@actsecurity/iam-lens 0.1.156

package/dist/cjs/simulate/simulate.js

@@ -0,0 +1,296 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.simulateRequest = simulateRequest;
+exports.resultMatchesExpectation = resultMatchesExpectation;
+const iam_data_1 = require("@actsecurity/iam-data");
+const iam_simulate_1 = require("@actsecurity/iam-simulate");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const principals_js_1 = require("../principals.js");
+const resources_js_1 = require("../resources.js");
+const sts_js_1 = require("../utils/sts.js");
+const contextKeys_js_1 = require("./contextKeys.js");
+/**
+ * Simulate an IAM request against the collected IAM data.
+ *
+ * @param simulationRequest the simulation request details.
+ * @param collectClient the IAM collect client to use for data access.
+ * @returns the simulation result, including the request and the evaluation result.
+ */
+async function simulateRequest(simulationRequest, collectClient) {
+    const actionParts = simulationRequest.action.split(':');
+    const service = actionParts[0];
+    const serviceAction = actionParts[1];
+    const serviceExists = await (0, iam_data_1.iamServiceExists)(service);
+    const actionExists = serviceExists && (await (0, iam_data_1.iamActionExists)(service, serviceAction));
+    if (!serviceExists || !actionExists) {
+        throw new Error(`Unable to find action details for ${simulationRequest.action}`);
+    }
+    const actionDetails = await (0, iam_data_1.iamActionDetails)(service, serviceAction);
+    // If it is a wildcard action, the resource account is always the principal account
+    if (actionDetails.isWildcardOnly) {
+        simulationRequest.resourceAccount = (0, iam_utils_1.splitArnParts)(simulationRequest.principal).accountId;
+    }
+    if (!simulationRequest.resourceAccount && !simulationRequest.resourceArn) {
+        throw new Error('Non wildcard actions require a resource ARN or resource account to be specified.');
+    }
+    simulationRequest.resourceAccount =
+        simulationRequest.resourceAccount ||
+            (await (0, resources_js_1.getAccountIdForResource)(collectClient, simulationRequest.resourceArn));
+    if (!simulationRequest.resourceAccount) {
+        throw new Error(`Unable to find account ID for resource ${simulationRequest.resourceArn}`);
+    }
+    const principalFound = await (0, principals_js_1.principalExists)(simulationRequest.principal, collectClient);
+    if (!principalFound && !simulationRequest.ignoreMissingPrincipal) {
+        throw new Error(`Principal ${simulationRequest.principal} does not exist. Use --ignore-missing-principal to ignore this.`);
+    }
+    const request = {
+        action: simulationRequest.action,
+        resource: {
+            resource: simulationRequest.resourceArn || '*',
+            accountId: simulationRequest.resourceAccount
+        },
+        principal: simulationRequest.principal,
+        contextVariables: {}
+    };
+    //Lookup the principal policies
+    const principalPolicies = await (0, principals_js_1.getAllPoliciesForPrincipal)(collectClient, simulationRequest.principal);
+    const { resourcePolicy, resourceRcps } = await getResourcePolicies(collectClient, simulationRequest.resourceArn, simulationRequest.resourceAccount);
+    const useResourcePolicy = simulationRequest.resourceArn &&
+        !((0, iam_utils_1.isIamRoleArn)(simulationRequest.resourceArn) && service.toLowerCase() === 'iam');
+    if (sts_js_1.AssumeRoleActions.has(simulationRequest.action.toLowerCase()) && !resourcePolicy) {
+        throw new Error(`Trust policy not found for resource ${simulationRequest.resourceArn}. sts assume role actions require a trust policy.`);
+    }
+    const principalArnForContext = await resolvePrincipalArnForContext(collectClient, simulationRequest.principal);
+    const { contextKeys, resourceTagsAreKnown } = await (0, contextKeys_js_1.createContextKeys)(collectClient, simulationRequest, service, simulationRequest.customContextKeys, principalArnForContext);
+    const vpcEndpointId = (0, contextKeys_js_1.contextValue)(contextKeys, contextKeys_js_1.CONTEXT_KEYS.vpcEndpointId);
+    let vpcEndpointPolicy = undefined;
+    if (vpcEndpointId && typeof vpcEndpointId === 'string') {
+        const vpcEndpointArn = await collectClient.getVpcEndpointArnForVpcEndpointId(vpcEndpointId);
+        if (vpcEndpointArn) {
+            const vpcPolicy = await collectClient.getVpcEndpointPolicyForArn(vpcEndpointArn);
+            if (vpcPolicy) {
+                vpcEndpointPolicy = { name: vpcEndpointArn, policy: vpcPolicy };
+            }
+        }
+    }
+    const applicableScps = (0, principals_js_1.isServiceLinkedRole)(simulationRequest.principal)
+        ? []
+        : principalPolicies.scps;
+    request.contextVariables = contextKeys;
+    const simulation = {
+        request,
+        sessionPolicy: simulationRequest.sessionPolicy,
+        identityPolicies: prepareIdentityPolicies(simulationRequest.principal, principalPolicies),
+        serviceControlPolicies: applicableScps,
+        resourceControlPolicies: rcpsForRequest(simulationRequest.principal, actionDetails.isWildcardOnly, resourceRcps, principalPolicies.rcps),
+        resourcePolicy: useResourcePolicy ? resourcePolicy : undefined,
+        permissionBoundaryPolicies: preparePermissionBoundary(principalPolicies),
+        vpcEndpointPolicies: vpcEndpointPolicy ? [vpcEndpointPolicy] : undefined
+    };
+    const s3BucketOrObjectRequest = simulationRequest.resourceArn && (0, iam_utils_1.isS3BucketOrObjectArn)(simulationRequest.resourceArn);
+    if (s3BucketOrObjectRequest) {
+        const [bucketAbacEnabled, blockPublicAccess] = await Promise.all([
+            evaluateAbacForBucket(simulationRequest.s3AbacOverride, collectClient, simulationRequest.resourceAccount, simulationRequest.resourceArn),
+            collectClient.getBlockPublicAccessEnabledForBucket(simulationRequest.resourceAccount, simulationRequest.resourceArn)
+        ]);
+        simulation.additionalSettings = {
+            s3: {
+                bucketAbacEnabled,
+                blockPublicAccess
+            }
+        };
+    }
+    // Assemble the strict context keys for the simulation
+    // Start with the default known context keys
+    const strictContextKeys = [
+        ...contextKeys_js_1.knownContextKeys,
+        ...(simulationRequest.additionalStrictContextKeys ?? [])
+    ];
+    if (!(0, iam_utils_1.isIamRoleArn)(simulationRequest.principal)) {
+        strictContextKeys.push(contextKeys_js_1.CONTEXT_KEYS.userId);
+    }
+    if (!simulationRequest.principal.endsWith(':root')) {
+        // Treat this as strict unless it is a root principal
+        strictContextKeys.push(contextKeys_js_1.CONTEXT_KEYS.assumedRoot);
+    }
+    // S3 Access Points are Not Supported Right Now, Don't Add Noise
+    if (simulationRequest.action.startsWith('s3:')) {
+        strictContextKeys.push('s3:DataAccessPointAccount');
+        strictContextKeys.push('s3:DataAccessPointArn');
+    }
+    // Add the custom context keys from the simulation request
+    for (const key of Object.keys(simulationRequest.customContextKeys)) {
+        strictContextKeys.push(key);
+    }
+    //If we know the tag keys, just make all tag keys strict
+    if (resourceTagsAreKnown) {
+        strictContextKeys.push('/^aws:ResourceTag\/.*/');
+        if (s3BucketOrObjectRequest) {
+            strictContextKeys.push('/^s3:BucketTag\/.*/');
+        }
+    }
+    // There also may be other tag context keys, so add those too
+    for (const key of Object.keys(contextKeys)) {
+        if (key.toLowerCase().includes('tag/')) {
+            strictContextKeys.push(key);
+        }
+    }
+    const discoveryContextKeyConstraints = strictContextKeys.map(discoveryConstraintForStrictKey);
+    const result = await (0, iam_simulate_1.runSimulation)(simulation, {
+        simulationMode: simulationRequest.simulationMode,
+        discoveryContextKeyConstraints
+    });
+    return { request, result };
+}
+const awsSourceKeyPrefix = 'aws:source';
+/**
+ * Converts an iam-lens strict context key into an iam-simulate Discovery constraint.
+ *
+ * Most strict keys should preserve the old behavior where both presence and
+ * value are authoritative. Service source context keys are different during
+ * who-can discovery: iam-lens supplies resource-derived placeholder values, but
+ * the actual source account/org for a service principal request may differ.
+ * Treating those values as unknown lets who-can return conditional access
+ * instead of incorrectly denying service-principal statements.
+ *
+ * @param keyName the literal context key or slash-delimited key pattern
+ * @returns the Discovery constraint to pass to iam-simulate
+ */
+function discoveryConstraintForStrictKey(keyName) {
+    if (keyName.slice(0, 10).localeCompare(awsSourceKeyPrefix, undefined, { sensitivity: 'base' }) === 0) {
+        return {
+            keyName,
+            presenceIsKnown: true,
+            valueIsKnown: false
+        };
+    }
+    return {
+        keyName,
+        presenceIsKnown: true,
+        valueIsKnown: true
+    };
+}
+async function getResourcePolicies(collectClient, resourceArn, resourceAccount) {
+    if (!resourceArn) {
+        return { resourcePolicy: undefined, resourceRcps: [] };
+    }
+    const resourcePolicy = await (0, resources_js_1.getResourcePolicyForResource)(collectClient, resourceArn, resourceAccount);
+    const resourceRcps = await (0, resources_js_1.getRcpsForResource)(collectClient, resourceArn, resourceAccount);
+    return { resourcePolicy, resourceRcps };
+}
+function rcpsForRequest(principalArn, actionIsWildcard, resourceRcps, principalRcps) {
+    if ((0, principals_js_1.isServiceLinkedRole)(principalArn)) {
+        return [];
+    }
+    let theRcps = resourceRcps;
+    if (actionIsWildcard) {
+        theRcps = principalRcps;
+    }
+    return theRcps.map((rcp) => {
+        rcp.orgIdentifier;
+        return {
+            orgIdentifier: rcp.orgIdentifier,
+            policies: rcp.policies.filter((policy) => {
+                return !policy.name.toLowerCase().endsWith('rcpfullawsaccess');
+            })
+        };
+    });
+}
+/**
+ * Resolves the principal ARN to use for role-backed context keys.
+ *
+ * Direct simulations can use STS assumed-role session ARNs, but collected tags
+ * and the canonical `aws:PrincipalArn` value belong to the underlying IAM role.
+ * This function performs the collected-data lookup only after the principal ARN
+ * passes the cheap assumed-role ARN check, avoiding unnecessary storage lookups
+ * for users, role ARNs, root principals, and service principals.
+ *
+ * @param collectClient the IAM collect client to use for resolving role ARNs
+ * @param principalArn the simulation principal ARN or service principal
+ * @returns the canonical role ARN for assumed-role sessions, otherwise undefined
+ */
+async function resolvePrincipalArnForContext(collectClient, principalArn) {
+    if (!(0, iam_utils_1.isAssumedRoleArn)(principalArn)) {
+        return undefined;
+    }
+    return ((await collectClient.resolvePrincipalArn(principalArn)) ??
+        (0, iam_utils_1.convertAssumedRoleArnToRoleArn)(principalArn));
+}
+function prepareIdentityPolicies(principalArn, principalPolicies) {
+    //Collect unique managed policies
+    const uniqueIdentityPolicies = {};
+    principalPolicies.managedPolicies.forEach((policy) => {
+        if (!uniqueIdentityPolicies[policy.arn]) {
+            uniqueIdentityPolicies[policy.arn] = {
+                name: policy.arn,
+                policy: policy.policy
+            };
+        }
+    });
+    principalPolicies.groupPolicies?.forEach((groupPolicy) => {
+        groupPolicy.managedPolicies.forEach((policy) => {
+            if (!uniqueIdentityPolicies[policy.arn]) {
+                uniqueIdentityPolicies[policy.arn] = {
+                    name: policy.arn,
+                    policy: policy.policy
+                };
+            }
+        });
+    });
+    const identityPolicies = Object.values(uniqueIdentityPolicies);
+    principalPolicies.inlinePolicies.forEach((policy) => {
+        identityPolicies.push({
+            name: `${principalArn}#${policy.name}`,
+            policy: policy.policy
+        });
+    });
+    principalPolicies.groupPolicies?.forEach((groupPolicy) => {
+        groupPolicy.inlinePolicies.forEach((policy) => {
+            identityPolicies.push({
+                name: `${groupPolicy.group}#${policy.name}`,
+                policy: policy.policy
+            });
+        });
+    });
+    return identityPolicies;
+}
+function preparePermissionBoundary(principalPolicies) {
+    if (principalPolicies.permissionBoundary) {
+        return [
+            {
+                name: principalPolicies.permissionBoundary.arn,
+                policy: principalPolicies.permissionBoundary.policy
+            }
+        ];
+    }
+    return undefined;
+}
+function resultMatchesExpectation(expected, result) {
+    if (!expected) {
+        return true;
+    }
+    if (expected === 'AnyDeny') {
+        return result.includes('Denied');
+    }
+    return expected === result;
+}
+/**
+ * Evaluates whether ABAC (Attribute-Based Access Control) is enabled for a given S3 bucket or object.
+ * The evaluation can be overridden by the `s3AbacOverride` parameter.
+ *
+ * @param s3AbacOverride the override setting for S3 ABAC or undefined to auto-detect
+ * @param collectClient the IAM collect client to use for data access
+ * @param bucketAccountId the account ID the bucket belongs to
+ * @param bucketOrObjectArn the ARN of the bucket or bucket object
+ * @returns whether ABAC should be used to evaluate access for the bucket or object
+ */
+async function evaluateAbacForBucket(s3AbacOverride, collectClient, bucketAccountId, bucketOrObjectArn) {
+    if (s3AbacOverride === 'enabled') {
+        return true;
+    }
+    if (s3AbacOverride === 'disabled') {
+        return false;
+    }
+    return collectClient.getAbacEnabledForBucket(bucketAccountId, bucketOrObjectArn);
+}
+//# sourceMappingURL=simulate.js.map

package/dist/cjs/simulate/simulate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulate.js","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":";;AAqHA,0CA+LC;AA2KD,4DAWC;AA1eD,oDAA2F;AAE3F,4DAOkC;AAClC,sDAM+B;AAE/B,oDAKyB;AACzB,kDAIwB;AAExB,4CAAmD;AACnD,qDAMyB;AAyEzB;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,iBAAoC,EACpC,aAA+B;IAE/B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACpC,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAA;IACrD,MAAM,YAAY,GAAG,aAAa,IAAI,CAAC,MAAM,IAAA,0BAAe,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAA;IACrF,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAEpE,mFAAmF;IACnF,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;QACjC,iBAAiB,CAAC,eAAe,GAAG,IAAA,yBAAa,EAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,SAAU,CAAA;IAC3F,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,eAAe,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAA;IACH,CAAC;IACD,iBAAiB,CAAC,eAAe;QAC/B,iBAAiB,CAAC,eAAe;YACjC,CAAC,MAAM,IAAA,sCAAuB,EAAC,aAAa,EAAE,iBAAiB,CAAC,WAAY,CAAC,CAAC,CAAA;IAEhF,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0CAA0C,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5F,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAe,EAAC,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IACxF,IAAI,CAAC,cAAc,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,aAAa,iBAAiB,CAAC,SAAS,iEAAiE,CAC1G,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAA0B;QACrC,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,QAAQ,EAAE;YACR,QAAQ,EAAE,iBAAiB,CAAC,WAAW,IAAI,GAAG;YAC9C,SAAS,EAAE,iBAAiB,CAAC,eAAe;SAC7C;QACD,SAAS,EAAE,iBAAiB,CAAC,SAAS;QACtC,gBAAgB,EAAE,EAAE;KACrB,CAAA;IAED,+BAA+B;IAC/B,MAAM,iBAAiB,GAAG,MAAM,IAAA,0CAA0B,EACxD,aAAa,EACb,iBAAiB,CAAC,SAAS,CAC5B,CAAA;IAED,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,MAAM,mBAAmB,CAChE,aAAa,EACb,iBAAiB,CAAC,WAAW,EAC7B,iBAAiB,CAAC,eAAe,CAClC,CAAA;IAED,MAAM,iBAAiB,GACrB,iBAAiB,CAAC,WAAW;QAC7B,CAAC,CAAC,IAAA,wBAAY,EAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAA;IAEnF,IAAI,0BAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,uCAAuC,iBAAiB,CAAC,WAAW,mDAAmD,CACxH,CAAA;IACH,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,6BAA6B,CAChE,aAAa,EACb,iBAAiB,CAAC,SAAS,CAC5B,CAAA;IAED,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,MAAM,IAAA,kCAAiB,EACnE,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,iBAAiB,CAAC,iBAAiB,EACnC,sBAAsB,CACvB,CAAA;IAED,MAAM,aAAa,GAAG,IAAA,6BAAY,EAAC,WAAW,EAAE,6BAAY,CAAC,aAAa,CAAC,CAAA;IAC3E,IAAI,iBAAiB,GAA8C,SAAS,CAAA;IAC5E,IAAI,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,iCAAiC,CAAC,aAAa,CAAC,CAAA;QAC3F,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAA;YAChF,IAAI,SAAS,EAAE,CAAC;gBACd,iBAAiB,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,mCAAmB,EAAC,iBAAiB,CAAC,SAAS,CAAC;QACrE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAA;IAE1B,OAAO,CAAC,gBAAgB,GAAG,WAAW,CAAA;IAEtC,MAAM,UAAU,GAAe;QAC7B,OAAO;QACP,aAAa,EAAE,iBAAiB,CAAC,aAAa;QAC9C,gBAAgB,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACzF,sBAAsB,EAAE,cAAc;QACtC,uBAAuB,EAAE,cAAc,CACrC,iBAAiB,CAAC,SAAS,EAC3B,aAAa,CAAC,cAAc,EAC5B,YAAY,EACZ,iBAAiB,CAAC,IAAI,CACvB;QACD,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAC9D,0BAA0B,EAAE,yBAAyB,CAAC,iBAAiB,CAAC;QACxE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;KACzE,CAAA;IAED,MAAM,uBAAuB,GAC3B,iBAAiB,CAAC,WAAW,IAAI,IAAA,iCAAqB,EAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACvF,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,qBAAqB,CACnB,iBAAiB,CAAC,cAAc,EAChC,aAAa,EACb,iBAAiB,CAAC,eAAgB,EAClC,iBAAiB,CAAC,WAAY,CAC/B;YACD,aAAa,CAAC,oCAAoC,CAChD,iBAAiB,CAAC,eAAgB,EAClC,iBAAiB,CAAC,WAAY,CAC/B;SACF,CAAC,CAAA;QACF,UAAU,CAAC,kBAAkB,GAAG;YAC9B,EAAE,EAAE;gBACF,iBAAiB;gBACjB,iBAAiB;aAClB;SACF,CAAA;IACH,CAAC;IAED,sDAAsD;IACtD,4CAA4C;IAC5C,MAAM,iBAAiB,GAAG;QACxB,GAAG,iCAAgB;QACnB,GAAG,CAAC,iBAAiB,CAAC,2BAA2B,IAAI,EAAE,CAAC;KACzD,CAAA;IAED,IAAI,CAAC,IAAA,wBAAY,EAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,iBAAiB,CAAC,IAAI,CAAC,6BAAY,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,qDAAqD;QACrD,iBAAiB,CAAC,IAAI,CAAC,6BAAY,CAAC,WAAW,CAAC,CAAA;IAClD,CAAC;IAED,gEAAgE;IAChE,IAAI,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,iBAAiB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACnD,iBAAiB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACjD,CAAC;IAED,0DAA0D;IAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IAED,wDAAwD;IACxD,IAAI,oBAAoB,EAAE,CAAC;QACzB,iBAAiB,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAChD,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,8BAA8B,GAAG,iBAAiB,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;IAE7F,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAa,EAAC,UAAU,EAAE;QAC7C,cAAc,EAAE,iBAAiB,CAAC,cAAc;QAChD,8BAA8B;KAC/B,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAEvC;;;;;;;;;;;;GAYG;AACH,SAAS,+BAA+B,CAAC,OAAe;IACtD,IACE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,kBAAkB,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAChG,CAAC;QACD,OAAO;YACL,OAAO;YACP,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,KAAK;SACpB,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,IAAI;KACnB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,aAA+B,EAC/B,WAA+B,EAC/B,eAAmC;IAKnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAA,2CAA4B,EACvD,aAAa,EACb,WAAW,EACX,eAAe,CAChB,CAAA;IACD,MAAM,YAAY,GAAG,MAAM,IAAA,iCAAkB,EAAC,aAAa,EAAE,WAAW,EAAE,eAAe,CAAC,CAAA;IAE1F,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAA;AACzC,CAAC;AAED,SAAS,cAAc,CACrB,YAAoB,EACpB,gBAAyB,EACzB,YAAqC,EACrC,aAAsC;IAEtC,IAAI,IAAA,mCAAmB,EAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,OAAO,GAAG,YAAY,CAAA;IAE1B,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,GAAG,aAAa,CAAA;IACzB,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,aAAa,CAAA;QACjB,OAAO;YACL,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACvC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;YAChE,CAAC,CAAC;SACH,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,6BAA6B,CAC1C,aAA+B,EAC/B,YAAoB;IAEpB,IAAI,CAAC,IAAA,4BAAgB,EAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,CACL,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACvD,IAAA,0CAA8B,EAAC,YAAY,CAAC,CAC7C,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,YAAoB,EACpB,iBAAoC;IAEpC,iCAAiC;IACjC,MAAM,sBAAsB,GAAkD,EAAE,CAAA;IAChF,iBAAiB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACnD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;gBACnC,IAAI,EAAE,MAAM,CAAC,GAAG;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACvD,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7C,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;oBACnC,IAAI,EAAE,MAAM,CAAC,GAAG;oBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;IAE9D,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAClD,gBAAgB,CAAC,IAAI,CAAC;YACpB,IAAI,EAAE,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,EAAE;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACvD,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC5C,gBAAgB,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;gBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,SAAS,yBAAyB,CAChC,iBAAoC;IAEpC,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;QACzC,OAAO;YACL;gBACE,IAAI,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,GAAG;gBAC9C,MAAM,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,MAAM;aACpD;SACF,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAgB,wBAAwB,CACtC,QAAkD,EAClD,MAAwB;IAExB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,QAAQ,KAAK,MAAM,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qBAAqB,CAClC,cAA0C,EAC1C,aAA+B,EAC/B,eAAuB,EACvB,iBAAyB;IAEzB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,cAAc,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,aAAa,CAAC,uBAAuB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;AAClF,CAAC"}

package/dist/cjs/test-datasets/testClient.d.ts

@@ -0,0 +1,17 @@
+import { type TopLevelConfig } from '@actsecurity/iam-collect';
+import { IamCollectClient } from '../collect/client.js';
+/**
+ * Get an IAMCollectClient for a test database
+ *
+ * @param dataSetId the ID of the test dataset to use
+ * @returns IamCollectClient instance configured for the specified dataset
+ */
+export declare function getTestDatasetClient(dataSetId: string): Promise<IamCollectClient>;
+/**
+ * Get TopLevelConfig array for a test dataset.
+ *
+ * @param dataSetId - The numeric ID suffix of the dataset
+ * @returns Configuration array pointing to the dataset's file storage
+ */
+export declare function getTestDatasetConfigs(dataSetId: string): TopLevelConfig[];
+//# sourceMappingURL=testClient.d.ts.map

package/dist/cjs/test-datasets/testClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testClient.d.ts","sourceRoot":"","sources":["../../../src/test-datasets/testClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAI9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAgBvD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoBvF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,EAAE,CAUzE"}

package/dist/cjs/test-datasets/testClient.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTestDatasetClient = getTestDatasetClient;
+exports.getTestDatasetConfigs = getTestDatasetConfigs;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const url_1 = require("url");
+const collect_js_1 = require("../collect/collect.js");
+// @ts-ignore
+const __dirname = (0, path_1.dirname)((0, url_1.fileURLToPath)(import.meta.url));
+/**
+ * Resolves the absolute path for a test dataset directory.
+ *
+ * @param dataSetId - The numeric ID suffix of the dataset (e.g. "1" for iam-data-1)
+ * @returns Absolute path to the dataset directory
+ */
+function datasetPath(dataSetId) {
+    return (0, path_1.resolve)((0, path_1.join)(__dirname, `iam-data-${dataSetId}`));
+}
+/**
+ * Get an IAMCollectClient for a test database
+ *
+ * @param dataSetId the ID of the test dataset to use
+ * @returns IamCollectClient instance configured for the specified dataset
+ */
+async function getTestDatasetClient(dataSetId) {
+    const path = datasetPath(dataSetId);
+    if (!(0, fs_1.existsSync)(path)) {
+        throw new Error(`Test dataset with ID ${dataSetId} does not exist at path ${path}. Someone messed up.`);
+    }
+    return (0, collect_js_1.getCollectClient)([
+        {
+            iamCollectVersion: '0.0.0',
+            storage: {
+                type: 'file',
+                path
+            }
+        }
+    ], 'aws');
+}
+/**
+ * Get TopLevelConfig array for a test dataset.
+ *
+ * @param dataSetId - The numeric ID suffix of the dataset
+ * @returns Configuration array pointing to the dataset's file storage
+ */
+function getTestDatasetConfigs(dataSetId) {
+    return [
+        {
+            iamCollectVersion: '0.0.0',
+            storage: {
+                type: 'file',
+                path: datasetPath(dataSetId)
+            }
+        }
+    ];
+}
+//# sourceMappingURL=testClient.js.map

package/dist/cjs/test-datasets/testClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testClient.js","sourceRoot":"","sources":["../../../src/test-datasets/testClient.ts"],"names":[],"mappings":";;AA0BA,oDAoBC;AAQD,sDAUC;AA/DD,2BAA+B;AAC/B,+BAA6C;AAC7C,6BAAmC;AAEnC,sDAAwD;AAExD,aAAa;AACb,MAAM,SAAS,GAAG,IAAA,cAAO,EAAC,IAAA,mBAAa,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAEzD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,IAAA,cAAO,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACnC,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,wBAAwB,SAAS,2BAA2B,IAAI,sBAAsB,CACvF,CAAA;IACH,CAAC;IAED,OAAO,IAAA,6BAAgB,EACrB;QACE;YACE,iBAAiB,EAAE,OAAO;YAC1B,OAAO,EAAE;gBACP,IAAI,EAAE,MAAM;gBACZ,IAAI;aACL;SACF;KACF,EACD,KAAK,CACN,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,OAAO;QACL;YACE,iBAAiB,EAAE,OAAO;YAC1B,OAAO,EAAE;gBACP,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC;aAC7B;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/cjs/utils/arn.d.ts

@@ -0,0 +1,22 @@
+import { type ArnParts } from '@actsecurity/iam-utils';
+export declare class Arn {
+    private readonly arn;
+    private readonly parts;
+    constructor(arn: string);
+    get service(): string;
+    get partition(): string;
+    get region(): string | undefined;
+    get accountId(): string | undefined;
+    get resourceType(): string | undefined;
+    get resourcePath(): string | undefined;
+    get resource(): string;
+    get value(): string;
+    /**
+     * Check
+     *
+     * @param parts
+     * @returns
+     */
+    matches(parts: Partial<ArnParts>): boolean;
+}
+//# sourceMappingURL=arn.d.ts.map

package/dist/cjs/utils/arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../../src/utils/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAiB,MAAM,wBAAwB,CAAA;AAErE,qBAAa,GAAG;IAGF,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;gBAEH,GAAG,EAAE,MAAM;IAIxC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO;CAK3C"}

package/dist/cjs/utils/arn.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Arn = void 0;
+const iam_utils_1 = require("@actsecurity/iam-utils");
+class Arn {
+    arn;
+    parts;
+    constructor(arn) {
+        this.arn = arn;
+        this.parts = (0, iam_utils_1.splitArnParts)(arn);
+    }
+    get service() {
+        return this.parts.service;
+    }
+    get partition() {
+        return this.parts.partition;
+    }
+    get region() {
+        return this.parts.region;
+    }
+    get accountId() {
+        return this.parts.accountId;
+    }
+    get resourceType() {
+        return this.parts.resourceType;
+    }
+    get resourcePath() {
+        return this.parts.resourcePath;
+    }
+    get resource() {
+        return this.parts.resource || '';
+    }
+    get value() {
+        return this.arn;
+    }
+    /**
+     * Check
+     *
+     * @param parts
+     * @returns
+     */
+    matches(parts) {
+        return Object.entries(parts).every(([key, value]) => {
+            return this.parts[key] === value;
+        });
+    }
+}
+exports.Arn = Arn;
+//# sourceMappingURL=arn.js.map

package/dist/cjs/utils/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../../src/utils/arn.ts"],"names":[],"mappings":";;;AAAA,sDAAqE;AAErE,MAAa,GAAG;IAGe;IAFZ,KAAK,CAAU;IAEhC,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QACtC,IAAI,CAAC,KAAK,GAAG,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,OAAQ,CAAA;IAC5B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAU,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;IAC1B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAA;IAC7B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;IAChC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAA;IAClC,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAwB;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAqB,CAAC,KAAK,KAAK,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAlDD,kBAkDC"}

package/dist/cjs/utils/bitset.d.ts

@@ -0,0 +1,45 @@
+import BitSet from 'bitset';
+/**
+ * Encode a BitSet into a more compact representation
+ *
+ * @param bitset the BitSet to encode
+ * @returns the encoded representation
+ */
+export declare function encodeBitSet(bitset: BitSet): any;
+/**
+ * Decode a BitSet from a compact representation
+ *
+ * @param encoded the encoded representation
+ * @returns the decoded BitSet
+ */
+export declare function decodeBitSet(encoded: any): BitSet;
+/**
+ * Compress a hexadecimal string by replacing runs of zeros with a compact representation
+ *
+ * @param rawHex the original hexadecimal string
+ * @returns the compressed hexadecimal string
+ */
+export declare function compressHex(rawHex: string): string;
+/**
+ * Decompress a hexadecimal string
+ *
+ * @param compressedHex the compressed hexadecimal string
+ * @returns the decompressed hexadecimal string
+ */
+export declare function decompressHex(compressedHex: string): string;
+/**
+ * Compress a principal string for storage
+ *
+ * @param principalString the full principal string
+ * @returns the compressed principal string
+ */
+export declare function compressPrincipalString(principalString: string): string;
+/**
+ * Decompress a principal string
+ *
+ * @param compressedString the compressed principal string
+ * @param prefix the ARN prefix to use
+ * @returns the decompressed principal string
+ */
+export declare function decompressPrincipalString(compressedString: string, prefix?: string): string;
+//# sourceMappingURL=bitset.d.ts.map

package/dist/cjs/utils/bitset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitset.d.ts","sourceRoot":"","sources":["../../../src/utils/bitset.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAchD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,CA2BjD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAgBvE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,MAAwB,GAC/B,MAAM,CAuBR"}