1/insight/webhook/${source.webhookToken}`;
+                let webhookUrl = `${baseUrl}${webhookPath}`;
+                if (source.webhookAuthToken) {
+                    const urlObj = new URL(baseUrl);
+                    urlObj.username = "webhook";
+                    urlObj.password = source.webhookAuthToken;
+                    webhookUrl = `${urlObj.toString().replace(/\/$/, "")}${webhookPath}`;
+                }
+                const deploymentStatusPath = `/api/v1/insight/sources/${source.id}/aws/cloudtrail/deployment-status`;
+                const deploymentStatusUrl = `${baseUrl}${deploymentStatusPath}?token=${encodeURIComponent(source.webhookToken)}`;
+                const templatePath = `/api/v1/insight/sources/${source.id}/aws/cloudtrail/central-stack-template.yml`;
+                const templateUrl = `${baseUrl}${templatePath}?token=${encodeURIComponent(source.webhookToken)}`;
+                const templateDownloadUrl = templateUrl;
+                const canPrefillTemplateUrl = isAwsSupportedTemplateUrl(templateUrl);
+                const isPublicTemplateUrl = !/localhost|127\.0\.0\.1/i.test(templateUrl);
+                const quickCreateUrl = buildAwsConsoleCreateStackUrl({
+                    region,
+                    stackName,
+                    templateUrl: canPrefillTemplateUrl ? templateUrl : null,
+                });
+                // StackSet name (predictable from the central stack name)
+                // Used by the frontend to build the "Add instances" console link
+                const stackSetName = `MeyiConnect-SecurityMonitoring-${stackName}`;
+                const encodedRegion = encodeURIComponent(region);
+                const encodedStackSetName = encodeURIComponent(stackSetName);
+                // URL to the "Add stacks to StackSet" wizard in AWS Console (no OU ID needed — wizard handles it)
+                const stackSetAddInstancesUrl = deploymentMode === "Organizations"
+                    ? `https://${encodedRegion}.console.aws.amazon.com/cloudformation/home?region=${encodedRegion}#/stacksets/${encodedStackSetName}/addStacks`
+                    : null;
+                return res.json({
+                    ok: true,
+                    source: {
+                        id: source.id,
+                        name: source.name,
+                        type: normalizeSourceType(source.type),
+                    },
+                    webhook: {
+                        path: webhookPath,
+                        url: webhookUrl,
+                    },
+                    deployment: {
+                        method: "aws_console_cloudformation_central_stack",
+                        region,
+                        stackName,
+                        createNewTrail,
+                        deploymentMode,
+                        targetOUs,
+                        targetAccounts,
+                        // All active regions — never user-specified
+                        targetRegions: ALL_AWS_ACTIVE_REGIONS,
+                        // Management account info (Organizations mode only)
+                        managementAccountId,
+                        managementAccountName,
+                        deploymentStatusUrl,
+                        templateUrl,
+                        templateDownloadUrl,
+                        quickCreateUrl,
+                        isPublicTemplateUrl,
+                        canPrefillTemplateUrl,
+                        // Organizations: URL to add existing accounts via the AWS Console StackSet wizard
+                        stackSetName,
+                        stackSetAddInstancesUrl,
+                        resources: ["cloudtrail", "s3_bucket", "sns_topic", "eventbridge_rules", "lambda", "iam_role"],
+                    },
+                });
+            }
+            catch (e) {
+                return res.status(500).json({ ok: false, error: e.message || "Failed to prepare AWS Console deployment" });
+            }
+        },
+        /**
+         * POST /:id/aws/cloudtrail/console-deploy/start
+         * Sets awsDeploymentStatus = "pending" when the user opens the AWS Console quick-create URL.
+         */
+        async markDeploymentStarted(req, res) {
+            try {
+                const source = await sourceService.getById(req.params.id);
+                if (!source)
+                    return res.status(404).json({ ok: false, error: "Source not found" });
+                if (!isCloudTrailType(source.type)) {
+                    return res.status(400).json({ ok: false, error: "Source type must be cloudtrail" });
+                }
+                const stackName = String(req.body?.stackName || source.awsStackName || `meyi-cloudtrail-${source.id.slice(0, 8)}`).trim();
+                const updated = await sourceService.updateCloudTrailDeployment(source.id, {
+                    awsDeploymentStatus: "pending",
+                    awsDeploymentStatusReason: "AWS Console stack creation opened",
+                    awsStackName: stackName,
+                });
+                return res.json({
+                    ok: true,
+                    source: {
+                        id: updated.id,
+                        awsDeploymentStatus: updated.awsDeploymentStatus,
+                        awsDeploymentStatusReason: updated.awsDeploymentStatusReason,
+                        awsStackName: updated.awsStackName,
+                        awsStackId: updated.awsStackId,
+                    },
+                });
+            }
+            catch (e) {
+                return res.status(500).json({ ok: false, error: e.message || "Failed to mark deployment started" });
+            }
+        },
+        /**
+         * POST /:id/aws/cloudtrail/deployment-status?token=<webhookToken>
+         * Token-gated callback invoked by the CloudFormation custom resource Lambda after stack create/update/delete.
+         */
+        async updateDeploymentStatus(req, res) {
+            try {
+                const source = await sourceService.getById(req.params.id);
+                if (!source)
+                    return res.status(404).json({ ok: false, error: "Source not found" });
+                if (!isCloudTrailType(source.type)) {
+                    return res.status(400).json({ ok: false, error: "Source type must be cloudtrail" });
+                }
+                const token = String(req.query.token || req.body?.token || "").trim();
+                if (!token || token !== String(source.webhookToken || "")) {
+                    return res.status(403).json({ ok: false, error: "Invalid deployment status token" });
+                }
+                let parsedBody = req.body;
+                if (req.body?.source === "aws.cloudformation" && req.body?.detail) {
+                    const detail = req.body.detail;
+                    const statusDetails = detail["status-details"] || {};
+                    parsedBody = {
+                        operationStatus: statusDetails["detailed-status"] || statusDetails["status"],
+                        reason: statusDetails["status-reason"],
+                        stackId: detail["stack-set-arn"] || detail["stack-id"] || req.body.resources?.[0],
+                        stackName: (detail["stack-set-arn"] || detail["stack-id"] || req.body.resources?.[0]) ? (detail["stack-set-arn"] || detail["stack-id"] || req.body.resources?.[0]).split("/")[1] : undefined
+                    };
+                }
+                // Map CloudFormation StackSet status to internal status
+                const rawStatus = String(parsedBody?.operationStatus || parsedBody?.status || "").trim().toLowerCase();
+                let requestedStatus = rawStatus;
+                if (rawStatus === "succeeded" || rawStatus === "create_complete" || rawStatus === "update_complete" || rawStatus === "deployed")
+                    requestedStatus = "deployed";
+                else if (rawStatus.includes("failed"))
+                    requestedStatus = "failed";
+                else if (rawStatus === "delete_complete" || rawStatus === "deleted")
+                    requestedStatus = "deleted";
+                const allowed = new Set(["not_started", "pending", "deployed", "failed", "deleted"]);
+                const status = allowed.has(requestedStatus) ? requestedStatus : "pending";
+                const updated = await sourceService.updateCloudTrailDeployment(source.id, {
+                    awsDeploymentStatus: status,
+                    awsDeploymentStatusReason: String(parsedBody?.reason || "").trim() || null,
+                    awsStackId: String(parsedBody?.stackId || "").trim() || null,
+                    awsStackName: String(parsedBody?.stackName || source.awsStackName || "").trim() || null,
+                });
+                return res.json({
+                    ok: true,
+                    sourceId: updated.id,
+                    awsDeploymentStatus: updated.awsDeploymentStatus,
+                    awsDeploymentStatusReason: updated.awsDeploymentStatusReason,
+                    awsStackId: updated.awsStackId,
+                });
+            }
+            catch (e) {
+                return res.status(500).json({ ok: false, error: e.message || "Failed to update deployment status" });
+            }
+        },
+        /**
+         * GET /:id/aws/cloudtrail/central-stack-template.yml?token=<webhookToken>
+         * Token-gated download of the CloudFormation central-stack template with substitutions applied.
+         * The `?token=` param allows CFN to fetch the template without auth headers.
+         */
+        async downloadTemplate(req, res) {
+            try {
+                const source = await sourceService.getById(req.params.id);
+                if (!source)
+                    return res.status(404).json({ ok: false, error: "Source not found" });
+                if (!isCloudTrailType(source.type)) {
+                    return res.status(400).json({ ok: false, error: "Source type must be cloudtrail" });
+                }
+                const token = String(req.query.token || "").trim();
+                if (!token || token !== String(source.webhookToken || "")) {
+                    return res.status(403).json({ ok: false, error: "Invalid template token" });
+                }
+                const baseUrl = buildPublicBaseUrl(req);
+                let webhookUrl = `${baseUrl}/api/v1/insight/webhook/${source.webhookToken}`;
+                const deploymentStatusUrl = `${baseUrl}/api/v1/insight/sources/${source.id}/aws/cloudtrail/deployment-status?token=${encodeURIComponent(source.webhookToken)}`;
+                // Read from query params first (if provided by frontend during download), then fallback to database
+                const reqCreateNewTrail = req.query.createNewTrail !== undefined
+                    ? String(req.query.createNewTrail).toLowerCase() !== "false"
+                    : undefined;
+                const createNewTrail = reqCreateNewTrail ?? (source.awsCreateNewTrail !== false); // default true
+                const reqDeploymentMode = req.query.deploymentMode ? String(req.query.deploymentMode).trim() : undefined;
+                const deploymentMode = reqDeploymentMode || source.awsDeploymentMode || 'Standalone';
+                const targetAccounts = req.query.targetAccounts !== undefined ? String(req.query.targetAccounts).trim() : (source.awsTargetAccounts || '');
+                const targetRegions = req.query.targetRegions !== undefined ? String(req.query.targetRegions).trim() : (source.awsTargetRegions || '');
+                const targetOUs = req.query.targetOUs !== undefined ? String(req.query.targetOUs).trim() : (source.awsTargetOUs || '');
+                const templateBody = buildCloudTrailCentralStackTemplate({
+                    webhookUrl,
+                    webhookAuthToken: source.webhookAuthToken,
+                    deploymentStatusUrl,
+                    createCloudTrail: createNewTrail,
+                    deploymentMode,
+                    targetAccounts,
+                    targetRegions,
+                    targetOUs,
+                });
+                res.setHeader("Content-Type", "application/yaml; charset=utf-8");
+                res.setHeader("Content-Disposition", `attachment; filename="meyi-cloudtrail-central-stack-${source.id.slice(0, 8)}.yml"`);
+                return res.status(200).send(templateBody);
+            }
+            catch (e) {
+                return res.status(500).json({ ok: false, error: e.message || "Failed to generate CloudTrail template" });
+            }
+        },
+    };
+}
+//# sourceMappingURL=controller.js.map

package/dist/features/sources/cloudtrail/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACnC,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3B,IAAI,UAAU,KAAK,gBAAgB,IAAI,UAAU,KAAK,aAAa;QAAE,OAAO,YAAY,CAAC;IACzF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3B,IAAI,YAAY;QAAE,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,UAAU,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAY,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;IACnF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5D,MAAM,IAAI,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IAE3F,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1D,KAAK,GAAG,OAAO,CAAC;IAClB,CAAC;IAED,OAAO,kBAAkB,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,QAAgB,EAAE,SAAiB;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,IAAI,QAAQ,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,6BAA6B,CAAC,KAItC;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1D,OAAO,WAAW,MAAM,sDAAsD,MAAM,oCAAoC,SAAS,gBAAgB,WAAW,EAAE,CAAC;IACjK,CAAC;IACD,OAAO,WAAW,MAAM,sDAAsD,MAAM,sCAAsC,SAAS,EAAE,CAAC;AACxI,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,IAAI,KAAK,kBAAkB;gBAC1B,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/C,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,aAA4B,EAC5B,gBAAmC;IAEnC,OAAO;QACL;;;WAGG;QACH,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,GAAa;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM;oBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACtF,CAAC;gBAED,OAAO,GAAG,CAAC,IAAI,CAAC;oBACd,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE;wBACN,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;qBACvC;oBACD,KAAK,EAAE;wBACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC;wBACnD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,mBAAmB,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;wBACvF,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,KAAK,KAAK,EAAE,eAAe;wBACtE,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,IAAI,aAAa,CAAC;wBACxE,yBAAyB,EAAE,MAAM,CAAC,yBAAyB,IAAI,IAAI;wBACnE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;qBACtC;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,iCAAiC,EAAE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QAED;;;;;;;;;WASG;QACH,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM;oBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACtF,CAAC;gBAED,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;gBACnG,MAAM,SAAS,GAAG,eAAe,CAC/B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,EAC1C,mBAAmB,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;gBAEF,4DAA4D;gBAC5D,IAAI,cAAuB,CAAC;gBAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;oBAC3C,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;gBAC9E,CAAC;qBAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;oBAClD,cAAc,GAAG,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;gBAED,wEAAwE;gBACxE,MAAM,cAAc,GAClB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,IAAI,eAAe,CAAC,CAAC,IAAI,EAGrF,IAAI,eAAe,CAAC;gBAErB,yEAAyE;gBACzE,IAAI,cAAc,GAAG,EAAE,CAAC;gBACxB,IAAI,SAAS,GAAG,EAAE,CAAC;gBACnB,IAAI,mBAAmB,GAAkB,IAAI,CAAC;gBAC9C,IAAI,qBAAqB,GAAkB,IAAI,CAAC;gBAEhD,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;oBACvC,qFAAqF;oBACrF,IAAI,gBAAgB,IAAI,QAAQ,EAAE,CAAC;wBACjC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC3E,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC5D,IAAI,IAAI,GAAG,IAAI,CAAC;wBAChB,IAAI,eAAe,EAAE,CAAC;4BACpB,IAAI;gCACF,aAAa,CAAC,IAAI,CAChB,CAAC,CAAM,EAAE,EAAE,CACT,CAAC,CAAC,SAAS,KAAK,eAAe;oCAC/B,CAAC,CAAC,mBAAmB;oCACrB,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,SAAS,CACxC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC;wBACzE,CAAC;wBACD,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,IAAI,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;wBACjE,CAAC;wBACD,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gCAC1B,EAAE,EAAE,KAAK;gCACT,KAAK,EACH,yCAAyC;oCACzC,0DAA0D;6BAC7D,CAAC,CAAC;wBACL,CAAC;wBACD,mBAAmB,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;wBAC7C,qBAAqB,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;oBACnD,CAAC;oBACD,qGAAqG;oBACrG,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC5E,cAAc,GAAG,EAAE,CAAC,CAAC,sCAAsC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,2EAA2E;oBAC3E,MAAM,gBAAgB,GAAG,MAAM,CAC7B,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;oBAET,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBAC5D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;4BAC1B,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE,2DAA2D;yBACnE,CAAC,CAAC;oBACL,CAAC;oBAED,IAAI,gBAAgB,IAAI,QAAQ,EAAE,CAAC;wBACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;wBACrF,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gCAC1B,EAAE,EAAE,KAAK;gCACT,KAAK,EACH,WAAW,gBAAgB,kCAAkC;oCAC7D,6FAA6F;6BAChG,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAED,cAAc,GAAG,gBAAgB,CAAC;oBAClC,SAAS,GAAG,EAAE,CAAC;gBACjB,CAAC;gBAED,0EAA0E;gBAC1E,MAAM,aAAa,GAAG,EAAE,CAAC;gBAEzB,MAAM,aAAa,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE;oBACnD,SAAS,EAAE,MAAM;oBACjB,YAAY,EAAE,SAAS;oBACvB,iBAAiB,EAAE,cAAc;oBACjC,iBAAiB,EAAE,cAAc;oBACjC,YAAY,EAAE,SAAS,IAAI,IAAI;oBAC/B,iBAAiB,EAAE,cAAc,IAAI,IAAI;oBACzC,gBAAgB,EAAE,IAAI,EAAE,4BAA4B;iBACrD,CAAC,CAAC;gBAEH,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,2BAA2B,MAAM,CAAC,YAAY,EAAE,CAAC;gBACrE,IAAI,UAAU,GAAG,GAAG,OAAO,GAAG,WAAW,EAAE,CAAC;gBAC5C,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;oBAChC,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;oBAC5B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;oBAC1C,UAAU,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC;gBACvE,CAAC;gBACD,MAAM,oBAAoB,GAAG,2BAA2B,MAAM,CAAC,EAAE,mCAAmC,CAAC;gBACrG,MAAM,mBAAmB,GAAG,GAAG,OAAO,GAAG,oBAAoB,UAAU,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjH,MAAM,YAAY,GAAG,2BAA2B,MAAM,CAAC,EAAE,4CAA4C,CAAC;gBACtG,MAAM,WAAW,GAAG,GAAG,OAAO,GAAG,YAAY,UAAU,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjG,MAAM,mBAAmB,GAAG,WAAW,CAAC;gBACxC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;gBACrE,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACzE,MAAM,cAAc,GAAG,6BAA6B,CAAC;oBACnD,MAAM;oBACN,SAAS;oBACT,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;iBACxD,CAAC,CAAC;gBAEH,0DAA0D;gBAC1D,iEAAiE;gBACjE,MAAM,YAAY,GAAG,kCAAkC,SAAS,EAAE,CAAC;gBACnE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBAC7D,kGAAkG;gBAClG,MAAM,uBAAuB,GAAG,cAAc,KAAK,eAAe;oBAChE,CAAC,CAAC,WAAW,aAAa,sDAAsD,aAAa,eAAe,mBAAmB,YAAY;oBAC3I,CAAC,CAAC,IAAI,CAAC;gBAET,OAAO,GAAG,CAAC,IAAI,CAAC;oBACd,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE;wBACN,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;qBACvC;oBACD,OAAO,EAAE;wBACP,IAAI,EAAE,WAAW;wBACjB,GAAG,EAAE,UAAU;qBAChB;oBACD,UAAU,EAAE;wBACV,MAAM,EAAE,0CAA0C;wBAClD,MAAM;wBACN,SAAS;wBACT,cAAc;wBACd,cAAc;wBACd,SAAS;wBACT,cAAc;wBACd,4CAA4C;wBAC5C,aAAa,EAAE,sBAAsB;wBACrC,oDAAoD;wBACpD,mBAAmB;wBACnB,qBAAqB;wBACrB,mBAAmB;wBACnB,WAAW;wBACX,mBAAmB;wBACnB,cAAc;wBACd,mBAAmB;wBACnB,qBAAqB;wBACrB,kFAAkF;wBAClF,YAAY;wBACZ,uBAAuB;wBACvB,SAAS,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC;qBAC/F;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,0CAA0C,EAAE,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;YACrD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM;oBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACtF,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,CACtB,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC,YAAY,IAAI,mBAAmB,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACzF,CAAC,IAAI,EAAE,CAAC;gBAET,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,EAAE;oBACxE,mBAAmB,EAAE,SAAS;oBAC9B,yBAAyB,EAAE,mCAAmC;oBAC9D,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;gBAEH,OAAO,GAAG,CAAC,IAAI,CAAC;oBACd,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE;wBACN,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;wBAChD,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;wBAC5D,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,UAAU,EAAE,OAAO,CAAC,UAAU;qBAC/B;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,mCAAmC,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,sBAAsB,CAAC,GAAY,EAAE,GAAa;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM;oBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACtF,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtE,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACvF,CAAC;gBAED,IAAI,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;gBAC1B,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,oBAAoB,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAClE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;oBAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;oBACrD,UAAU,GAAG;wBACX,eAAe,EAAE,aAAa,CAAC,iBAAiB,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC;wBAC5E,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC;wBACtC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;wBACjF,SAAS,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;qBAC7L,CAAC;gBACJ,CAAC;gBAED,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,eAAe,IAAI,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACvG,IAAI,eAAe,GAAG,SAAS,CAAC;gBAChC,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,iBAAiB,IAAI,SAAS,KAAK,iBAAiB,IAAI,SAAS,KAAK,UAAU;oBAAE,eAAe,GAAG,UAAU,CAAC;qBACzJ,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,eAAe,GAAG,QAAQ,CAAC;qBAC7D,IAAI,SAAS,KAAK,iBAAiB,IAAI,SAAS,KAAK,SAAS;oBAAE,eAAe,GAAG,SAAS,CAAC;gBAEjG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE1E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,EAAE;oBACxE,mBAAmB,EAAE,MAAM;oBAC3B,yBAAyB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;oBAC1E,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;oBAC5D,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;iBACxF,CAAC,CAAC;gBAEH,OAAO,GAAG,CAAC,IAAI,CAAC;oBACd,EAAE,EAAE,IAAI;oBACR,QAAQ,EAAE,OAAO,CAAC,EAAE;oBACpB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;oBAChD,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;oBAC5D,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,oCAAoC,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM;oBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACtF,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,UAAU,GAAG,GAAG,OAAO,2BAA2B,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC5E,MAAM,mBAAmB,GAAG,GAAG,OAAO,2BAA2B,MAAM,CAAC,EAAE,2CAA2C,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/J,oGAAoG;gBACpG,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;oBAC9D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO;oBAC5D,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,cAAc,GAAG,iBAAiB,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,eAAe;gBAEjG,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzG,MAAM,cAAc,GAAI,iBAAoD,IAAK,MAAM,CAAC,iBAAoD,IAAI,YAAY,CAAC;gBAE7J,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;gBAC3I,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;gBACvI,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;gBAEvH,MAAM,YAAY,GAAG,mCAAmC,CAAC;oBACvD,UAAU;oBACV,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,mBAAmB;oBACnB,gBAAgB,EAAE,cAAc;oBAChC,cAAc;oBACd,cAAc;oBACd,aAAa;oBACb,SAAS;iBACV,CAAC,CAAC;gBAEH,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;gBACjE,GAAG,CAAC,SAAS,CACX,qBAAqB,EACrB,uDAAuD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CACpF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,wCAAwC,EAAE,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/features/sources/cloudtrail/routes.d.ts

@@ -0,0 +1,6 @@
+import type { Router } from "express";
+import type { createCloudTrailSourceController } from "./controller.js";
+type CloudTrailSourceController = ReturnType<typeof createCloudTrailSourceController>;
+export declare function registerCloudTrailSourceRoutes(router: Router, ctrl: CloudTrailSourceController): void;
+export {};
+//# sourceMappingURL=routes.d.ts.map

package/dist/features/sources/cloudtrail/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAC;AAExE,KAAK,0BAA0B,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEtF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,QAM9F"}

package/dist/features/sources/cloudtrail/routes.js

@@ -0,0 +1,8 @@
+export function registerCloudTrailSourceRoutes(router, ctrl) {
+    router.get("/:id/aws/cloudtrail/setup", ctrl.getSetup.bind(ctrl));
+    router.get("/:id/aws/cloudtrail/console-deploy", ctrl.getConsoleDeploy.bind(ctrl));
+    router.post("/:id/aws/cloudtrail/console-deploy/start", ctrl.markDeploymentStarted.bind(ctrl));
+    router.post("/:id/aws/cloudtrail/deployment-status", ctrl.updateDeploymentStatus.bind(ctrl));
+    router.get("/:id/aws/cloudtrail/central-stack-template.yml", ctrl.downloadTemplate.bind(ctrl));
+}
+//# sourceMappingURL=routes.js.map

package/dist/features/sources/cloudtrail/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/routes.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,IAAgC;IAC7F,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,CAAC,gDAAgD,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC"}

package/dist/features/sources/cloudtrail/schema.d.ts

@@ -0,0 +1,2 @@
+export declare function createInsightCloudTrailSourceSetups(meyiconnect: any, insightSources: any): any;
+//# sourceMappingURL=schema.d.ts.map

package/dist/features/sources/cloudtrail/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/schema.ts"],"names":[],"mappings":"AAEA,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,OA2BxF"}

package/dist/features/sources/cloudtrail/schema.js

@@ -0,0 +1,26 @@
+import { boolean, index, text, timestamp, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+export function createInsightCloudTrailSourceSetups(meyiconnect, insightSources) {
+    return meyiconnect.table("insight_cloudtrail_source_setups", {
+        id: uuid("id").primaryKey().defaultRandom(),
+        sourceId: uuid("source_id")
+            .notNull()
+            .references(() => insightSources.id, { onDelete: "cascade" }),
+        awsRegion: text("aws_region"),
+        awsStackName: text("aws_stack_name"),
+        awsCreateNewTrail: boolean("aws_create_new_trail").notNull().default(true),
+        awsDeploymentStatus: text("aws_deployment_status").notNull().default("not_started"),
+        awsDeploymentStatusReason: text("aws_deployment_status_reason"),
+        awsStackId: text("aws_stack_id"),
+        // Deployment configuration inputs from the onboarding wizard
+        awsDeploymentMode: text("aws_deployment_mode").default("Organizations"),
+        awsTargetOUs: text("aws_target_ous"), // comma-separated OU IDs or Root ID; null = all accounts
+        awsTargetAccounts: text("aws_target_accounts"), // comma-separated account IDs; null = all accounts in OU
+        awsTargetRegions: text("aws_target_regions"), // comma-separated region names; null = all active regions
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    }, (t) => [
+        uniqueIndex("insight_cloudtrail_source_setups_source_unique").on(t.sourceId),
+        index("insight_cloudtrail_source_setups_status_idx").on(t.awsDeploymentStatus),
+    ]);
+}
+//# sourceMappingURL=schema.js.map

package/dist/features/sources/cloudtrail/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEzF,MAAM,UAAU,mCAAmC,CAAC,WAAgB,EAAE,cAAmB;IACvF,OAAO,WAAW,CAAC,KAAK,CACtB,kCAAkC,EAClC;QACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;QAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;aACxB,OAAO,EAAE;aACT,UAAU,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC/D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;QAC7B,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC;QACpC,iBAAiB,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1E,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;QACnF,yBAAyB,EAAE,IAAI,CAAC,8BAA8B,CAAC;QAC/D,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC;QAChC,6DAA6D;QAC7D,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACvE,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAa,yDAAyD;QAC1G,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,EAAG,yDAAyD;QAC1G,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAK,0DAA0D;QAC3G,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;QACjF,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;KAClF,EACD,CAAC,CAAM,EAAE,EAAE,CAAC;QACV,WAAW,CAAC,gDAAgD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5E,KAAK,CAAC,6CAA6C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;KAC/E,CACF,CAAC;AACJ,CAAC"}

package/dist/features/sources/cloudtrail/stackTemplates.d.ts

@@ -0,0 +1,3 @@
+export declare const STACK_YAML = "AWSTemplateFormatVersion: '2010-09-09'\nDescription: |\n  Meyi Connect Security Monitoring - Regional Events Stack.\n  Deploys regional security alerting rules and SNS webhook delivery.\n\nParameters:\n  Environment:\n    Type: String\n    Default: \"MeyiConnect\"\n    Description: Environment name (used as a prefix for resource names)\n\n  WebhookUrl:\n    Type: String\n    Description: MeyiConnect webhook URL for security alerts.\n\n  CreateCloudTrail:\n    Type: String\n    Default: 'false'\n    Description: Kept for backwards compatibility.\n\n  PrimaryRegion:\n    Type: String\n    Default: 'us-east-1'\n    Description: Kept for backwards compatibility.\n\n  DeploymentMode:\n    Type: String\n    Default: 'Organizations'\n    Description: Kept for backwards compatibility.\n\nResources:\n\n  # ============================================================\n  # SNS TOPIC & SUBSCRIPTION FOR ALERTS\n  # ============================================================\n\n  SecurityAlertsTopic:\n    Type: AWS::SNS::Topic\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n\n  SecurityAlertsTopicPolicy:\n    Type: AWS::SNS::TopicPolicy\n    Properties:\n      Topics:\n        - !Ref SecurityAlertsTopic\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service: events.amazonaws.com\n            Action: sns:Publish\n            Resource: !Ref SecurityAlertsTopic\n\n  WebhookSubscription:\n    Type: AWS::SNS::Subscription\n    Properties:\n      TopicArn: !Ref SecurityAlertsTopic\n      Endpoint: !Ref WebhookUrl\n      Protocol: https\n\n  # ============================================================\n  # EVENTBRIDGE RULES ON DEFAULT BUS\n  # Regional events fire directly in this region - no forwarding needed\n  # ============================================================\n\n  DataAndInfrastructureSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: EC2, VPC, network, S3, and RDS configuration changes in the deployment region\n      EventPattern:\n        source:\n          - aws.ec2\n          - aws.s3\n          - aws.rds\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - ec2.amazonaws.com\n            - s3.amazonaws.com\n            - rds.amazonaws.com\n          eventName:\n            # EC2 & Network Events\n            - StopInstances\n            - RunInstances\n            - RebootInstances\n            - StartInstances\n            - TerminateInstances\n            - CreateCustomerGateway\n            - DeleteCustomerGateway\n            - AttachInternetGateway\n            - CreateInternetGateway\n            - DeleteInternetGateway\n            - DetachInternetGateway\n            - CreateNetworkAcl\n            - DeleteNetworkAcl\n            - CreateNetworkAclEntry\n            - DeleteNetworkAclEntry\n            - ReplaceNetworkAclEntry\n            - ReplaceNetworkAclAssociation\n            - AuthorizeSecurityGroupIngress\n            - AuthorizeSecurityGroupEgress\n            - RevokeSecurityGroupIngress\n            - RevokeSecurityGroupEgress\n            - ModifySecurityGroupRules\n            - UpdateSecurityGroupRuleDescriptionsIngress\n            - UpdateSecurityGroupRuleDescriptionsEgress\n            - CreateSecurityGroup\n            - DeleteSecurityGroup\n            - CreateVpc\n            - DeleteVpc\n            - ModifyVpcAttribute\n            - AcceptVpcPeeringConnection\n            - CreateVpcPeeringConnection\n            - DeleteVpcPeeringConnection\n            - RejectVpcPeeringConnection\n            - AttachClassicLinkVpc\n            - DetachClassicLinkVpc\n            - DisableVpcClassicLink\n            - EnableVpcClassicLink\n            - ModifyImageAttribute\n            - ModifySnapshotAttribute\n            - ModifyInstanceAttribute\n            - ImportKeyPair\n            - CreateKeyPair\n            - DisableEbsEncryptionByDefault\n            - DeleteFlowLogs\n            # S3 Events\n            - PutBucketPublicAccessBlock\n            - DeletePublicAccessBlock\n            - PutBucketPolicy\n            - DeleteBucketPolicy\n            - PutBucketAcl\n            - PutBucketEncryption\n            - DeleteBucketEncryption\n            - DeleteBucket\n            # RDS Events\n            - ModifyDBInstance\n            - ModifyDBSnapshotAttribute\n            - DeleteDBInstance\n            - DeleteDBClusterSnapshot\n            - RestoreDBInstanceFromDBSnapshot\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  OperationsAndSecretsSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Lambda, SSM, Secrets Manager, and KMS configuration/management events\n      EventPattern:\n        source:\n          - aws.lambda\n          - aws.ssm\n          - aws.secretsmanager\n          - aws.kms\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - lambda.amazonaws.com\n            - ssm.amazonaws.com\n            - secretsmanager.amazonaws.com\n            - kms.amazonaws.com\n          eventName:\n            # Lambda, SSM, Secrets Manager\n            - AddPermission\n            - CreateFunction\n            - UpdateFunctionCode\n            - CreateEventSourceMapping\n            - SendCommand\n            - StartSession\n            - PutParameter\n            - DeleteParameter\n            - DeleteSecret\n            - PutResourcePolicy\n            # KMS\n            - ScheduleKeyDeletion\n            - DisableKey\n            - DisableKeyRotation\n            - PutKeyPolicy\n            - DeleteAlias\n            - CancelKeyDeletion\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  AuditAndTamperingSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: CloudTrail, GuardDuty, Security Hub, and Config auditing or tampering events\n      EventPattern:\n        source:\n          - aws.cloudtrail\n          - aws.securityhub\n          - aws.guardduty\n          - aws.config\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - cloudtrail.amazonaws.com\n            - securityhub.amazonaws.com\n            - guardduty.amazonaws.com\n            - config.amazonaws.com\n          eventName:\n            # CloudTrail\n            - CreateTrail\n            - UpdateTrail\n            - DeleteTrail\n            - StartLogging\n            - StopLogging\n            - PutEventSelectors\n            - DeleteEventDataStore\n            # Security Services Tampering\n            - BatchDisableStandards\n            - DeleteMembers\n            - DisassociateMembers\n            - DeleteDetector\n            - UpdateDetector\n            - CreateFilter\n            - StopMonitoringMembers\n            - DisableSecurityHub\n            - StopConfigurationRecorder\n            - DeleteConfigurationRecorder\n            - DeleteDeliveryChannel\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  ControlTowerManagedRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Security Hub findings imported by AWS Control Tower\n      EventPattern:\n        source:\n          - aws.securityhub\n        detail-type:\n          - Security Hub Findings - Imported\n        detail:\n          findings:\n            Compliance:\n              AssociatedStandards:\n                StandardsId:\n                  - prefix: standards/service-managed-aws-control-tower\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n# ============================================================\n# OUTPUTS\n# ============================================================\n\nOutputs:\n  SecurityAlertsTopicArn:\n    Description: ARN of the regional security alerts SNS topic\n    Value: !Ref SecurityAlertsTopic";
+export declare const GLOBAL_STACK_YAML = "AWSTemplateFormatVersion: '2010-09-09'\nDescription: |\n  Meyi Connect Security Monitoring - Global Events Stack (us-east-1). Fully independent of\n  the regional Central Stack. Captures IAM, Root Login, Console Login Failure, and AWS Health\n  events (all global services that only fire in us-east-1) and delivers them directly to the\n  Meyi Connect webhook via Amazon SNS. No cross-region forwarding,\n  no shared resources with any other stack.\n\nParameters:\n  Environment:\n    Type: String\n    Default: \"MeyiConnect\"\n    Description: Environment name (used as a prefix for resource names)\n\n  WebhookUrl:\n    Type: String\n    Description: MeyiConnect webhook URL for global security alerts.\n\n  CreateCloudTrail:\n    Type: String\n    Default: 'false'\n    Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.\n\n  PrimaryRegion:\n    Type: String\n    Default: 'us-east-1'\n    Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.\n\n  DeploymentMode:\n    Type: String\n    Default: 'Organizations'\n    AllowedValues:\n      - 'Organizations'\n      - 'Standalone'\n    Description: Whether this is deployed via AWS Organizations or as a standalone account.\n\nResources:\n\n  # ============================================================\n  # SNS TOPIC & SUBSCRIPTION FOR GLOBAL ALERTS\n  # ============================================================\n\n  GlobalSecurityAlertsTopic:\n    Type: AWS::SNS::Topic\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n\n  GlobalSecurityAlertsTopicPolicy:\n    Type: AWS::SNS::TopicPolicy\n    Properties:\n      Topics:\n        - !Ref GlobalSecurityAlertsTopic\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service: events.amazonaws.com\n            Action: sns:Publish\n            Resource: !Ref GlobalSecurityAlertsTopic\n\n  WebhookSubscription:\n    Type: AWS::SNS::Subscription\n    Properties:\n      TopicArn: !Ref GlobalSecurityAlertsTopic\n      Endpoint: !Ref WebhookUrl\n      Protocol: https\n\n  # ============================================================\n  # EVENTBRIDGE RULES - GLOBAL EVENTS\n  # IAM, Root Login, Console Login, Health, and Organizations all fire only in us-east-1\n  # ============================================================\n\n  IAMAndOrganizationsSecurityEventsRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: IAM and Organizations security configuration changes\n      EventPattern:\n        source:\n          - aws.iam\n          - aws.organizations\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventName:\n            # IAM events\n            - CreateUser\n            - DeleteUser\n            - CreateAccessKey\n            - UpdateAccessKey\n            - DeleteAccessKey\n            - AttachRolePolicy\n            - DetachRolePolicy\n            - PutUserPolicy\n            - PutRolePolicy\n            - UpdateAssumeRolePolicy\n            - DeactivateMFADevice\n            - CreateLoginProfile\n            - UpdateLoginProfile\n            - DeleteLoginProfile\n            - CreateAccountAlias\n            - DeleteAccountAlias\n            - UpdateAccountPasswordPolicy\n            - DeleteAccountPasswordPolicy\n            - DeleteGroupPolicy\n            - PutGroupPolicy\n            - CreatePolicy\n            - DeletePolicy\n            - CreatePolicyVersion\n            - DeletePolicyVersion\n            - AttachUserPolicy\n            - DetachUserPolicy\n            - AttachGroupPolicy\n            - DetachGroupPolicy\n            - CreateRole\n            - DeleteRole\n            - CreateSAMLProvider\n            - UpdateSAMLProvider\n            - CreateOpenIDConnectProvider\n            - UpdateOpenIDConnectProvider\n            - CreateServiceSpecificCredential\n            # Organizations events\n            - LeaveOrganization\n            - RemoveAccountFromOrganization\n            - DeletePolicy\n            - DetachPolicy\n            - DisablePolicyType\n            - UpdatePolicy\n            - CreateAccount\n            - InviteAccountToOrganization\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n  ConsoleLoginRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Root login, failed console logins, and MFA-not-used console login attempts\n      EventPattern:\n        detail-type:\n          - AWS Console Sign In via CloudTrail\n        detail:\n          eventName:\n            - ConsoleLogin\n          $or:\n            - userIdentity:\n                type:\n                  - Root\n              responseElements:\n                ConsoleLogin:\n                  - Success\n            - responseElements:\n                ConsoleLogin:\n                  - Failure\n            - responseElements:\n                ConsoleLogin:\n                  - Success\n              additionalEventData:\n                MFAUsed:\n                  - \"No\"\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n  HealthEventsRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: AWS Health notifications\n      EventPattern:\n        source:\n          - aws.health\n        detail-type:\n          - AWS Health Event\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n  RootAPICallsRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Capture any API call made by the Root user account in us-east-1\n      EventPattern:\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          userIdentity:\n            type:\n              - Root\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n# ============================================================\n# OUTPUTS\n# ============================================================\n\nOutputs:\n  TopicArn:\n    Description: Global security alerts SNS Topic ARN\n    Value: !Ref GlobalSecurityAlertsTopic\n\n  RulesDeployed:\n    Description: Rules deployed in this stack\n    Value: IAMAndOrganizationsSecurityEvents, ConsoleLogin, HealthEvents, RootAPICalls";
+//# sourceMappingURL=stackTemplates.d.ts.map

package/dist/features/sources/cloudtrail/stackTemplates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stackTemplates.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/stackTemplates.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,+kSA4Sa,CAAC;AAErC,eAAO,MAAM,iBAAiB,u6OAqPyD,CAAC"}