@prism-d1/cli 1.1.2 → 1.3.0

package/dist/src/security/pentest-dockerfile.js

@@ -0,0 +1,163 @@
+/**
+ * The `dockerfile` app-type adapter for `prism-cli security pentest`.
+ *
+ * Builds the app image from the repo's Dockerfile and runs it on Fargate behind
+ * an internal ALB in a fresh private VPC, by synth/deploy of the shipped CDK
+ * app in commands/security/pentest-cdk (generalized from the proven spike).
+ * `plan` synths + diffs (no writes); `apply` deploys, reads the stack outputs,
+ * and uploads the repo-at-HEAD source zip for white-box testing. Teardown is
+ * not here: pentest.ts deletes the recorded stack with CloudFormation.
+ *
+ * Everything AWS/cdk runs through child processes here, so this file is only
+ * exercised on the real command path; the orchestration in pentest.ts is tested
+ * against a fake adapter.
+ */
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, statSync } from 'node:fs';
+import { join, relative, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Abort, call } from './setup.js';
+import { repoZipKey } from './repo.js';
+import { getAssetPath } from '../utils/root.js';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const CDK_MAX_BUFFER = 64 * 1024 * 1024;
+/** Hours until the environment's prism:expires-at tag; the env is disposable. */
+const TTL_HOURS = 24;
+/** The shipped CDK app dir: the built asset when present, else the source tree (dev/tsx). */
+function assetDir() {
+    // Built: dist/assets/pentest-cdk, found the same way enable security finds
+    // its infra asset (walks up from this file). Dev/tsx: the source tree.
+    let built = null;
+    try {
+        built = getAssetPath(import.meta.url, 'pentest-cdk');
+    }
+    catch { /* not built */ }
+    const source = resolve(__dirname, '..', 'commands', 'security', 'pentest-cdk');
+    for (const d of [built, source])
+        if (d && existsSync(join(d, 'bin', 'app.ts')))
+            return d;
+    throw new Abort(`pentest CDK app not found (looked for dist/assets/pentest-cdk and ${source}); run npm run build`);
+}
+function cleanEnv(extra) {
+    const env = { ...process.env, ...extra };
+    for (const k of Object.keys(env))
+        if (k.startsWith('npm_'))
+            delete env[k];
+    return env;
+}
+/** Short, CFN-safe run id from the repo name plus a base36 timestamp. */
+export function runSlug(repo, now) {
+    const name = (repo.id.split('/').pop() || 'app').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 24) || 'app';
+    return `${name}-${now.toString(36)}`;
+}
+export function dockerfileApp(opts) {
+    const dir = () => assetDir();
+    const profileArgs = opts.profile ? ['--profile', opts.profile] : [];
+    function ensureDeps(d) {
+        if (existsSync(join(d, 'node_modules', '.bin', 'cdk')))
+            return;
+        execFileSync('npm', ['install', '--no-audit', '--no-fund'], { cwd: d, stdio: 'inherit', env: cleanEnv({}) });
+    }
+    function cdkEnv(ctx) {
+        const acct = call(ctx, ['sts', 'get-caller-identity']).json?.Account;
+        return cleanEnv({ CDK_DEFAULT_ACCOUNT: String(acct || ''), CDK_DEFAULT_REGION: ctx.opts.region, AWS_DEFAULT_REGION: ctx.opts.region, AWS_REGION: ctx.opts.region, AWS_PAGER: '' });
+    }
+    const ctxArgs = (c) => Object.entries(c).flatMap(([k, v]) => ['-c', `${k}=${v}`]);
+    function context(repo, cfg, slug) {
+        const appDir = join(repo.root, cfg.path);
+        // DockerImageAsset takes the Dockerfile relative to the build context.
+        const dockerfile = relative(appDir, join(repo.root, cfg.dockerfile)) || 'Dockerfile';
+        const byType = (t) => cfg.actors.filter((a) => a.auth.providerType === t).map((a) => a.auth.value);
+        return {
+            slug, appDir, dockerfile, port: String(cfg.port), healthPath: cfg.healthPath, zoneName: `${slug}.prism.internal`, ttlHours: String(TTL_HOURS),
+            // JSON in context values: spawnSync passes argv without a shell, so no quoting is involved.
+            env: JSON.stringify(Object.fromEntries(cfg.env.map((e) => [e.name, e.value]))),
+            secrets: JSON.stringify(Object.fromEntries(cfg.secretEnv.map((e) => [e.name, e.secret]))),
+            actorSecrets: JSON.stringify(byType('SECRETS_MANAGER')),
+            actorLambdas: JSON.stringify(byType('AWS_LAMBDA')),
+        };
+    }
+    function plan(ctx, repo, cfg) {
+        const slug = runSlug(repo, ctx.deps.now().getTime());
+        const stack = `PrismPentest-${slug}`;
+        const host = `app.${slug}.prism.internal`;
+        const d = dir();
+        ensureDeps(d);
+        const env = cdkEnv(ctx);
+        const bin = join(d, 'node_modules', '.bin', 'cdk');
+        const ctxA = ctxArgs(context(repo, cfg, slug));
+        const synth = spawnSync(bin, ['synth', '--quiet', ...ctxA, ...profileArgs], { cwd: d, env, encoding: 'utf8', maxBuffer: CDK_MAX_BUFFER });
+        if (synth.status !== 0)
+            throw new Abort(`cdk synth of the pentest target failed:\n${(synth.stderr || '').split('\n').slice(-15).join('\n')}`);
+        const diff = spawnSync(bin, ['diff', stack, '--no-color', '--method=template', ...ctxA, ...profileArgs], { cwd: d, env, encoding: 'utf8', maxBuffer: CDK_MAX_BUFFER });
+        const diffText = `${diff.stdout || ''}${diff.stderr || ''}`.trim() || 'A private VPC (isolated subnets only), ECR/S3/Logs VPC endpoints, a Fargate service, an internal ALB, four security groups, a scoped service role, a source bucket and a log group.';
+        return { diffText, targetHost: host, stack, slug };
+    }
+    function apply(ctx, repo, cfg, p, approveAll) {
+        const d = dir();
+        ensureDeps(d);
+        const env = cdkEnv(ctx);
+        const bin = join(d, 'node_modules', '.bin', 'cdk');
+        const ctxA = ctxArgs(context(repo, cfg, p.slug));
+        const approval = approveAll ? ['--require-approval', 'never'] : [];
+        const deploy = spawnSync(bin, ['deploy', p.stack, ...approval, ...ctxA, ...profileArgs], { cwd: d, env, stdio: 'inherit' });
+        if (deploy.status !== 0)
+            throw new Abort(`cdk deploy of the pentest target (${p.stack}) failed; check the output above and CloudFormation.`);
+        const outputs = readStackOutputs(ctx, p.stack);
+        const subnetArns = (outputs.SubnetArns || '').split(',').filter(Boolean);
+        if (!outputs.VpcArn || !subnetArns.length || !outputs.AgentSecurityGroupArn || !outputs.ServiceRoleArn || !outputs.AgentLogGroup || !outputs.PrivateHost || !outputs.SourceBucket || !outputs.TargetGroupArn) {
+            throw new Abort(`the pentest stack ${p.stack} did not report the expected outputs; cannot configure the pentest.`);
+        }
+        const sourceZipS3 = uploadSourceZip(ctx, repo, outputs.SourceBucket);
+        return {
+            targetHost: outputs.PrivateHost, targetUrl: `http://${outputs.PrivateHost}`,
+            vpcArn: outputs.VpcArn, subnetArns, pentestSubnetArn: subnetArns[0],
+            agentSecurityGroupArn: outputs.AgentSecurityGroupArn, serviceRoleArn: outputs.ServiceRoleArn,
+            logGroup: outputs.AgentLogGroup, sourceZipS3, expiresAt: outputs.ExpiresAt || '',
+            stack: p.stack, slug: p.slug,
+            targetGroupArn: outputs.TargetGroupArn, appLogGroup: outputs.AppLogGroup || '',
+        };
+    }
+    function readStackOutputs(ctx, stack) {
+        const r = call(ctx, ['cloudformation', 'describe-stacks', '--stack-name', stack]);
+        const outs = r.json?.Stacks?.[0]?.Outputs || [];
+        const map = {};
+        for (const o of outs)
+            if (o?.OutputKey)
+                map[String(o.OutputKey)] = String(o.OutputValue ?? '');
+        return map;
+    }
+    function uploadSourceZip(ctx, repo, bucket) {
+        const dirTmp = ctx.deps.makeTempDir();
+        const zip = join(dirTmp, 'source.zip');
+        const archived = ctx.deps.git(['-C', repo.root, 'archive', 'HEAD', '--format=zip', '-o', zip]);
+        if (!archived.ok || !existsSync(zip)) {
+            ctx.deps.log('Warning: git archive HEAD failed; the pentest runs without white-box source.');
+            return null;
+        }
+        const key = repoZipKey(repo.slug);
+        call(ctx, ['s3api', 'put-object', '--bucket', bucket, '--key', key, '--body', zip]);
+        return `s3://${bucket}/${key}`;
+    }
+    return {
+        type: 'dockerfile',
+        detect: (appDir, dockerfile) => {
+            try {
+                if (!statSync(appDir).isDirectory())
+                    return false;
+            }
+            catch {
+                return false;
+            }
+            const f = dockerfile ?? join(appDir, 'Dockerfile');
+            try {
+                return statSync(f).isFile();
+            }
+            catch {
+                return false;
+            }
+        },
+        plan, apply,
+    };
+}
+//# sourceMappingURL=pentest-dockerfile.js.map

package/dist/src/security/pentest-dockerfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest-dockerfile.js","sourceRoot":"","sources":["../../../src/security/pentest-dockerfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAA0B,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,iFAAiF;AACjF,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,6FAA6F;AAC7F,SAAS,QAAQ;IACf,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,KAAK,CAAC,qEAAqE,MAAM,sBAAsB,CAAC,CAAC;AACrH,CAAC;AAED,SAAS,QAAQ,CAAC,KAA6B;IAC7C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,OAAO,CAAC,IAAa,EAAE,GAAW;IAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;IACzI,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,SAAS,UAAU,CAAC,CAAS;QAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO;QAC/D,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,SAAS,MAAM,CAAC,GAAQ;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC;QACrE,OAAO,QAAQ,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACrL,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAyB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1G,SAAS,OAAO,CAAC,IAAa,EAAE,GAAkB,EAAE,IAAY;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,uEAAuE;QACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,YAAY,CAAC;QACrF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3G,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,iBAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;YAC7I,4FAA4F;YAC5F,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzF,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACvD,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,SAAS,IAAI,CAAC,GAAQ,EAAE,IAAa,EAAE,GAAkB;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,gBAAgB,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,IAAI,iBAAiB,CAAC;QAC1C,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,UAAU,CAAC,CAAC,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1I,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9I,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QACvK,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,qLAAqL,CAAC;QAC5P,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,SAAS,KAAK,CAAC,GAAQ,EAAE,IAAa,EAAE,GAAkB,EAAE,CAAc,EAAE,UAAmB;QAC7F,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,UAAU,CAAC,CAAC,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5H,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,KAAK,sDAAsD,CAAC,CAAC;QAE7I,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC7M,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,qEAAqE,CAAC,CAAC;QACrH,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACrE,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;YAC3E,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC;YACnE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc;YAC5F,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;YAChF,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;SAC/E,CAAC;IACJ,CAAC;IAED,SAAS,gBAAgB,CAAC,GAAQ,EAAE,KAAa;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,EAAE,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC/F,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,eAAe,CAAC,GAAQ,EAAE,IAAa,EAAE,MAAc;QAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACpJ,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ,MAAM,IAAI,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC,MAAc,EAAE,UAAmB,EAAE,EAAE;YAC9C,IAAI,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;oBAAE,OAAO,KAAK,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;YAClF,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACnD,IAAI,CAAC;gBAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC9D,CAAC;QACD,IAAI,EAAE,KAAK;KACZ,CAAC;AACJ,CAAC"}

package/dist/src/security/pentest.d.ts

@@ -0,0 +1,233 @@
+import { type PentestInfo, type PrismResult, type ResultEntry } from '../codewatch/results.js';
+import { type Ctx, type RepoCtx, type SecurityOptions } from './setup.js';
+import { TERMINAL, type ReviewDeps } from './review.js';
+/** A pentest runs for hours (the spike took ~2h50m), so --wait defaults to 6h, not code-review's 30m. */
+export declare const PENTEST_DEFAULT_TIMEOUT_MIN = 360;
+/** Terminal job states (STOPPING is not terminal). Same set as code-review. */
+export { TERMINAL };
+export declare const FAIL_ON_LEVELS: readonly ["critical", "high", "medium", "low"];
+export declare const PENTEST_NOTICE = "prism-cli security pentest deploys a TEMPORARY private environment (a VPC with private subnets only, Fargate behind an internal ALB, VPC endpoints, a service role, a source bucket and a log group) into the AWS account your credentials point to, builds and pushes your app image, uploads the repo at HEAD, registers and verifies a PRIVATE_VPC target domain, and starts an AWS Security Agent penetration test against that environment only. The environment is reachable only by the pentest agent; it has no public endpoint. It is torn down when the job finishes (--keep leaves it up, --cleanup removes it later).";
+export declare const COST_WARNING = "Cost: AWS Security Agent penetration testing is billed in task-hours (publicly reported at $50 per task-hour, per-second metered; verify current pricing at the AWS Security Agent pricing page), plus the Fargate, internal ALB and VPC-endpoint running cost for as long as the environment is up. A run can last hours (the reference run took ~2h50m).";
+export interface PentestOptions extends SecurityOptions {
+    /** Repo top level (default: the working directory). */
+    path?: string;
+    /** Docker build context, relative to the repo root; overrides "path" in pentest.json. */
+    appDir?: string;
+    /** Dockerfile, relative to the repo root; overrides "dockerfile" in pentest.json. */
+    dockerfile?: string;
+    /** Adapter to build the app with (default: inferred, v1 only "dockerfile"). */
+    appType?: string;
+    /** commander turns --no-wait off; default here is already not to wait, so this is opt-in. */
+    wait?: boolean;
+    timeout?: string | number;
+    keep?: boolean;
+    status?: boolean;
+    cleanup?: boolean;
+    includeFalsePositives?: boolean;
+    failOn?: string;
+    /** security findings --pentest only: a specific job id, and the display severity floor. */
+    job?: string;
+    severity?: string;
+}
+export declare const PENTEST_CONFIG_PATH = ".prism/pentest.json";
+export interface ActorConfig {
+    identifier: string;
+    uris?: string[];
+    auth: {
+        providerType: string;
+        value: string;
+    };
+}
+export interface PentestConfig {
+    appType: string;
+    /** Docker build context, relative to the repo root. */
+    path: string;
+    /** Dockerfile, relative to the repo root (default: <path>/Dockerfile). */
+    dockerfile: string;
+    port: number;
+    healthPath: string;
+    /** Literal env values plus resolved Secrets Manager references. */
+    env: {
+        name: string;
+        value: string;
+    }[];
+    secretEnv: {
+        name: string;
+        secret: string;
+    }[];
+    actors: ActorConfig[];
+    excludeRiskTypes: string[];
+}
+/**
+ * Loads and validates `.prism/pentest.json`. A sensitive-looking env value must
+ * be a Secrets Manager reference ({ "secret": "<arn>" }), never a literal, so
+ * no credential lands in the committed file.
+ */
+export declare function loadPentestConfig(repoRoot: string, override?: {
+    appType?: string;
+    path?: string;
+    appDir?: string;
+    dockerfile?: string;
+}): PentestConfig;
+/** The deployed temporary environment the pentest runs against. */
+export interface TargetEnv {
+    /** The verified target host (app.<zone>) and its URL. */
+    targetHost: string;
+    targetUrl: string;
+    vpcArn: string;
+    /** Every private subnet (for the agent space). */
+    subnetArns: string[];
+    /** The ONE subnet create-pentest --vpc-config accepts. */
+    pentestSubnetArn: string;
+    agentSecurityGroupArn: string;
+    serviceRoleArn: string;
+    logGroup: string;
+    sourceZipS3?: string | null;
+    expiresAt: string;
+    /** CloudFormation stack of the environment, for teardown. */
+    stack: string;
+    slug: string;
+    /** The ALB target group in front of the app; the command waits for a healthy target in it. */
+    targetGroupArn: string;
+    /** The app container's log group, named in the health-timeout hint. */
+    appLogGroup: string;
+}
+export interface PentestPlan {
+    /** Human-readable summary of what the deploy will create (cdk diff). */
+    diffText: string;
+    /** The target host the deploy will stand up (derivable before deploy). */
+    targetHost: string;
+    stack: string;
+    slug: string;
+}
+/**
+ * An app type knows how to stand its app up as a private pentest target and
+ * tear it down. `plan` is read-only (synth + diff); `apply` deploys and returns
+ * the environment handle. v1 ships only the dockerfile adapter.
+ */
+export interface PentestApp {
+    readonly type: string;
+    /** Can this adapter handle the app at `dir`? */
+    /** True when the build context dir and (for dockerfile) the Dockerfile exist. */
+    detect(dir: string, dockerfile?: string): boolean;
+    plan(ctx: Ctx, repo: RepoCtx, cfg: PentestConfig): PentestPlan;
+    apply(ctx: Ctx, repo: RepoCtx, cfg: PentestConfig, plan: PentestPlan, approveAll: boolean): TargetEnv;
+}
+interface PentestJob {
+    jobId: string;
+    status: string;
+    step?: string | null;
+    reason?: string | null;
+    overview?: string | null;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export declare function toPentestJob(j: any): PentestJob;
+interface Env {
+    targetHost: string;
+    stack: string;
+    slug: string;
+    expiresAt: string;
+    agentSgId?: string | null;
+    appLogGroup?: string | null;
+    targetDomainId?: string | null;
+}
+export declare function pendingPentestResult(o: {
+    job: PentestJob;
+    pentestId: string;
+    agentSpaceId: string;
+    dedicated: boolean;
+    region: string;
+    account: string;
+    env: Env;
+    commit: string | null;
+    branch: string | null;
+    startedAt: string;
+}): PrismResult;
+export declare function countByRisk(fs: PentestFinding[]): Record<string, number>;
+export interface PentestFinding {
+    findingId: string;
+    riskLevel: string;
+    confidence: string;
+    title: string;
+    riskType: string;
+    description: string;
+}
+export declare function completedPentestResult(o: {
+    job: PentestJob;
+    pentestId: string;
+    agentSpaceId: string;
+    dedicated: boolean;
+    region: string;
+    account: string;
+    env: Env;
+    commit: string | null;
+    branch: string | null;
+    startedAt: string;
+    findings: PentestFinding[];
+    now: Date;
+    wallS?: number | null;
+}): PrismResult;
+export declare function totalsLine(c: Record<string, number>): string;
+export declare function getPentestJob(ctx: Ctx, agentSpaceId: string, jobId: string): PentestJob;
+/** Pentest findings, dropping FALSE_POSITIVE confidence unless `includeFP`. */
+export declare function fetchPentestFindings(ctx: Ctx, agentSpaceId: string, jobId: string, includeFP: boolean): PentestFinding[];
+export declare function failOnHit(fs: PentestFinding[], failOn: string | undefined): boolean;
+export type PollOutcome = {
+    kind: 'done' | 'timeout' | 'interrupted';
+    job: PentestJob;
+};
+export declare function pollPentest(ctx: Ctx, agentSpaceId: string, first: PentestJob, timeoutMin: number): Promise<PollOutcome>;
+/** The --profile/--region this run was given, so a printed follow-up command targets the same account and region. */
+export declare const followUpFlags: (ctx: Ctx) => string;
+/** The newest security-pentest record for this account+region (pending first, else any), used by --status/--cleanup/findings. */
+export declare function latestPentestEntry(root: string, account: string, region: string, jobId?: string): ResultEntry | null;
+/** cdk deploy returns before the ALB has a healthy target; starting then gets 503s and PREFLIGHT fails. */
+export declare const HEALTH_TIMEOUT_MS: number;
+export declare const HEALTH_POLL_MS = 15000;
+/**
+ * Polls the ALB target group until at least one target is `healthy`. On
+ * timeout aborts with the targets' state, reason and description and how to
+ * read the app's logs -- before anything is created in Security Agent.
+ */
+export declare function waitForHealthyTarget(ctx: Ctx, env: TargetEnv, say: (l?: string) => void, timeoutMs?: number): Promise<void>;
+/** Security Agent removes its ENIs a while after a job ends; the stack cannot delete the subnets/SG until then. */
+export declare const ENI_DRAIN_TIMEOUT_MS: number;
+export declare const ENI_POLL_MS = 15000;
+/** How long one stack deletion may take (VPC endpoints, the ALB and the bucket-emptying custom resource). */
+export declare const STACK_DELETE_TIMEOUT_MS: number;
+export declare const STACK_POLL_MS = 15000;
+/**
+ * The environment stack a record belongs to: the stored name, else the slug,
+ * else derived from the target host. shortcut: the derivation follows the
+ * dockerfile adapter's naming (PrismPentest-<slug>, app.<slug>.prism.internal)
+ * and exists for records whose earlier teardown cleared the name; drop it once
+ * those records are gone.
+ */
+export declare function recordedStackName(p: PentestInfo): string | null;
+export declare function teardownFailedLine(ctx: Ctx, p: PentestInfo): string;
+/** `prism-cli security pentest`. Returns the exit code. */
+export declare function securityPentest(input: PentestOptions, deps: ReviewDeps, app: PentestApp): Promise<number>;
+/**
+ * `prism-cli security findings --pentest [<job>]`. Read-only in AWS: refreshes
+ * the pentest job, completes the cached record in place, and prints the
+ * findings. Never tears the environment down (that is pentest --status /
+ * --cleanup). Returns the exit code.
+ */
+export declare function securityPentestFindings(input: PentestOptions, deps: ReviewDeps): Promise<number>;
+/** create-target-domain (PRIVATE_VPC) + verify. UNREACHABLE and VERIFIED/PENDING are OK; FAILED aborts. Returns the domain id. */
+export declare function createAndVerifyDomain(ctx: Ctx, host: string, say: (l?: string) => void): string;
+/**
+ * The agent space to run in. v1 creates a DEDICATED pentest space per run (the
+ * spike-proven path), bound to the run's VPC, role, log group and target
+ * domain. shortcut: reuse the shared PrismD1SecurityAgent space via
+ * update-agent-space once that path is proven in an account (see the design's
+ * open question); reusing it untested risks the code-review space's config.
+ */
+export declare function resolveAgentSpace(ctx: Ctx, env: TargetEnv, domainId: string, say: (l?: string) => void): {
+    agentSpaceId: string;
+    dedicated: boolean;
+};
+/** create-pentest with vpc-config (ONE subnet), a single ALLOW rule for the target URL, and the source zip. Returns the pentest id. */
+export declare function createPentest(ctx: Ctx, cfg: PentestConfig, env: TargetEnv, agentSpaceId: string, say: (l?: string) => void): string;
+//# sourceMappingURL=pentest.d.ts.map

package/dist/src/security/pentest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest.d.ts","sourceRoot":"","sources":["../../../src/security/pentest.ts"],"names":[],"mappings":"AAsBA,OAAO,EAES,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EACnE,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAEL,KAAK,GAAG,EAAE,KAAK,OAAO,EAAiB,KAAK,eAAe,EAC5D,MAAM,YAAY,CAAC;AACpB,OAAO,EACiE,QAAQ,EAC7D,KAAK,UAAU,EACjC,MAAM,aAAa,CAAC;AAMrB,yGAAyG;AACzG,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpB,eAAO,MAAM,cAAc,gDAAiD,CAAC;AAQ7E,eAAO,MAAM,cAAc,smBAAsmB,CAAC;AAEloB,eAAO,MAAM,YAAY,+VAA+V,CAAC;AAMzX,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,MAAM,WAAW,WAAW;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE;AACnH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAuDvJ;AAMD,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,WAAW,CAAC;IAC/D,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;CAGvG;AAMD,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,GAAG,UAAU,CAgB/C;AAOD,UAAU,GAAG;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AA6B5K,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAMjP;AAWD,wBAAgB,WAAW,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxE;AAED,MAAM,WAAW,cAAc;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAElJ,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAkBjT;AAMD,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAG5D;AAUD,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAIvF;AAcD,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,cAAc,EAAE,CAqBxH;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAInF;AAoBD,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE,CAAC;AAsBxF,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA2B7H;AAED,qHAAqH;AACrH,eAAO,MAAM,aAAa,GAAI,KAAK,GAAG,WAA+I,CAAC;AAoDtL,iIAAiI;AACjI,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CASpH;AASD,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,QAAc,CAAC;AAC7C,eAAO,MAAM,cAAc,QAAS,CAAC;AAiBrC;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,SAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB5I;AAMD,mHAAmH;AACnH,eAAO,MAAM,oBAAoB,QAAc,CAAC;AAChD,eAAO,MAAM,WAAW,QAAS,CAAC;AAoClC,6GAA6G;AAC7G,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,eAAO,MAAM,aAAa,QAAS,CAAC;AAwFpC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAI/D;AASD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,CAEnE;AAMD,2DAA2D;AAC3D,wBAAsB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAwI/G;AAsED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgDtG;AAMD,kIAAkI;AAClI,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAU/F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAYrJ;AAED,uIAAuI;AACvI,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAkBnI"}