@prism-d1/cli 1.3.0 → 1.4.0

package/dist/src/aws/connect.d.ts

@@ -0,0 +1,65 @@
+import type { AwsResult } from '../utils/aws.js';
+import type { RunResult } from '../utils/exec.js';
+export interface ConnectOptions {
+    profile?: string;
+    region?: string;
+    /** Write (or clear) the per-repo file instead of the per-user one. */
+    repo?: boolean;
+    status?: boolean;
+    clear?: boolean;
+}
+export interface ConnectDeps {
+    /** A read-only `aws <args>` call as `profile` in `region` (JSON output). */
+    aws(args: string[], profile: string, region: string): AwsResult;
+    listProfiles(): string[];
+    configRegion(profile?: string): string | null;
+    git(args: string[]): RunResult;
+    env: NodeJS.ProcessEnv;
+    home: string;
+    cwd(): string;
+    isTTY: boolean;
+    ask(question: string): Promise<string>;
+    log(line?: string): void;
+    now(): Date;
+}
+export declare const CONNECT_NOTICE = "Read-only (aws connect): it checks the profile with STS and reads the account alias, Organizations and IAM; nothing in AWS is changed. No credentials are stored, only the profile name and region.";
+export interface Identity {
+    account: string;
+    arn: string;
+}
+export type OrgRole = {
+    kind: 'management';
+    orgId: string;
+} | {
+    kind: 'member';
+    orgId: string;
+} | {
+    kind: 'none';
+} | {
+    kind: 'unknown';
+    reason: string;
+};
+export interface AccessLevel {
+    level: 'admin' | 'read-only' | 'unknown';
+    basis: string;
+}
+export declare function callerIdentity(d: ConnectDeps, profile: string, region: string): Identity | {
+    error: string;
+};
+export declare function accountAlias(d: ConnectDeps, profile: string, region: string): string | null;
+/** Whether the account is its organization's management account. AccessDenied is "unknown", never "no". */
+export declare function orgRole(d: ConnectDeps, profile: string, region: string, account: string): OrgRole;
+/** The principal behind a caller ARN: an assumed role, an IAM user, or root. */
+export declare function principalOf(arn: string): {
+    kind: 'role' | 'user' | 'root' | 'other';
+    name: string;
+};
+/**
+ * Admin or read-only, as far as can be told without simulating policies:
+ * the attached managed policies when they can be read, else the role or user
+ * name. "unknown" whenever neither is conclusive.
+ */
+export declare function accessLevel(d: ConnectDeps, profile: string, region: string, arn: string): AccessLevel;
+/** Runs `aws connect`. Returns the exit code. */
+export declare function awsConnect(o: ConnectOptions, d: ConnectDeps): Promise<number>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/src/aws/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/aws/connect.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQlD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAChE,YAAY,IAAI,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,IAAI,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,IAAI,IAAI,CAAC;CACb;AAED,eAAO,MAAM,cAAc,wMAAwM,CAAC;AAEpO,MAAM,WAAW,QAAQ;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAC1D,MAAM,MAAM,OAAO,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACzJ,MAAM,WAAW,WAAW;IAAG,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAIxF,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAK5G;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3F;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAUjG;AAOD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAOnG;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAarG;AA8ED,iDAAiD;AACjD,wBAAsB,UAAU,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAsDnF"}

package/dist/src/aws/connect.js

@@ -0,0 +1,250 @@
+/**
+ * `prism-cli aws connect`: choose the AWS profile and region the other AWS
+ * commands default to, verify them, and save the choice. Read-only in AWS;
+ * stores no credentials (see connection.ts for the files and precedence).
+ */
+import { existsSync } from 'node:fs';
+import { ensureMarkerIgnored } from '../security/marker.js';
+import { accountChangeWarning, applyConnection, clearConnectionFile, connectionLabel, ENV_CREDENTIAL_VARS, loadConnection, PROFILE_RE, readConnectionFile, REGION_RE, REPO_CONNECTION_PATH, repoConnectionPath, repoRootOf, userConnectionPath, writeConnectionFile, } from './connection.js';
+export const CONNECT_NOTICE = 'Read-only (aws connect): it checks the profile with STS and reads the account alias, Organizations and IAM; nothing in AWS is changed. No credentials are stored, only the profile name and region.';
+const reason = (r) => r.errorCode || r.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'unknown error';
+export function callerIdentity(d, profile, region) {
+    const r = d.aws(['sts', 'get-caller-identity'], profile, region);
+    if (!r.ok)
+        return { error: reason(r) };
+    const account = String(r.json?.Account || '');
+    return account ? { account, arn: String(r.json?.Arn || '') } : { error: 'get-caller-identity returned no account' };
+}
+export function accountAlias(d, profile, region) {
+    const r = d.aws(['iam', 'list-account-aliases'], profile, region);
+    const a = r.ok && Array.isArray(r.json?.AccountAliases) ? r.json.AccountAliases[0] : null;
+    return a ? String(a) : null;
+}
+/** Whether the account is its organization's management account. AccessDenied is "unknown", never "no". */
+export function orgRole(d, profile, region, account) {
+    const r = d.aws(['organizations', 'describe-organization'], profile, region);
+    if (r.ok) {
+        const org = r.json?.Organization ?? {};
+        // The API names the management account's id field MasterAccountId.
+        const managementId = String(org.MasterAccountId || '');
+        return managementId === account ? { kind: 'management', orgId: String(org.Id || '') } : { kind: 'member', orgId: String(org.Id || '') };
+    }
+    if (r.errorCode === 'AWSOrganizationsNotInUseException')
+        return { kind: 'none' };
+    return { kind: 'unknown', reason: reason(r) };
+}
+const ADMIN_POLICY = /^(AdministratorAccess|PowerUserAccess)$|FullAccess$/;
+const READ_POLICY = /^(ReadOnlyAccess|ViewOnlyAccess|SecurityAudit)$|ReadOnly/;
+const ADMIN_NAME = /admin|poweruser|fullaccess/i;
+const READ_NAME = /read-?only|view-?only|audit/i;
+/** The principal behind a caller ARN: an assumed role, an IAM user, or root. */
+export function principalOf(arn) {
+    const m = /^arn:[^:]+:(sts|iam)::\d{12}:(assumed-role|user|root|role)(?:\/(.*))?$/.exec(arn);
+    if (!m)
+        return { kind: 'other', name: '' };
+    if (m[2] === 'root')
+        return { kind: 'root', name: 'root' };
+    const parts = (m[3] || '').split('/');
+    if (m[2] === 'assumed-role' || m[2] === 'role')
+        return { kind: 'role', name: m[2] === 'assumed-role' ? parts[0] : parts[parts.length - 1] };
+    return { kind: 'user', name: parts[parts.length - 1] };
+}
+/**
+ * Admin or read-only, as far as can be told without simulating policies:
+ * the attached managed policies when they can be read, else the role or user
+ * name. "unknown" whenever neither is conclusive.
+ */
+export function accessLevel(d, profile, region, arn) {
+    const p = principalOf(arn);
+    if (p.kind === 'root')
+        return { level: 'admin', basis: 'the root user' };
+    if (p.kind === 'other' || !p.name)
+        return { level: 'unknown', basis: 'the caller ARN has an unexpected form' };
+    const call = p.kind === 'role' ? ['iam', 'list-attached-role-policies', '--role-name', p.name] : ['iam', 'list-attached-user-policies', '--user-name', p.name];
+    const r = d.aws(call, profile, region);
+    const names = r.ok ? (r.json?.AttachedPolicies || []).map((x) => String(x?.PolicyName || '')).filter(Boolean) : [];
+    if (names.some((n) => ADMIN_POLICY.test(n)))
+        return { level: 'admin', basis: `attached policy ${names.find((n) => ADMIN_POLICY.test(n))}` };
+    if (names.length && names.every((n) => READ_POLICY.test(n)))
+        return { level: 'read-only', basis: `attached policies ${names.join(', ')}` };
+    const why = r.ok ? (names.length ? `custom policies (${names.join(', ')})` : 'no managed policies attached') : `policies not readable (${reason(r)})`;
+    if (ADMIN_NAME.test(p.name))
+        return { level: 'admin', basis: `the ${p.kind} name ${p.name}; ${why}` };
+    if (READ_NAME.test(p.name))
+        return { level: 'read-only', basis: `the ${p.kind} name ${p.name}; ${why}` };
+    return { level: 'unknown', basis: why };
+}
+const orgText = (o) => o.kind === 'management' ? `yes, the management account of ${o.orgId}`
+    : o.kind === 'member' ? `no, a member account of ${o.orgId}` : o.kind === 'none' ? 'no, not in an organization' : `unknown (${o.reason})`;
+async function chooseProfile(o, d, saved) {
+    if (o.profile)
+        return o.profile;
+    const profiles = d.listProfiles();
+    if (!d.isTTY) {
+        if (d.env.AWS_PROFILE)
+            return d.env.AWS_PROFILE;
+        return { error: 'no --profile given and there is no terminal to choose on. Pass --profile <name> (see aws configure list-profiles).' };
+    }
+    if (!profiles.length)
+        return { error: 'no AWS profiles are configured. Create one with aws configure sso (or aws configure --profile <name>), then re-run.' };
+    const preferred = d.env.AWS_PROFILE || saved?.profile || (profiles.includes('default') ? 'default' : profiles[0]);
+    const def = Math.max(0, profiles.indexOf(preferred));
+    d.log('AWS profiles (from aws configure list-profiles):');
+    profiles.forEach((p, i) => d.log(`  ${i + 1}) ${p}${i === def ? '  (default)' : ''}`));
+    const a = (await d.ask(`Profile [${def + 1}]: `)).trim();
+    if (!a)
+        return profiles[def];
+    const n = Number.parseInt(a, 10);
+    if (String(n) === a && n >= 1 && n <= profiles.length)
+        return profiles[n - 1];
+    return profiles.includes(a) ? a : { error: `"${a}" is not one of the listed profiles.` };
+}
+async function chooseRegion(o, d, profile) {
+    if (o.region)
+        return o.region;
+    const def = d.env.AWS_REGION || d.env.AWS_DEFAULT_REGION || d.configRegion(profile) || '';
+    if (!d.isTTY)
+        return def || { error: `no --region given and profile ${profile} has no configured region. Pass --region <region>.` };
+    const a = (await d.ask(`Region${def ? ` [${def}]` : ''}: `)).trim();
+    return a || def || { error: 'a region is required.' };
+}
+function repoRoot(d) {
+    return repoRootOf(d.cwd(), d.git);
+}
+/** `--clear`: removes the user file, or the repo file with --repo. */
+function clear(o, d) {
+    let path;
+    if (o.repo) {
+        const root = repoRoot(d);
+        if (!root) {
+            d.log('Error: --repo needs to run inside a git repository.');
+            return 1;
+        }
+        path = repoConnectionPath(root);
+    }
+    else
+        path = userConnectionPath(d.home);
+    d.log(clearConnectionFile(path) ? `Removed ${path}. Nothing in AWS was changed.` : `Nothing to clear: ${path} does not exist.`);
+    return 0;
+}
+function describeFile(label, path, d) {
+    const c = readConnectionFile(path);
+    if (c)
+        d.log(`  ${label}: ${path}\n      profile ${c.profile}, region ${c.region}, account ${c.account}${c.alias ? ` (${c.alias})` : ''}, verified ${c.verifiedAt || 'unknown'}`);
+    else
+        d.log(`  ${label}: ${path} (${existsSync(path) ? 'not a valid connection; ignored. Re-run prism-cli aws connect' : 'not set'})`);
+}
+/** `--status`: what is saved, which file applies, and whether it still validates. */
+function status(d) {
+    const root = repoRoot(d);
+    d.log('Saved AWS connection:');
+    describeFile('user', userConnectionPath(d.home), d);
+    if (root)
+        describeFile('repo', repoConnectionPath(root), d);
+    else
+        d.log('  repo: (not in a git repository)');
+    const saved = loadConnection(d.home, root);
+    if (!saved) {
+        d.log('');
+        d.log('No saved connection: AWS commands use the default credential chain. Save one with: prism-cli aws connect');
+        return 0;
+    }
+    const applied = applyConnection({}, saved, d.env);
+    d.log('');
+    if (applied.profileSource)
+        d.log(`In use: profile ${saved.profile}, region ${saved.region} (${connectionLabel(saved)}, ${saved.path})`);
+    else {
+        const v = ENV_CREDENTIAL_VARS.find((k) => d.env[k]);
+        d.log(`Not in use for credentials: ${v} is set, and the environment wins over the saved connection${applied.connection ? ` (the saved region ${saved.region} still applies)` : ''}.`);
+    }
+    if (d.env.AWS_REGION || d.env.AWS_DEFAULT_REGION)
+        d.log(`Region note: ${d.env.AWS_REGION ? 'AWS_REGION' : 'AWS_DEFAULT_REGION'} is set and wins over the saved region.`);
+    const id = callerIdentity(d, saved.profile, saved.region);
+    if ('error' in id) {
+        d.log(`Validation: FAILED for profile ${saved.profile}: ${id.error}. Sign in again (e.g. aws sso login --profile ${saved.profile}) or re-run prism-cli aws connect.`);
+        return 1;
+    }
+    const w = accountChangeWarning(saved, id.account);
+    d.log(w ?? `Validation: ok, profile ${saved.profile} is account ${id.account} as saved (caller ${id.arn}).`);
+    return w ? 1 : 0;
+}
+/** Runs `aws connect`. Returns the exit code. */
+export async function awsConnect(o, d) {
+    if (o.status && o.clear) {
+        d.log('Error: --status and --clear cannot be combined.');
+        return 1;
+    }
+    if (o.clear)
+        return clear(o, d);
+    d.log(CONNECT_NOTICE);
+    d.log('');
+    if (o.status)
+        return status(d);
+    const root = repoRoot(d);
+    if (o.repo && !root) {
+        d.log('Error: --repo needs to run inside a git repository.');
+        return 1;
+    }
+    const before = loadConnection(d.home, root);
+    const profile = await chooseProfile(o, d, before);
+    if (typeof profile !== 'string') {
+        d.log(`Error: ${profile.error}`);
+        return 1;
+    }
+    if (!PROFILE_RE.test(profile)) {
+        d.log(`Error: "${profile}" is not a valid profile name.`);
+        return 1;
+    }
+    const known = d.listProfiles();
+    if (known.length && !known.includes(profile)) {
+        d.log(`Error: profile ${profile} is not configured here (aws configure list-profiles lists: ${known.join(', ')}).`);
+        return 1;
+    }
+    const region = await chooseRegion(o, d, profile);
+    if (typeof region !== 'string') {
+        d.log(`Error: ${region.error}`);
+        return 1;
+    }
+    if (!REGION_RE.test(region)) {
+        d.log(`Error: "${region}" is not a valid AWS region name (e.g. us-west-2).`);
+        return 1;
+    }
+    const id = callerIdentity(d, profile, region);
+    if ('error' in id) {
+        d.log(`Error: profile ${profile} does not validate: ${id.error}. Sign in (e.g. aws sso login --profile ${profile}) and re-run. Nothing was saved.`);
+        return 1;
+    }
+    const alias = accountAlias(d, profile, region);
+    const org = orgRole(d, profile, region, id.account);
+    const access = accessLevel(d, profile, region, id.arn);
+    d.log(`Profile:     ${profile}`);
+    d.log(`Region:      ${region}`);
+    d.log(`Account:     ${id.account}${alias ? ` (${alias})` : ' (no account alias)'}`);
+    d.log(`Caller:      ${id.arn || 'unknown'}`);
+    d.log(`Org management account: ${orgText(org)}`);
+    d.log(`Access:      ${access.level} (${access.basis})`);
+    if (access.level === 'admin')
+        d.log('             prism-cli aws check and aws recommend only need read access; a read-only profile is enough for them.');
+    const path = o.repo && root ? repoConnectionPath(root) : userConnectionPath(d.home);
+    const prev = readConnectionFile(path);
+    if (prev && prev.profile === profile && prev.account !== id.account) {
+        d.log(`Warning: profile ${profile} was saved as account ${prev.account}; it now resolves to account ${id.account}.`);
+    }
+    const conn = { profile, region, account: id.account, alias, verifiedAt: d.now().toISOString() };
+    if (o.repo && root) {
+        const excluded = ensureMarkerIgnored(root, d.git, REPO_CONNECTION_PATH, 'prism-cli aws connect');
+        if (excluded)
+            d.log(`Added ${REPO_CONNECTION_PATH} to ${excluded} so git ignores it in this clone.`);
+    }
+    writeConnectionFile(path, conn);
+    d.log('');
+    d.log(`Saved ${path} (profile name, region, account and alias; no credentials).`);
+    d.log(`AWS commands now default to profile ${profile} in ${region}${o.repo ? ' in this repo' : ''}. --profile/--region and AWS_PROFILE/AWS_REGION still win.`);
+    const env = ENV_CREDENTIAL_VARS.find((k) => d.env[k]);
+    if (env && d.env.AWS_PROFILE !== profile)
+        d.log(`Note: ${env} is set in this shell, so it wins here until it is unset.`);
+    if (!o.repo && root && readConnectionFile(repoConnectionPath(root)))
+        d.log(`Note: this repo has its own ${REPO_CONNECTION_PATH}, which wins over the user file here.`);
+    return 0;
+}
+//# sourceMappingURL=connect.js.map

package/dist/src/aws/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/aws/connect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,oBAAoB,EAAE,eAAe,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAChH,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EACnH,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AA0BzB,MAAM,CAAC,MAAM,cAAc,GAAG,qMAAqM,CAAC;AAMpO,MAAM,MAAM,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC;AAEhI,MAAM,UAAU,cAAc,CAAC,CAAc,EAAE,OAAe,EAAE,MAAc;IAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAc,EAAE,OAAe,EAAE,MAAc;IAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,OAAO,CAAC,CAAc,EAAE,OAAe,EAAE,MAAc,EAAE,OAAe;IACtF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1I,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,mCAAmC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,YAAY,GAAG,qDAAqD,CAAC;AAC3E,MAAM,WAAW,GAAG,0DAA0D,CAAC;AAC/E,MAAM,UAAU,GAAG,6BAA6B,CAAC;AACjD,MAAM,SAAS,GAAG,8BAA8B,CAAC;AAEjD,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,wEAAwE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC5I,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAc,EAAE,OAAe,EAAE,MAAc,EAAE,GAAW;IACtF,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACzE,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IAC/G,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/J,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5I,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC3I,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,0BAA0B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;IACtJ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;IACtG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;IACzG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,KAAK,EAAE;IACnG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;AAE5I,KAAK,UAAU,aAAa,CAAC,CAAiB,EAAE,CAAc,EAAE,KAA6B;IAC3F,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;IAClC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,oHAAoH,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,qHAAqH,EAAE,CAAC;IAC9J,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,KAAK,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,sCAAsC,EAAE,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAiB,EAAE,CAAc,EAAE,OAAe;IAC5E,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAO,GAAG,IAAI,EAAE,KAAK,EAAE,iCAAiC,OAAO,oDAAoD,EAAE,CAAC;IACpI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,OAAO,CAAC,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAc;IAC9B,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,SAAS,KAAK,CAAC,CAAiB,EAAE,CAAc;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACtF,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;;QAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC,CAAC,qBAAqB,IAAI,kBAAkB,CAAC,CAAC;IAChI,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,CAAc;IAC/D,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,mBAAmB,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC;;QAC7K,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;AACxI,CAAC;AAED,qFAAqF;AACrF,SAAS,MAAM,CAAC,CAAc;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC/B,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,IAAI;QAAE,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;;QACvD,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,0GAA0G,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvJ,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,OAAO,CAAC,aAAa;QAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;SACnI,CAAC;QACJ,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC,8DAA8D,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxL,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,kBAAkB;QAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,yCAAyC,CAAC,CAAC;IACzK,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,KAAK,iDAAiD,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvM,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,2BAA2B,KAAK,CAAC,OAAO,eAAe,EAAE,CAAC,OAAO,qBAAqB,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7G,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAiB,EAAE,CAAc;IAChE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChG,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAE/B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChG,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,WAAW,OAAO,gCAAgC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACvG,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,OAAO,+DAA+D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChL,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,WAAW,MAAM,oDAAoD,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAExH,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,kBAAkB,OAAO,uBAAuB,EAAE,CAAC,KAAK,2CAA2C,OAAO,kCAAkC,CAAC,CAAC;QACpJ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAEvD,CAAC,CAAC,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,GAAG,CAAC,2BAA2B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,mHAAmH,CAAC,CAAC;IAEzJ,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,oBAAoB,OAAO,yBAAyB,IAAI,CAAC,OAAO,gCAAgC,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,IAAI,GAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/G,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;QACjG,IAAI,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,oBAAoB,OAAO,QAAQ,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,6DAA6D,CAAC,CAAC;IAClF,CAAC,CAAC,GAAG,CAAC,uCAAuC,OAAO,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,4DAA4D,CAAC,CAAC;IAC/J,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,2DAA2D,CAAC,CAAC;IACzH,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,+BAA+B,oBAAoB,uCAAuC,CAAC,CAAC;IACvK,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/aws/connection.d.ts

@@ -0,0 +1,67 @@
+import { type RunResult } from '../utils/exec.js';
+export declare const USER_CONNECTION_PATH = "~/.prism/aws.json";
+export declare const REPO_CONNECTION_PATH = ".prism/aws.local.json";
+export interface AwsConnection {
+    profile: string;
+    region: string;
+    account: string;
+    alias: string | null;
+    verifiedAt: string;
+}
+export type ConnectionScope = 'repo' | 'user';
+export interface SavedConnection extends AwsConnection {
+    scope: ConnectionScope;
+    path: string;
+}
+/** What a command's options gain from the resolver. */
+export interface ConnectionDefaults {
+    profile?: string;
+    /** Where `profile` came from, e.g. "--profile" or "aws connect, user". Unset when no profile is used. */
+    profileSource?: string;
+    /** The saved connection whose region (and account, for the change warning) applies. */
+    connection?: SavedConnection;
+}
+/** Credential env vars that the AWS CLI prefers over any profile; when set, the saved profile is not applied. */
+export declare const ENV_CREDENTIAL_VARS: string[];
+export declare const PROFILE_RE: RegExp;
+export declare const REGION_RE: RegExp;
+export declare const userConnectionPath: (home: string) => string;
+export declare const repoConnectionPath: (root: string) => string;
+/** The connection in `path`; null when the file is absent or not a valid connection. */
+export declare function readConnectionFile(path: string): AwsConnection | null;
+/** Atomic write, owner-only (no secrets inside, but it is per-user state). */
+export declare function writeConnectionFile(path: string, c: AwsConnection): void;
+/** Removes the file; true when there was one. */
+export declare function clearConnectionFile(path: string): boolean;
+/** The repo file first, then the user file. `home` '' means no user file. */
+export declare function loadConnection(home: string, repoRoot: string | null): SavedConnection | null;
+export declare const connectionLabel: (c: Pick<SavedConnection, "scope">) => string;
+/**
+ * Fills the profile from the saved connection when neither a flag nor the
+ * environment chose the credentials, and attaches the connection whose region
+ * applies. Pure: the caller loads the connection.
+ */
+export declare function applyConnection<T extends {
+    profile?: string;
+    region?: string;
+}>(opts: T, saved: SavedConnection | null, env: NodeJS.ProcessEnv): T & ConnectionDefaults;
+/** `git -C dir rev-parse --show-toplevel`, or null outside a repository. */
+export declare function repoRootOf(dir: string, git?: (args: string[]) => RunResult): string | null;
+/**
+ * The real-runtime entry point: loads the saved connection for the working
+ * directory (or `opts.path`) and applies it. With an explicit `env` (tests),
+ * the user file is looked up under env.HOME only, so a developer's own saved
+ * connection never leaks into a test run.
+ */
+export declare function connectionDefaults<T extends {
+    profile?: string;
+    region?: string;
+    path?: string;
+}>(opts: T, env?: NodeJS.ProcessEnv): T & ConnectionDefaults;
+/** The account-change warning, or null when the account is the one that was verified. */
+export declare function accountChangeWarning(c: SavedConnection | undefined, account: string): string | null;
+/** `aws configure get region [--profile p]`: local config only, no AWS call. */
+export declare function configuredRegion(profile?: string): string | null;
+/** `aws configure list-profiles`: local config only, no AWS call. */
+export declare function listProfiles(): string[];
+//# sourceMappingURL=connection.d.ts.map

package/dist/src/aws/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/aws/connection.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAO,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AACxD,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAC9C,MAAM,WAAW,eAAgB,SAAQ,aAAa;IAAG,KAAK,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAE/F,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yGAAyG;IACzG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,UAAsJ,CAAC;AAEvL,eAAO,MAAM,UAAU,QAAiC,CAAC;AACzD,eAAO,MAAM,SAAS,QAAiC,CAAC;AAGxD,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAA0C,CAAC;AAC7F,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAA6C,CAAC;AAchG,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAErE;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,GAAG,IAAI,CAMxE;AAED,iDAAiD;AACjD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,eAAe,GAAG,IAAI,CAY5F;AAED,eAAO,MAAM,eAAe,GAAI,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,KAAG,MAAmC,CAAC;AAExG;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,GAAG,kBAAkB,CAOvK;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAgC,GAAG,MAAM,GAAG,IAAI,CAGhH;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,GAAG,kBAAkB,CAK3J;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,eAAe,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAInG;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAED,qEAAqE;AACrE,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAGvC"}

package/dist/src/aws/connection.js

@@ -0,0 +1,137 @@
+/**
+ * The saved AWS connection from `prism-cli aws connect`, and the one resolver
+ * every AWS command uses to pick its default profile and region.
+ *
+ * What is saved is a profile NAME, a region and what that pair was verified
+ * as (account, alias, when). Never a credential: the AWS CLI still resolves
+ * the profile's credentials itself, every time.
+ *
+ * Files:
+ *   ~/.prism/aws.json         per user
+ *   .prism/aws.local.json     per repo override (git-ignored via .git/info/exclude)
+ *
+ * Precedence, per field:
+ *   profile: --profile > env credentials (AWS_PROFILE, AWS_ACCESS_KEY_ID, ...) > repo file > user file > default chain
+ *   region:  --region  > AWS_REGION > AWS_DEFAULT_REGION > saved region > the profile's configured region
+ * The saved region is used only together with its saved profile (the two were
+ * verified as a pair): `--profile other` falls through to other's own region.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { run } from '../utils/exec.js';
+export const USER_CONNECTION_PATH = '~/.prism/aws.json';
+export const REPO_CONNECTION_PATH = '.prism/aws.local.json';
+/** Credential env vars that the AWS CLI prefers over any profile; when set, the saved profile is not applied. */
+export const ENV_CREDENTIAL_VARS = ['AWS_PROFILE', 'AWS_ACCESS_KEY_ID', 'AWS_WEB_IDENTITY_TOKEN_FILE', 'AWS_CONTAINER_CREDENTIALS_FULL_URI', 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'];
+export const PROFILE_RE = /^[A-Za-z0-9_.+=,@:-]{1,128}$/;
+export const REGION_RE = /^[a-z]{2}(-[a-z]+)+-\d{1,2}$/;
+const ACCOUNT_RE = /^\d{12}$/;
+export const userConnectionPath = (home) => join(home, '.prism', 'aws.json');
+export const repoConnectionPath = (root) => resolve(root, REPO_CONNECTION_PATH);
+function parse(x) {
+    if (!x || typeof x !== 'object')
+        return null;
+    if (typeof x.profile !== 'string' || !PROFILE_RE.test(x.profile))
+        return null;
+    if (typeof x.region !== 'string' || !REGION_RE.test(x.region))
+        return null;
+    if (typeof x.account !== 'string' || !ACCOUNT_RE.test(x.account))
+        return null;
+    return {
+        profile: x.profile, region: x.region, account: x.account,
+        alias: typeof x.alias === 'string' && x.alias ? x.alias : null,
+        verifiedAt: typeof x.verifiedAt === 'string' ? x.verifiedAt : '',
+    };
+}
+/** The connection in `path`; null when the file is absent or not a valid connection. */
+export function readConnectionFile(path) {
+    try {
+        return parse(JSON.parse(readFileSync(path, 'utf8')));
+    }
+    catch {
+        return null;
+    }
+}
+/** Atomic write, owner-only (no secrets inside, but it is per-user state). */
+export function writeConnectionFile(path, c) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    const body = { profile: c.profile, region: c.region, account: c.account, alias: c.alias, verifiedAt: c.verifiedAt };
+    writeFileSync(tmp, JSON.stringify(body, null, 2) + '\n', { mode: 0o600 });
+    renameSync(tmp, path);
+}
+/** Removes the file; true when there was one. */
+export function clearConnectionFile(path) {
+    if (!existsSync(path))
+        return false;
+    rmSync(path, { force: true });
+    return true;
+}
+/** The repo file first, then the user file. `home` '' means no user file. */
+export function loadConnection(home, repoRoot) {
+    if (repoRoot) {
+        const p = repoConnectionPath(repoRoot);
+        const c = readConnectionFile(p);
+        if (c)
+            return { ...c, scope: 'repo', path: p };
+    }
+    if (home) {
+        const p = userConnectionPath(home);
+        const c = readConnectionFile(p);
+        if (c)
+            return { ...c, scope: 'user', path: p };
+    }
+    return null;
+}
+export const connectionLabel = (c) => `aws connect, ${c.scope}`;
+/**
+ * Fills the profile from the saved connection when neither a flag nor the
+ * environment chose the credentials, and attaches the connection whose region
+ * applies. Pure: the caller loads the connection.
+ */
+export function applyConnection(opts, saved, env) {
+    if (opts.profile)
+        return { ...opts, profileSource: '--profile', connection: saved && saved.profile === opts.profile ? saved : undefined };
+    if (ENV_CREDENTIAL_VARS.some((k) => env[k])) {
+        return { ...opts, connection: saved && env.AWS_PROFILE === saved.profile ? saved : undefined };
+    }
+    if (saved)
+        return { ...opts, profile: saved.profile, profileSource: connectionLabel(saved), connection: saved };
+    return { ...opts };
+}
+/** `git -C dir rev-parse --show-toplevel`, or null outside a repository. */
+export function repoRootOf(dir, git = (a) => run('git', a)) {
+    const r = git(['-C', dir, 'rev-parse', '--show-toplevel']);
+    return r.ok && r.stdout ? r.stdout.trim() : null;
+}
+/**
+ * The real-runtime entry point: loads the saved connection for the working
+ * directory (or `opts.path`) and applies it. With an explicit `env` (tests),
+ * the user file is looked up under env.HOME only, so a developer's own saved
+ * connection never leaks into a test run.
+ */
+export function connectionDefaults(opts, env) {
+    const e = env ?? process.env;
+    const home = env ? (env.HOME ?? '') : homedir();
+    const root = repoRootOf(opts.path ? resolve(opts.path) : process.cwd());
+    return applyConnection(opts, loadConnection(home, root), e);
+}
+/** The account-change warning, or null when the account is the one that was verified. */
+export function accountChangeWarning(c, account) {
+    if (!c || !account || c.account === account)
+        return null;
+    return `Warning: aws connect verified profile ${c.profile} as account ${c.account}${c.verifiedAt ? ` on ${c.verifiedAt}` : ''}, but it now resolves to account ${account}. `
+        + `Check the profile, then re-run prism-cli aws connect${c.scope === 'repo' ? ' --repo' : ''}.`;
+}
+/** `aws configure get region [--profile p]`: local config only, no AWS call. */
+export function configuredRegion(profile) {
+    const r = run('aws', ['configure', 'get', 'region', ...(profile ? ['--profile', profile] : [])]);
+    return r.ok && r.stdout ? r.stdout.trim() : null;
+}
+/** `aws configure list-profiles`: local config only, no AWS call. */
+export function listProfiles() {
+    const r = run('aws', ['configure', 'list-profiles']);
+    return r.ok ? r.stdout.split('\n').map((l) => l.trim()).filter(Boolean) : [];
+}
+//# sourceMappingURL=connection.js.map

package/dist/src/aws/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/aws/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,GAAG,EAAkB,MAAM,kBAAkB,CAAC;AAEvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAsB5D,iHAAiH;AACjH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,wCAAwC,CAAC,CAAC;AAEvL,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACxD,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC7F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAEhG,SAAS,KAAK,CAAC,CAAM;IACnB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;QACxD,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC9D,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACtF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,CAAgB;IAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,IAAI,GAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;IACnI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAuB;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAiC,EAAU,EAAE,CAAC,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC;AAExG;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAkD,IAAO,EAAE,KAA6B,EAAE,GAAsB;IAC7I,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC1I,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAChH,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAqC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAiE,IAAO,EAAE,GAAuB;IACjI,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,OAAO,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,CAA8B,EAAE,OAAe;IAClF,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,yCAAyC,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,oCAAoC,OAAO,IAAI;UACxK,uDAAuD,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AACpG,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC"}

package/dist/src/aws/recommend.d.ts

@@ -0,0 +1,70 @@
+import { type Finding, type Severity } from '../utils/audit.js';
+import { type PrismResult, type ResultEntry } from '../codewatch/results.js';
+import { type Effort } from './advice.js';
+import { type CheckOptions, type CheckRunDeps } from './run-check.js';
+export declare const RECOMMEND_NOTICE = "No AWS calls (aws recommend): it reads the latest aws check result in .prism/results/. Nothing in AWS is changed.";
+export interface RecommendOptions extends Pick<CheckOptions, 'profile' | 'region' | 'profileSource' | 'connection'> {
+    account?: string;
+    refresh?: boolean;
+    json?: boolean;
+    markdown?: boolean;
+}
+/** Why an INDETERMINATE check could not run, as far as its detail tells. */
+export type IndeterminateCause = 'access-denied' | 'no-credential-report' | 'prerequisite' | 'not-integrated' | 'other';
+export interface Recommendation {
+    /** fix: one or more FAILs. access: one or more INDETERMINATE checks (could not check). */
+    kind: 'fix' | 'access';
+    /** The recommendation key; checks that share one fix share it (e.g. "budgets"). */
+    id: string;
+    /** Every check this item covers, worst first. */
+    covers: {
+        id: string;
+        title: string;
+        detail: string;
+    }[];
+    section: string;
+    severity: Severity;
+    effort: Effort;
+    title: string;
+    why: string;
+    steps: string[];
+    command: string | null;
+    doc: string | null;
+    /** fix only: its position in the ranked list, 1-based across sections. */
+    number?: number;
+    /** access only. */
+    cause?: IndeterminateCause;
+}
+/** Account and region from the result, filled into the advice's `<account>` and `<region>`. */
+export interface AdviceContext {
+    account?: string;
+    region?: string;
+}
+export declare const NO_REPORT_STEP = "No credential report exists yet. Run `prism-cli bedrock-protection scan-account` once (it generates one, which is a write) or `aws iam generate-credential-report`, then re-run aws check.";
+/** Only an access-denied detail means "grant"; a missing report or a missing prerequisite says what to do first. */
+export declare function indeterminateCause(f: Finding): IndeterminateCause;
+type Rankable = Pick<Recommendation, 'severity' | 'effort' | 'id'>;
+/** Severity first, then effort (quick wins first), then id. */
+export declare function rank(a: Rankable, b: Rankable): number;
+/** Check ids older results still carry, and the check that replaced them, so a cached result de-duplicates too. */
+export declare const RETIRED_IDS: Record<string, string>;
+export interface SectionAdvice {
+    section: string;
+    heading: string;
+    fixes: Recommendation[];
+    access: Recommendation[];
+}
+/**
+ * FAILs and INDETERMINATEs as recommendations, grouped by section in aws
+ * check's order, each group ranked. Fixes are numbered across sections, so a
+ * check that waits on a fix can name it ("item 2").
+ */
+export declare function buildRecommendations(checks: Finding[], c?: AdviceContext): SectionAdvice[];
+/** The newest aws-check result, optionally for one account and region. */
+export declare function latestCheck(entries: ResultEntry[], account?: string, region?: string): ResultEntry | null;
+export declare function renderText(r: PrismResult, groups: SectionAdvice[], source: string): string[];
+export declare function renderMarkdown(r: PrismResult, groups: SectionAdvice[], source: string): string;
+/** Runs `aws recommend`. Returns the exit code. */
+export declare function awsRecommend(input: RecommendOptions, d: CheckRunDeps): number;
+export {};
+//# sourceMappingURL=recommend.d.ts.map