@prism-d1/cli 1.2.0 → 1.4.0

package/dist/src/security/pentest.d.ts

@@ -0,0 +1,233 @@
+import { type PentestInfo, type PrismResult, type ResultEntry } from '../codewatch/results.js';
+import { type Ctx, type RepoCtx, type SecurityOptions } from './setup.js';
+import { TERMINAL, type ReviewDeps } from './review.js';
+/** A pentest runs for hours (the spike took ~2h50m), so --wait defaults to 6h, not code-review's 30m. */
+export declare const PENTEST_DEFAULT_TIMEOUT_MIN = 360;
+/** Terminal job states (STOPPING is not terminal). Same set as code-review. */
+export { TERMINAL };
+export declare const FAIL_ON_LEVELS: readonly ["critical", "high", "medium", "low"];
+export declare const PENTEST_NOTICE = "prism-cli security pentest deploys a TEMPORARY private environment (a VPC with private subnets only, Fargate behind an internal ALB, VPC endpoints, a service role, a source bucket and a log group) into the AWS account your credentials point to, builds and pushes your app image, uploads the repo at HEAD, registers and verifies a PRIVATE_VPC target domain, and starts an AWS Security Agent penetration test against that environment only. The environment is reachable only by the pentest agent; it has no public endpoint. It is torn down when the job finishes (--keep leaves it up, --cleanup removes it later).";
+export declare const COST_WARNING = "Cost: AWS Security Agent penetration testing is billed in task-hours (publicly reported at $50 per task-hour, per-second metered; verify current pricing at the AWS Security Agent pricing page), plus the Fargate, internal ALB and VPC-endpoint running cost for as long as the environment is up. A run can last hours (the reference run took ~2h50m).";
+export interface PentestOptions extends SecurityOptions {
+    /** Repo top level (default: the working directory). */
+    path?: string;
+    /** Docker build context, relative to the repo root; overrides "path" in pentest.json. */
+    appDir?: string;
+    /** Dockerfile, relative to the repo root; overrides "dockerfile" in pentest.json. */
+    dockerfile?: string;
+    /** Adapter to build the app with (default: inferred, v1 only "dockerfile"). */
+    appType?: string;
+    /** commander turns --no-wait off; default here is already not to wait, so this is opt-in. */
+    wait?: boolean;
+    timeout?: string | number;
+    keep?: boolean;
+    status?: boolean;
+    cleanup?: boolean;
+    includeFalsePositives?: boolean;
+    failOn?: string;
+    /** security findings --pentest only: a specific job id, and the display severity floor. */
+    job?: string;
+    severity?: string;
+}
+export declare const PENTEST_CONFIG_PATH = ".prism/pentest.json";
+export interface ActorConfig {
+    identifier: string;
+    uris?: string[];
+    auth: {
+        providerType: string;
+        value: string;
+    };
+}
+export interface PentestConfig {
+    appType: string;
+    /** Docker build context, relative to the repo root. */
+    path: string;
+    /** Dockerfile, relative to the repo root (default: <path>/Dockerfile). */
+    dockerfile: string;
+    port: number;
+    healthPath: string;
+    /** Literal env values plus resolved Secrets Manager references. */
+    env: {
+        name: string;
+        value: string;
+    }[];
+    secretEnv: {
+        name: string;
+        secret: string;
+    }[];
+    actors: ActorConfig[];
+    excludeRiskTypes: string[];
+}
+/**
+ * Loads and validates `.prism/pentest.json`. A sensitive-looking env value must
+ * be a Secrets Manager reference ({ "secret": "<arn>" }), never a literal, so
+ * no credential lands in the committed file.
+ */
+export declare function loadPentestConfig(repoRoot: string, override?: {
+    appType?: string;
+    path?: string;
+    appDir?: string;
+    dockerfile?: string;
+}): PentestConfig;
+/** The deployed temporary environment the pentest runs against. */
+export interface TargetEnv {
+    /** The verified target host (app.<zone>) and its URL. */
+    targetHost: string;
+    targetUrl: string;
+    vpcArn: string;
+    /** Every private subnet (for the agent space). */
+    subnetArns: string[];
+    /** The ONE subnet create-pentest --vpc-config accepts. */
+    pentestSubnetArn: string;
+    agentSecurityGroupArn: string;
+    serviceRoleArn: string;
+    logGroup: string;
+    sourceZipS3?: string | null;
+    expiresAt: string;
+    /** CloudFormation stack of the environment, for teardown. */
+    stack: string;
+    slug: string;
+    /** The ALB target group in front of the app; the command waits for a healthy target in it. */
+    targetGroupArn: string;
+    /** The app container's log group, named in the health-timeout hint. */
+    appLogGroup: string;
+}
+export interface PentestPlan {
+    /** Human-readable summary of what the deploy will create (cdk diff). */
+    diffText: string;
+    /** The target host the deploy will stand up (derivable before deploy). */
+    targetHost: string;
+    stack: string;
+    slug: string;
+}
+/**
+ * An app type knows how to stand its app up as a private pentest target and
+ * tear it down. `plan` is read-only (synth + diff); `apply` deploys and returns
+ * the environment handle. v1 ships only the dockerfile adapter.
+ */
+export interface PentestApp {
+    readonly type: string;
+    /** Can this adapter handle the app at `dir`? */
+    /** True when the build context dir and (for dockerfile) the Dockerfile exist. */
+    detect(dir: string, dockerfile?: string): boolean;
+    plan(ctx: Ctx, repo: RepoCtx, cfg: PentestConfig): PentestPlan;
+    apply(ctx: Ctx, repo: RepoCtx, cfg: PentestConfig, plan: PentestPlan, approveAll: boolean): TargetEnv;
+}
+interface PentestJob {
+    jobId: string;
+    status: string;
+    step?: string | null;
+    reason?: string | null;
+    overview?: string | null;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export declare function toPentestJob(j: any): PentestJob;
+interface Env {
+    targetHost: string;
+    stack: string;
+    slug: string;
+    expiresAt: string;
+    agentSgId?: string | null;
+    appLogGroup?: string | null;
+    targetDomainId?: string | null;
+}
+export declare function pendingPentestResult(o: {
+    job: PentestJob;
+    pentestId: string;
+    agentSpaceId: string;
+    dedicated: boolean;
+    region: string;
+    account: string;
+    env: Env;
+    commit: string | null;
+    branch: string | null;
+    startedAt: string;
+}): PrismResult;
+export declare function countByRisk(fs: PentestFinding[]): Record<string, number>;
+export interface PentestFinding {
+    findingId: string;
+    riskLevel: string;
+    confidence: string;
+    title: string;
+    riskType: string;
+    description: string;
+}
+export declare function completedPentestResult(o: {
+    job: PentestJob;
+    pentestId: string;
+    agentSpaceId: string;
+    dedicated: boolean;
+    region: string;
+    account: string;
+    env: Env;
+    commit: string | null;
+    branch: string | null;
+    startedAt: string;
+    findings: PentestFinding[];
+    now: Date;
+    wallS?: number | null;
+}): PrismResult;
+export declare function totalsLine(c: Record<string, number>): string;
+export declare function getPentestJob(ctx: Ctx, agentSpaceId: string, jobId: string): PentestJob;
+/** Pentest findings, dropping FALSE_POSITIVE confidence unless `includeFP`. */
+export declare function fetchPentestFindings(ctx: Ctx, agentSpaceId: string, jobId: string, includeFP: boolean): PentestFinding[];
+export declare function failOnHit(fs: PentestFinding[], failOn: string | undefined): boolean;
+export type PollOutcome = {
+    kind: 'done' | 'timeout' | 'interrupted';
+    job: PentestJob;
+};
+export declare function pollPentest(ctx: Ctx, agentSpaceId: string, first: PentestJob, timeoutMin: number): Promise<PollOutcome>;
+/** The --profile/--region this run was given, so a printed follow-up command targets the same account and region. */
+export declare const followUpFlags: (ctx: Ctx) => string;
+/** The newest security-pentest record for this account+region (pending first, else any), used by --status/--cleanup/findings. */
+export declare function latestPentestEntry(root: string, account: string, region: string, jobId?: string): ResultEntry | null;
+/** cdk deploy returns before the ALB has a healthy target; starting then gets 503s and PREFLIGHT fails. */
+export declare const HEALTH_TIMEOUT_MS: number;
+export declare const HEALTH_POLL_MS = 15000;
+/**
+ * Polls the ALB target group until at least one target is `healthy`. On
+ * timeout aborts with the targets' state, reason and description and how to
+ * read the app's logs -- before anything is created in Security Agent.
+ */
+export declare function waitForHealthyTarget(ctx: Ctx, env: TargetEnv, say: (l?: string) => void, timeoutMs?: number): Promise<void>;
+/** Security Agent removes its ENIs a while after a job ends; the stack cannot delete the subnets/SG until then. */
+export declare const ENI_DRAIN_TIMEOUT_MS: number;
+export declare const ENI_POLL_MS = 15000;
+/** How long one stack deletion may take (VPC endpoints, the ALB and the bucket-emptying custom resource). */
+export declare const STACK_DELETE_TIMEOUT_MS: number;
+export declare const STACK_POLL_MS = 15000;
+/**
+ * The environment stack a record belongs to: the stored name, else the slug,
+ * else derived from the target host. shortcut: the derivation follows the
+ * dockerfile adapter's naming (PrismPentest-<slug>, app.<slug>.prism.internal)
+ * and exists for records whose earlier teardown cleared the name; drop it once
+ * those records are gone.
+ */
+export declare function recordedStackName(p: PentestInfo): string | null;
+export declare function teardownFailedLine(ctx: Ctx, p: PentestInfo): string;
+/** `prism-cli security pentest`. Returns the exit code. */
+export declare function securityPentest(input: PentestOptions, deps: ReviewDeps, app: PentestApp): Promise<number>;
+/**
+ * `prism-cli security findings --pentest [<job>]`. Read-only in AWS: refreshes
+ * the pentest job, completes the cached record in place, and prints the
+ * findings. Never tears the environment down (that is pentest --status /
+ * --cleanup). Returns the exit code.
+ */
+export declare function securityPentestFindings(input: PentestOptions, deps: ReviewDeps): Promise<number>;
+/** create-target-domain (PRIVATE_VPC) + verify. UNREACHABLE and VERIFIED/PENDING are OK; FAILED aborts. Returns the domain id. */
+export declare function createAndVerifyDomain(ctx: Ctx, host: string, say: (l?: string) => void): string;
+/**
+ * The agent space to run in. v1 creates a DEDICATED pentest space per run (the
+ * spike-proven path), bound to the run's VPC, role, log group and target
+ * domain. shortcut: reuse the shared PrismD1SecurityAgent space via
+ * update-agent-space once that path is proven in an account (see the design's
+ * open question); reusing it untested risks the code-review space's config.
+ */
+export declare function resolveAgentSpace(ctx: Ctx, env: TargetEnv, domainId: string, say: (l?: string) => void): {
+    agentSpaceId: string;
+    dedicated: boolean;
+};
+/** create-pentest with vpc-config (ONE subnet), a single ALLOW rule for the target URL, and the source zip. Returns the pentest id. */
+export declare function createPentest(ctx: Ctx, cfg: PentestConfig, env: TargetEnv, agentSpaceId: string, say: (l?: string) => void): string;
+//# sourceMappingURL=pentest.d.ts.map

package/dist/src/security/pentest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest.d.ts","sourceRoot":"","sources":["../../../src/security/pentest.ts"],"names":[],"mappings":"AAsBA,OAAO,EAES,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EACnE,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAEL,KAAK,GAAG,EAAE,KAAK,OAAO,EAAiB,KAAK,eAAe,EAC5D,MAAM,YAAY,CAAC;AACpB,OAAO,EACiE,QAAQ,EAC7D,KAAK,UAAU,EACjC,MAAM,aAAa,CAAC;AAMrB,yGAAyG;AACzG,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpB,eAAO,MAAM,cAAc,gDAAiD,CAAC;AAQ7E,eAAO,MAAM,cAAc,smBAAsmB,CAAC;AAEloB,eAAO,MAAM,YAAY,+VAA+V,CAAC;AAMzX,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,MAAM,WAAW,WAAW;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE;AACnH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAuDvJ;AAMD,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,WAAW,CAAC;IAC/D,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;CAGvG;AAMD,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,GAAG,UAAU,CAgB/C;AAOD,UAAU,GAAG;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AA6B5K,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAMjP;AAWD,wBAAgB,WAAW,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxE;AAED,MAAM,WAAW,cAAc;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAElJ,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAkBjT;AAMD,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAG5D;AAUD,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAIvF;AAcD,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,cAAc,EAAE,CAqBxH;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAInF;AAoBD,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE,CAAC;AAsBxF,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA2B7H;AAED,qHAAqH;AACrH,eAAO,MAAM,aAAa,GAAI,KAAK,GAAG,WAA+I,CAAC;AAoDtL,iIAAiI;AACjI,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CASpH;AASD,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,QAAc,CAAC;AAC7C,eAAO,MAAM,cAAc,QAAS,CAAC;AAiBrC;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,SAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB5I;AAMD,mHAAmH;AACnH,eAAO,MAAM,oBAAoB,QAAc,CAAC;AAChD,eAAO,MAAM,WAAW,QAAS,CAAC;AAoClC,6GAA6G;AAC7G,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,eAAO,MAAM,aAAa,QAAS,CAAC;AAwFpC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAI/D;AASD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,CAEnE;AAMD,2DAA2D;AAC3D,wBAAsB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAwI/G;AAsED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgDtG;AAMD,kIAAkI;AAClI,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAU/F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAYrJ;AAED,uIAAuI;AACvI,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAkBnI"}