@prism-d1/cli 1.3.0 → 1.4.0

package/dist/src/aws/recommend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommend.d.ts","sourceRoot":"","sources":["../../../src/aws/recommend.ts"],"names":[],"mappings":"AAOA,OAAO,EAAgB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAkC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG7G,OAAO,EAAkB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAyB,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE7F,eAAO,MAAM,gBAAgB,sHAAsH,CAAC;AAGpJ,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,QAAQ,GAAG,eAAe,GAAG,YAAY,CAAC;IACjH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,sBAAsB,GAAG,cAAc,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAExH,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvB,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAAG,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAMpE,eAAO,MAAM,cAAc,+LAA+L,CAAC;AAE3N,oHAAoH;AACpH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAOjE;AAED,KAAK,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEnE,+DAA+D;AAC/D,wBAAgB,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,GAAG,MAAM,CAErD;AAID,mHAAmH;AACnH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAA+C,CAAC;AAkE/F,MAAM,WAAW,aAAa;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,cAAc,EAAE,CAAA;CAAE;AAEtH;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,GAAE,aAAkB,GAAG,aAAa,EAAE,CAc9F;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAIzG;AAeD,wBAAgB,UAAU,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB5F;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAmB9F;AAED,mDAAmD;AACnD,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,YAAY,GAAG,MAAM,CAgC7E"}

package/dist/src/aws/recommend.js

@@ -0,0 +1,244 @@
+/**
+ * `prism-cli aws recommend`: turns the latest aws check result for the
+ * account and region into a ranked fix list. Makes no AWS calls (except
+ * through --refresh, which runs aws check first) and no model calls.
+ */
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { severityRank } from '../utils/audit.js';
+import { readResultEntries, RESULTS_DIR } from '../codewatch/results.js';
+import { resolveRegion } from '../security/setup.js';
+import { SECTIONS } from './check.js';
+import { ADVICE, GROUPS } from './advice.js';
+import { awsCheck, resultsRoot } from './run-check.js';
+export const RECOMMEND_NOTICE = 'No AWS calls (aws recommend): it reads the latest aws check result in .prism/results/. Nothing in AWS is changed.';
+const EFFORT_RANK = { quick: 0, medium: 1, large: 2 };
+const fill = (text, c) => text.replace(/<region>/g, c.region || '<region>').replace(/<account>/g, c.account || '<account>');
+const DENIED = /AccessDenied|UnauthorizedOperation|AuthorizationError|not authorized|Unauthorized/i;
+export const NO_REPORT_STEP = 'No credential report exists yet. Run `prism-cli bedrock-protection scan-account` once (it generates one, which is a write) or `aws iam generate-credential-report`, then re-run aws check.';
+/** Only an access-denied detail means "grant"; a missing report or a missing prerequisite says what to do first. */
+export function indeterminateCause(f) {
+    const a = ADVICE[f.id];
+    if (a?.indeterminate)
+        return 'not-integrated';
+    if (/ReportNotPresent/.test(f.detail))
+        return 'no-credential-report';
+    if (DENIED.test(f.detail))
+        return 'access-denied';
+    if (a?.prerequisite)
+        return 'prerequisite';
+    return 'other';
+}
+/** Severity first, then effort (quick wins first), then id. */
+export function rank(a, b) {
+    return severityRank(b.severity) - severityRank(a.severity) || EFFORT_RANK[a.effort] - EFFORT_RANK[b.effort] || a.id.localeCompare(b.id);
+}
+const unique = (xs) => [...new Set(xs)];
+/** Check ids older results still carry, and the check that replaced them, so a cached result de-duplicates too. */
+export const RETIRED_IDS = { 'baseline.root-mfa': 'bedrock.root-mfa' };
+const adviceId = (id) => RETIRED_IDS[id] ?? id;
+/** FAILs that share a recommendation key become one fix naming every check it covers. */
+function fixes(fails, c) {
+    const byKey = new Map();
+    for (const f of fails) {
+        const key = ADVICE[adviceId(f.id)]?.key ?? adviceId(f.id);
+        byKey.set(key, [...(byKey.get(key) ?? []), f]);
+    }
+    return [...byKey.entries()].map(([key, fs]) => {
+        // The worst member sets the severity, the section and the lead text; the current id leads a retired one.
+        const retired = (id) => Number(id in RETIRED_IDS);
+        const members = fs.map((f) => ({ f, a: ADVICE[adviceId(f.id)], r: { severity: f.severity, effort: ADVICE[adviceId(f.id)]?.effort ?? 'medium', id: f.id } }))
+            .sort((x, y) => retired(x.f.id) - retired(y.f.id) || rank(x.r, y.r));
+        const lead = members[0];
+        const group = GROUPS[key];
+        // A check id with no mapping (an older result) falls back to the check's own remediation.
+        const steps = unique(members.flatMap(({ f, a }) => (a ? a.steps : f.remediation ? [f.remediation] : []))).map((x) => fill(x, c));
+        const cmd = members.map((m) => m.a?.command).find(Boolean);
+        const effort = members.map((m) => m.r.effort).sort((x, y) => EFFORT_RANK[x] - EFFORT_RANK[y])[0];
+        return {
+            kind: 'fix', id: key, section: lead.f.category, severity: lead.f.severity, effort,
+            covers: members.map(({ f }) => ({ id: f.id, title: f.title, detail: f.detail })),
+            title: fill(group?.title ?? lead.a?.title ?? lead.f.title, c), why: group?.why ?? lead.a?.why ?? lead.f.detail,
+            steps, command: cmd ? fill(cmd, c) : null, doc: lead.a?.doc ?? null,
+        };
+    });
+}
+function accessItem(f, numbers, c) {
+    const a = ADVICE[f.id];
+    const cause = indeterminateCause(f);
+    let title = `Could not check: ${f.title}`;
+    let step = 'The check got no answer (see what it found); re-run prism-cli aws check.';
+    if (cause === 'not-integrated') {
+        title = a.title;
+        step = a.indeterminate;
+    }
+    else if (cause === 'no-credential-report') {
+        title = 'Create an IAM credential report';
+        step = NO_REPORT_STEP;
+    }
+    else if (cause === 'access-denied') {
+        title = `Grant read access to check: ${f.title}`;
+        step = a?.needs?.length ? `Grant ${a.needs.join(', ')} (read-only), then re-run prism-cli aws check.` : 'Grant read access for this check, then re-run prism-cli aws check.';
+    }
+    else if (cause === 'prerequisite') {
+        const n = numbers.get(a.prerequisite);
+        title = `Checked after another fix: ${f.title}`;
+        step = `${GROUPS[a.prerequisite]?.first ?? `Fix ${a.prerequisite}`}${n ? ` in item ${n}` : ''} first, then re-run prism-cli aws check.`;
+    }
+    return {
+        kind: 'access', id: f.id, cause, section: f.category, severity: f.severity, effort: 'quick',
+        covers: [{ id: f.id, title: f.title, detail: f.detail }], title, why: 'The check could not run, so it is not a pass.',
+        steps: [fill(step, c)], command: null, doc: a?.doc ?? null,
+    };
+}
+/** INDETERMINATE items with the same step (three checks waiting on one credential report) become one. */
+function mergeAccess(items) {
+    const out = new Map();
+    for (const x of [...items].sort(rank)) {
+        const prev = out.get(x.steps[0]);
+        if (prev)
+            prev.covers.push(...x.covers);
+        else
+            out.set(x.steps[0], { ...x, covers: [...x.covers] });
+    }
+    for (const x of out.values()) {
+        if (x.covers.length > 1 && (x.cause === 'access-denied' || x.cause === 'other'))
+            x.title = `${x.title.split(': ')[0]}: ${x.covers.map((v) => v.title).join('; ')}`;
+    }
+    return [...out.values()];
+}
+/**
+ * FAILs and INDETERMINATEs as recommendations, grouped by section in aws
+ * check's order, each group ranked. Fixes are numbered across sections, so a
+ * check that waits on a fix can name it ("item 2").
+ */
+export function buildRecommendations(checks, c = {}) {
+    const fixList = fixes(checks.filter((f) => f.status === 'FAIL'), c);
+    const known = SECTIONS.map((s) => [s.name, s.heading]);
+    const extra = unique(checks.filter((f) => f.status !== 'PASS').map((f) => f.category))
+        .filter((s) => !known.some(([n]) => n === s)).map((s) => [s, s]);
+    const groups = [...known, ...extra].map(([section, heading]) => ({
+        section, heading, fixes: fixList.filter((r) => r.section === section).sort(rank), access: [],
+    }));
+    const numbers = new Map();
+    let n = 0;
+    for (const g of groups)
+        for (const x of g.fixes) {
+            x.number = ++n;
+            numbers.set(x.id, n);
+        }
+    const access = mergeAccess(checks.filter((f) => f.status === 'INDETERMINATE').map((f) => accessItem(f, numbers, c)));
+    for (const g of groups)
+        g.access = access.filter((x) => x.section === g.section);
+    return groups.filter((g) => g.fixes.length || g.access.length);
+}
+/** The newest aws-check result, optionally for one account and region. */
+export function latestCheck(entries, account, region) {
+    return entries
+        .filter((e) => e.result.kind === 'aws-check' && e.result.aws_check && (!account || e.result.aws_check.account === account) && (!region || e.result.aws_check.region === region))
+        .sort((a, b) => b.result.started_at.localeCompare(a.result.started_at))[0] ?? null;
+}
+const header = (r) => {
+    const c = r.aws_check;
+    return `account ${c.account}${c.alias ? ` (${c.alias})` : ''}, region ${c.region}`;
+};
+/** What the check found; one line per check when an item covers several. */
+function found(x) {
+    if (x.covers.length === 1)
+        return [`Found: ${x.covers[0].detail}`];
+    return [`Covers ${x.covers.length} checks:`, ...x.covers.map((v) => `- ${v.title}: ${v.detail}`)];
+}
+const coversText = (x) => (x.covers.length > 1 && !x.title.includes(x.covers[1].title) ? ` (covers: ${x.covers.map((v) => v.title).join('; ')})` : '');
+export function renderText(r, groups, source) {
+    const out = [`AWS recommendations for ${header(r)}`, `   From aws check at ${r.started_at} (${source}).`, ''];
+    if (!groups.length)
+        return [...out, 'Nothing to fix: every check passed.'];
+    for (const g of groups) {
+        out.push(`── ${g.heading} ──`, '');
+        for (const x of g.fixes) {
+            out.push(`  ${x.number}. [${x.severity} · ${x.effort}] ${x.title}`, `     Why: ${x.why}`, ...found(x).map((l) => `     ${l}`));
+            for (const s of x.steps)
+                out.push(`     - ${s}`);
+            if (x.command)
+                out.push(`     Run: ${x.command}`);
+            if (x.doc)
+                out.push(`     Docs: ${x.doc}`);
+            out.push('');
+        }
+        if (g.access.length) {
+            out.push('  Could not check (not a pass):');
+            for (const x of g.access)
+                out.push(`  - [${x.severity}] ${x.title}: ${x.steps[0]}${coversText(x)}`);
+            out.push('');
+        }
+    }
+    return out;
+}
+export function renderMarkdown(r, groups, source) {
+    const out = [`# AWS recommendations`, '', `For ${header(r)}, from \`prism-cli aws check\` at ${r.started_at} (${source}). Generated by \`prism-cli aws recommend\`; no AWS or model calls.`, ''];
+    if (!groups.length)
+        out.push('Nothing to fix: every check passed.', '');
+    for (const g of groups) {
+        out.push(`## ${g.heading}`, '');
+        for (const x of g.fixes) {
+            out.push(`### ${x.number}. ${x.title}`, '', `**${x.severity}**, effort ${x.effort}. ${x.why}`, '', ...found(x), '');
+            for (const s of x.steps)
+                out.push(`- ${s}`);
+            if (x.command)
+                out.push(`- Run \`${x.command}\``);
+            if (x.doc)
+                out.push(`- Docs: ${x.doc}`);
+            out.push('');
+        }
+        if (g.access.length) {
+            out.push('Could not check (not a pass):', '');
+            for (const x of g.access)
+                out.push(`- **${x.severity}** ${x.title}: ${x.steps[0]}${coversText(x)}`);
+            out.push('');
+        }
+    }
+    return out.join('\n');
+}
+/** Runs `aws recommend`. Returns the exit code. */
+export function awsRecommend(input, d) {
+    const say = input.json ? d.err : d.log;
+    say(input.refresh ? 'aws recommend --refresh: runs prism-cli aws check first (read-only), then reads its result.' : RECOMMEND_NOTICE);
+    say('');
+    if (input.account && !/^\d{12}$/.test(input.account)) {
+        say(`Error: --account must be a 12-digit account id, got "${input.account}".`);
+        return 1;
+    }
+    let account = input.account ?? input.connection?.account;
+    const region = resolveRegion(input, d)?.region;
+    if (input.refresh) {
+        const o = awsCheck({ ...input, json: false, report: !input.json }, { ...d, log: say });
+        if (o.code !== 0 && !o.result)
+            return o.code;
+        account = o.result?.aws_check?.account ?? account;
+        say('');
+    }
+    const roots = [...new Set([resultsRoot(d), d.home])];
+    const entry = latestCheck(roots.flatMap((root) => readResultEntries(root).map((e) => ({ ...e, root }))), account, region);
+    if (!entry) {
+        const scope = [account ? `account ${account}` : '', region ? `region ${region}` : ''].filter(Boolean).join(', ');
+        say(`No aws check result${scope ? ` for ${scope}` : ''}. Run prism-cli aws check first, or prism-cli aws recommend --refresh.`);
+        return 1;
+    }
+    const source = join(entry.root, RESULTS_DIR, `${entry.id}.json`);
+    const c = entry.result.aws_check;
+    const groups = buildRecommendations(c.checks, { account: c.account, region: c.region });
+    if (!account)
+        say(`Using the latest result (${entry.result.aws_check.account}); pass --account to choose another account.`);
+    if (input.json)
+        d.log(JSON.stringify({ schema: 'prism.aws-recommend.v1', account: entry.result.aws_check.account, region: entry.result.aws_check.region, checked_at: entry.result.started_at, source, groups }, null, 2));
+    else
+        for (const l of renderText(entry.result, groups, source))
+            d.log(l);
+    if (input.markdown) {
+        const md = join(entry.root, RESULTS_DIR, `${entry.id}.recommend.md`);
+        writeFileSync(md, renderMarkdown(entry.result, groups, source), { mode: 0o600 });
+        say(`Wrote ${md}`);
+    }
+    return 0;
+}
+//# sourceMappingURL=recommend.js.map

package/dist/src/aws/recommend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommend.js","sourceRoot":"","sources":["../../../src/aws/recommend.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAA+B,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAsC,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAe,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAwC,MAAM,gBAAgB,CAAC;AAE7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,mHAAmH,CAAC;AACpJ,MAAM,WAAW,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAoC9E,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAgB,EAAU,EAAE,CACtD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC;AAEpG,MAAM,MAAM,GAAG,oFAAoF,CAAC;AACpG,MAAM,CAAC,MAAM,cAAc,GAAG,4LAA4L,CAAC;AAE3N,oHAAoH;AACpH,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,aAAa;QAAE,OAAO,gBAAgB,CAAC;IAC9C,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IAClD,IAAI,CAAC,EAAE,YAAY;QAAE,OAAO,cAAc,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAID,+DAA+D;AAC/D,MAAM,UAAU,IAAI,CAAC,CAAW,EAAE,CAAW;IAC3C,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1I,CAAC;AAED,MAAM,MAAM,GAAG,CAAI,EAAO,EAAO,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAErD,mHAAmH;AACnH,MAAM,CAAC,MAAM,WAAW,GAA2B,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;AAC/F,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AAEvD,yFAAyF;AACzF,SAAS,KAAK,CAAC,KAAgB,EAAE,CAAgB;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;QAC5C,yGAAyG;QACzG,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAc,EAAE,CAAC,CAAC;aACrK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,0FAA0F;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjI,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO;YACL,IAAI,EAAE,KAAc,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM;YAC1F,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM;YAC9G,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI;SACpE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,CAAU,EAAE,OAA4B,EAAE,CAAgB;IAC5E,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1C,IAAI,IAAI,GAAG,0EAA0E,CAAC;IACtF,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;QAAC,KAAK,GAAG,CAAE,CAAC,KAAK,CAAC;QAAC,IAAI,GAAG,CAAE,CAAC,aAAc,CAAC;IAAC,CAAC;SAC1E,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;QAAC,KAAK,GAAG,iCAAiC,CAAC;QAAC,IAAI,GAAG,cAAc,CAAC;IAAC,CAAC;SAC3G,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QACnC,KAAK,GAAG,+BAA+B,CAAC,CAAC,KAAK,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,CAAC,oEAAoE,CAAC;IAC/K,CAAC;SAAM,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAE,CAAC,YAAa,CAAC,CAAC;QACxC,KAAK,GAAG,8BAA8B,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,IAAI,GAAG,GAAG,MAAM,CAAC,CAAE,CAAC,YAAa,CAAC,EAAE,KAAK,IAAI,OAAO,CAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC;IAC7I,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO;QAC3F,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,+CAA+C;QACrH,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,IAAI;KAC3D,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,WAAW,CAAC,KAAuB;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;;YACnC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;YAAE,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrK,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,IAAmB,EAAE;IAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAU,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;SACnF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAoB,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE;KAC7F,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,OAAsB,EAAE,OAAgB,EAAE,MAAe;IACnF,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;SAC/K,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACvF,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAc,EAAE,EAAE;IAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAU,CAAC;IACvB,OAAO,WAAW,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC,CAAC;AAEF,4EAA4E;AAC5E,SAAS,KAAK,CAAC,CAAiB;IAC9B,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,UAAU,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEvK,MAAM,UAAU,UAAU,CAAC,CAAc,EAAE,MAAuB,EAAE,MAAc;IAChF,MAAM,GAAG,GAAG,CAAC,2BAA2B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC,UAAU,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9G,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,GAAG,EAAE,qCAAqC,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,aAAa,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/H,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAc,EAAE,MAAuB,EAAE,MAAc;IACpF,MAAM,GAAG,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,OAAO,MAAM,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,UAAU,KAAK,MAAM,qEAAqE,EAAE,EAAE,CAAC,CAAC;IACjM,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;YAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,YAAY,CAAC,KAAuB,EAAE,CAAe;IACnE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6FAA6F,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACtI,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,wDAAwD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACnJ,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;IACzD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC7C,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,IAAI,OAAO,CAAC;QAClD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAA4C,CAAC;IACrK,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjH,GAAG,CAAC,sBAAsB,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,wEAAwE,CAAC,CAAC;QAChI,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,SAAU,CAAC;IAClC,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,OAAO;QAAE,GAAG,CAAC,4BAA4B,KAAK,CAAC,MAAM,CAAC,SAAU,CAAC,OAAO,8CAA8C,CAAC,CAAC;IAC7H,IAAI,KAAK,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,SAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,SAAU,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;QACvN,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,EAAE,eAAe,CAAC,CAAC;QACrE,aAAa,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/aws/run-check.d.ts

@@ -0,0 +1,31 @@
+import type { RunResult } from '../utils/exec.js';
+import { type PrismResult } from '../codewatch/results.js';
+import { type SecurityOptions } from '../security/setup.js';
+export declare const CHECK_NOTICE = "Read-only (aws check): every AWS call is a describe, get or list; nothing in AWS is changed. The result is saved to .prism/results/.";
+export interface CheckOptions extends Pick<SecurityOptions, 'profile' | 'region' | 'profileSource' | 'connection'> {
+    section?: string[];
+    failOn?: string;
+    json?: boolean;
+    /** false: save the result but print no report (aws recommend --refresh --json). */
+    report?: boolean;
+}
+export interface CheckRunDeps {
+    env: NodeJS.ProcessEnv;
+    home: string;
+    cwd(): string;
+    configRegion(profile?: string): string | null;
+    awsVersion(): string | null;
+    git(args: string[]): RunResult;
+    log(line?: string): void;
+    err(line?: string): void;
+    now(): Date;
+}
+export interface CheckOutcome {
+    code: number;
+    result?: PrismResult;
+    path?: string;
+}
+/** Where results go: the repo of the working directory, else ~ (so ~/.prism/results/). */
+export declare function resultsRoot(d: Pick<CheckRunDeps, 'cwd' | 'git' | 'home'>): string;
+export declare function awsCheck(input: CheckOptions, d: CheckRunDeps): CheckOutcome;
+//# sourceMappingURL=run-check.d.ts.map

package/dist/src/aws/run-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-check.d.ts","sourceRoot":"","sources":["../../../src/aws/run-check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACvG,OAAO,EAAkE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI5H,eAAO,MAAM,YAAY,yIAAyI,CAAC;AAEnK,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,eAAe,GAAG,YAAY,CAAC;IAChH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,IAAI,MAAM,CAAC;IACd,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,UAAU,IAAI,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,IAAI,IAAI,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AAEnF,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,CAEjF;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CA+D3E"}

package/dist/src/aws/run-check.js

@@ -0,0 +1,91 @@
+/**
+ * Runs `prism-cli aws check`: resolve the target, print the identity header,
+ * run the selected sections, save the result (kind aws-check) and print the
+ * report. Synchronous on purpose: every AWS call is a blocking CLI read, and
+ * the tests drive it through the fake `aws` binary.
+ */
+import { aws } from '../utils/aws.js';
+import { parseFailOn, renderReport } from '../utils/audit.js';
+import { makeResult, writeResult } from '../codewatch/results.js';
+import { NO_REGION_MESSAGE, printIdentity, resolveRegion } from '../security/setup.js';
+import { repoRootOf } from './connection.js';
+import { breaching, countFindings, failBySeverity, securityContext, selectSections } from './check.js';
+export const CHECK_NOTICE = 'Read-only (aws check): every AWS call is a describe, get or list; nothing in AWS is changed. The result is saved to .prism/results/.';
+/** Where results go: the repo of the working directory, else ~ (so ~/.prism/results/). */
+export function resultsRoot(d) {
+    return repoRootOf(d.cwd(), d.git) ?? d.home;
+}
+export function awsCheck(input, d) {
+    const say = input.json ? d.err : d.log;
+    say(CHECK_NOTICE);
+    say('');
+    let failOn;
+    try {
+        failOn = parseFailOn(input.failOn);
+    }
+    catch (e) {
+        say(`Error: ${e.message}`);
+        return { code: 1 };
+    }
+    const sections = selectSections(input.section);
+    if ('error' in sections) {
+        say(`Error: ${sections.error}`);
+        return { code: 1 };
+    }
+    const r = resolveRegion(input, d);
+    if (!r) {
+        say(`Error: ${NO_REGION_MESSAGE} Or save one with prism-cli aws connect.`);
+        return { code: 1 };
+    }
+    const region = r.region;
+    // The region is pinned in the child env too, so global-endpoint calls (IAM, budgets) never depend on profile config.
+    const target = { profile: input.profile, env: { AWS_PAGER: '', AWS_REGION: region, AWS_DEFAULT_REGION: region } };
+    const who = aws(['sts', 'get-caller-identity'], target);
+    const account = who.ok ? String(who.json?.Account || '') : '';
+    if (!account) {
+        const why = who.errorCode || who.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'no account in the response';
+        say(`Error: cannot resolve the AWS identity: ${why}. Sign in (e.g. aws sso login), pass --profile, or run prism-cli aws connect.`);
+        return { code: 1 };
+    }
+    const a = aws(['iam', 'list-account-aliases'], target);
+    const alias = a.ok && a.json?.AccountAliases?.[0] ? String(a.json.AccountAliases[0]) : null;
+    const opts = { ...input, region, regionSource: r.source };
+    const security = securityContext(opts, (args, rg) => aws([...args, '--region', rg], target), d.env, d.awsVersion, say);
+    printIdentity(security, { account, arn: String(who.json?.Arn || ''), alias });
+    say('');
+    const started = d.now().toISOString();
+    const ctx = { target, account, region, home: d.home, security };
+    const findings = sections.flatMap((s) => s.run(ctx));
+    const info = {
+        account, alias, region, profile: input.profile ?? null, profile_source: input.profileSource ?? null,
+        sections: sections.map((s) => s.name),
+        section_counts: Object.fromEntries(sections.map((s) => [s.name, countFindings(findings.filter((f) => f.category === s.name))])),
+        counts: countFindings(findings),
+        fail_by_severity: failBySeverity(findings),
+        checks: findings,
+    };
+    const result = makeResult({
+        kind: 'aws-check', hook: 'manual', tool: 'prism-cli', started_at: started, finished_at: d.now().toISOString(),
+        status: info.counts.fail || info.counts.indeterminate ? 'findings' : 'ok',
+        summary: `${info.counts.pass} pass, ${info.counts.fail} fail, ${info.counts.indeterminate} indeterminate`,
+        aws_check: info,
+    });
+    const path = writeResult(resultsRoot(d), result);
+    if (input.report !== false)
+        renderReport(findings, {
+            title: '☁️  AWS account check',
+            subtitle: `Account: ${account}${alias ? ` (${alias})` : ''}    Region: ${region}`,
+            groups: sections.map((s) => [s.name, s.heading]),
+            json: !!input.json,
+            jsonContext: { account, alias, region, sections: info.sections, section_counts: info.section_counts, result_path: path },
+        });
+    say(`Saved ${path}`);
+    say('Next: prism-cli aws recommend (turns these results into a ranked fix list; no AWS calls).');
+    const breach = breaching(findings, failOn);
+    if (breach.length) {
+        d.err(`❌ ${breach.length} finding(s) at or above ${failOn}: ${breach.map((f) => f.id).join(', ')}`);
+        return { code: 1, result, path };
+    }
+    return { code: 0, result, path };
+}
+//# sourceMappingURL=run-check.js.map

package/dist/src/aws/run-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-check.js","sourceRoot":"","sources":["../../../src/aws/run-check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,GAAG,EAAkB,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAuC,MAAM,yBAAyB,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAuC,MAAM,sBAAsB,CAAC;AAC5H,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAE1H,MAAM,CAAC,MAAM,YAAY,GAAG,sIAAsI,CAAC;AAwBnK,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,CAA6C;IACvE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAmB,EAAE,CAAe;IAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClB,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,UAAW,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,CAAC;IACpH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,CAAC;IACjF,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,UAAU,iBAAiB,0CAA0C,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,qHAAqH;IACrH,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAAC;IAE7H,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,4BAA4B,CAAC;QAC5H,GAAG,CAAC,2CAA2C,GAAG,+EAA+E,CAAC,CAAC;QACnI,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,IAAI,GAAa,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACvH,aAAa,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,GAAG,CAAC,EAAE,CAAC,CAAC;IAER,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,GAAG,GAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAc,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAiB;QACzB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QACnG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/H,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,QAAQ;KACjB,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC;QACxB,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC7G,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACzE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,aAAa,gBAAgB;QACzG,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEjD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,YAAY,CAAC,QAAQ,EAAE;YACjD,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,YAAY,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,MAAM,EAAE;YACjF,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE;SACzH,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACrB,GAAG,CAAC,2FAA2F,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,2BAA2B,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC"}

package/dist/src/codewatch/results.d.ts

@@ -1,3 +1,4 @@
+import type { Finding as AuditFinding, Severity as AuditSeverity } from '../utils/audit.js';
 export declare const RESULT_SCHEMA_VERSION = 1;
 export declare const RESULTS_DIR = ".prism/results";
 /** Pre-commit ran with no gitleaks on PATH: the commit was allowed but not secret-scanned. */
@@ -33,7 +34,35 @@ export interface Finding {
  * `security-threat-model` = an AWS Security Agent threat model job;
  * `security-pentest` = an AWS Security Agent penetration test job.
  */
-export type ResultKind = 'secrets' | 'review' | 'security-review' | 'security-threat-model' | 'security-pentest';
+export type ResultKind = 'secrets' | 'review' | 'security-review' | 'security-threat-model' | 'security-pentest' | 'aws-check';
+/**
+ * aws-check only: one `prism-cli aws check` run. The audit findings live in
+ * `checks` (their shape differs from a code finding); `findings` stays empty.
+ */
+export interface AwsCheckInfo {
+    account: string;
+    alias: string | null;
+    region: string;
+    profile: string | null;
+    /** Where the profile came from, e.g. "--profile" or "aws connect, user". */
+    profile_source: string | null;
+    /** The sections that ran, in order. */
+    sections: string[];
+    /** PASS / FAIL / INDETERMINATE counts per section. */
+    section_counts: Record<string, {
+        pass: number;
+        fail: number;
+        indeterminate: number;
+    }>;
+    counts: {
+        pass: number;
+        fail: number;
+        indeterminate: number;
+    };
+    /** FAIL findings per severity. */
+    fail_by_severity: Record<AuditSeverity, number>;
+    checks: AuditFinding[];
+}
 /** security-threat-model only: the job behind the result. */
 export interface ThreatModelInfo {
     job_id: string;
@@ -171,6 +200,8 @@ export interface PrismResult {
     threat_model?: ThreatModelInfo;
     /** Present on kind security-pentest. */
     pentest?: PentestInfo;
+    /** Present on kind aws-check. */
+    aws_check?: AwsCheckInfo;
 }
 export type ResultInit = Omit<PrismResult, 'schema_version' | 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'> & Partial<Pick<PrismResult, 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'>>;
 export declare function makeResult(init: ResultInit): PrismResult;

package/dist/src/codewatch/results.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AACjD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,2HAA2H;IAC3H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,uBAAuB,GAAG,kBAAkB,CAAC;AAEjH,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oHAAoH;IACpH,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,mHAAmH;IACnH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2HAA2H;IAC3H,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2GAA2G;IAC3G,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iGAAiG;IACjG,eAAe,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AACD,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAC;AACrE;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,wCAAwC;IACxC,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,GACtL,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC;AAE5J,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAgBxD;AAOD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAYjF;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAgBjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAE3D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI7E"}
+{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,IAAI,YAAY,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5F,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AACjD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,2HAA2H;IAC3H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,uBAAuB,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAE/H;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oHAAoH;IACpH,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,mHAAmH;IACnH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2HAA2H;IAC3H,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2GAA2G;IAC3G,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iGAAiG;IACjG,eAAe,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AACD,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAC;AACrE;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,wCAAwC;IACxC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iCAAiC;IACjC,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,GACtL,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC;AAE5J,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAgBxD;AAOD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAOrD;AAED;;;GAGG;AACH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAYjF;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAgBjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAE3D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI7E"}

package/dist/src/codewatch/results.js

@@ -47,6 +47,10 @@ export function compactTimestamp(iso) {
  * no commit yet (pre-commit).
  */
 export function resultFileName(r) {
+    // An account check is not tied to a commit: `aws-<account>-<region>-<time>-aws-check.json`.
+    if (r.kind === 'aws-check' && r.aws_check) {
+        return `aws-${safePart(r.aws_check.account)}-${safePart(r.aws_check.region)}-${compactTimestamp(r.started_at)}-${safePart(r.kind)}.json`;
+    }
     const id = r.commit ? safePart(r.commit.slice(0, 12)) : r.tree ? `tree-${safePart(r.tree.slice(0, 12))}` : 'nocommit';
     return `${id}-${compactTimestamp(r.started_at)}-${safePart(r.hook)}-${safePart(r.kind)}.json`;
 }

package/dist/src/codewatch/results.js.map

@@ -1 +1 @@
-{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAmL1D,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO;QACL,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAc;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACtH,OAAO,GAAG,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,aAAa,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,2CAA2C,WAAW,KAAK,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,CAAc,EAAE,EAAW;IACvE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACvF,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,qBAAqB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,CAAC,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAGvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AA0M1D,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO;QACL,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAc;IAC3C,4FAA4F;IAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3I,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACtH,OAAO,GAAG,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,aAAa,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,2CAA2C,WAAW,KAAK,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,CAAc,EAAE,EAAW;IACvE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACvF,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,qBAAqB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,CAAC,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/commands/aws/check.d.ts

@@ -0,0 +1,25 @@
+import { type CheckOptions, type CheckRunDeps } from '../../aws/run-check.js';
+import { type RunHooks } from '../enable/security.js';
+export declare function checkDeps(): CheckRunDeps;
+/** --profile and --region, shared by aws check and aws recommend. */
+export declare const AWS_TARGET_OPTIONS: {
+    flags: string;
+    description: string;
+}[];
+export interface CheckHooks extends RunHooks {
+    checkDeps?: () => CheckRunDeps;
+}
+declare const _default: {
+    description: string;
+    options: ({
+        flags: string;
+        description: string;
+    } | {
+        flags: string;
+        description: string;
+        parser: (v: string, prev?: string[]) => string[];
+    })[];
+    action(opts: CheckOptions, hooks?: CheckHooks): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=check.d.ts.map

package/dist/src/commands/aws/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/commands/aws/check.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE,wBAAgB,SAAS,IAAI,YAAY,CAYxC;AAID,qEAAqE;AACrE,eAAO,MAAM,kBAAkB;;;GAG9B,CAAC;AAEF,MAAM,WAAW,UAAW,SAAQ,QAAQ;IAAG,SAAS,CAAC,EAAE,MAAM,YAAY,CAAA;CAAE;;;;;;;;;oBAR3D,MAAM,SAAQ,MAAM,EAAE;;iBAkBrB,YAAY,UAAS,UAAU;;AARpD,wBAcE"}

package/dist/src/commands/aws/check.js

@@ -0,0 +1,42 @@
+import { homedir } from 'node:os';
+import { run } from '../../utils/exec.js';
+import { FAIL_ON_OPTION, JSON_OPTION } from '../../utils/audit.js';
+import { configuredRegion, connectionDefaults } from '../../aws/connection.js';
+import { SECTIONS } from '../../aws/check.js';
+import { awsCheck } from '../../aws/run-check.js';
+import { runGuarded } from '../enable/security.js';
+export function checkDeps() {
+    return {
+        env: process.env,
+        home: homedir(),
+        cwd: () => process.cwd(),
+        configRegion: configuredRegion,
+        awsVersion: () => { const r = run('aws', ['--version']); return r.ok ? r.stdout : null; },
+        git: (args) => run('git', args),
+        log: (line = '') => console.log(line),
+        err: (line = '') => console.error(line),
+        now: () => new Date(),
+    };
+}
+const collect = (v, prev = []) => [...prev, v];
+/** --profile and --region, shared by aws check and aws recommend. */
+export const AWS_TARGET_OPTIONS = [
+    { flags: '--profile <name>', description: 'AWS CLI profile (default: AWS_PROFILE or env credentials, else the one saved by prism-cli aws connect, else the default chain)' },
+    { flags: '--region <region>', description: 'AWS region (default: AWS_REGION, AWS_DEFAULT_REGION, the aws connect region, else the profile\'s region; refuses when none is set)' },
+];
+export default {
+    description: 'Read-only AWS account checks: Bedrock protection, PRISM setup, account baseline (results saved for aws recommend and the dashboard)',
+    options: [
+        ...AWS_TARGET_OPTIONS,
+        { flags: '--section <name>', description: `Run only this section, repeatable: ${SECTIONS.map((s) => s.name).join(', ')} (default: all)`, parser: collect },
+        { ...FAIL_ON_OPTION, description: 'Exit 1 if any FAIL is at or above this severity (CRITICAL|HIGH|MEDIUM|LOW|none; default none: report only)' },
+        JSON_OPTION,
+    ],
+    async action(opts, hooks = {}) {
+        await runGuarded(async () => {
+            const o = connectionDefaults({ ...opts, profile: opts.profile || undefined, region: opts.region || undefined }, hooks.env);
+            return awsCheck(o, (hooks.checkDeps ?? checkDeps)()).code;
+        }, hooks);
+    },
+};
+//# sourceMappingURL=check.js.map

package/dist/src/commands/aws/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../../src/commands/aws/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAwC,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAElE,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,OAAO,EAAE;QACf,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QACxB,YAAY,EAAE,gBAAgB;QAC9B,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAC/B,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,OAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAEjE,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,gIAAgI,EAAE;IAC5K,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,oIAAoI,EAAE;CAClL,CAAC;AAIF,eAAe;IACb,WAAW,EAAE,qIAAqI;IAClJ,OAAO,EAAE;QACP,GAAG,kBAAkB;QACrB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,sCAAsC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE;QAC1J,EAAE,GAAG,cAAc,EAAE,WAAW,EAAE,4GAA4G,EAAE;QAChJ,WAAW;KACZ;IACD,KAAK,CAAC,MAAM,CAAC,IAAkB,EAAE,QAAoB,EAAE;QACrD,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3H,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}