@prism-d1/cli 1.3.0 → 1.4.0

package/dist/src/aws/advice.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The fixed mapping behind `prism-cli aws recommend`: one entry per check id
+ * aws check can return. A test fails when a check id has no entry.
+ *
+ * effort: quick = one command or console toggle; medium = a setup step that
+ * takes some decisions; large = a project (migrating users, redesigning access).
+ */
+export type Effort = 'quick' | 'medium' | 'large';
+export interface Advice {
+    title: string;
+    why: string;
+    steps: string[];
+    /** The prism-cli command that fixes it, when there is one. */
+    command?: string;
+    doc: string;
+    effort: Effort;
+    /** IAM actions the check reads; shown when the check was INDETERMINATE. */
+    needs?: string[];
+    /** Replaces the generic "grant read access" item when INDETERMINATE means something else. */
+    indeterminate?: string;
+    /** Checks with the same key are one fix in aws recommend (default: the check id). */
+    key?: string;
+    /** The key of a fix this check can only be judged after (INDETERMINATE for that reason points at it). */
+    prerequisite?: string;
+}
+/** Title and wording for a key that several checks share. `first` names the fix when another check waits on it. */
+export declare const GROUPS: Record<string, {
+    title: string;
+    why: string;
+    first: string;
+}>;
+export declare const ADVICE: Record<string, Advice>;
+//# sourceMappingURL=advice.d.ts.map

package/dist/src/aws/advice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advice.d.ts","sourceRoot":"","sources":["../../../src/aws/advice.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,mHAAmH;AACnH,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAMhF,CAAC;AAiBF,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA0JzC,CAAC"}

package/dist/src/aws/advice.js

@@ -0,0 +1,174 @@
+/** Title and wording for a key that several checks share. `first` names the fix when another check waits on it. */
+export const GROUPS = {
+    budgets: {
+        title: 'Create AWS Budgets: one for all spend, plus filters for Bedrock and AWS Marketplace',
+        why: 'Without budgets unexpected spend raises no alert, and Bedrock\'s third-party models bill under Marketplace, so a Bedrock-only filter misses them.',
+        first: 'Create the budgets',
+    },
+};
+const IAM = 'https://docs.aws.amazon.com/IAM/latest/UserGuide';
+const COST = 'https://docs.aws.amazon.com/cost-management/latest/userguide';
+const BEDROCK = 'https://docs.aws.amazon.com/bedrock/latest/userguide';
+const GUIDE = 'https://github.com/aws-samples/sample-prism-d1-velocity/blob/main/USER_GUIDE.md';
+const CREDENTIAL_REPORT = ['iam:GetCredentialReport (the report must exist: run aws iam generate-credential-report once, or prism-cli bedrock-protection scan-account)'];
+const rootMfa = {
+    title: 'Add MFA to the root user', why: 'Root cannot be limited by SCPs or permission boundaries; without MFA a leaked root password is a full account takeover.',
+    steps: [
+        'Sign in as the root user.', 'Security credentials > Assign MFA device; prefer a FIDO2 security key.',
+        'In some managed or organization accounts the root user is controlled centrally; check with your account owner.',
+    ],
+    doc: `${IAM}/enable-mfa-for-root.html`, effort: 'quick', needs: ['iam:GetAccountSummary'],
+};
+export const ADVICE = {
+    // -- bedrock (bedrock-protection scan-account) ---------------------------------
+    'bedrock.root-mfa': rootMfa,
+    'bedrock.root-access-keys': {
+        title: 'Delete the root access keys', why: 'Root keys are long-lived and unconstrainable: the worst credential to leak.',
+        steps: ['Sign in as root > Security credentials > Access keys > Delete.', 'Move any automation that used them to an IAM role.'],
+        doc: `${IAM}/root-user-best-practices.html`, effort: 'quick', needs: ['iam:GetAccountSummary'],
+    },
+    'bedrock.password-policy': {
+        title: 'Set an account password policy', why: 'Without one only the AWS defaults apply (8 characters, no reuse rules).',
+        steps: ['aws iam update-account-password-policy --minimum-password-length 14 --require-symbols --require-numbers --password-reuse-prevention 24', 'Better: move console users to IAM Identity Center.'],
+        doc: `${IAM}/id_credentials_passwords_account-policy.html`, effort: 'quick', needs: ['iam:GetAccountPasswordPolicy'],
+    },
+    'bedrock.access-key-age': {
+        title: 'Rotate or remove long-lived access keys', why: 'Old static keys are what LLMjacking attackers steal and burn on Bedrock.',
+        steps: ['List the flagged keys (prism-cli bedrock-protection scan-account).', 'Replace each with a role (SSO, OIDC, instance profile), or rotate and delete the old key.'],
+        doc: `${IAM}/id_credentials_access-keys.html`, effort: 'medium', needs: CREDENTIAL_REPORT,
+    },
+    'bedrock.console-user-no-mfa': {
+        title: 'Require MFA for console users', why: 'A console password without MFA falls to phishing or reuse.',
+        steps: ['Assign an MFA device to each flagged user, or move them to IAM Identity Center.'],
+        doc: `${IAM}/id_credentials_mfa_enable.html`, effort: 'medium', needs: CREDENTIAL_REPORT,
+    },
+    'bedrock.unused-credentials': {
+        title: 'Remove unused credentials', why: 'Idle passwords and keys are attack surface nobody watches.',
+        steps: ['Deactivate the flagged passwords and keys, wait a week, then delete them.'],
+        doc: `${IAM}/id_credentials_finding-unused.html`, effort: 'quick', needs: CREDENTIAL_REPORT,
+    },
+    'bedrock.user-admin-policy': {
+        title: 'Take AdministratorAccess off IAM users', why: 'Any access key of such a user is an unbounded credential.',
+        steps: ['Create an admin role gated on MFA (or an Identity Center permission set).', 'Detach AdministratorAccess from the users.'],
+        doc: `${IAM}/best-practices.html`, effort: 'large', needs: ['iam:ListUsers', 'iam:ListAttachedUserPolicies'],
+    },
+    'bedrock.bedrock-budget': {
+        title: 'Add a budget that covers Bedrock', why: 'Runaway inference from a stolen key has no ceiling and raises no alert.',
+        steps: ['Billing > Budgets > Create a monthly COST budget filtered on Service contains "Bedrock".', 'Alert at 50/80/100% to an SNS topic.'],
+        doc: `${COST}/budgets-create.html`, effort: 'quick', needs: ['budgets:ViewBudget'], key: 'budgets',
+    },
+    'bedrock.marketplace-budget': {
+        title: 'Add a budget that covers AWS Marketplace (Bedrock Edition models)', why: 'Third-party models bill under Marketplace, so a Bedrock-only budget misses them.',
+        steps: ['Create a second COST budget filtered on Service = AWS Marketplace, or one Cost Category covering both.'],
+        doc: `${COST}/budgets-create.html`, effort: 'quick', needs: ['budgets:ViewBudget'], key: 'budgets',
+    },
+    'bedrock.budget-alerting': {
+        title: 'Make the Bedrock budgets notify someone', why: 'A budget with no subscriber records the overspend without telling anyone.',
+        steps: ['Add 50/80/100% notification thresholds with an SNS topic (or email) subscriber to each covering budget.'],
+        doc: `${COST}/budgets-sns-policy.html`, effort: 'quick', needs: ['budgets:ViewBudget'], prerequisite: 'budgets',
+    },
+    'bedrock.cost-explorer-enabled': {
+        title: 'Enable Cost Explorer', why: 'Anomaly detection and cost checks need it, and it stays off until someone turns it on.',
+        steps: ['Billing > Cost Explorer > Enable (data appears within 24 hours).'],
+        doc: `${COST}/ce-enable.html`, effort: 'quick', needs: ['ce:GetAnomalyMonitors'],
+    },
+    'bedrock.anomaly-monitor': {
+        title: 'Add a cost anomaly monitor with an alert subscription', why: 'It catches spend spikes a fixed budget threshold misses.',
+        steps: ['Billing > Cost Anomaly Detection > Create an AWS services monitor.', 'Add an alert subscription (SNS or email).'],
+        doc: `${COST}/getting-started-ad.html`, effort: 'quick', needs: ['ce:GetAnomalyMonitors', 'ce:GetAnomalySubscriptions'],
+    },
+    'bedrock.bedrock-invocation-alarm': {
+        title: 'Alarm on Bedrock invocation volume', why: 'Cost data lags up to a day; the AWS/Bedrock metrics are the only fast signal.',
+        steps: ['Create CloudWatch alarms on AWS/Bedrock Invocations and InputTokenCount above normal peak.'],
+        doc: `${BEDROCK}/monitoring.html`, effort: 'medium', needs: ['cloudwatch:DescribeAlarms'],
+    },
+    'bedrock.guardduty-ai-protection': {
+        title: 'Enable GuardDuty AI Protection', why: 'It detects cost-harvesting patterns against Bedrock.',
+        steps: ['Enable GuardDuty in the region if needed, then the AI_PROTECTION feature on the detector (org-wide from the delegated administrator if you can).'],
+        doc: 'https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html', effort: 'quick', needs: ['guardduty:ListDetectors', 'guardduty:GetDetector'],
+    },
+    'bedrock.provisioned-throughput': {
+        title: 'Review Provisioned Throughput commitments', why: 'A commitment bills whether or not it is used, and is a target for misuse.',
+        steps: ['Check each commitment is expected and owned; delete the ones nobody uses when their term allows.'],
+        doc: `${BEDROCK}/prov-throughput.html`, effort: 'medium', needs: ['bedrock:ListProvisionedModelThroughputs'],
+    },
+    'bedrock.model-invocation-logging': {
+        title: 'Turn on Bedrock model invocation logging', why: 'Without it you can see spend rose but not who or what caused it.',
+        steps: ['Bedrock console > Settings > Model invocation logging > CloudWatch Logs or S3.', 'Treat the destination as sensitive: it holds prompts and completions.'],
+        doc: `${BEDROCK}/model-invocation-logging.html`, effort: 'quick', needs: ['bedrock:GetModelInvocationLoggingConfiguration'],
+    },
+    // -- prism-setup -------------------------------------------------------------
+    'prism-setup.metrics-pipeline': {
+        title: 'Deploy the PRISM metrics pipeline', why: 'Without it CI and codeburn have nowhere to send PRISM metrics.',
+        steps: ['From the repo: cd infra && npm ci && npx cdk deploy PrismD1MetricsPipeline (see the workshop setup guide).'],
+        doc: `${GUIDE}`, effort: 'medium', needs: ['cloudformation:DescribeStacks'],
+    },
+    'prism-setup.security-agent-stack': {
+        title: 'Set up AWS Security Agent', why: 'The CI eval gate and the security commands need its stack.',
+        steps: ['Run the command below; it shows a diff and asks before any change.'], command: 'prism-cli enable security',
+        doc: `${GUIDE}#security-agent-setup-enable-security`, effort: 'quick', needs: ['cloudformation:DescribeStacks', 'cloudformation:GetTemplate'],
+    },
+    'prism-setup.security-agent-ssm': {
+        title: 'Restore the Security Agent SSM parameters', why: 'The CI gate and security commands find the agent space and scan bucket through /prism/continuum/*.',
+        steps: ['Run the command below (the stack owns these parameters; do not edit them by hand).'], command: 'prism-cli enable security',
+        doc: `${GUIDE}#security-agent-setup-enable-security`, effort: 'quick', needs: ['ssm:GetParameter', 'securityagent:ListAgentSpaces'],
+    },
+    'prism-setup.scan-bucket-listed': {
+        title: 'List the scan bucket on the Security Agent space', why: 'security threat-model fails when the agent space does not list the scan bucket.',
+        steps: ['Run the command below to update the stack.'], command: 'prism-cli enable security',
+        doc: `${GUIDE}#security-agent-setup-enable-security`, effort: 'quick', needs: ['securityagent:BatchGetAgentSpaces'],
+    },
+    'prism-setup.ci-oidc-role': {
+        title: 'Create the CI OIDC provider and role', why: 'CI should publish PRISM metrics with short-lived OIDC credentials, not stored keys.',
+        steps: ['Run the command below (or bootstrapper setup-gitlab-oidc for GitLab).', 'Set PRISM_METRICS_ROLE_ARN in the CI settings to the role it prints.'],
+        command: 'prism-cli bootstrapper setup-github-oidc', doc: GUIDE, effort: 'quick', needs: ['iam:ListOpenIDConnectProviders', 'iam:ListRoles'],
+    },
+    'prism-setup.codeburn-sync': {
+        title: 'Connect codeburn to the PRISM collector', why: 'This machine sends no AI usage telemetry to PRISM until codeburn sync is set up.',
+        steps: ['Run the command below; it installs codeburn if missing and schedules the sync.'], command: 'prism-cli enable codeburn',
+        doc: GUIDE, effort: 'quick', indeterminate: 'The codeburn sync config (~/.config/codeburn/sync.json) could not be read; check the file or re-run prism-cli enable codeburn.',
+    },
+    // -- baseline ----------------------------------------------------------------
+    'baseline.cloudtrail-multiregion': {
+        title: 'Log API activity in every region with a multi-region trail', why: 'Without it activity in other regions leaves no record for an investigation.',
+        steps: ['aws cloudtrail create-trail --name prism-audit --s3-bucket-name <bucket> --is-multi-region-trail', 'aws cloudtrail start-logging --name prism-audit', 'In an organization, prefer one organization trail from the management account.'],
+        doc: 'https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html', effort: 'medium', needs: ['cloudtrail:DescribeTrails', 'cloudtrail:GetTrailStatus'],
+    },
+    'baseline.guardduty': {
+        title: 'Enable GuardDuty', why: 'It is the managed threat detection for compromised credentials and instances.',
+        steps: ['aws guardduty create-detector --enable --region <region>', 'In an organization, enable it from a delegated administrator with auto-enable.'],
+        doc: 'https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html', effort: 'quick', needs: ['guardduty:ListDetectors', 'guardduty:GetDetector'],
+    },
+    'baseline.securityhub': {
+        title: 'Enable Security Hub', why: 'It runs the AWS Foundational Security Best Practices checks continuously and collects findings in one place.',
+        steps: ['Security Hub console > Enable, with the AWS Foundational Security Best Practices standard.'],
+        doc: 'https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html', effort: 'quick', needs: ['securityhub:DescribeHub'],
+    },
+    'baseline.access-analyzer': {
+        title: 'Create an IAM Access Analyzer', why: 'It flags buckets, roles and keys shared outside the account.',
+        steps: ['aws accessanalyzer create-analyzer --analyzer-name prism --type ACCOUNT --region <region>'],
+        doc: `${IAM}/access-analyzer-getting-started.html`, effort: 'quick', needs: ['access-analyzer:ListAnalyzers'],
+    },
+    'baseline.budget': {
+        title: 'Create an AWS Budget', why: 'Without a budget, unexpected spend raises no alert.',
+        steps: ['Billing > Budgets > Create a monthly cost budget for all services with 80% and 100% alerts.'],
+        doc: `${COST}/budgets-create.html`, effort: 'quick', needs: ['budgets:ViewBudget'], key: 'budgets',
+    },
+    'baseline.s3-account-bpa': {
+        title: 'Turn on S3 Block Public Access for the account', why: 'One misconfigured bucket policy or ACL is otherwise enough to publish data.',
+        steps: ['aws s3control put-public-access-block --account-id <account> --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true', 'First check no bucket needs public access on purpose.'],
+        doc: 'https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html', effort: 'quick', needs: ['s3:GetAccountPublicAccessBlock'],
+    },
+    'baseline.ebs-default-encryption': {
+        title: 'Encrypt new EBS volumes by default', why: 'Unencrypted volumes and snapshots can expose data when shared or copied.',
+        steps: ['aws ec2 enable-ebs-encryption-by-default --region <region> (applies to new volumes only).'],
+        doc: 'https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html', effort: 'quick', needs: ['ec2:GetEbsEncryptionByDefault'],
+    },
+    // -- startup-advisor ---------------------------------------------------------
+    'startup-advisor.not-integrated': {
+        title: 'Startup Advisor checks', why: 'Planned: PRISM will reuse Startup Advisor\'s account checks once how to consume them, and the license, are settled.',
+        steps: ['Nothing to do yet.'], doc: 'https://github.com/aws-samples/sample-prism-d1-velocity/blob/main/docs/PRISM-CLI-STATUS.md', effort: 'quick',
+        indeterminate: 'Not integrated yet; nothing to grant or fix.',
+    },
+};
+//# sourceMappingURL=advice.js.map

package/dist/src/aws/advice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advice.js","sourceRoot":"","sources":["../../../src/aws/advice.ts"],"names":[],"mappings":"AA2BA,mHAAmH;AACnH,MAAM,CAAC,MAAM,MAAM,GAAkE;IACnF,OAAO,EAAE;QACP,KAAK,EAAE,qFAAqF;QAC5F,GAAG,EAAE,mJAAmJ;QACxJ,KAAK,EAAE,oBAAoB;KAC5B;CACF,CAAC;AAEF,MAAM,GAAG,GAAG,kDAAkD,CAAC;AAC/D,MAAM,IAAI,GAAG,8DAA8D,CAAC;AAC5E,MAAM,OAAO,GAAG,sDAAsD,CAAC;AACvE,MAAM,KAAK,GAAG,iFAAiF,CAAC;AAChG,MAAM,iBAAiB,GAAG,CAAC,4IAA4I,CAAC,CAAC;AAEzK,MAAM,OAAO,GAAW;IACtB,KAAK,EAAE,0BAA0B,EAAE,GAAG,EAAE,yHAAyH;IACjK,KAAK,EAAE;QACL,2BAA2B,EAAE,wEAAwE;QACrG,gHAAgH;KACjH;IACD,GAAG,EAAE,GAAG,GAAG,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC;CAC1F,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA2B;IAC5C,iFAAiF;IACjF,kBAAkB,EAAE,OAAO;IAC3B,0BAA0B,EAAE;QAC1B,KAAK,EAAE,6BAA6B,EAAE,GAAG,EAAE,6EAA6E;QACxH,KAAK,EAAE,CAAC,gEAAgE,EAAE,oDAAoD,CAAC;QAC/H,GAAG,EAAE,GAAG,GAAG,gCAAgC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC;KAC/F;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,gCAAgC,EAAE,GAAG,EAAE,yEAAyE;QACvH,KAAK,EAAE,CAAC,wIAAwI,EAAE,oDAAoD,CAAC;QACvM,GAAG,EAAE,GAAG,GAAG,+CAA+C,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,8BAA8B,CAAC;KACrH;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,yCAAyC,EAAE,GAAG,EAAE,0EAA0E;QACjI,KAAK,EAAE,CAAC,oEAAoE,EAAE,2FAA2F,CAAC;QAC1K,GAAG,EAAE,GAAG,GAAG,kCAAkC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB;KAC1F;IACD,6BAA6B,EAAE;QAC7B,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,4DAA4D;QACzG,KAAK,EAAE,CAAC,iFAAiF,CAAC;QAC1F,GAAG,EAAE,GAAG,GAAG,iCAAiC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB;KACzF;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,2BAA2B,EAAE,GAAG,EAAE,4DAA4D;QACrG,KAAK,EAAE,CAAC,2EAA2E,CAAC;QACpF,GAAG,EAAE,GAAG,GAAG,qCAAqC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB;KAC5F;IACD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,wCAAwC,EAAE,GAAG,EAAE,2DAA2D;QACjH,KAAK,EAAE,CAAC,2EAA2E,EAAE,4CAA4C,CAAC;QAClI,GAAG,EAAE,GAAG,GAAG,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,eAAe,EAAE,8BAA8B,CAAC;KAC7G;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,kCAAkC,EAAE,GAAG,EAAE,yEAAyE;QACzH,KAAK,EAAE,CAAC,0FAA0F,EAAE,sCAAsC,CAAC;QAC3I,GAAG,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,SAAS;KACnG;IACD,4BAA4B,EAAE;QAC5B,KAAK,EAAE,mEAAmE,EAAE,GAAG,EAAE,kFAAkF;QACnK,KAAK,EAAE,CAAC,wGAAwG,CAAC;QACjH,GAAG,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,SAAS;KACnG;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,yCAAyC,EAAE,GAAG,EAAE,2EAA2E;QAClI,KAAK,EAAE,CAAC,yGAAyG,CAAC;QAClH,GAAG,EAAE,GAAG,IAAI,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,SAAS;KAChH;IACD,+BAA+B,EAAE;QAC/B,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,wFAAwF;QAC5H,KAAK,EAAE,CAAC,kEAAkE,CAAC;QAC3E,GAAG,EAAE,GAAG,IAAI,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC;KACjF;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,uDAAuD,EAAE,GAAG,EAAE,0DAA0D;QAC/H,KAAK,EAAE,CAAC,oEAAoE,EAAE,2CAA2C,CAAC;QAC1H,GAAG,EAAE,GAAG,IAAI,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,uBAAuB,EAAE,4BAA4B,CAAC;KACxH;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,oCAAoC,EAAE,GAAG,EAAE,+EAA+E;QACjI,KAAK,EAAE,CAAC,4FAA4F,CAAC;QACrG,GAAG,EAAE,GAAG,OAAO,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,2BAA2B,CAAC;KAC1F;IACD,iCAAiC,EAAE;QACjC,KAAK,EAAE,gCAAgC,EAAE,GAAG,EAAE,sDAAsD;QACpG,KAAK,EAAE,CAAC,kJAAkJ,CAAC;QAC3J,GAAG,EAAE,wEAAwE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;KAC5J;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,2CAA2C,EAAE,GAAG,EAAE,2EAA2E;QACpI,KAAK,EAAE,CAAC,kGAAkG,CAAC;QAC3G,GAAG,EAAE,GAAG,OAAO,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,yCAAyC,CAAC;KAC7G;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,0CAA0C,EAAE,GAAG,EAAE,kEAAkE;QAC1H,KAAK,EAAE,CAAC,gFAAgF,EAAE,uEAAuE,CAAC;QAClK,GAAG,EAAE,GAAG,OAAO,gCAAgC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC;KAC5H;IAED,+EAA+E;IAC/E,8BAA8B,EAAE;QAC9B,KAAK,EAAE,mCAAmC,EAAE,GAAG,EAAE,gEAAgE;QACjH,KAAK,EAAE,CAAC,4GAA4G,CAAC;QACrH,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,+BAA+B,CAAC;KAC5E;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,2BAA2B,EAAE,GAAG,EAAE,4DAA4D;QACrG,KAAK,EAAE,CAAC,oEAAoE,CAAC,EAAE,OAAO,EAAE,2BAA2B;QACnH,GAAG,EAAE,GAAG,KAAK,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,+BAA+B,EAAE,4BAA4B,CAAC;KAC9I;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,2CAA2C,EAAE,GAAG,EAAE,oGAAoG;QAC7J,KAAK,EAAE,CAAC,oFAAoF,CAAC,EAAE,OAAO,EAAE,2BAA2B;QACnI,GAAG,EAAE,GAAG,KAAK,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,kBAAkB,EAAE,+BAA+B,CAAC;KACpI;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,kDAAkD,EAAE,GAAG,EAAE,iFAAiF;QACjJ,KAAK,EAAE,CAAC,4CAA4C,CAAC,EAAE,OAAO,EAAE,2BAA2B;QAC3F,GAAG,EAAE,GAAG,KAAK,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,mCAAmC,CAAC;KACpH;IACD,0BAA0B,EAAE;QAC1B,KAAK,EAAE,sCAAsC,EAAE,GAAG,EAAE,qFAAqF;QACzI,KAAK,EAAE,CAAC,uEAAuE,EAAE,sEAAsE,CAAC;QACxJ,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,gCAAgC,EAAE,eAAe,CAAC;KAC7I;IACD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,yCAAyC,EAAE,GAAG,EAAE,kFAAkF;QACzI,KAAK,EAAE,CAAC,gFAAgF,CAAC,EAAE,OAAO,EAAE,2BAA2B;QAC/H,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gIAAgI;KAC7K;IAED,+EAA+E;IAC/E,iCAAiC,EAAE;QACjC,KAAK,EAAE,4DAA4D,EAAE,GAAG,EAAE,6EAA6E;QACvJ,KAAK,EAAE,CAAC,kGAAkG,EAAE,iDAAiD,EAAE,gFAAgF,CAAC;QAChP,GAAG,EAAE,sGAAsG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,2BAA2B,EAAE,2BAA2B,CAAC;KACjM;IACD,oBAAoB,EAAE;QACpB,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,+EAA+E;QAC/G,KAAK,EAAE,CAAC,0DAA0D,EAAE,gFAAgF,CAAC;QACrJ,GAAG,EAAE,0EAA0E,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;KAC9J;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,8GAA8G;QACjJ,KAAK,EAAE,CAAC,4FAA4F,CAAC;QACrG,GAAG,EAAE,qFAAqF,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,yBAAyB,CAAC;KAChJ;IACD,0BAA0B,EAAE;QAC1B,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,8DAA8D;QAC3G,KAAK,EAAE,CAAC,2FAA2F,CAAC;QACpG,GAAG,EAAE,GAAG,GAAG,uCAAuC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,+BAA+B,CAAC;KAC9G;IACD,iBAAiB,EAAE;QACjB,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,qDAAqD;QACzF,KAAK,EAAE,CAAC,6FAA6F,CAAC;QACtG,GAAG,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,SAAS;KACnG;IACD,yBAAyB,EAAE;QACzB,KAAK,EAAE,gDAAgD,EAAE,GAAG,EAAE,6EAA6E;QAC3I,KAAK,EAAE,CAAC,+LAA+L,EAAE,uDAAuD,CAAC;QACjQ,GAAG,EAAE,+FAA+F,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,gCAAgC,CAAC;KACjK;IACD,iCAAiC,EAAE;QACjC,KAAK,EAAE,oCAAoC,EAAE,GAAG,EAAE,0EAA0E;QAC5H,KAAK,EAAE,CAAC,2FAA2F,CAAC;QACpG,GAAG,EAAE,sEAAsE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,+BAA+B,CAAC;KACvI;IAED,+EAA+E;IAC/E,gCAAgC,EAAE;QAChC,KAAK,EAAE,wBAAwB,EAAE,GAAG,EAAE,qHAAqH;QAC3J,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,4FAA4F,EAAE,MAAM,EAAE,OAAO;QACjJ,aAAa,EAAE,8CAA8C;KAC9D;CACF,CAAC"}

package/dist/src/aws/check.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `prism-cli aws check`: read-only account checks on the audit framework
+ * (utils/audit.ts), in pluggable sections. A section is a name, a heading,
+ * the check ids it can return, and a run function; SECTIONS is the registry.
+ *
+ * Every AWS call here is a read. INDETERMINATE (a denied or failed read) is
+ * never counted as a pass.
+ */
+import { type AwsTarget } from '../utils/aws.js';
+import { type Finding, type Severity } from '../utils/audit.js';
+import { type Ctx, type Deps, type Resolved } from '../security/setup.js';
+export interface CheckContext {
+    target: AwsTarget;
+    account: string;
+    region: string;
+    home: string;
+    /** A read-only enable-security context, for the Security Agent rows. */
+    security: Ctx;
+}
+export interface CheckSection {
+    name: string;
+    heading: string;
+    /** Every check id run() can return (without the section prefix). */
+    ids: readonly string[];
+    run(c: CheckContext): Finding[];
+}
+/** `<section>.<id>`: one id space across sections (a check appears in one section only). */
+export declare const checkId: (section: string, id: string) => string;
+export declare const bedrockSection: CheckSection;
+export declare function metricsPipeline(c: CheckContext): Finding;
+/** Maps the enable security --status rows to findings. A row that never appeared (the report stopped) is INDETERMINATE. */
+export declare function securityAgent(c: CheckContext): Finding[];
+export declare function ciOidcRole(c: CheckContext): Finding;
+/** Local only: the endpoint codeburn syncs to (~/.config/codeburn/sync.json). No AWS call. */
+export declare function codeburnSync(c: CheckContext): Finding;
+export declare const prismSetupSection: CheckSection;
+export declare function cloudTrail(c: CheckContext): Finding;
+export declare function guardDuty(c: CheckContext): Finding;
+export declare function securityHub(c: CheckContext): Finding;
+export declare function accessAnalyzer(c: CheckContext): Finding;
+export declare function budget(c: CheckContext): Finding;
+export declare function s3PublicAccess(c: CheckContext): Finding;
+export declare function ebsEncryption(c: CheckContext): Finding;
+export declare const baselineSection: CheckSection;
+export declare const startupAdvisorSection: CheckSection;
+export declare const SECTIONS: CheckSection[];
+/** Every full check id any section can return. */
+export declare const ALL_CHECK_IDS: string[];
+/** The sections named by --section (all when none), or an error naming the valid ones. */
+export declare function selectSections(names: string[] | undefined): CheckSection[] | {
+    error: string;
+};
+export interface SectionCounts {
+    pass: number;
+    fail: number;
+    indeterminate: number;
+}
+export declare function countFindings(findings: Finding[]): SectionCounts;
+export declare function failBySeverity(findings: Finding[]): Record<Severity, number>;
+/** FAIL findings at or above `failOn` (none when failOn is null). */
+export declare function breaching(findings: Finding[], failOn: Severity | null): Finding[];
+/** A read-only enable-security context for collectSecurityStatus. Repo rows are skipped (git reports no repo). */
+export declare function securityContext(opts: Resolved, aws: Deps['aws'], env: NodeJS.ProcessEnv, awsVersion: () => string | null, log: (l?: string) => void): Ctx;
+//# sourceMappingURL=check.d.ts.map

package/dist/src/aws/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/aws/check.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAgB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG9E,OAAO,EACkC,KAAK,GAAG,EAAE,KAAK,IAAI,EAAE,KAAK,QAAQ,EAC1E,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,GAAG,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,EAAE,CAAC;CACjC;AAED,4FAA4F;AAC5F,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,EAAE,IAAI,MAAM,KAAG,MAA4B,CAAC;AAkBnF,eAAO,MAAM,cAAc,EAAE,YAS5B,CAAC;AAUF,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAQxD;AAED,2HAA2H;AAC3H,wBAAgB,aAAa,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,EAAE,CAqBxD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAanD;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAMrD;AAED,eAAO,MAAM,iBAAiB,EAAE,YAK/B,CAAC;AAOF,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAgBnD;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAUlD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAQpD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAOvD;AAKD,wBAAgB,MAAM,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAM/C;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAQvD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAMtD;AAED,eAAO,MAAM,eAAe,EAAE,YAK7B,CAAC;AAKF,eAAO,MAAM,qBAAqB,EAAE,YASnC,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,YAAY,EAAgF,CAAC;AAEpH,kDAAkD;AAClD,eAAO,MAAM,aAAa,EAAE,MAAM,EAAoE,CAAC;AAEvG,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,YAAY,EAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAK9F;AAED,MAAM,WAAW,aAAa;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAEpF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,aAAa,CAMhE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI5E;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,EAAE,CAGjF;AAED,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,GAAG,CAazJ"}

package/dist/src/aws/check.js

@@ -0,0 +1,269 @@
+/**
+ * `prism-cli aws check`: read-only account checks on the audit framework
+ * (utils/audit.ts), in pluggable sections. A section is a name, a heading,
+ * the check ids it can return, and a run function; SECTIONS is the registry.
+ *
+ * Every AWS call here is a read. INDETERMINATE (a denied or failed read) is
+ * never counted as a pass.
+ */
+import { aws } from '../utils/aws.js';
+import { severityRank } from '../utils/audit.js';
+import { auditAccount, ACCOUNT_AUDIT_IDS } from '../utils/audit-account.js';
+import { configuredSyncUrl } from '../commands/enable/codeburn.js';
+import { collectSecurityStatus, PIPELINE_STACK, } from '../security/setup.js';
+/** `<section>.<id>`: one id space across sections (a check appears in one section only). */
+export const checkId = (section, id) => `${section}.${id}`;
+const call = (c, args, region = c.region) => aws([...args, '--region', region], c.target);
+const why = (r) => r.errorCode || r.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'unknown error';
+const pass = (b, detail) => ({ ...b, status: 'PASS', detail });
+const fail = (b, detail, remediation) => ({ ...b, status: 'FAIL', detail, remediation });
+/** A read that did not answer. `action` is the IAM action the check needs, when known. */
+const unknown = (b, r, action) => ({
+    ...b, status: 'INDETERMINATE',
+    detail: `Could not check (${typeof r === 'string' ? r : why(r)}).${action ? ` Needs ${action}.` : ''}`,
+    remediation: action ? `Grant ${action} (read-only) and re-run prism-cli aws check.` : undefined,
+});
+// ---------------------------------------------------------------------------
+// bedrock: the bedrock-protection scan-account checks, unchanged
+// ---------------------------------------------------------------------------
+export const bedrockSection = {
+    name: 'bedrock',
+    heading: 'Bedrock protection (the bedrock-protection scan-account checks)',
+    ids: ACCOUNT_AUDIT_IDS,
+    run(c) {
+        // generateCredentialReport false: aws check never calls iam generate-credential-report.
+        return auditAccount(c.target, c.account, c.region, { maxKeyAge: 90, unusedDays: 90, runIam: true, runBedrock: true, generateCredentialReport: false })
+            .map((f) => ({ ...f, id: checkId('bedrock', f.id), category: 'bedrock' }));
+    },
+};
+// ---------------------------------------------------------------------------
+// prism-setup
+// ---------------------------------------------------------------------------
+const PS = (id, title, severity) => ({ id: checkId('prism-setup', id), category: 'prism-setup', title, severity });
+const GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';
+/** Role names bootstrapper setup-github-oidc / setup-gitlab-oidc create. */
+const CI_ROLE = /^(GitHubActions|GitLabCI)-/;
+export function metricsPipeline(c) {
+    const b = PS('metrics-pipeline', `PRISM metrics pipeline stack (${PIPELINE_STACK})`, 'MEDIUM');
+    const r = call(c, ['cloudformation', 'describe-stacks', '--stack-name', PIPELINE_STACK]);
+    const fix = `Deploy the metrics pipeline (infra/, cdk deploy ${PIPELINE_STACK}); see the PRISM workshop setup guide.`;
+    if (!r.ok)
+        return /does not exist/.test(r.raw) ? fail(b, `${PIPELINE_STACK} is not deployed in ${c.region}.`, fix) : unknown(b, r, 'cloudformation:DescribeStacks');
+    const status = String(r.json?.Stacks?.[0]?.StackStatus || 'UNKNOWN');
+    if (/_COMPLETE$/.test(status) && !/ROLLBACK_COMPLETE$|^DELETE_COMPLETE$/.test(status))
+        return pass(b, `${PIPELINE_STACK} is ${status} in ${c.region}.`);
+    return fail(b, `${PIPELINE_STACK} is ${status} in ${c.region}.`, fix);
+}
+/** Maps the enable security --status rows to findings. A row that never appeared (the report stopped) is INDETERMINATE. */
+export function securityAgent(c) {
+    const { rows } = collectSecurityStatus(c.security);
+    const row = (label) => rows.find((r) => r[1] === label);
+    const stopped = rows.find((r) => r[1] === 'Stopped' || (r[1] === 'Credentials' && r[0] !== 'ok'));
+    const fix = 'Run prism-cli enable security (it shows a diff and asks before any change).';
+    const one = (b, r) => {
+        if (!r)
+            return unknown(b, stopped ? stopped[2] : 'not reached', undefined);
+        if (r[0] === 'ok')
+            return pass(b, r[2]);
+        if (r[0] === 'unknown')
+            return unknown(b, r[2]);
+        return fail(b, r[2], fix);
+    };
+    const ssm = ['SSM agent-space-id', 'SSM scan-bucket', 'SSM service-role-arn'].map(row);
+    const ssmB = PS('security-agent-ssm', 'Security Agent SSM parameters (/prism/continuum/*)', 'MEDIUM');
+    const ssmF = ssm.some((r) => !r) ? one(ssmB, undefined)
+        : ssm.every((r) => r[0] === 'ok') ? pass(ssmB, ssm.map((r) => r[2]).join('; '))
+            : fail(ssmB, ssm.filter((r) => r[0] !== 'ok').map((r) => r[2]).join('; '), fix);
+    return [
+        one(PS('security-agent-stack', 'Security Agent stack (PrismD1SecurityAgent or pipeline-hosted)', 'MEDIUM'), row('Stack')),
+        ssmF,
+        one(PS('scan-bucket-listed', 'Scan bucket listed on the Security Agent space', 'LOW'), row('Scan bucket on agent space')),
+    ];
+}
+export function ciOidcRole(c) {
+    const b = PS('ci-oidc-role', 'GitHub/GitLab OIDC provider and CI role', 'MEDIUM');
+    const fix = 'Run prism-cli bootstrapper setup-github-oidc (or setup-gitlab-oidc) for the repo whose CI publishes PRISM metrics.';
+    const p = call(c, ['iam', 'list-open-id-connect-providers']);
+    if (!p.ok)
+        return unknown(b, p, 'iam:ListOpenIDConnectProviders');
+    const arns = (p.json?.OpenIDConnectProviderList || []).map((x) => String(x?.Arn || ''));
+    const providers = arns.filter((a) => a.endsWith(`/${GITHUB_OIDC_HOST}`) || /gitlab/i.test(a)).map((a) => a.split('oidc-provider/')[1]);
+    const r = call(c, ['iam', 'list-roles', '--query', 'Roles[].RoleName']);
+    if (!r.ok)
+        return unknown(b, r, 'iam:ListRoles');
+    const roles = (Array.isArray(r.json) ? r.json : []).map(String).filter((n) => CI_ROLE.test(n));
+    if (providers.length && roles.length)
+        return pass(b, `OIDC provider ${providers.join(', ')}; CI role ${roles.slice(0, 3).join(', ')}${roles.length > 3 ? ` and ${roles.length - 3} more` : ''}.`);
+    const missing = [providers.length ? '' : 'no GitHub or GitLab OIDC provider', roles.length ? '' : 'no GitHubActions-* or GitLabCI-* role'].filter(Boolean);
+    return fail(b, `${missing.join(' and ')}, so CI cannot publish PRISM metrics with short-lived credentials.`, fix);
+}
+/** Local only: the endpoint codeburn syncs to (~/.config/codeburn/sync.json). No AWS call. */
+export function codeburnSync(c) {
+    const b = PS('codeburn-sync', 'codeburn sync endpoint configured on this machine', 'LOW');
+    const url = configuredSyncUrl(c.home);
+    if (url === null)
+        return fail(b, 'codeburn sync is not set up here, so this machine sends no usage telemetry to the PRISM collector.', 'Run prism-cli enable codeburn.');
+    if (!url)
+        return unknown(b, 'the codeburn sync config could not be read');
+    return pass(b, `codeburn syncs to ${url}.`);
+}
+export const prismSetupSection = {
+    name: 'prism-setup',
+    heading: 'PRISM setup',
+    ids: ['metrics-pipeline', 'security-agent-stack', 'security-agent-ssm', 'scan-bucket-listed', 'ci-oidc-role', 'codeburn-sync'],
+    run: (c) => [metricsPipeline(c), ...securityAgent(c), ciOidcRole(c), codeburnSync(c)],
+};
+// ---------------------------------------------------------------------------
+// baseline
+// ---------------------------------------------------------------------------
+const BL = (id, title, severity) => ({ id: checkId('baseline', id), category: 'baseline', title, severity });
+export function cloudTrail(c) {
+    const b = BL('cloudtrail-multiregion', 'CloudTrail: a multi-region trail that is logging', 'HIGH');
+    const fix = 'Create a multi-region trail (aws cloudtrail create-trail --is-multi-region-trail, then start-logging), or an organization trail from the management account.';
+    const r = call(c, ['cloudtrail', 'describe-trails']);
+    if (!r.ok)
+        return unknown(b, r, 'cloudtrail:DescribeTrails');
+    const multi = (r.json?.trailList || []).filter((t) => t?.IsMultiRegionTrail);
+    if (!multi.length)
+        return fail(b, 'No multi-region trail, so API activity in other regions is not recorded.', fix);
+    let readable = 0;
+    for (const t of multi) {
+        const s = call(c, ['cloudtrail', 'get-trail-status', '--name', String(t.TrailARN || t.Name)], String(t.HomeRegion || c.region));
+        if (!s.ok)
+            continue;
+        readable++;
+        if (s.json?.IsLogging)
+            return pass(b, `${t.Name} is multi-region and logging.`);
+    }
+    if (!readable)
+        return unknown(b, 'get-trail-status was denied for every multi-region trail', 'cloudtrail:GetTrailStatus');
+    return fail(b, `Multi-region trail(s) ${multi.map((t) => t.Name).join(', ')} exist but none is logging.`, 'Start logging: aws cloudtrail start-logging --name <trail>.');
+}
+export function guardDuty(c) {
+    const b = BL('guardduty', `GuardDuty detector enabled in ${c.region}`, 'HIGH');
+    const fix = `Enable GuardDuty in ${c.region} (aws guardduty create-detector --enable), ideally org-wide from a delegated administrator.`;
+    const r = call(c, ['guardduty', 'list-detectors']);
+    if (!r.ok)
+        return unknown(b, r, 'guardduty:ListDetectors');
+    const ids = r.json?.DetectorIds || [];
+    if (!ids.length)
+        return fail(b, `No GuardDuty detector in ${c.region}.`, fix);
+    const d = call(c, ['guardduty', 'get-detector', '--detector-id', ids[0]]);
+    if (!d.ok)
+        return unknown(b, d, 'guardduty:GetDetector');
+    return d.json?.Status === 'ENABLED' ? pass(b, `Detector ${ids[0]} is enabled.`) : fail(b, `Detector ${ids[0]} is ${d.json?.Status || 'not enabled'}.`, fix);
+}
+export function securityHub(c) {
+    const b = BL('securityhub', `Security Hub enabled in ${c.region}`, 'MEDIUM');
+    const r = call(c, ['securityhub', 'describe-hub']);
+    if (r.ok)
+        return pass(b, `Security Hub is enabled${r.json?.SubscribedAt ? ` (since ${r.json.SubscribedAt})` : ''}.`);
+    if (/^(InvalidAccessException|ResourceNotFoundException)$/.test(r.errorCode)) {
+        return fail(b, `Security Hub is not enabled in ${c.region}.`, `Enable Security Hub in ${c.region} with the AWS Foundational Security Best Practices standard.`);
+    }
+    return unknown(b, r, 'securityhub:DescribeHub');
+}
+export function accessAnalyzer(c) {
+    const b = BL('access-analyzer', `IAM Access Analyzer in ${c.region}`, 'MEDIUM');
+    const r = call(c, ['accessanalyzer', 'list-analyzers']);
+    if (!r.ok)
+        return unknown(b, r, 'access-analyzer:ListAnalyzers');
+    const active = (r.json?.analyzers || []).filter((a) => a?.status === 'ACTIVE');
+    return active.length ? pass(b, `Analyzer ${active[0].name} (${active[0].type}) is active.`)
+        : fail(b, `No active Access Analyzer in ${c.region}, so resources shared outside the account are not flagged.`, `Create one: aws accessanalyzer create-analyzer --analyzer-name prism --type ACCOUNT --region ${c.region}.`);
+}
+// Root MFA is not repeated here: the bedrock section's bedrock.root-mfa reads the same
+// iam get-account-summary, and a second copy listed the same fix twice.
+export function budget(c) {
+    const b = BL('budget', 'At least one AWS Budget', 'MEDIUM');
+    const r = call(c, ['budgets', 'describe-budgets', '--account-id', c.account]);
+    if (!r.ok)
+        return unknown(b, r, 'budgets:ViewBudget');
+    const n = (r.json?.Budgets || []).length;
+    return n ? pass(b, `${n} budget(s) defined.`) : fail(b, 'No budgets, so unexpected spend raises no alert.', 'Create a monthly cost budget with 80% and 100% alerts (Billing console > Budgets).');
+}
+export function s3PublicAccess(c) {
+    const b = BL('s3-account-bpa', 'S3 Block Public Access at the account level', 'HIGH');
+    const fix = `Turn on all four settings: aws s3control put-public-access-block --account-id ${c.account} --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true.`;
+    const r = call(c, ['s3control', 'get-public-access-block', '--account-id', c.account]);
+    if (!r.ok)
+        return r.errorCode === 'NoSuchPublicAccessBlockConfiguration' ? fail(b, 'No account-level Block Public Access configuration.', fix) : unknown(b, r, 's3:GetAccountPublicAccessBlock');
+    const cfg = r.json?.PublicAccessBlockConfiguration ?? {};
+    const off = ['BlockPublicAcls', 'IgnorePublicAcls', 'BlockPublicPolicy', 'RestrictPublicBuckets'].filter((k) => cfg[k] !== true);
+    return off.length ? fail(b, `Off: ${off.join(', ')}.`, fix) : pass(b, 'All four account-level settings are on.');
+}
+export function ebsEncryption(c) {
+    const b = BL('ebs-default-encryption', `EBS encryption by default in ${c.region}`, 'MEDIUM');
+    const r = call(c, ['ec2', 'get-ebs-encryption-by-default']);
+    if (!r.ok)
+        return unknown(b, r, 'ec2:GetEbsEncryptionByDefault');
+    return r.json?.EbsEncryptionByDefault === true ? pass(b, 'New EBS volumes are encrypted by default.')
+        : fail(b, `New EBS volumes in ${c.region} are not encrypted by default.`, `aws ec2 enable-ebs-encryption-by-default --region ${c.region}.`);
+}
+export const baselineSection = {
+    name: 'baseline',
+    heading: 'Account baseline',
+    ids: ['cloudtrail-multiregion', 'guardduty', 'securityhub', 'access-analyzer', 'budget', 's3-account-bpa', 'ebs-default-encryption'],
+    run: (c) => [cloudTrail(c), guardDuty(c), securityHub(c), accessAnalyzer(c), budget(c), s3PublicAccess(c), ebsEncryption(c)],
+};
+// ---------------------------------------------------------------------------
+// startup-advisor: placeholder until how it is consumed (and its license) is known
+// ---------------------------------------------------------------------------
+export const startupAdvisorSection = {
+    name: 'startup-advisor',
+    heading: 'Startup Advisor',
+    ids: ['not-integrated'],
+    run: () => [{
+            id: checkId('startup-advisor', 'not-integrated'), category: 'startup-advisor', title: 'Startup Advisor account checks',
+            status: 'INDETERMINATE', severity: 'INFO',
+            detail: 'Not integrated yet: how PRISM consumes Startup Advisor, and under what license, is still open.',
+        }],
+};
+export const SECTIONS = [bedrockSection, prismSetupSection, baselineSection, startupAdvisorSection];
+/** Every full check id any section can return. */
+export const ALL_CHECK_IDS = SECTIONS.flatMap((s) => s.ids.map((id) => checkId(s.name, id)));
+/** The sections named by --section (all when none), or an error naming the valid ones. */
+export function selectSections(names) {
+    if (!names?.length)
+        return SECTIONS;
+    const bad = names.filter((n) => !SECTIONS.some((s) => s.name === n));
+    if (bad.length)
+        return { error: `unknown --section ${bad.join(', ')}; choose from ${SECTIONS.map((s) => s.name).join(', ')}` };
+    return SECTIONS.filter((s) => names.includes(s.name));
+}
+export function countFindings(findings) {
+    return {
+        pass: findings.filter((f) => f.status === 'PASS').length,
+        fail: findings.filter((f) => f.status === 'FAIL').length,
+        indeterminate: findings.filter((f) => f.status === 'INDETERMINATE').length,
+    };
+}
+export function failBySeverity(findings) {
+    const out = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, INFO: 0 };
+    for (const f of findings)
+        if (f.status === 'FAIL')
+            out[f.severity]++;
+    return out;
+}
+/** FAIL findings at or above `failOn` (none when failOn is null). */
+export function breaching(findings, failOn) {
+    if (!failOn)
+        return [];
+    return findings.filter((f) => f.status === 'FAIL' && severityRank(f.severity) >= severityRank(failOn));
+}
+/** A read-only enable-security context for collectSecurityStatus. Repo rows are skipped (git reports no repo). */
+export function securityContext(opts, aws, env, awsVersion, log) {
+    const unused = () => { throw new Error('internal: not available in aws check'); };
+    const deps = {
+        aws, env, awsVersion, log,
+        configRegion: () => null,
+        cdk: { synth: unused, diff: unused, deploy: unused },
+        git: () => ({ ok: false, stdout: '', stderr: 'not used by aws check' }),
+        makeTempDir: unused,
+        isTTY: false,
+        ask: async () => '',
+        now: () => new Date(),
+    };
+    return { opts, deps, cliVersion: awsVersion(), readOnly: true };
+}
+//# sourceMappingURL=check.js.map

package/dist/src/aws/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/aws/check.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,GAAG,EAAkC,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAA+B,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,qBAAqB,EAAE,cAAc,GACtC,MAAM,sBAAsB,CAAC;AAmB9B,4FAA4F;AAC5F,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAU,EAAU,EAAE,CAAC,GAAG,OAAO,IAAI,EAAE,EAAE,CAAC;AAEnF,MAAM,IAAI,GAAG,CAAC,CAAe,EAAE,IAAc,EAAE,MAAM,GAAG,CAAC,CAAC,MAAM,EAAa,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7H,MAAM,GAAG,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC;AAG7H,MAAM,IAAI,GAAG,CAAC,CAAO,EAAE,MAAc,EAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACtF,MAAM,IAAI,GAAG,CAAC,CAAO,EAAE,MAAc,EAAE,WAAmB,EAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AACxH,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,CAAO,EAAE,CAAqB,EAAE,MAAe,EAAW,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe;IAC7B,MAAM,EAAE,oBAAoB,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACtG,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,MAAM,8CAA8C,CAAC,CAAC,CAAC,SAAS;CAChG,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,iEAAiE;IAC1E,GAAG,EAAE,iBAAiB;IACtB,GAAG,CAAC,CAAC;QACH,wFAAwF;QACxF,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;aACnJ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;CACF,CAAC;AAEF,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAC9E,MAAM,EAAE,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,QAAkB,EAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnJ,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,4EAA4E;AAC5E,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAE7C,MAAM,UAAU,eAAe,CAAC,CAAe;IAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,iCAAiC,cAAc,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/F,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,mDAAmD,cAAc,wCAAwC,CAAC;IACtH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,cAAc,uBAAuB,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACpK,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,SAAS,CAAC,CAAC;IACrE,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,cAAc,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxJ,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,cAAc,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,aAAa,CAAC,CAAe;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,6EAA6E,CAAC;IAC1F,MAAM,GAAG,GAAG,CAAC,CAAO,EAAE,CAAwB,EAAW,EAAE;QACzD,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,EAAE,CAAC,oBAAoB,EAAE,oDAAoD,EAAE,QAAQ,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;QACrD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO;QACL,GAAG,CAAC,EAAE,CAAC,sBAAsB,EAAE,gEAAgE,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzH,IAAI;QACJ,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,gDAAgD,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,4BAA4B,CAAC,CAAC;KAC1H,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAe;IACxC,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,yCAAyC,EAAE,QAAQ,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,oHAAoH,CAAC;IACjI,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,gCAAgC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,CAAC,CAAC,CAAC,IAAI,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvI,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,IAAI,SAAS,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClM,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mCAAmC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3J,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oEAAoE,EAAE,GAAG,CAAC,CAAC;AACpH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,CAAe;IAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,mDAAmD,EAAE,KAAK,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,oGAAoG,EAAE,gCAAgC,CAAC,CAAC;IACzK,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,4CAA4C,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,EAAE,qBAAqB,GAAG,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,aAAa;IACtB,GAAG,EAAE,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,CAAC;IAC9H,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACtF,CAAC;AAEF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAC9E,MAAM,EAAE,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,QAAkB,EAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE7I,MAAM,UAAU,UAAU,CAAC,CAAe;IACxC,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,kDAAkD,EAAE,MAAM,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,8JAA8J,CAAC;IAC3K,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,0EAA0E,EAAE,GAAG,CAAC,CAAC;IACnH,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAChI,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,SAAS;QACpB,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,+BAA+B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,0DAA0D,EAAE,2BAA2B,CAAC,CAAC;IAC1H,OAAO,IAAI,CAAC,CAAC,EAAE,yBAAyB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,6DAA6D,CAAC,CAAC;AAC3K,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAe;IACvC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,uBAAuB,CAAC,CAAC,MAAM,6FAA6F,CAAC;IACzI,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAa,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;AAC9J,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAe;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrH,IAAI,sDAAsD,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC,MAAM,GAAG,EAAE,0BAA0B,CAAC,CAAC,MAAM,8DAA8D,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACjE,MAAM,MAAM,GAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC;QACzF,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC,MAAM,4DAA4D,EAAE,gGAAgG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACjO,CAAC;AAED,uFAAuF;AACvF,wEAAwE;AAExE,MAAM,UAAU,MAAM,CAAC,CAAe;IACpC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,yBAAyB,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,kDAAkD,EAAE,oFAAoF,CAAC,CAAC;AACpM,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,MAAM,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,iFAAiF,CAAC,CAAC,OAAO,oIAAoI,CAAC;IAC3O,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,yBAAyB,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC,SAAS,KAAK,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,qDAAqD,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACjM,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,8BAA8B,IAAI,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACjI,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,yCAAyC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAe;IAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,gCAAgC,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,2CAA2C,CAAC;QACnG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,MAAM,gCAAgC,EAAE,qDAAqD,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,kBAAkB;IAC3B,GAAG,EAAE,CAAC,wBAAwB,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,wBAAwB,CAAC;IACpI,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;CAC7H,CAAC;AAEF,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,iBAAiB;IAC1B,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACvB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACV,EAAE,EAAE,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,gCAAgC;YACtH,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM;YACzC,MAAM,EAAE,gGAAgG;SACzG,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAmB,CAAC,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;AAEpH,kDAAkD;AAClD,MAAM,CAAC,MAAM,aAAa,GAAa,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAEvG,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,KAA2B;IACxD,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC/H,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAID,MAAM,UAAU,aAAa,CAAC,QAAmB;IAC/C,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;QACxD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;QACxD,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,MAAM;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,MAAM,GAAG,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,QAAmB,EAAE,MAAuB;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAgB,EAAE,GAAsB,EAAE,UAA+B,EAAE,GAAyB;IAClJ,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,IAAI,GAAS;QACjB,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG;QACzB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;QACxB,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACvE,WAAW,EAAE,MAAM;QACnB,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QACnB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC"}