@prism-d1/cli 1.0.94 → 1.0.95

package/dist/src/utils/audit-bedrock.js

@@ -0,0 +1,331 @@
+import { aws } from './aws.js';
+/**
+ * Audit Bedrock blast-radius controls -- what bounds runaway model spend, how
+ * fast you find out, and whether you can attribute it afterwards.
+ *
+ * These checks are composed by `bedrock-protection scan-account` alongside the
+ * IAM hygiene checks in audit-iam.ts. Repository credential exposure is the
+ * third side, covered by `bedrock-protection scan-repo`.
+ *
+ * Audit-only: every AWS call here is a read.
+ */
+/**
+ * Bedrock spend lands on TWO billing surfaces, and a filter scoped to only the
+ * first silently misses the second:
+ *
+ *   1. `Amazon Bedrock*` services -- first-party models, AgentCore, Knowledge
+ *      Bases, Guardrails.
+ *   2. `AWS Marketplace` -- every third-party model, billed as a subscription
+ *      line item named e.g. "Claude Opus 5 (Amazon Bedrock Edition)".
+ *
+ * So a budget filtered on Amazon Bedrock alone reports nothing while an attacker
+ * burns Opus -- both the priciest option and the likeliest target. The two
+ * surfaces are therefore separate checks below, and a budget covering only one
+ * does not clear the other.
+ */
+const BEDROCK_HINTS = ['bedrock'];
+const MARKETPLACE_HINTS = ['marketplace'];
+function budgetCovers(budget, hints) {
+    // Older budgets carry CostFilters (dimension -> values). Newer ones carry
+    // FilterExpression, a nested tree. Rather than pretend to fully interpret an
+    // expression tree, match its serialised form -- and return 'unknown' when
+    // neither field is present, because an unrecognised budget must never be
+    // counted as coverage.
+    const filters = budget?.CostFilters;
+    if (filters && Object.keys(filters).length > 0) {
+        const blob = JSON.stringify(filters).toLowerCase();
+        return hints.some((h) => blob.includes(h)) ? 'yes' : 'no';
+    }
+    if (budget?.FilterExpression) {
+        const blob = JSON.stringify(budget.FilterExpression).toLowerCase();
+        return hints.some((h) => blob.includes(h)) ? 'yes' : 'no';
+    }
+    // No filter at all means the budget covers total account spend. That bounds
+    // Bedrock, but only bluntly -- it will not fire until everything else has
+    // grown too.
+    return 'unknown';
+}
+/**
+ * Only a COST budget bounds spend.
+ *
+ * BudgetType is one of USAGE, COST, RI_UTILIZATION, RI_COVERAGE,
+ * SAVINGS_PLANS_UTILIZATION or SAVINGS_PLANS_COVERAGE. A USAGE budget filtered on
+ * Bedrock tracks request counts, and an RI/SP budget tracks commitment
+ * efficiency -- neither caps a dollar figure. Treating any of them as coverage
+ * would report a spend ceiling that does not exist, which is worse than
+ * reporting none because it stops the reader looking.
+ */
+function isCostBudget(budget) {
+    return budget?.BudgetType === 'COST';
+}
+export function auditBudgets(profile, accountId) {
+    // describe-budgets requires an explicit account id, and returns an EMPTY body
+    // -- not {"Budgets": []} -- when no budgets exist.
+    const bud = aws(['budgets', 'describe-budgets', '--account-id', accountId], profile);
+    if (!bud.ok) {
+        return { coveringBudgets: [], findings: [
+                ['bedrock-budget', 'Budget covering Bedrock services'],
+                ['marketplace-budget', 'Budget covering Marketplace (Bedrock Edition) models'],
+            ].map(([id, title]) => ({
+                id, category: 'budget', title,
+                status: 'INDETERMINATE', severity: 'HIGH',
+                detail: `Could not list budgets (${bud.errorCode || 'unknown error'}).`,
+                remediation: 'Grant budgets:DescribeBudgets and re-run.',
+            })) };
+    }
+    const budgets = bud.json?.Budgets ?? [];
+    // Coverage requires BOTH a matching filter and BudgetType === COST.
+    const covering = (hints) => budgets.filter((b) => budgetCovers(b, hints) === 'yes' && isCostBudget(b)).map((b) => b.BudgetName);
+    // Matching filter but the wrong budget type: named explicitly, because from
+    // the console it looks like a Bedrock budget while capping no dollar figure.
+    const wrongType = (hints) => budgets.filter((b) => budgetCovers(b, hints) === 'yes' && !isCostBudget(b))
+        .map((b) => `${b.BudgetName} (BudgetType=${b.BudgetType})`);
+    const untargeted = budgets
+        .filter((b) => budgetCovers(b, BEDROCK_HINTS) === 'unknown' && isCostBudget(b))
+        .map((b) => b.BudgetName);
+    const bedrock = covering(BEDROCK_HINTS);
+    const marketplace = covering(MARKETPLACE_HINTS);
+    const bedrockWrongType = wrongType(BEDROCK_HINTS);
+    const marketplaceWrongType = wrongType(MARKETPLACE_HINTS);
+    return { coveringBudgets: [...new Set([...bedrock, ...marketplace])], findings: [
+            {
+                id: 'bedrock-budget', category: 'budget', title: 'Budget covering Bedrock services',
+                status: bedrock.length ? 'PASS' : 'FAIL', severity: 'HIGH',
+                detail: bedrock.length
+                    ? `Covered by: ${bedrock.join(', ')}.`
+                    : budgets.length === 0
+                        ? 'No budgets exist in this account, so runaway Bedrock spend has no ceiling and raises no alert.'
+                        : bedrockWrongType.length
+                            ? `${bedrockWrongType.join(', ')} filters on Bedrock but is not a COST budget, so it caps no dollar figure — it looks like a Bedrock budget in the console while bounding nothing.`
+                            : `${budgets.length} budget(s) exist but none is a COST budget filtering on a Bedrock service${untargeted.length ? ` (${untargeted.length} cover total account spend, which bounds Bedrock only indirectly)` : ''}.`,
+                remediation: bedrock.length ? undefined : 'Create a monthly budget filtered on Service contains "Bedrock", alerting at 50/80/100% to SNS.',
+            },
+            {
+                id: 'marketplace-budget', category: 'budget', title: 'Budget covering Marketplace (Bedrock Edition) models',
+                status: marketplace.length ? 'PASS' : 'FAIL', severity: 'HIGH',
+                detail: marketplace.length
+                    ? `Covered by: ${marketplace.join(', ')}.`
+                    : (marketplaceWrongType.length ? `${marketplaceWrongType.join(', ')} filters on Marketplace but is not a COST budget, so it caps no dollar figure. ` : '')
+                        + 'No COST budget filters on AWS Marketplace. Third-party models invoked through Bedrock — Anthropic, Meta, Mistral, Cohere — bill as Marketplace subscription line items named "(Amazon Bedrock Edition)", NOT under Amazon Bedrock. A Bedrock-only budget misses them entirely, which is the most expensive blind spot here because Opus-class models are both the priciest and the likeliest target.',
+                remediation: marketplace.length ? undefined : 'Add a second COST budget filtered on Service = AWS Marketplace, or define a Cost Category grouping both surfaces and budget on that.',
+            },
+        ] };
+}
+/**
+ * A budget that alerts nobody is a record, not a control.
+ *
+ * `describe-budgets` says nothing about whether anyone is told when a threshold
+ * is crossed -- notifications and their subscribers are separate resources. A
+ * budget created without them still shows a spend bar in the console and still
+ * reports as "a Bedrock budget exists", while nothing reaches a human. For
+ * LLMjacking specifically, being told is the entire value: the spend has already
+ * happened by the time anyone opens the Billing console.
+ *
+ * `DescribeBudgetNotificationsForAccount` returns notifications for every budget
+ * in ONE call. Subscribers need a call per notification, which is why this is
+ * scoped to the budgets that actually cover Bedrock rather than all of them.
+ */
+export function auditBudgetAlerting(profile, accountId, coveringBudgets) {
+    const id = 'budget-alerting';
+    const title = 'Bedrock budgets actually notify someone';
+    if (coveringBudgets.length === 0) {
+        // Nothing to evaluate. Not a PASS -- no alerting was established -- and not
+        // a duplicate FAIL, since bedrock-budget/marketplace-budget already report
+        // the absence.
+        return {
+            id, category: 'budget', title,
+            status: 'INDETERMINATE', severity: 'HIGH',
+            detail: 'No COST budget covers Bedrock or Marketplace, so there is no budget whose alerting could be checked (see bedrock-budget and marketplace-budget above).',
+        };
+    }
+    const all = aws(['budgets', 'describe-budget-notifications-for-account', '--account-id', accountId], profile);
+    if (!all.ok) {
+        return {
+            id, category: 'budget', title,
+            status: 'INDETERMINATE', severity: 'HIGH',
+            detail: `Could not read budget notifications (${all.errorCode || 'unknown error'}), so it is unknown whether ${coveringBudgets.join(', ')} alerts anyone.`,
+            remediation: 'Grant budgets:DescribeBudgetNotificationsForAccount and budgets:DescribeSubscribersForNotification, then re-run.',
+        };
+    }
+    const perBudget = all.json?.BudgetNotificationsForAccount ?? [];
+    const silent = [];
+    const unsubscribed = [];
+    let alerting = 0;
+    for (const name of coveringBudgets) {
+        const entry = perBudget.find((e) => e.BudgetName === name);
+        const notifications = entry?.Notifications ?? [];
+        if (notifications.length === 0) {
+            silent.push(name);
+            continue;
+        }
+        let subscribers = 0;
+        for (const n of notifications) {
+            const subs = aws([
+                'budgets', 'describe-subscribers-for-notification',
+                '--account-id', accountId, '--budget-name', name,
+                '--notification', JSON.stringify(n),
+            ], profile);
+            if (subs.ok)
+                subscribers += (subs.json?.Subscribers ?? []).length;
+        }
+        if (subscribers === 0)
+            unsubscribed.push(name);
+        else
+            alerting++;
+    }
+    const broken = [...silent, ...unsubscribed];
+    return {
+        id, category: 'budget', title,
+        status: broken.length ? 'FAIL' : 'PASS', severity: 'HIGH',
+        detail: broken.length
+            ? [
+                silent.length ? `${silent.join(', ')} has no notification thresholds at all` : '',
+                unsubscribed.length ? `${unsubscribed.join(', ')} has thresholds but no subscribers` : '',
+            ].filter(Boolean).join('; ')
+                + '. A budget with nothing to notify records the overspend without telling anyone, which reads as protection while providing none.'
+            : `All ${alerting} covering budget(s) have at least one threshold with a subscriber.`,
+        remediation: broken.length
+            ? 'Add notification thresholds (50/80/100%) with an SNS topic or email subscriber. Prefer SNS — it can fan out to a rota rather than one mailbox.'
+            : undefined,
+    };
+}
+/**
+ * One title constant per check, because this check is pushed from three
+ * branches (CE disabled, CE unreadable, CE readable). Inlining the string in
+ * each made them drift the moment the check gained its subscription
+ * requirement: the same `anomaly-monitor` id reported two different titles
+ * depending on account state, which is unstable in --json output.
+ */
+const ANOMALY_TITLE = 'Cost anomaly monitor covering Bedrock, with an alert subscription';
+export function auditDetection(profile, region) {
+    const out = [];
+    // Cost Explorer is an account-level opt-in that stays OFF until someone
+    // enables it -- measured error: AccessDeniedException "User not enabled for
+    // cost explorer access". Every CE-backed check must be gated on this, or the
+    // audit reports "no anomaly monitor configured" when the truth is that it
+    // could not look.
+    const ce = aws(['ce', 'get-anomaly-monitors'], profile);
+    const ceDisabled = !ce.ok && /not enabled for cost explorer/i.test(ce.raw);
+    out.push({
+        id: 'cost-explorer-enabled', category: 'detection', title: 'Cost Explorer enabled',
+        status: ceDisabled ? 'FAIL' : ce.ok ? 'PASS' : 'INDETERMINATE',
+        severity: 'HIGH',
+        detail: ceDisabled
+            ? 'Cost Explorer is not enabled on this account, so cost anomaly detection is impossible and spend cannot be attributed to a service or model.'
+            : ce.ok
+                ? 'Cost Explorer is enabled.'
+                : `Could not confirm Cost Explorer access (${ce.errorCode || 'unknown error'}).`,
+        remediation: ceDisabled ? 'Enable Cost Explorer in Billing settings (management account for an org). It backfills up to 12 months and can take 24h to become queryable.' : undefined,
+    });
+    if (ceDisabled || !ce.ok) {
+        out.push({
+            id: 'anomaly-monitor', category: 'detection', title: ANOMALY_TITLE,
+            status: 'INDETERMINATE', severity: 'MEDIUM',
+            detail: ceDisabled
+                ? 'Cannot be checked while Cost Explorer is disabled.'
+                : `Could not list anomaly monitors (${ce.errorCode || 'unknown error'}).`,
+        });
+    }
+    else {
+        const monitors = ce.json?.AnomalyMonitors ?? [];
+        const serviceWide = monitors.filter((m) => m.MonitorDimension === 'SERVICE');
+        const bedrockScoped = monitors.filter((m) => JSON.stringify(m.MonitorSpecification ?? {}).toLowerCase().includes('bedrock'));
+        const covering = [...serviceWide, ...bedrockScoped];
+        // A monitor with no subscription is the same failure mode as a budget with
+        // no subscriber: it detects the anomaly and tells nobody. Monitors and
+        // subscriptions are separate resources, and get-anomaly-monitors reports
+        // nothing about whether one is attached, so this needs a second call.
+        //
+        // Worth knowing: creating a first budget auto-enables Cost Explorer, and AWS
+        // then auto-creates a "Default-Services-Monitor" (SERVICE dimension) WITH a
+        // subscription -- observed live. So this check often passes as a side effect
+        // of setting up budgets rather than deliberately.
+        const subs = aws(['ce', 'get-anomaly-subscriptions'], profile);
+        const coveringArns = new Set(covering.map((m) => m.MonitorArn));
+        const subscribed = subs.ok
+            ? (subs.json?.AnomalySubscriptions ?? []).some((s) => (s.MonitorArnList ?? []).some((arn) => coveringArns.has(arn)))
+            : null;
+        const status = covering.length === 0 ? 'FAIL' : subscribed === null ? 'INDETERMINATE' : subscribed ? 'PASS' : 'FAIL';
+        out.push({
+            id: 'anomaly-monitor', category: 'detection', title: ANOMALY_TITLE,
+            status, severity: 'MEDIUM',
+            detail: covering.length === 0
+                ? (monitors.length === 0
+                    ? 'No cost anomaly monitors. A budget only fires once a threshold is crossed; anomaly detection catches spend that is abnormal for this account, which is what a stolen key looks like on day one.'
+                    : `${monitors.length} monitor(s) exist but none covers Bedrock.`)
+                : subscribed === null
+                    ? `${covering.length} covering monitor(s), but the subscription list could not be read (${subs.errorCode || 'unknown error'}), so it is unknown whether anomalies reach anyone.`
+                    : subscribed
+                        ? `${covering.length} covering monitor(s) (${serviceWide.length} SERVICE-dimension, ${bedrockScoped.length} Bedrock-scoped), with an alert subscription attached.`
+                        : `${covering.length} covering monitor(s) exist but NO subscription references them, so detected anomalies notify nobody — the monitor records them and stops there.`,
+            remediation: status === 'PASS' ? undefined
+                : covering.length === 0
+                    ? 'Create a SERVICE-dimension monitor — it covers every service including Marketplace — then attach a subscription with a threshold low enough to fire before the monthly budget would.'
+                    : 'Attach an anomaly subscription to the monitor. Without one the monitor is detection with no delivery.',
+        });
+    }
+    // CloudWatch is the only fast signal. Cost data lags 12-24h, so a cost-only
+    // posture lets a stolen key run for up to a day before anything fires.
+    const alarms = aws(['cloudwatch', 'describe-alarms', '--region', region], profile);
+    if (!alarms.ok) {
+        out.push({
+            id: 'bedrock-invocation-alarm', category: 'detection', title: 'CloudWatch alarm on Bedrock invocation volume',
+            status: 'INDETERMINATE', severity: 'MEDIUM',
+            detail: `Could not list alarms in ${region} (${alarms.errorCode || 'unknown error'}).`,
+        });
+    }
+    else {
+        const bedrockAlarms = (alarms.json?.MetricAlarms ?? []).filter((a) => a.Namespace === 'AWS/Bedrock');
+        out.push({
+            id: 'bedrock-invocation-alarm', category: 'detection', title: 'CloudWatch alarm on Bedrock invocation volume',
+            status: bedrockAlarms.length ? 'PASS' : 'FAIL', severity: 'MEDIUM',
+            detail: bedrockAlarms.length
+                ? `${bedrockAlarms.length} alarm(s) on AWS/Bedrock metrics: ${bedrockAlarms.map((a) => a.AlarmName).slice(0, 5).join(', ')}.`
+                : `No alarms on AWS/Bedrock metrics in ${region}. Cost data lags 12–24h, so budgets and anomaly detection cannot catch a stolen key inside the first day. Token-count metrics are near real-time and are the only fast signal available.`,
+            remediation: bedrockAlarms.length ? undefined : 'Alarm on AWS/Bedrock Invocations and InputTokenCount with a threshold above normal peak; it fires in minutes rather than hours.',
+        });
+    }
+    return out;
+}
+export function auditCommitments(profile, region) {
+    const pt = aws(['bedrock', 'list-provisioned-model-throughputs', '--region', region], profile);
+    if (!pt.ok) {
+        return {
+            id: 'provisioned-throughput', category: 'commitment', title: 'Provisioned Throughput commitments',
+            status: 'INDETERMINATE', severity: 'INFO',
+            detail: `Could not list provisioned throughput in ${region} (${pt.errorCode || 'unknown error'}).`,
+        };
+    }
+    const pts = pt.json?.provisionedModelSummaries ?? [];
+    return {
+        id: 'provisioned-throughput', category: 'commitment', title: 'Provisioned Throughput commitments',
+        status: pts.length ? 'FAIL' : 'PASS',
+        severity: pts.length ? 'MEDIUM' : 'INFO',
+        detail: pts.length
+            ? `${pts.length} commitment(s) in ${region}: ${pts.map((p) => p.provisionedModelName || p.modelArn).slice(0, 5).join(', ')}. These bill monthly whether or not they are used.`
+            : `No Provisioned Throughput commitments in ${region}. NOTE: region-scoped — a commitment in another region will not appear here.`,
+        remediation: pts.length ? 'Confirm each commitment is intentional and still in use; an abandoned one bills indefinitely.' : undefined,
+    };
+}
+export function auditForensics(profile, region) {
+    // Returns an EMPTY body when logging is off -- same trap as describe-budgets.
+    const log = aws(['bedrock', 'get-model-invocation-logging-configuration', '--region', region], profile);
+    if (!log.ok) {
+        return {
+            id: 'model-invocation-logging', category: 'forensics', title: 'Bedrock model invocation logging',
+            status: 'INDETERMINATE', severity: 'MEDIUM',
+            detail: `Could not read the logging configuration in ${region} (${log.errorCode || 'unknown error'}).`,
+        };
+    }
+    const cfg = log.json?.loggingConfig;
+    const configured = Boolean(cfg && (cfg.cloudWatchConfig || cfg.s3Config));
+    return {
+        id: 'model-invocation-logging', category: 'forensics', title: 'Bedrock model invocation logging',
+        status: configured ? 'PASS' : 'FAIL', severity: 'MEDIUM',
+        detail: configured
+            ? `Enabled in ${region} (${[cfg.cloudWatchConfig && 'CloudWatch', cfg.s3Config && 'S3'].filter(Boolean).join(' + ')}).`
+            : `Off in ${region}. CloudTrail records that InvokeModel was called but not the model, prompt or token counts, so during an incident you can see spend rose without being able to attribute it to a caller or workload.`,
+        remediation: configured ? undefined : 'Enable model invocation logging to CloudWatch Logs or S3. Prompts and completions are captured, so treat the destination as sensitive and scope its access accordingly.',
+    };
+}
+//# sourceMappingURL=audit-bedrock.js.map

package/dist/src/utils/audit-bedrock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-bedrock.js","sourceRoot":"","sources":["../../../src/utils/audit-bedrock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAG/B;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,CAAC;AAClC,MAAM,iBAAiB,GAAG,CAAC,aAAa,CAAC,CAAC;AAE1C,SAAS,YAAY,CAAC,MAAW,EAAE,KAAe;IAChD,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,OAAO,GAAG,MAAM,EAAE,WAAW,CAAC;IACpC,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,aAAa;IACb,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA2B,EAAE,SAAiB;IACzE,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAErF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE;gBACtC,CAAC,gBAAgB,EAAE,kCAAkC,CAAC;gBACtD,CAAC,oBAAoB,EAAE,sDAAsD,CAAC;aAC/E,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;gBAC7B,MAAM,EAAE,eAAwB,EAAE,QAAQ,EAAE,MAAe;gBAC3D,MAAM,EAAE,2BAA2B,GAAG,CAAC,SAAS,IAAI,eAAe,IAAI;gBACvE,WAAW,EAAE,2CAA2C;aACzD,CAAC,CAAC,EAAE,CAAC;IACR,CAAC;IAED,MAAM,OAAO,GAAU,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;IAE/C,oEAAoE;IACpE,MAAM,QAAQ,GAAG,CAAC,KAAe,EAAE,EAAE,CACnC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,KAAK,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtG,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,CAAC,KAAe,EAAE,EAAE,CACpC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,gBAAgB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,OAAO;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAE5B,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,gBAAgB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,oBAAoB,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAE1D,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE;YAC9E;gBACE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,kCAAkC;gBACnF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;gBAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;oBACpB,CAAC,CAAC,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACtC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;wBACpB,CAAC,CAAC,gGAAgG;wBAClG,CAAC,CAAC,gBAAgB,CAAC,MAAM;4BACvB,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mJAAmJ;4BACnL,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,4EAA4E,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,mEAAmE,CAAC,CAAC,CAAC,EAAE,GAAG;gBAC1N,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gGAAgG;aAC3I;YACD;gBACE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,sDAAsD;gBAC3G,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;gBAC9D,MAAM,EAAE,WAAW,CAAC,MAAM;oBACxB,CAAC,CAAC,eAAe,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC1C,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC,CAAC,EAAE,CAAC;0BACtJ,sYAAsY;gBAC5Y,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sIAAsI;aACrL;SACF,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA2B,EAC3B,SAAiB,EACjB,eAAyB;IAEzB,MAAM,EAAE,GAAG,iBAAiB,CAAC;IAC7B,MAAM,KAAK,GAAG,yCAAyC,CAAC;IAExD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,4EAA4E;QAC5E,2EAA2E;QAC3E,eAAe;QACf,OAAO;YACL,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;YAC7B,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM;YACzC,MAAM,EAAE,wJAAwJ;SACjK,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,2CAA2C,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9G,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;YAC7B,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM;YACzC,MAAM,EAAE,wCAAwC,GAAG,CAAC,SAAS,IAAI,eAAe,+BAA+B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAC1J,WAAW,EAAE,kHAAkH;SAChI,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAU,GAAG,CAAC,IAAI,EAAE,6BAA6B,IAAI,EAAE,CAAC;IACvE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAU,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC;QACxD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAEhE,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC;gBACf,SAAS,EAAE,uCAAuC;gBAClD,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI;gBAChD,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;aACpC,EAAE,OAAO,CAAC,CAAC;YACZ,IAAI,IAAI,CAAC,EAAE;gBAAE,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACpE,CAAC;QACD,IAAI,WAAW,KAAK,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAAM,QAAQ,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;QACzD,MAAM,EAAE,MAAM,CAAC,MAAM;YACnB,CAAC,CAAC;gBACE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE;gBACjF,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE;aAC1F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;kBAC1B,iIAAiI;YACrI,CAAC,CAAC,OAAO,QAAQ,oEAAoE;QACvF,WAAW,EAAE,MAAM,CAAC,MAAM;YACxB,CAAC,CAAC,gJAAgJ;YAClJ,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,mEAAmE,CAAC;AAE1F,MAAM,UAAU,cAAc,CAAC,OAA2B,EAAE,MAAc;IAAgB,MAAM,GAAG,GAAc,EAAE,CAAC;IAElH,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,kBAAkB;IAClB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,gCAAgC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAE3E,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB;QAClF,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;QAC9D,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,UAAU;YAChB,CAAC,CAAC,6IAA6I;YAC/I,CAAC,CAAC,EAAE,CAAC,EAAE;gBACL,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,2CAA2C,EAAE,CAAC,SAAS,IAAI,eAAe,IAAI;QACpF,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,8IAA8I,CAAC,CAAC,CAAC,SAAS;KACrL,CAAC,CAAC;IAEH,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa;YAClE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;YAC3C,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,oCAAoC,EAAE,CAAC,SAAS,IAAI,eAAe,IAAI;SAC5E,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAU,EAAE,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,CAAC;QAEpD,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,EAAE;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,kDAAkD;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE;YACxB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CACtD,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACrH,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa;YAClE,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAC3B,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;oBACtB,CAAC,CAAC,iMAAiM;oBACnM,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,4CAA4C,CAAC;gBACnE,CAAC,CAAC,UAAU,KAAK,IAAI;oBACnB,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,sEAAsE,IAAI,CAAC,SAAS,IAAI,eAAe,qDAAqD;oBAChL,CAAC,CAAC,UAAU;wBACV,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,yBAAyB,WAAW,CAAC,MAAM,uBAAuB,aAAa,CAAC,MAAM,wDAAwD;wBAClK,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,iJAAiJ;YAC3K,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS;gBACxC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;oBACrB,CAAC,CAAC,sLAAsL;oBACxL,CAAC,CAAC,uGAAuG;SAC9G,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,0BAA0B,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,+CAA+C;YAC7G,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;YAC3C,MAAM,EAAE,4BAA4B,MAAM,KAAK,MAAM,CAAC,SAAS,IAAI,eAAe,IAAI;SACvF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC;QAC1G,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,0BAA0B,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,+CAA+C;YAC7G,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAClE,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC1B,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,qCAAqC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClI,CAAC,CAAC,uCAAuC,MAAM,0LAA0L;YAC3O,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iIAAiI;SAClL,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA2B,EAAE,MAAc;IAC1E,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,oCAAoC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,oCAAoC;YACjG,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM;YACzC,MAAM,EAAE,4CAA4C,MAAM,KAAK,EAAE,CAAC,SAAS,IAAI,eAAe,IAAI;SACnG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAU,EAAE,CAAC,IAAI,EAAE,yBAAyB,IAAI,EAAE,CAAC;IAC5D,OAAO;QACL,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,oCAAoC;QACjG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM;YAChB,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,qBAAqB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;YAC9K,CAAC,CAAC,4CAA4C,MAAM,8EAA8E;QACpI,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,+FAA+F,CAAC,CAAC,CAAC,SAAS;KACtI,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA2B,EAAE,MAAc;IACxE,8EAA8E;IAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,4CAA4C,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACxG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,0BAA0B,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,kCAAkC;YAChG,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;YAC3C,MAAM,EAAE,+CAA+C,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,eAAe,IAAI;SACvG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,EAAE,EAAE,0BAA0B,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,kCAAkC;QAChG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;QACxD,MAAM,EAAE,UAAU;YAChB,CAAC,CAAC,cAAc,MAAM,KAAK,CAAC,GAAG,CAAC,gBAAgB,IAAI,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;YACvH,CAAC,CAAC,UAAU,MAAM,sMAAsM;QAC1N,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yKAAyK;KAChN,CAAC;AACJ,CAAC"}

package/dist/src/utils/audit-iam.d.ts

@@ -0,0 +1,6 @@
+import { Finding } from './audit.js';
+export declare function auditRoot(profile?: string): Finding[];
+export declare function auditPasswordPolicy(profile?: string): Finding;
+export declare function auditUsers(profile: string | undefined, maxKeyAge: number, unusedDays: number): Finding[];
+export declare function auditUserPolicies(profile?: string): Finding;
+//# sourceMappingURL=audit-iam.d.ts.map

package/dist/src/utils/audit-iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-iam.d.ts","sourceRoot":"","sources":["../../../src/utils/audit-iam.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAY,MAAM,YAAY,CAAC;AAwE/C,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,EAAE,CA6CrD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAmC7D;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE,CA2ExG;AAED,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAgC3D"}

package/dist/src/utils/audit-iam.js

@@ -0,0 +1,239 @@
+import { aws, daysSince } from './aws.js';
+/**
+ * GetCredentialReport fails with ReportNotPresent until GenerateCredentialReport
+ * has been called -- measured, not assumed. Generation is asynchronous, so this
+ * kicks it off and re-reads a bounded number of times.
+ *
+ * This is the only non-read AWS call in the command. It produces a report
+ * artifact and modifies no resource.
+ */
+function credentialReport(profile) {
+    let got = aws(['iam', 'get-credential-report'], profile);
+    if (!got.ok && got.errorCode === 'ReportNotPresent') {
+        const gen = aws(['iam', 'generate-credential-report'], profile);
+        if (!gen.ok)
+            return { error: gen.errorCode || 'generate-credential-report failed' };
+        for (let i = 0; i < 10 && !got.ok; i++) {
+            got = aws(['iam', 'get-credential-report'], profile);
+            if (!got.ok && got.errorCode !== 'ReportNotPresent')
+                break;
+        }
+    }
+    if (!got.ok)
+        return { error: got.errorCode || 'get-credential-report failed' };
+    const b64 = got.json?.Content;
+    if (!b64)
+        return { error: 'credential report had no Content' };
+    const csv = Buffer.from(b64, 'base64').toString('utf8');
+    const lines = csv.trim().split('\n');
+    const header = lines[0].split(',');
+    const col = (name) => header.indexOf(name);
+    const rows = [];
+    for (const line of lines.slice(1)) {
+        const c = line.split(',');
+        const at = (name) => (col(name) >= 0 ? c[col(name)] : '');
+        rows.push({
+            user: at('user'),
+            passwordEnabled: at('password_enabled') === 'true',
+            mfaActive: at('mfa_active') === 'true',
+            passwordLastUsed: at('password_last_used'),
+            keys: [1, 2].map((n) => ({
+                n,
+                active: at(`access_key_${n}_active`) === 'true',
+                lastRotated: at(`access_key_${n}_last_rotated`),
+                lastUsed: at(`access_key_${n}_last_used_date`),
+            })),
+        });
+    }
+    return rows;
+}
+export function auditRoot(profile) {
+    const out = [];
+    // GetAccountSummary answers the two most severe questions in one call and
+    // needs no credential report. AccountMFAEnabled and AccountAccessKeysPresent
+    // both describe the ROOT user specifically.
+    const summary = aws(['iam', 'get-account-summary'], profile);
+    const map = summary.ok ? (summary.json?.SummaryMap ?? null) : null;
+    if (!map) {
+        out.push({
+            id: 'root-mfa', category: 'root', title: 'Root account MFA',
+            status: 'INDETERMINATE', severity: 'CRITICAL',
+            detail: `Could not read the account summary (${summary.errorCode || 'unknown error'}).`,
+            remediation: 'Grant iam:GetAccountSummary and re-run.',
+        });
+        out.push({
+            id: 'root-access-keys', category: 'root', title: 'Root access keys',
+            status: 'INDETERMINATE', severity: 'CRITICAL',
+            detail: `Could not read the account summary (${summary.errorCode || 'unknown error'}).`,
+        });
+        return out;
+    }
+    const rootMfa = map.AccountMFAEnabled === 1;
+    out.push({
+        id: 'root-mfa', category: 'root', title: 'Root account MFA',
+        status: rootMfa ? 'PASS' : 'FAIL', severity: 'CRITICAL',
+        detail: rootMfa
+            ? 'Root user has an MFA device.'
+            : 'Root user has NO MFA device. Root cannot be constrained by SCPs or permission boundaries, so a compromised root is unbounded.',
+        remediation: 'Attach a FIDO2 security key to root — phishing resistant, unlike TOTP. In Amazon-internal Isengard accounts root is managed for you and this may not be actionable; confirm before escalating.',
+    });
+    const rootKeys = map.AccountAccessKeysPresent === 1;
+    out.push({
+        id: 'root-access-keys', category: 'root', title: 'Root access keys',
+        status: rootKeys ? 'FAIL' : 'PASS', severity: 'CRITICAL',
+        detail: rootKeys
+            ? 'Root has active access keys — unconstrainable long-lived credentials, the single worst credential to leak.'
+            : 'No root access keys.',
+        remediation: 'Delete root access keys. Nothing legitimate requires them.',
+    });
+    return out;
+}
+export function auditPasswordPolicy(profile) {
+    const pol = aws(['iam', 'get-account-password-policy'], profile);
+    // NoSuchEntity is the API saying "no policy set", which means AWS defaults
+    // apply. That is a finding, not an error -- treating it as an error hides it.
+    if (!pol.ok && pol.errorCode === 'NoSuchEntity') {
+        return {
+            id: 'password-policy', category: 'policy', title: 'Account password policy',
+            status: 'FAIL', severity: 'MEDIUM',
+            detail: 'No password policy is set, so only AWS defaults apply (minimum length 8, no complexity or reuse rules).',
+            remediation: 'Set MinimumPasswordLength >= 14 with complexity and reuse prevention — or remove console passwords entirely in favour of Identity Center.',
+        };
+    }
+    if (!pol.ok) {
+        return {
+            id: 'password-policy', category: 'policy', title: 'Account password policy',
+            status: 'INDETERMINATE', severity: 'MEDIUM',
+            detail: `Could not read the password policy (${pol.errorCode || 'unknown error'}).`,
+        };
+    }
+    const p = pol.json?.PasswordPolicy ?? {};
+    const weak = [];
+    if ((p.MinimumPasswordLength ?? 0) < 14)
+        weak.push(`MinimumPasswordLength=${p.MinimumPasswordLength ?? 'unset'} (< 14)`);
+    if (!p.RequireSymbols)
+        weak.push('RequireSymbols=false');
+    if (!p.RequireNumbers)
+        weak.push('RequireNumbers=false');
+    if (!p.RequireUppercaseCharacters || !p.RequireLowercaseCharacters)
+        weak.push('mixed case not required');
+    if (!p.PasswordReusePrevention)
+        weak.push('PasswordReusePrevention unset');
+    return {
+        id: 'password-policy', category: 'policy', title: 'Account password policy',
+        status: weak.length ? 'FAIL' : 'PASS', severity: 'MEDIUM',
+        detail: weak.length ? `Weaker than baseline: ${weak.join(', ')}.` : 'Policy meets the baseline.',
+        remediation: weak.length ? 'Raise minimum length to 14+, require complexity, enable reuse prevention.' : undefined,
+    };
+}
+export function auditUsers(profile, maxKeyAge, unusedDays) {
+    const out = [];
+    const report = credentialReport(profile);
+    if ('error' in report) {
+        for (const [id, title, sev] of [
+            ['access-key-age', 'Long-lived access keys', 'HIGH'],
+            ['console-user-no-mfa', 'Console users without MFA', 'HIGH'],
+            ['unused-credentials', 'Unused credentials', 'MEDIUM'],
+        ]) {
+            out.push({
+                id, category: 'users', title,
+                status: 'INDETERMINATE', severity: sev,
+                detail: `Credential report unavailable (${report.error}).`,
+                remediation: 'Grant iam:GenerateCredentialReport and iam:GetCredentialReport, then re-run.',
+            });
+        }
+        return out;
+    }
+    // <root_account> is covered by the summary checks and reported with a
+    // different shape, so exclude it here rather than double-reporting.
+    const users = report.filter((r) => r.user !== '<root_account>');
+    const stale = [];
+    for (const u of users) {
+        for (const k of u.keys) {
+            if (!k.active)
+                continue;
+            const age = daysSince(k.lastRotated);
+            if (age !== null && age > maxKeyAge)
+                stale.push(`${u.user} key ${k.n} (${age}d)`);
+        }
+    }
+    out.push({
+        id: 'access-key-age', category: 'users', title: 'Long-lived access keys',
+        status: stale.length ? 'FAIL' : 'PASS', severity: 'HIGH',
+        detail: stale.length
+            ? `${stale.length} active key(s) older than ${maxKeyAge}d: ${stale.slice(0, 8).join(', ')}${stale.length > 8 ? ', …' : ''}. Key age is the strongest single predictor of credential-theft exposure — an old key has had more opportunities to leak and is rarely missed when it does.`
+            : `No active access key is older than ${maxKeyAge}d.`,
+        remediation: stale.length ? 'Rotate, or delete the key and move the workload onto an IAM role. A role issues short-lived credentials that cannot be exfiltrated as a static string.' : undefined,
+    });
+    const noMfa = users.filter((u) => u.passwordEnabled && !u.mfaActive).map((u) => u.user);
+    out.push({
+        id: 'console-user-no-mfa', category: 'users', title: 'Console users without MFA',
+        status: noMfa.length ? 'FAIL' : 'PASS', severity: 'HIGH',
+        detail: noMfa.length
+            ? `${noMfa.length} user(s) have console passwords and no MFA: ${noMfa.slice(0, 8).join(', ')}${noMfa.length > 8 ? ', …' : ''}.`
+            : 'Every console-enabled user has MFA.',
+        remediation: noMfa.length ? 'Enforce MFA with a deny policy conditioned on aws:MultiFactorAuthPresent rather than relying on voluntary enrolment.' : undefined,
+    });
+    const unused = [];
+    for (const u of users) {
+        if (u.passwordEnabled) {
+            const d = daysSince(u.passwordLastUsed);
+            if (d !== null && d > unusedDays)
+                unused.push(`${u.user} password (${d}d)`);
+        }
+        for (const k of u.keys) {
+            if (!k.active)
+                continue;
+            // 'N/A' means active but never used; fall back to key age so a
+            // never-used key is not silently skipped.
+            const d = daysSince(k.lastUsed) ?? daysSince(k.lastRotated);
+            if (d !== null && d > unusedDays)
+                unused.push(`${u.user} key ${k.n} (${d}d)`);
+        }
+    }
+    out.push({
+        id: 'unused-credentials', category: 'users', title: 'Unused credentials',
+        status: unused.length ? 'FAIL' : 'PASS', severity: 'MEDIUM',
+        detail: unused.length
+            ? `${unused.length} credential(s) idle for over ${unusedDays}d: ${unused.slice(0, 8).join(', ')}${unused.length > 8 ? ', …' : ''}. An idle credential is pure attack surface — its first malicious use looks identical to its first legitimate use.`
+            : `No credential has been idle longer than ${unusedDays}d.`,
+        remediation: unused.length ? 'Delete them. Idle credentials are the ones whose misuse goes unnoticed longest.' : undefined,
+    });
+    return out;
+}
+export function auditUserPolicies(profile) {
+    const list = aws(['iam', 'list-users', '--query', 'Users[].UserName'], profile);
+    if (!list.ok) {
+        return {
+            id: 'user-admin-policy', category: 'users', title: 'AdministratorAccess on IAM users',
+            status: 'INDETERMINATE', severity: 'HIGH',
+            detail: `Could not list users (${list.errorCode || 'unknown error'}).`,
+        };
+    }
+    const names = Array.isArray(list.json) ? list.json : [];
+    const admins = [];
+    let unchecked = 0;
+    for (const name of names) {
+        const att = aws(['iam', 'list-attached-user-policies', '--user-name', name], profile);
+        if (!att.ok) {
+            unchecked++;
+            continue;
+        }
+        const policies = att.json?.AttachedPolicies ?? [];
+        if (policies.some((p) => p.PolicyName === 'AdministratorAccess'))
+            admins.push(name);
+    }
+    return {
+        id: 'user-admin-policy', category: 'users', title: 'AdministratorAccess on IAM users',
+        // A partial read cannot clear the check: unchecked users may be the admins.
+        status: admins.length ? 'FAIL' : unchecked > 0 ? 'INDETERMINATE' : 'PASS',
+        severity: 'HIGH',
+        detail: admins.length
+            ? `AdministratorAccess is attached directly to: ${admins.join(', ')}. Any access key belonging to these users is an unbounded credential.`
+            : unchecked > 0
+                ? `Checked ${names.length - unchecked}/${names.length} users; ${unchecked} could not be read, so this result is incomplete.`
+                : `None of ${names.length} user(s) has AdministratorAccess attached directly.`,
+        remediation: admins.length ? 'Move admin access behind an assumable role gated on MFA, so no static key carries it.' : undefined,
+    };
+}
+//# sourceMappingURL=audit-iam.js.map

package/dist/src/utils/audit-iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-iam.js","sourceRoot":"","sources":["../../../src/utils/audit-iam.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAwB1C;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,OAAgB;IACxC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC,CAAC;IAEzD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,mCAAmC,EAAE,CAAC;QACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,kBAAkB;gBAAE,MAAM;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,8BAA8B,EAAE,CAAC;IAE/E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IAE/D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC;YAChB,eAAe,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,MAAM;YAClD,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,MAAM;YACtC,gBAAgB,EAAE,EAAE,CAAC,oBAAoB,CAAC;YAC1C,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,CAAC;gBACD,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,MAAM;gBAC/C,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,CAAC;gBAC/C,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC;aAC/C,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,0EAA0E;IAC1E,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;YAC3D,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU;YAC7C,MAAM,EAAE,uCAAuC,OAAO,CAAC,SAAS,IAAI,eAAe,IAAI;YACvF,WAAW,EAAE,yCAAyC;SACvD,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;YACnE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU;YAC7C,MAAM,EAAE,uCAAuC,OAAO,CAAC,SAAS,IAAI,eAAe,IAAI;SACxF,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;QAC3D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU;QACvD,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,8BAA8B;YAChC,CAAC,CAAC,+HAA+H;QACnI,WAAW,EAAE,gMAAgM;KAC9M,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,CAAC,wBAAwB,KAAK,CAAC,CAAC;IACpD,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;QACnE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU;QACxD,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,4GAA4G;YAC9G,CAAC,CAAC,sBAAsB;QAC1B,WAAW,EAAE,4DAA4D;KAC1E,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,6BAA6B,CAAC,EAAE,OAAO,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB;YAC3E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAClC,MAAM,EAAE,yGAAyG;YACjH,WAAW,EAAE,2IAA2I;SACzJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB;YAC3E,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ;YAC3C,MAAM,EAAE,uCAAuC,GAAG,CAAC,SAAS,IAAI,eAAe,IAAI;SACpF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,GAAG,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,qBAAqB,IAAI,OAAO,SAAS,CAAC,CAAC;IACzH,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,CAAC,CAAC,0BAA0B;QAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,CAAC,uBAAuB;QAAE,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAE3E,OAAO;QACL,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB;QAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;QACzD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B;QAChG,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,2EAA2E,CAAC,CAAC,CAAC,SAAS;KACnH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA2B,EAAE,SAAiB,EAAE,UAAkB;IAC3F,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI;YAC7B,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,CAAC;YACpD,CAAC,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,CAAC;YAC5D,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,QAAQ,CAAC;SAClB,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK;gBAC5B,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG;gBACtC,MAAM,EAAE,kCAAkC,MAAM,CAAC,KAAK,IAAI;gBAC1D,WAAW,EAAE,8EAA8E;aAC5F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,CAAC,MAAM;gBAAE,SAAS;YACxB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB;QACxE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;YAClB,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,6BAA6B,SAAS,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,6JAA6J;YACtR,CAAC,CAAC,sCAAsC,SAAS,IAAI;QACvD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,wJAAwJ,CAAC,CAAC,CAAC,SAAS;KACjM,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,2BAA2B;QAChF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM;YAClB,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,+CAA+C,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;YAC/H,CAAC,CAAC,qCAAqC;QACzC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sHAAsH,CAAC,CAAC,CAAC,SAAS;KAC/J,CAAC,CAAC;IAEH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,UAAU;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,CAAC,MAAM;gBAAE,SAAS;YACxB,+DAA+D;YAC/D,0CAA0C;YAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,UAAU;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB;QACxE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;QAC3D,MAAM,EAAE,MAAM,CAAC,MAAM;YACnB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,gCAAgC,UAAU,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,oHAAoH;YACpP,CAAC,CAAC,2CAA2C,UAAU,IAAI;QAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,iFAAiF,CAAC,CAAC,CAAC,SAAS;KAC3H,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,kCAAkC;YACrF,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM;YACzC,MAAM,EAAE,yBAAyB,IAAI,CAAC,SAAS,IAAI,eAAe,IAAI;SACvE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAa,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,6BAA6B,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAAC,SAAS,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,qBAAqB,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO;QACL,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,kCAAkC;QACrF,4EAA4E;QAC5E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM;QACzE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;YACnB,CAAC,CAAC,gDAAgD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE;YAC1I,CAAC,CAAC,SAAS,GAAG,CAAC;gBACb,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,WAAW,SAAS,mDAAmD;gBAC5H,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,qDAAqD;QAClF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,uFAAuF,CAAC,CAAC,CAAC,SAAS;KACjI,CAAC;AACJ,CAAC"}