@prism-d1/cli 1.2.0 → 1.4.0

package/dist/src/aws/check.js

@@ -0,0 +1,269 @@
+/**
+ * `prism-cli aws check`: read-only account checks on the audit framework
+ * (utils/audit.ts), in pluggable sections. A section is a name, a heading,
+ * the check ids it can return, and a run function; SECTIONS is the registry.
+ *
+ * Every AWS call here is a read. INDETERMINATE (a denied or failed read) is
+ * never counted as a pass.
+ */
+import { aws } from '../utils/aws.js';
+import { severityRank } from '../utils/audit.js';
+import { auditAccount, ACCOUNT_AUDIT_IDS } from '../utils/audit-account.js';
+import { configuredSyncUrl } from '../commands/enable/codeburn.js';
+import { collectSecurityStatus, PIPELINE_STACK, } from '../security/setup.js';
+/** `<section>.<id>`: one id space across sections (a check appears in one section only). */
+export const checkId = (section, id) => `${section}.${id}`;
+const call = (c, args, region = c.region) => aws([...args, '--region', region], c.target);
+const why = (r) => r.errorCode || r.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'unknown error';
+const pass = (b, detail) => ({ ...b, status: 'PASS', detail });
+const fail = (b, detail, remediation) => ({ ...b, status: 'FAIL', detail, remediation });
+/** A read that did not answer. `action` is the IAM action the check needs, when known. */
+const unknown = (b, r, action) => ({
+    ...b, status: 'INDETERMINATE',
+    detail: `Could not check (${typeof r === 'string' ? r : why(r)}).${action ? ` Needs ${action}.` : ''}`,
+    remediation: action ? `Grant ${action} (read-only) and re-run prism-cli aws check.` : undefined,
+});
+// ---------------------------------------------------------------------------
+// bedrock: the bedrock-protection scan-account checks, unchanged
+// ---------------------------------------------------------------------------
+export const bedrockSection = {
+    name: 'bedrock',
+    heading: 'Bedrock protection (the bedrock-protection scan-account checks)',
+    ids: ACCOUNT_AUDIT_IDS,
+    run(c) {
+        // generateCredentialReport false: aws check never calls iam generate-credential-report.
+        return auditAccount(c.target, c.account, c.region, { maxKeyAge: 90, unusedDays: 90, runIam: true, runBedrock: true, generateCredentialReport: false })
+            .map((f) => ({ ...f, id: checkId('bedrock', f.id), category: 'bedrock' }));
+    },
+};
+// ---------------------------------------------------------------------------
+// prism-setup
+// ---------------------------------------------------------------------------
+const PS = (id, title, severity) => ({ id: checkId('prism-setup', id), category: 'prism-setup', title, severity });
+const GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';
+/** Role names bootstrapper setup-github-oidc / setup-gitlab-oidc create. */
+const CI_ROLE = /^(GitHubActions|GitLabCI)-/;
+export function metricsPipeline(c) {
+    const b = PS('metrics-pipeline', `PRISM metrics pipeline stack (${PIPELINE_STACK})`, 'MEDIUM');
+    const r = call(c, ['cloudformation', 'describe-stacks', '--stack-name', PIPELINE_STACK]);
+    const fix = `Deploy the metrics pipeline (infra/, cdk deploy ${PIPELINE_STACK}); see the PRISM workshop setup guide.`;
+    if (!r.ok)
+        return /does not exist/.test(r.raw) ? fail(b, `${PIPELINE_STACK} is not deployed in ${c.region}.`, fix) : unknown(b, r, 'cloudformation:DescribeStacks');
+    const status = String(r.json?.Stacks?.[0]?.StackStatus || 'UNKNOWN');
+    if (/_COMPLETE$/.test(status) && !/ROLLBACK_COMPLETE$|^DELETE_COMPLETE$/.test(status))
+        return pass(b, `${PIPELINE_STACK} is ${status} in ${c.region}.`);
+    return fail(b, `${PIPELINE_STACK} is ${status} in ${c.region}.`, fix);
+}
+/** Maps the enable security --status rows to findings. A row that never appeared (the report stopped) is INDETERMINATE. */
+export function securityAgent(c) {
+    const { rows } = collectSecurityStatus(c.security);
+    const row = (label) => rows.find((r) => r[1] === label);
+    const stopped = rows.find((r) => r[1] === 'Stopped' || (r[1] === 'Credentials' && r[0] !== 'ok'));
+    const fix = 'Run prism-cli enable security (it shows a diff and asks before any change).';
+    const one = (b, r) => {
+        if (!r)
+            return unknown(b, stopped ? stopped[2] : 'not reached', undefined);
+        if (r[0] === 'ok')
+            return pass(b, r[2]);
+        if (r[0] === 'unknown')
+            return unknown(b, r[2]);
+        return fail(b, r[2], fix);
+    };
+    const ssm = ['SSM agent-space-id', 'SSM scan-bucket', 'SSM service-role-arn'].map(row);
+    const ssmB = PS('security-agent-ssm', 'Security Agent SSM parameters (/prism/continuum/*)', 'MEDIUM');
+    const ssmF = ssm.some((r) => !r) ? one(ssmB, undefined)
+        : ssm.every((r) => r[0] === 'ok') ? pass(ssmB, ssm.map((r) => r[2]).join('; '))
+            : fail(ssmB, ssm.filter((r) => r[0] !== 'ok').map((r) => r[2]).join('; '), fix);
+    return [
+        one(PS('security-agent-stack', 'Security Agent stack (PrismD1SecurityAgent or pipeline-hosted)', 'MEDIUM'), row('Stack')),
+        ssmF,
+        one(PS('scan-bucket-listed', 'Scan bucket listed on the Security Agent space', 'LOW'), row('Scan bucket on agent space')),
+    ];
+}
+export function ciOidcRole(c) {
+    const b = PS('ci-oidc-role', 'GitHub/GitLab OIDC provider and CI role', 'MEDIUM');
+    const fix = 'Run prism-cli bootstrapper setup-github-oidc (or setup-gitlab-oidc) for the repo whose CI publishes PRISM metrics.';
+    const p = call(c, ['iam', 'list-open-id-connect-providers']);
+    if (!p.ok)
+        return unknown(b, p, 'iam:ListOpenIDConnectProviders');
+    const arns = (p.json?.OpenIDConnectProviderList || []).map((x) => String(x?.Arn || ''));
+    const providers = arns.filter((a) => a.endsWith(`/${GITHUB_OIDC_HOST}`) || /gitlab/i.test(a)).map((a) => a.split('oidc-provider/')[1]);
+    const r = call(c, ['iam', 'list-roles', '--query', 'Roles[].RoleName']);
+    if (!r.ok)
+        return unknown(b, r, 'iam:ListRoles');
+    const roles = (Array.isArray(r.json) ? r.json : []).map(String).filter((n) => CI_ROLE.test(n));
+    if (providers.length && roles.length)
+        return pass(b, `OIDC provider ${providers.join(', ')}; CI role ${roles.slice(0, 3).join(', ')}${roles.length > 3 ? ` and ${roles.length - 3} more` : ''}.`);
+    const missing = [providers.length ? '' : 'no GitHub or GitLab OIDC provider', roles.length ? '' : 'no GitHubActions-* or GitLabCI-* role'].filter(Boolean);
+    return fail(b, `${missing.join(' and ')}, so CI cannot publish PRISM metrics with short-lived credentials.`, fix);
+}
+/** Local only: the endpoint codeburn syncs to (~/.config/codeburn/sync.json). No AWS call. */
+export function codeburnSync(c) {
+    const b = PS('codeburn-sync', 'codeburn sync endpoint configured on this machine', 'LOW');
+    const url = configuredSyncUrl(c.home);
+    if (url === null)
+        return fail(b, 'codeburn sync is not set up here, so this machine sends no usage telemetry to the PRISM collector.', 'Run prism-cli enable codeburn.');
+    if (!url)
+        return unknown(b, 'the codeburn sync config could not be read');
+    return pass(b, `codeburn syncs to ${url}.`);
+}
+export const prismSetupSection = {
+    name: 'prism-setup',
+    heading: 'PRISM setup',
+    ids: ['metrics-pipeline', 'security-agent-stack', 'security-agent-ssm', 'scan-bucket-listed', 'ci-oidc-role', 'codeburn-sync'],
+    run: (c) => [metricsPipeline(c), ...securityAgent(c), ciOidcRole(c), codeburnSync(c)],
+};
+// ---------------------------------------------------------------------------
+// baseline
+// ---------------------------------------------------------------------------
+const BL = (id, title, severity) => ({ id: checkId('baseline', id), category: 'baseline', title, severity });
+export function cloudTrail(c) {
+    const b = BL('cloudtrail-multiregion', 'CloudTrail: a multi-region trail that is logging', 'HIGH');
+    const fix = 'Create a multi-region trail (aws cloudtrail create-trail --is-multi-region-trail, then start-logging), or an organization trail from the management account.';
+    const r = call(c, ['cloudtrail', 'describe-trails']);
+    if (!r.ok)
+        return unknown(b, r, 'cloudtrail:DescribeTrails');
+    const multi = (r.json?.trailList || []).filter((t) => t?.IsMultiRegionTrail);
+    if (!multi.length)
+        return fail(b, 'No multi-region trail, so API activity in other regions is not recorded.', fix);
+    let readable = 0;
+    for (const t of multi) {
+        const s = call(c, ['cloudtrail', 'get-trail-status', '--name', String(t.TrailARN || t.Name)], String(t.HomeRegion || c.region));
+        if (!s.ok)
+            continue;
+        readable++;
+        if (s.json?.IsLogging)
+            return pass(b, `${t.Name} is multi-region and logging.`);
+    }
+    if (!readable)
+        return unknown(b, 'get-trail-status was denied for every multi-region trail', 'cloudtrail:GetTrailStatus');
+    return fail(b, `Multi-region trail(s) ${multi.map((t) => t.Name).join(', ')} exist but none is logging.`, 'Start logging: aws cloudtrail start-logging --name <trail>.');
+}
+export function guardDuty(c) {
+    const b = BL('guardduty', `GuardDuty detector enabled in ${c.region}`, 'HIGH');
+    const fix = `Enable GuardDuty in ${c.region} (aws guardduty create-detector --enable), ideally org-wide from a delegated administrator.`;
+    const r = call(c, ['guardduty', 'list-detectors']);
+    if (!r.ok)
+        return unknown(b, r, 'guardduty:ListDetectors');
+    const ids = r.json?.DetectorIds || [];
+    if (!ids.length)
+        return fail(b, `No GuardDuty detector in ${c.region}.`, fix);
+    const d = call(c, ['guardduty', 'get-detector', '--detector-id', ids[0]]);
+    if (!d.ok)
+        return unknown(b, d, 'guardduty:GetDetector');
+    return d.json?.Status === 'ENABLED' ? pass(b, `Detector ${ids[0]} is enabled.`) : fail(b, `Detector ${ids[0]} is ${d.json?.Status || 'not enabled'}.`, fix);
+}
+export function securityHub(c) {
+    const b = BL('securityhub', `Security Hub enabled in ${c.region}`, 'MEDIUM');
+    const r = call(c, ['securityhub', 'describe-hub']);
+    if (r.ok)
+        return pass(b, `Security Hub is enabled${r.json?.SubscribedAt ? ` (since ${r.json.SubscribedAt})` : ''}.`);
+    if (/^(InvalidAccessException|ResourceNotFoundException)$/.test(r.errorCode)) {
+        return fail(b, `Security Hub is not enabled in ${c.region}.`, `Enable Security Hub in ${c.region} with the AWS Foundational Security Best Practices standard.`);
+    }
+    return unknown(b, r, 'securityhub:DescribeHub');
+}
+export function accessAnalyzer(c) {
+    const b = BL('access-analyzer', `IAM Access Analyzer in ${c.region}`, 'MEDIUM');
+    const r = call(c, ['accessanalyzer', 'list-analyzers']);
+    if (!r.ok)
+        return unknown(b, r, 'access-analyzer:ListAnalyzers');
+    const active = (r.json?.analyzers || []).filter((a) => a?.status === 'ACTIVE');
+    return active.length ? pass(b, `Analyzer ${active[0].name} (${active[0].type}) is active.`)
+        : fail(b, `No active Access Analyzer in ${c.region}, so resources shared outside the account are not flagged.`, `Create one: aws accessanalyzer create-analyzer --analyzer-name prism --type ACCOUNT --region ${c.region}.`);
+}
+// Root MFA is not repeated here: the bedrock section's bedrock.root-mfa reads the same
+// iam get-account-summary, and a second copy listed the same fix twice.
+export function budget(c) {
+    const b = BL('budget', 'At least one AWS Budget', 'MEDIUM');
+    const r = call(c, ['budgets', 'describe-budgets', '--account-id', c.account]);
+    if (!r.ok)
+        return unknown(b, r, 'budgets:ViewBudget');
+    const n = (r.json?.Budgets || []).length;
+    return n ? pass(b, `${n} budget(s) defined.`) : fail(b, 'No budgets, so unexpected spend raises no alert.', 'Create a monthly cost budget with 80% and 100% alerts (Billing console > Budgets).');
+}
+export function s3PublicAccess(c) {
+    const b = BL('s3-account-bpa', 'S3 Block Public Access at the account level', 'HIGH');
+    const fix = `Turn on all four settings: aws s3control put-public-access-block --account-id ${c.account} --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true.`;
+    const r = call(c, ['s3control', 'get-public-access-block', '--account-id', c.account]);
+    if (!r.ok)
+        return r.errorCode === 'NoSuchPublicAccessBlockConfiguration' ? fail(b, 'No account-level Block Public Access configuration.', fix) : unknown(b, r, 's3:GetAccountPublicAccessBlock');
+    const cfg = r.json?.PublicAccessBlockConfiguration ?? {};
+    const off = ['BlockPublicAcls', 'IgnorePublicAcls', 'BlockPublicPolicy', 'RestrictPublicBuckets'].filter((k) => cfg[k] !== true);
+    return off.length ? fail(b, `Off: ${off.join(', ')}.`, fix) : pass(b, 'All four account-level settings are on.');
+}
+export function ebsEncryption(c) {
+    const b = BL('ebs-default-encryption', `EBS encryption by default in ${c.region}`, 'MEDIUM');
+    const r = call(c, ['ec2', 'get-ebs-encryption-by-default']);
+    if (!r.ok)
+        return unknown(b, r, 'ec2:GetEbsEncryptionByDefault');
+    return r.json?.EbsEncryptionByDefault === true ? pass(b, 'New EBS volumes are encrypted by default.')
+        : fail(b, `New EBS volumes in ${c.region} are not encrypted by default.`, `aws ec2 enable-ebs-encryption-by-default --region ${c.region}.`);
+}
+export const baselineSection = {
+    name: 'baseline',
+    heading: 'Account baseline',
+    ids: ['cloudtrail-multiregion', 'guardduty', 'securityhub', 'access-analyzer', 'budget', 's3-account-bpa', 'ebs-default-encryption'],
+    run: (c) => [cloudTrail(c), guardDuty(c), securityHub(c), accessAnalyzer(c), budget(c), s3PublicAccess(c), ebsEncryption(c)],
+};
+// ---------------------------------------------------------------------------
+// startup-advisor: placeholder until how it is consumed (and its license) is known
+// ---------------------------------------------------------------------------
+export const startupAdvisorSection = {
+    name: 'startup-advisor',
+    heading: 'Startup Advisor',
+    ids: ['not-integrated'],
+    run: () => [{
+            id: checkId('startup-advisor', 'not-integrated'), category: 'startup-advisor', title: 'Startup Advisor account checks',
+            status: 'INDETERMINATE', severity: 'INFO',
+            detail: 'Not integrated yet: how PRISM consumes Startup Advisor, and under what license, is still open.',
+        }],
+};
+export const SECTIONS = [bedrockSection, prismSetupSection, baselineSection, startupAdvisorSection];
+/** Every full check id any section can return. */
+export const ALL_CHECK_IDS = SECTIONS.flatMap((s) => s.ids.map((id) => checkId(s.name, id)));
+/** The sections named by --section (all when none), or an error naming the valid ones. */
+export function selectSections(names) {
+    if (!names?.length)
+        return SECTIONS;
+    const bad = names.filter((n) => !SECTIONS.some((s) => s.name === n));
+    if (bad.length)
+        return { error: `unknown --section ${bad.join(', ')}; choose from ${SECTIONS.map((s) => s.name).join(', ')}` };
+    return SECTIONS.filter((s) => names.includes(s.name));
+}
+export function countFindings(findings) {
+    return {
+        pass: findings.filter((f) => f.status === 'PASS').length,
+        fail: findings.filter((f) => f.status === 'FAIL').length,
+        indeterminate: findings.filter((f) => f.status === 'INDETERMINATE').length,
+    };
+}
+export function failBySeverity(findings) {
+    const out = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, INFO: 0 };
+    for (const f of findings)
+        if (f.status === 'FAIL')
+            out[f.severity]++;
+    return out;
+}
+/** FAIL findings at or above `failOn` (none when failOn is null). */
+export function breaching(findings, failOn) {
+    if (!failOn)
+        return [];
+    return findings.filter((f) => f.status === 'FAIL' && severityRank(f.severity) >= severityRank(failOn));
+}
+/** A read-only enable-security context for collectSecurityStatus. Repo rows are skipped (git reports no repo). */
+export function securityContext(opts, aws, env, awsVersion, log) {
+    const unused = () => { throw new Error('internal: not available in aws check'); };
+    const deps = {
+        aws, env, awsVersion, log,
+        configRegion: () => null,
+        cdk: { synth: unused, diff: unused, deploy: unused },
+        git: () => ({ ok: false, stdout: '', stderr: 'not used by aws check' }),
+        makeTempDir: unused,
+        isTTY: false,
+        ask: async () => '',
+        now: () => new Date(),
+    };
+    return { opts, deps, cliVersion: awsVersion(), readOnly: true };
+}
+//# sourceMappingURL=check.js.map

package/dist/src/aws/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/aws/check.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,GAAG,EAAkC,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAA+B,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,qBAAqB,EAAE,cAAc,GACtC,MAAM,sBAAsB,CAAC;AAmB9B,4FAA4F;AAC5F,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAU,EAAU,EAAE,CAAC,GAAG,OAAO,IAAI,EAAE,EAAE,CAAC;AAEnF,MAAM,IAAI,GAAG,CAAC,CAAe,EAAE,IAAc,EAAE,MAAM,GAAG,CAAC,CAAC,MAAM,EAAa,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7H,MAAM,GAAG,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC;AAG7H,MAAM,IAAI,GAAG,CAAC,CAAO,EAAE,MAAc,EAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACtF,MAAM,IAAI,GAAG,CAAC,CAAO,EAAE,MAAc,EAAE,WAAmB,EAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AACxH,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,CAAO,EAAE,CAAqB,EAAE,MAAe,EAAW,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe;IAC7B,MAAM,EAAE,oBAAoB,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACtG,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,MAAM,8CAA8C,CAAC,CAAC,CAAC,SAAS;CAChG,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,iEAAiE;IAC1E,GAAG,EAAE,iBAAiB;IACtB,GAAG,CAAC,CAAC;QACH,wFAAwF;QACxF,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;aACnJ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;CACF,CAAC;AAEF,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAC9E,MAAM,EAAE,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,QAAkB,EAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnJ,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,4EAA4E;AAC5E,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAE7C,MAAM,UAAU,eAAe,CAAC,CAAe;IAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,iCAAiC,cAAc,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/F,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,mDAAmD,cAAc,wCAAwC,CAAC;IACtH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,cAAc,uBAAuB,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACpK,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;IACrE,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,cAAc,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxJ,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,cAAc,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,aAAa,CAAC,CAAe;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,6EAA6E,CAAC;IAC1F,MAAM,GAAG,GAAG,CAAC,CAAO,EAAE,CAAwB,EAAW,EAAE;QACzD,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,EAAE,CAAC,oBAAoB,EAAE,oDAAoD,EAAE,QAAQ,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;QACrD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO;QACL,GAAG,CAAC,EAAE,CAAC,sBAAsB,EAAE,gEAAgE,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzH,IAAI;QACJ,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,gDAAgD,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,4BAA4B,CAAC,CAAC;KAC1H,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAe;IACxC,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,yCAAyC,EAAE,QAAQ,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,oHAAoH,CAAC;IACjI,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,gCAAgC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,CAAC,CAAC,CAAC,IAAI,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvI,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,IAAI,SAAS,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClM,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mCAAmC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3J,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oEAAoE,EAAE,GAAG,CAAC,CAAC;AACpH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,CAAe;IAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,mDAAmD,EAAE,KAAK,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,oGAAoG,EAAE,gCAAgC,CAAC,CAAC;IACzK,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,4CAA4C,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,EAAE,qBAAqB,GAAG,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,aAAa;IACtB,GAAG,EAAE,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,CAAC;IAC9H,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACtF,CAAC;AAEF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAC9E,MAAM,EAAE,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,QAAkB,EAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE7I,MAAM,UAAU,UAAU,CAAC,CAAe;IACxC,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,kDAAkD,EAAE,MAAM,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,8JAA8J,CAAC;IAC3K,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,0EAA0E,EAAE,GAAG,CAAC,CAAC;IACnH,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAChI,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,SAAS;QACpB,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,+BAA+B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,0DAA0D,EAAE,2BAA2B,CAAC,CAAC;IAC1H,OAAO,IAAI,CAAC,CAAC,EAAE,yBAAyB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,6DAA6D,CAAC,CAAC;AAC3K,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAe;IACvC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,uBAAuB,CAAC,CAAC,MAAM,6FAA6F,CAAC;IACzI,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAa,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;AAC9J,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAe;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrH,IAAI,sDAAsD,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC,MAAM,GAAG,EAAE,0BAA0B,CAAC,CAAC,MAAM,8DAA8D,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACjE,MAAM,MAAM,GAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC;QACzF,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC,MAAM,4DAA4D,EAAE,gGAAgG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACjO,CAAC;AAED,uFAAuF;AACvF,wEAAwE;AAExE,MAAM,UAAU,MAAM,CAAC,CAAe;IACpC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,yBAAyB,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,kDAAkD,EAAE,oFAAoF,CAAC,CAAC;AACpM,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,MAAM,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,iFAAiF,CAAC,CAAC,OAAO,oIAAoI,CAAC;IAC3O,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,yBAAyB,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC,SAAS,KAAK,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,qDAAqD,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACjM,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,8BAA8B,IAAI,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACjI,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,yCAAyC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAe;IAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,gCAAgC,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,2CAA2C,CAAC;QACnG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,MAAM,gCAAgC,EAAE,qDAAqD,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,kBAAkB;IAC3B,GAAG,EAAE,CAAC,wBAAwB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,wBAAwB,CAAC;IACpI,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;CAC7H,CAAC;AAEF,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,iBAAiB;IAC1B,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACvB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACV,EAAE,EAAE,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,gCAAgC;YACtH,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM;YACzC,MAAM,EAAE,gGAAgG;SACzG,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAmB,CAAC,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;AAEpH,kDAAkD;AAClD,MAAM,CAAC,MAAM,aAAa,GAAa,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAEvG,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,KAA2B;IACxD,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC/H,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAID,MAAM,UAAU,aAAa,CAAC,QAAmB;IAC/C,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;QACxD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;QACxD,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,MAAM;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,MAAM,GAAG,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,QAAmB,EAAE,MAAuB;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAgB,EAAE,GAAsB,EAAE,UAA+B,EAAE,GAAyB;IAClJ,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,IAAI,GAAS;QACjB,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG;QACzB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;QACxB,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACvE,WAAW,EAAE,MAAM;QACnB,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QACnB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC"}

package/dist/src/aws/connect.d.ts

@@ -0,0 +1,65 @@
+import type { AwsResult } from '../utils/aws.js';
+import type { RunResult } from '../utils/exec.js';
+export interface ConnectOptions {
+    profile?: string;
+    region?: string;
+    /** Write (or clear) the per-repo file instead of the per-user one. */
+    repo?: boolean;
+    status?: boolean;
+    clear?: boolean;
+}
+export interface ConnectDeps {
+    /** A read-only `aws <args>` call as `profile` in `region` (JSON output). */
+    aws(args: string[], profile: string, region: string): AwsResult;
+    listProfiles(): string[];
+    configRegion(profile?: string): string | null;
+    git(args: string[]): RunResult;
+    env: NodeJS.ProcessEnv;
+    home: string;
+    cwd(): string;
+    isTTY: boolean;
+    ask(question: string): Promise<string>;
+    log(line?: string): void;
+    now(): Date;
+}
+export declare const CONNECT_NOTICE = "Read-only (aws connect): it checks the profile with STS and reads the account alias, Organizations and IAM; nothing in AWS is changed. No credentials are stored, only the profile name and region.";
+export interface Identity {
+    account: string;
+    arn: string;
+}
+export type OrgRole = {
+    kind: 'management';
+    orgId: string;
+} | {
+    kind: 'member';
+    orgId: string;
+} | {
+    kind: 'none';
+} | {
+    kind: 'unknown';
+    reason: string;
+};
+export interface AccessLevel {
+    level: 'admin' | 'read-only' | 'unknown';
+    basis: string;
+}
+export declare function callerIdentity(d: ConnectDeps, profile: string, region: string): Identity | {
+    error: string;
+};
+export declare function accountAlias(d: ConnectDeps, profile: string, region: string): string | null;
+/** Whether the account is its organization's management account. AccessDenied is "unknown", never "no". */
+export declare function orgRole(d: ConnectDeps, profile: string, region: string, account: string): OrgRole;
+/** The principal behind a caller ARN: an assumed role, an IAM user, or root. */
+export declare function principalOf(arn: string): {
+    kind: 'role' | 'user' | 'root' | 'other';
+    name: string;
+};
+/**
+ * Admin or read-only, as far as can be told without simulating policies:
+ * the attached managed policies when they can be read, else the role or user
+ * name. "unknown" whenever neither is conclusive.
+ */
+export declare function accessLevel(d: ConnectDeps, profile: string, region: string, arn: string): AccessLevel;
+/** Runs `aws connect`. Returns the exit code. */
+export declare function awsConnect(o: ConnectOptions, d: ConnectDeps): Promise<number>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/src/aws/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/aws/connect.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQlD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAChE,YAAY,IAAI,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,IAAI,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,IAAI,IAAI,CAAC;CACb;AAED,eAAO,MAAM,cAAc,wMAAwM,CAAC;AAEpO,MAAM,WAAW,QAAQ;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAC1D,MAAM,MAAM,OAAO,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACzJ,MAAM,WAAW,WAAW;IAAG,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAIxF,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAK5G;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3F;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAUjG;AAOD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAOnG;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAarG;AA8ED,iDAAiD;AACjD,wBAAsB,UAAU,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAsDnF"}

package/dist/src/aws/connect.js

@@ -0,0 +1,250 @@
+/**
+ * `prism-cli aws connect`: choose the AWS profile and region the other AWS
+ * commands default to, verify them, and save the choice. Read-only in AWS;
+ * stores no credentials (see connection.ts for the files and precedence).
+ */
+import { existsSync } from 'node:fs';
+import { ensureMarkerIgnored } from '../security/marker.js';
+import { accountChangeWarning, applyConnection, clearConnectionFile, connectionLabel, ENV_CREDENTIAL_VARS, loadConnection, PROFILE_RE, readConnectionFile, REGION_RE, REPO_CONNECTION_PATH, repoConnectionPath, repoRootOf, userConnectionPath, writeConnectionFile, } from './connection.js';
+export const CONNECT_NOTICE = 'Read-only (aws connect): it checks the profile with STS and reads the account alias, Organizations and IAM; nothing in AWS is changed. No credentials are stored, only the profile name and region.';
+const reason = (r) => r.errorCode || r.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'unknown error';
+export function callerIdentity(d, profile, region) {
+    const r = d.aws(['sts', 'get-caller-identity'], profile, region);
+    if (!r.ok)
+        return { error: reason(r) };
+    const account = String(r.json?.Account || '');
+    return account ? { account, arn: String(r.json?.Arn || '') } : { error: 'get-caller-identity returned no account' };
+}
+export function accountAlias(d, profile, region) {
+    const r = d.aws(['iam', 'list-account-aliases'], profile, region);
+    const a = r.ok && Array.isArray(r.json?.AccountAliases) ? r.json.AccountAliases[0] : null;
+    return a ? String(a) : null;
+}
+/** Whether the account is its organization's management account. AccessDenied is "unknown", never "no". */
+export function orgRole(d, profile, region, account) {
+    const r = d.aws(['organizations', 'describe-organization'], profile, region);
+    if (r.ok) {
+        const org = r.json?.Organization ?? {};
+        // The API names the management account's id field MasterAccountId.
+        const managementId = String(org.MasterAccountId || '');
+        return managementId === account ? { kind: 'management', orgId: String(org.Id || '') } : { kind: 'member', orgId: String(org.Id || '') };
+    }
+    if (r.errorCode === 'AWSOrganizationsNotInUseException')
+        return { kind: 'none' };
+    return { kind: 'unknown', reason: reason(r) };
+}
+const ADMIN_POLICY = /^(AdministratorAccess|PowerUserAccess)$|FullAccess$/;
+const READ_POLICY = /^(ReadOnlyAccess|ViewOnlyAccess|SecurityAudit)$|ReadOnly/;
+const ADMIN_NAME = /admin|poweruser|fullaccess/i;
+const READ_NAME = /read-?only|view-?only|audit/i;
+/** The principal behind a caller ARN: an assumed role, an IAM user, or root. */
+export function principalOf(arn) {
+    const m = /^arn:[^:]+:(sts|iam)::\d{12}:(assumed-role|user|root|role)(?:\/(.*))?$/.exec(arn);
+    if (!m)
+        return { kind: 'other', name: '' };
+    if (m[2] === 'root')
+        return { kind: 'root', name: 'root' };
+    const parts = (m[3] || '').split('/');
+    if (m[2] === 'assumed-role' || m[2] === 'role')
+        return { kind: 'role', name: m[2] === 'assumed-role' ? parts[0] : parts[parts.length - 1] };
+    return { kind: 'user', name: parts[parts.length - 1] };
+}
+/**
+ * Admin or read-only, as far as can be told without simulating policies:
+ * the attached managed policies when they can be read, else the role or user
+ * name. "unknown" whenever neither is conclusive.
+ */
+export function accessLevel(d, profile, region, arn) {
+    const p = principalOf(arn);
+    if (p.kind === 'root')
+        return { level: 'admin', basis: 'the root user' };
+    if (p.kind === 'other' || !p.name)
+        return { level: 'unknown', basis: 'the caller ARN has an unexpected form' };
+    const call = p.kind === 'role' ? ['iam', 'list-attached-role-policies', '--role-name', p.name] : ['iam', 'list-attached-user-policies', '--user-name', p.name];
+    const r = d.aws(call, profile, region);
+    const names = r.ok ? (r.json?.AttachedPolicies || []).map((x) => String(x?.PolicyName || '')).filter(Boolean) : [];
+    if (names.some((n) => ADMIN_POLICY.test(n)))
+        return { level: 'admin', basis: `attached policy ${names.find((n) => ADMIN_POLICY.test(n))}` };
+    if (names.length && names.every((n) => READ_POLICY.test(n)))
+        return { level: 'read-only', basis: `attached policies ${names.join(', ')}` };
+    const why = r.ok ? (names.length ? `custom policies (${names.join(', ')})` : 'no managed policies attached') : `policies not readable (${reason(r)})`;
+    if (ADMIN_NAME.test(p.name))
+        return { level: 'admin', basis: `the ${p.kind} name ${p.name}; ${why}` };
+    if (READ_NAME.test(p.name))
+        return { level: 'read-only', basis: `the ${p.kind} name ${p.name}; ${why}` };
+    return { level: 'unknown', basis: why };
+}
+const orgText = (o) => o.kind === 'management' ? `yes, the management account of ${o.orgId}`
+    : o.kind === 'member' ? `no, a member account of ${o.orgId}` : o.kind === 'none' ? 'no, not in an organization' : `unknown (${o.reason})`;
+async function chooseProfile(o, d, saved) {
+    if (o.profile)
+        return o.profile;
+    const profiles = d.listProfiles();
+    if (!d.isTTY) {
+        if (d.env.AWS_PROFILE)
+            return d.env.AWS_PROFILE;
+        return { error: 'no --profile given and there is no terminal to choose on. Pass --profile <name> (see aws configure list-profiles).' };
+    }
+    if (!profiles.length)
+        return { error: 'no AWS profiles are configured. Create one with aws configure sso (or aws configure --profile <name>), then re-run.' };
+    const preferred = d.env.AWS_PROFILE || saved?.profile || (profiles.includes('default') ? 'default' : profiles[0]);
+    const def = Math.max(0, profiles.indexOf(preferred));
+    d.log('AWS profiles (from aws configure list-profiles):');
+    profiles.forEach((p, i) => d.log(`  ${i + 1}) ${p}${i === def ? '  (default)' : ''}`));
+    const a = (await d.ask(`Profile [${def + 1}]: `)).trim();
+    if (!a)
+        return profiles[def];
+    const n = Number.parseInt(a, 10);
+    if (String(n) === a && n >= 1 && n <= profiles.length)
+        return profiles[n - 1];
+    return profiles.includes(a) ? a : { error: `"${a}" is not one of the listed profiles.` };
+}
+async function chooseRegion(o, d, profile) {
+    if (o.region)
+        return o.region;
+    const def = d.env.AWS_REGION || d.env.AWS_DEFAULT_REGION || d.configRegion(profile) || '';
+    if (!d.isTTY)
+        return def || { error: `no --region given and profile ${profile} has no configured region. Pass --region <region>.` };
+    const a = (await d.ask(`Region${def ? ` [${def}]` : ''}: `)).trim();
+    return a || def || { error: 'a region is required.' };
+}
+function repoRoot(d) {
+    return repoRootOf(d.cwd(), d.git);
+}
+/** `--clear`: removes the user file, or the repo file with --repo. */
+function clear(o, d) {
+    let path;
+    if (o.repo) {
+        const root = repoRoot(d);
+        if (!root) {
+            d.log('Error: --repo needs to run inside a git repository.');
+            return 1;
+        }
+        path = repoConnectionPath(root);
+    }
+    else
+        path = userConnectionPath(d.home);
+    d.log(clearConnectionFile(path) ? `Removed ${path}. Nothing in AWS was changed.` : `Nothing to clear: ${path} does not exist.`);
+    return 0;
+}
+function describeFile(label, path, d) {
+    const c = readConnectionFile(path);
+    if (c)
+        d.log(`  ${label}: ${path}\n      profile ${c.profile}, region ${c.region}, account ${c.account}${c.alias ? ` (${c.alias})` : ''}, verified ${c.verifiedAt || 'unknown'}`);
+    else
+        d.log(`  ${label}: ${path} (${existsSync(path) ? 'not a valid connection; ignored. Re-run prism-cli aws connect' : 'not set'})`);
+}
+/** `--status`: what is saved, which file applies, and whether it still validates. */
+function status(d) {
+    const root = repoRoot(d);
+    d.log('Saved AWS connection:');
+    describeFile('user', userConnectionPath(d.home), d);
+    if (root)
+        describeFile('repo', repoConnectionPath(root), d);
+    else
+        d.log('  repo: (not in a git repository)');
+    const saved = loadConnection(d.home, root);
+    if (!saved) {
+        d.log('');
+        d.log('No saved connection: AWS commands use the default credential chain. Save one with: prism-cli aws connect');
+        return 0;
+    }
+    const applied = applyConnection({}, saved, d.env);
+    d.log('');
+    if (applied.profileSource)
+        d.log(`In use: profile ${saved.profile}, region ${saved.region} (${connectionLabel(saved)}, ${saved.path})`);
+    else {
+        const v = ENV_CREDENTIAL_VARS.find((k) => d.env[k]);
+        d.log(`Not in use for credentials: ${v} is set, and the environment wins over the saved connection${applied.connection ? ` (the saved region ${saved.region} still applies)` : ''}.`);
+    }
+    if (d.env.AWS_REGION || d.env.AWS_DEFAULT_REGION)
+        d.log(`Region note: ${d.env.AWS_REGION ? 'AWS_REGION' : 'AWS_DEFAULT_REGION'} is set and wins over the saved region.`);
+    const id = callerIdentity(d, saved.profile, saved.region);
+    if ('error' in id) {
+        d.log(`Validation: FAILED for profile ${saved.profile}: ${id.error}. Sign in again (e.g. aws sso login --profile ${saved.profile}) or re-run prism-cli aws connect.`);
+        return 1;
+    }
+    const w = accountChangeWarning(saved, id.account);
+    d.log(w ?? `Validation: ok, profile ${saved.profile} is account ${id.account} as saved (caller ${id.arn}).`);
+    return w ? 1 : 0;
+}
+/** Runs `aws connect`. Returns the exit code. */
+export async function awsConnect(o, d) {
+    if (o.status && o.clear) {
+        d.log('Error: --status and --clear cannot be combined.');
+        return 1;
+    }
+    if (o.clear)
+        return clear(o, d);
+    d.log(CONNECT_NOTICE);
+    d.log('');
+    if (o.status)
+        return status(d);
+    const root = repoRoot(d);
+    if (o.repo && !root) {
+        d.log('Error: --repo needs to run inside a git repository.');
+        return 1;
+    }
+    const before = loadConnection(d.home, root);
+    const profile = await chooseProfile(o, d, before);
+    if (typeof profile !== 'string') {
+        d.log(`Error: ${profile.error}`);
+        return 1;
+    }
+    if (!PROFILE_RE.test(profile)) {
+        d.log(`Error: "${profile}" is not a valid profile name.`);
+        return 1;
+    }
+    const known = d.listProfiles();
+    if (known.length && !known.includes(profile)) {
+        d.log(`Error: profile ${profile} is not configured here (aws configure list-profiles lists: ${known.join(', ')}).`);
+        return 1;
+    }
+    const region = await chooseRegion(o, d, profile);
+    if (typeof region !== 'string') {
+        d.log(`Error: ${region.error}`);
+        return 1;
+    }
+    if (!REGION_RE.test(region)) {
+        d.log(`Error: "${region}" is not a valid AWS region name (e.g. us-west-2).`);
+        return 1;
+    }
+    const id = callerIdentity(d, profile, region);
+    if ('error' in id) {
+        d.log(`Error: profile ${profile} does not validate: ${id.error}. Sign in (e.g. aws sso login --profile ${profile}) and re-run. Nothing was saved.`);
+        return 1;
+    }
+    const alias = accountAlias(d, profile, region);
+    const org = orgRole(d, profile, region, id.account);
+    const access = accessLevel(d, profile, region, id.arn);
+    d.log(`Profile:     ${profile}`);
+    d.log(`Region:      ${region}`);
+    d.log(`Account:     ${id.account}${alias ? ` (${alias})` : ' (no account alias)'}`);
+    d.log(`Caller:      ${id.arn || 'unknown'}`);
+    d.log(`Org management account: ${orgText(org)}`);
+    d.log(`Access:      ${access.level} (${access.basis})`);
+    if (access.level === 'admin')
+        d.log('             prism-cli aws check and aws recommend only need read access; a read-only profile is enough for them.');
+    const path = o.repo && root ? repoConnectionPath(root) : userConnectionPath(d.home);
+    const prev = readConnectionFile(path);
+    if (prev && prev.profile === profile && prev.account !== id.account) {
+        d.log(`Warning: profile ${profile} was saved as account ${prev.account}; it now resolves to account ${id.account}.`);
+    }
+    const conn = { profile, region, account: id.account, alias, verifiedAt: d.now().toISOString() };
+    if (o.repo && root) {
+        const excluded = ensureMarkerIgnored(root, d.git, REPO_CONNECTION_PATH, 'prism-cli aws connect');
+        if (excluded)
+            d.log(`Added ${REPO_CONNECTION_PATH} to ${excluded} so git ignores it in this clone.`);
+    }
+    writeConnectionFile(path, conn);
+    d.log('');
+    d.log(`Saved ${path} (profile name, region, account and alias; no credentials).`);
+    d.log(`AWS commands now default to profile ${profile} in ${region}${o.repo ? ' in this repo' : ''}. --profile/--region and AWS_PROFILE/AWS_REGION still win.`);
+    const env = ENV_CREDENTIAL_VARS.find((k) => d.env[k]);
+    if (env && d.env.AWS_PROFILE !== profile)
+        d.log(`Note: ${env} is set in this shell, so it wins here until it is unset.`);
+    if (!o.repo && root && readConnectionFile(repoConnectionPath(root)))
+        d.log(`Note: this repo has its own ${REPO_CONNECTION_PATH}, which wins over the user file here.`);
+    return 0;
+}
+//# sourceMappingURL=connect.js.map