@actsecurity/iam-lens 0.1.156

package/dist/cjs/whoCan/principalArnFilter.d.ts

@@ -0,0 +1,84 @@
+/**
+ * An action-scoped set of principal ARN patterns extracted from a Deny statement.
+ * The patterns only apply when the action being simulated matches one of the
+ * entry's action patterns.
+ */
+export interface DenyFilterEntry {
+    /** Action patterns from the deny statement (e.g., 'secretsmanager:GetSecretValue', 's3:*'). */
+    actionPatterns: string[];
+    /** Principal ARN patterns extracted from the condition. */
+    principalPatterns: RegExp[];
+}
+/**
+ * A pre-simulation filter that uses aws:PrincipalArn condition patterns
+ * from a resource policy to skip principals that cannot possibly be allowed.
+ */
+export interface PrincipalArnFilter {
+    /**
+     * Allow patterns extracted from resource policy Allow statements.
+     * If non-empty, a principal must match at least one pattern to be
+     * worth simulating.
+     */
+    allowPatterns: RegExp[];
+    /**
+     * From Deny statements with negative operators (StringNotLike, etc.).
+     * For each entry, if the simulation action matches one of the entry's
+     * action patterns, the principal must match at least one of the entry's
+     * principal patterns to be worth simulating.
+     */
+    denyDerivedAllowEntries: DenyFilterEntry[];
+    /**
+     * From Deny statements with positive operators (StringLike, etc.).
+     * For each entry, if the simulation action matches one of the entry's
+     * action patterns AND the principal matches one of the entry's principal
+     * patterns, the simulation can be skipped (the principal is explicitly denied).
+     */
+    denyEntries: DenyFilterEntry[];
+    /**
+     * Account IDs that are explicitly named as account principals in the
+     * resource policy's Allow statements. Principals in these accounts
+     * must bypass the filter because the account-level principal grant
+     * is independent of any PrincipalArn conditions on wildcard statements.
+     */
+    exemptAccounts: Set<string>;
+}
+/**
+ * Converts an IAM wildcard pattern to a case-sensitive anchored RegExp.
+ * Handles `*` (any characters) and `?` (single character) wildcards.
+ * Does not handle replacement variables — callers must ensure patterns
+ * with variables are excluded before calling this.
+ *
+ * @param pattern the IAM pattern string (e.g. `arn:aws:iam::*:role/ec2/*`)
+ * @returns an anchored case-sensitive RegExp
+ */
+export declare function iamPatternToRegex(pattern: string): RegExp;
+/**
+ * Builds a PrincipalArnFilter from a resource policy by extracting
+ * aws:PrincipalArn patterns from Allow statements with wildcard principals.
+ *
+ * The filter is only constructed if **every** wildcard-Allow statement has
+ * a usable aws:PrincipalArn condition. If any wildcard-Allow statement lacks
+ * one, the filter cannot safely exclude principals and undefined is returned.
+ *
+ * @param resourcePolicy the raw resource policy document, or undefined/null if none
+ * @returns a PrincipalArnFilter if filtering is possible, undefined otherwise
+ */
+export declare function buildPrincipalArnFilter(resourcePolicy: any): PrincipalArnFilter | undefined;
+/**
+ * Tests whether a principal ARN passes the PrincipalArnFilter for a given action.
+ *
+ * Principals in the resource account or an exempt account bypass the positive
+ * allow-side filtering (allow patterns and deny-derived allow entries) because
+ * they may be granted access through account-level principal grants independent
+ * of any PrincipalArn conditions. However, they are still subject to deny-side
+ * filtering (deny entries) because an explicit deny in a resource policy applies
+ * regardless of the principal's account.
+ *
+ * @param principal the principal ARN to test
+ * @param action the action being simulated
+ * @param resourceAccount the account that owns the resource being checked
+ * @param filter the filter to apply
+ * @returns true if the principal should be simulated, false if it can be skipped
+ */
+export declare function principalMatchesFilter(principal: string, action: string, resourceAccount: string, filter: PrincipalArnFilter): boolean;
+//# sourceMappingURL=principalArnFilter.d.ts.map

package/dist/cjs/whoCan/principalArnFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalArnFilter.d.ts","sourceRoot":"","sources":["../../../src/whoCan/principalArnFilter.ts"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,+FAA+F;IAC/F,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE,CAAA;IAEvB;;;;;OAKG;IACH,uBAAuB,EAAE,eAAe,EAAE,CAAA;IAE1C;;;;;OAKG;IACH,WAAW,EAAE,eAAe,EAAE,CAAA;IAE9B;;;;;OAKG;IACH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIzD;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,GAAG,GAAG,kBAAkB,GAAG,SAAS,CA6I3F;AAcD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CA+BT"}

package/dist/cjs/whoCan/principalArnFilter.js

@@ -0,0 +1,258 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.iamPatternToRegex = iamPatternToRegex;
+exports.buildPrincipalArnFilter = buildPrincipalArnFilter;
+exports.principalMatchesFilter = principalMatchesFilter;
+const iam_policy_1 = require("@actsecurity/iam-policy");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+/**
+ * Set of condition operators that can be used with aws:PrincipalArn to
+ * constrain which principals are allowed. These are the base operators
+ * (lowercase) without set modifiers or IfExists.
+ */
+const ALLOW_PRINCIPAL_ARN_OPERATORS = new Set([
+    'stringlike',
+    'stringequals',
+    'arnlike',
+    'arnequals'
+]);
+/**
+ * Negative condition operators on `aws:PrincipalArn` in Deny statements.
+ * The deny applies to principals NOT matching the patterns, so the patterns
+ * become an allow-list (only those principals are worth simulating).
+ */
+const DENY_NEGATIVE_OPERATORS = new Set([
+    'stringnotlike',
+    'stringnotequals',
+    'arnnotlike',
+    'arnnotequals'
+]);
+/**
+ * Positive condition operators on `aws:PrincipalArn` in Deny statements.
+ * The deny applies to principals matching the patterns, so those principals
+ * can be skipped for the deny statement's actions.
+ */
+const DENY_POSITIVE_OPERATORS = new Set(['stringlike', 'stringequals', 'arnlike', 'arnequals']);
+/**
+ * Converts an IAM wildcard pattern to a case-sensitive anchored RegExp.
+ * Handles `*` (any characters) and `?` (single character) wildcards.
+ * Does not handle replacement variables — callers must ensure patterns
+ * with variables are excluded before calling this.
+ *
+ * @param pattern the IAM pattern string (e.g. `arn:aws:iam::*:role/ec2/*`)
+ * @returns an anchored case-sensitive RegExp
+ */
+function iamPatternToRegex(pattern) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    const withWildcards = escaped.replace(/\*/g, '.*').replace(/\?/g, '.');
+    return new RegExp(`^${withWildcards}$`);
+}
+/**
+ * Checks whether any value in an array contains a replacement variable (`${...}`).
+ *
+ * @param values the condition values to check
+ * @returns true if any value contains a replacement variable
+ */
+function hasAnyReplacementVariable(values) {
+    return values.some((v) => v.includes('${'));
+}
+/**
+ * Builds a PrincipalArnFilter from a resource policy by extracting
+ * aws:PrincipalArn patterns from Allow statements with wildcard principals.
+ *
+ * The filter is only constructed if **every** wildcard-Allow statement has
+ * a usable aws:PrincipalArn condition. If any wildcard-Allow statement lacks
+ * one, the filter cannot safely exclude principals and undefined is returned.
+ *
+ * @param resourcePolicy the raw resource policy document, or undefined/null if none
+ * @returns a PrincipalArnFilter if filtering is possible, undefined otherwise
+ */
+function buildPrincipalArnFilter(resourcePolicy) {
+    if (!resourcePolicy) {
+        return undefined;
+    }
+    const policy = (0, iam_policy_1.loadPolicy)(resourcePolicy);
+    const allAllowPatterns = [];
+    const exemptAccounts = new Set();
+    let hasAnyWildcardAllow = false;
+    for (const statement of policy.statements()) {
+        if (!statement.isAllow()) {
+            continue;
+        }
+        // Check if this Allow statement has a wildcard principal, and collect
+        // explicit account principals whose accounts should be exempt from filtering
+        let hasWildcardPrincipal = false;
+        if (statement.isPrincipalStatement()) {
+            for (const principal of statement.principals()) {
+                if (principal.isWildcardPrincipal()) {
+                    hasWildcardPrincipal = true;
+                }
+                else if (principal.isAccountPrincipal()) {
+                    exemptAccounts.add(principal.accountId());
+                }
+            }
+        }
+        else if (statement.isNotPrincipalStatement()) {
+            // NotPrincipal Allow effectively allows everyone except the named principals,
+            // so it acts like a wildcard — we can't filter
+            return undefined;
+        }
+        if (!hasWildcardPrincipal) {
+            continue;
+        }
+        hasAnyWildcardAllow = true;
+        // Look for aws:PrincipalArn conditions with supported operators
+        let statementHasUsableFilter = false;
+        const conditions = statement.conditions();
+        for (const cond of conditions) {
+            if (cond.conditionKey().toLowerCase() !== 'aws:principalarn') {
+                continue;
+            }
+            const baseOp = cond.operation().baseOperator().toLowerCase();
+            if (!ALLOW_PRINCIPAL_ARN_OPERATORS.has(baseOp)) {
+                continue;
+            }
+            const values = cond.conditionValues();
+            // If any value has a replacement variable, ignore the entire condition
+            if (hasAnyReplacementVariable(values)) {
+                continue;
+            }
+            // All values count as a usable filter for the statement — even literal
+            // ARNs constrain which principals can match. However, only wildcard
+            // values are added as filter patterns; literal ARNs are already handled
+            // as specific principals by accountsToCheckBasedOnResourcePolicy.
+            for (const value of values) {
+                statementHasUsableFilter = true;
+                if (value.includes('*') || value.includes('?')) {
+                    allAllowPatterns.push(iamPatternToRegex(value));
+                }
+            }
+        }
+        // If this wildcard-Allow has no usable PrincipalArn condition,
+        // it could allow any principal — filtering is not safe
+        if (!statementHasUsableFilter) {
+            return undefined;
+        }
+    }
+    // --- Deny statement extraction ---
+    const denyDerivedAllowEntries = [];
+    const denyEntries = [];
+    for (const statement of policy.statements()) {
+        if (statement.isAllow())
+            continue;
+        if (!statement.isActionStatement())
+            continue;
+        if (statement.isNotResourceStatement())
+            continue;
+        if (statement.isNotPrincipalStatement())
+            continue;
+        // Must have a wildcard principal
+        let hasWildcardPrincipal = false;
+        if (statement.isPrincipalStatement()) {
+            for (const principal of statement.principals()) {
+                if (principal.isWildcardPrincipal()) {
+                    hasWildcardPrincipal = true;
+                    break;
+                }
+            }
+        }
+        if (!hasWildcardPrincipal)
+            continue;
+        // Resource must include '*' or be non-existent
+        if (statement.isResourceStatement()) {
+            if (!statement.resources().some((r) => r.isAllResources()))
+                continue;
+        }
+        // Must have exactly one condition and it must be aws:PrincipalArn
+        const conditions = statement.conditions();
+        if (conditions.length !== 1)
+            continue;
+        const cond = conditions[0];
+        if (cond.conditionKey().toLowerCase() !== 'aws:principalarn')
+            continue;
+        if (cond.operation().isIfExists())
+            continue;
+        const values = cond.conditionValues();
+        if (hasAnyReplacementVariable(values))
+            continue;
+        const baseOp = cond.operation().baseOperator().toLowerCase();
+        const actionPatterns = statement.actions().map((a) => a.value());
+        const principalPatterns = values.map(iamPatternToRegex);
+        if (DENY_NEGATIVE_OPERATORS.has(baseOp)) {
+            denyDerivedAllowEntries.push({ actionPatterns, principalPatterns });
+        }
+        else if (DENY_POSITIVE_OPERATORS.has(baseOp)) {
+            denyEntries.push({ actionPatterns, principalPatterns });
+        }
+    }
+    // Return a filter if there's anything useful
+    const hasAllowPatterns = hasAnyWildcardAllow && allAllowPatterns.length > 0;
+    const hasDenyInfo = denyDerivedAllowEntries.length > 0 || denyEntries.length > 0;
+    if (!hasAllowPatterns && !hasDenyInfo) {
+        return undefined;
+    }
+    return {
+        allowPatterns: hasAllowPatterns ? allAllowPatterns : [],
+        denyDerivedAllowEntries,
+        denyEntries,
+        exemptAccounts
+    };
+}
+/**
+ * Checks whether an action matches any of the given action patterns using
+ * IAM wildcard semantics.
+ *
+ * @param action the action being simulated (e.g., 'secretsmanager:GetSecretValue')
+ * @param patterns the action patterns from a deny statement
+ * @returns true if the action matches at least one pattern
+ */
+function actionMatchesAnyPattern(action, patterns) {
+    return patterns.some((pattern) => (0, iam_utils_1.actionMatchesPattern)(action, pattern));
+}
+/**
+ * Tests whether a principal ARN passes the PrincipalArnFilter for a given action.
+ *
+ * Principals in the resource account or an exempt account bypass the positive
+ * allow-side filtering (allow patterns and deny-derived allow entries) because
+ * they may be granted access through account-level principal grants independent
+ * of any PrincipalArn conditions. However, they are still subject to deny-side
+ * filtering (deny entries) because an explicit deny in a resource policy applies
+ * regardless of the principal's account.
+ *
+ * @param principal the principal ARN to test
+ * @param action the action being simulated
+ * @param resourceAccount the account that owns the resource being checked
+ * @param filter the filter to apply
+ * @returns true if the principal should be simulated, false if it can be skipped
+ */
+function principalMatchesFilter(principal, action, resourceAccount, filter) {
+    const accountId = (0, iam_utils_1.splitArnParts)(principal).accountId;
+    const isExempt = accountId === resourceAccount || filter.exemptAccounts.has(accountId ?? '');
+    // Allow patterns from Allow statements: exempt principals bypass this check
+    // because they may be granted access through account-level principal grants
+    // independent of any PrincipalArn conditions on wildcard statements.
+    if (!isExempt && filter.allowPatterns.length > 0) {
+        if (!filter.allowPatterns.some((pattern) => pattern.test(principal)))
+            return false;
+    }
+    // Deny-derived filtering applies to ALL principals regardless of account.
+    // An explicit deny in a resource policy applies universally.
+    // For each deny-derived allow entry whose actions match,
+    // the principal must match at least one principal pattern
+    for (const entry of filter.denyDerivedAllowEntries) {
+        if (actionMatchesAnyPattern(action, entry.actionPatterns)) {
+            if (!entry.principalPatterns.some((p) => p.test(principal)))
+                return false;
+        }
+    }
+    // For each deny entry whose actions match,
+    // skip if the principal matches any principal pattern
+    for (const entry of filter.denyEntries) {
+        if (actionMatchesAnyPattern(action, entry.actionPatterns)) {
+            if (entry.principalPatterns.some((p) => p.test(principal)))
+                return false;
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=principalArnFilter.js.map

package/dist/cjs/whoCan/principalArnFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalArnFilter.js","sourceRoot":"","sources":["../../../src/whoCan/principalArnFilter.ts"],"names":[],"mappings":";;AA4FA,8CAIC;AAuBD,0DA6IC;AA8BD,wDAoCC;AAtUD,wDAAoD;AACpD,sDAA4E;AAE5E;;;;GAIG;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,cAAc;IACd,SAAS;IACT,WAAW;CACZ,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,cAAc;CACf,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAA;AAmD/F;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACtE,OAAO,IAAI,MAAM,CAAC,IAAI,aAAa,GAAG,CAAC,CAAA;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,MAAgB;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,uBAAuB,CAAC,cAAmB;IACzD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,uBAAU,EAAC,cAAc,CAAC,CAAA;IACzC,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,IAAI,mBAAmB,GAAG,KAAK,CAAA;IAE/B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,SAAQ;QACV,CAAC;QAED,sEAAsE;QACtE,6EAA6E;QAC7E,IAAI,oBAAoB,GAAG,KAAK,CAAA;QAChC,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACrC,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC/C,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;oBACpC,oBAAoB,GAAG,IAAI,CAAA;gBAC7B,CAAC;qBAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;oBAC1C,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;YAC/C,8EAA8E;YAC9E,+CAA+C;YAC/C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAQ;QACV,CAAC;QAED,mBAAmB,GAAG,IAAI,CAAA;QAE1B,gEAAgE;QAChE,IAAI,wBAAwB,GAAG,KAAK,CAAA;QACpC,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;QAEzC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;gBAC7D,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;YAC5D,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;YAErC,uEAAuE;YACvE,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,SAAQ;YACV,CAAC;YAED,uEAAuE;YACvE,oEAAoE;YACpE,wEAAwE;YACxE,kEAAkE;YAClE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,wBAAwB,GAAG,IAAI,CAAA;gBAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,uDAAuD;QACvD,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,uBAAuB,GAAsB,EAAE,CAAA;IACrD,MAAM,WAAW,GAAsB,EAAE,CAAA;IAEzC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,OAAO,EAAE;YAAE,SAAQ;QACjC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE;YAAE,SAAQ;QAC5C,IAAI,SAAS,CAAC,sBAAsB,EAAE;YAAE,SAAQ;QAChD,IAAI,SAAS,CAAC,uBAAuB,EAAE;YAAE,SAAQ;QAEjD,iCAAiC;QACjC,IAAI,oBAAoB,GAAG,KAAK,CAAA;QAChC,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACrC,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC/C,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;oBACpC,oBAAoB,GAAG,IAAI,CAAA;oBAC3B,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,oBAAoB;YAAE,SAAQ;QAEnC,+CAA+C;QAC/C,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;gBAAE,SAAQ;QACtE,CAAC;QAED,kEAAkE;QAClE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;QACzC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB;YAAE,SAAQ;QACtE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE;YAAE,SAAQ;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;QACrC,IAAI,yBAAyB,CAAC,MAAM,CAAC;YAAE,SAAQ;QAE/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;QAC5D,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAChE,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QAEvD,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,uBAAuB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACrE,CAAC;aAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,gBAAgB,GAAG,mBAAmB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3E,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAA;IAEhF,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;QACvD,uBAAuB;QACvB,WAAW;QACX,cAAc;KACf,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,MAAc,EAAE,QAAkB;IACjE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,gCAAoB,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,MAAc,EACd,eAAuB,EACvB,MAA0B;IAE1B,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC,SAAS,CAAA;IACpD,MAAM,QAAQ,GAAG,SAAS,KAAK,eAAe,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAE5F,4EAA4E;IAC5E,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IACpF,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAE7D,yDAAyD;IACzD,0DAA0D;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACnD,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,sDAAsD;IACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/cjs/whoCan/principalScope.d.ts

@@ -0,0 +1,35 @@
+import { IamCollectClient } from '../collect/client.js';
+import { type WhoCanPrincipalScope } from './whoCan.js';
+/**
+ * Resolves a `WhoCanPrincipalScope` into concrete sets of account IDs and principal ARNs
+ * using the collect client for OU lookups.
+ *
+ * `scope.principals` are kept separate from `scope.accounts` — a scope like
+ * `{ principals: ['arn:...:role/Foo'] }` tests only that one role and does NOT
+ * expand to search every principal in Foo's account.
+ *
+ * @param client The collect client used to resolve OU paths to account IDs.
+ * @param scope The principal scope to resolve.
+ * @returns An object with `accounts` and `principals` sets.
+ */
+export declare function resolvePrincipalScope(client: IamCollectClient, scope: WhoCanPrincipalScope): Promise<{
+    accounts: Set<string>;
+    principals: Set<string>;
+}>;
+/**
+ * Intersects the resource-policy-derived scope with a caller-supplied principal scope.
+ * Returns the narrowed set of accounts (for full-account search) and principals
+ * (for individual principal testing).
+ *
+ * @param resourcePolicyAccounts Account IDs derived from the resource policy.
+ * @param resourcePolicyPrincipals Individual principal ARNs derived from the resource policy.
+ * @param resourcePolicyCheckAllAccounts Whether the resource policy implies all accounts should be checked.
+ * @param scopeAccounts Account IDs from the resolved principal scope.
+ * @param suggestedPrincipals Principal ARNs from the resolved principal scope.
+ * @returns The intersected accounts and principals to search.
+ */
+export declare function intersectWithPrincipalScope(resourcePolicyAccounts: string[], resourcePolicyPrincipals: string[], resourcePolicyCheckAllAccounts: boolean, scopeAccounts: Set<string>, scopePrincipals: Set<string>): {
+    accounts: string[];
+    principals: string[];
+};
+//# sourceMappingURL=principalScope.d.ts.map

package/dist/cjs/whoCan/principalScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalScope.d.ts","sourceRoot":"","sources":["../../../src/whoCan/principalScope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC;IAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAuB7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,sBAAsB,EAAE,MAAM,EAAE,EAChC,wBAAwB,EAAE,MAAM,EAAE,EAClC,8BAA8B,EAAE,OAAO,EACvC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,EAC1B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,GAC3B;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAwD9C"}

package/dist/cjs/whoCan/principalScope.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePrincipalScope = resolvePrincipalScope;
+exports.intersectWithPrincipalScope = intersectWithPrincipalScope;
+const iam_utils_1 = require("@actsecurity/iam-utils");
+/**
+ * Resolves a `WhoCanPrincipalScope` into concrete sets of account IDs and principal ARNs
+ * using the collect client for OU lookups.
+ *
+ * `scope.principals` are kept separate from `scope.accounts` — a scope like
+ * `{ principals: ['arn:...:role/Foo'] }` tests only that one role and does NOT
+ * expand to search every principal in Foo's account.
+ *
+ * @param client The collect client used to resolve OU paths to account IDs.
+ * @param scope The principal scope to resolve.
+ * @returns An object with `accounts` and `principals` sets.
+ */
+async function resolvePrincipalScope(client, scope) {
+    const accounts = new Set();
+    const principals = new Set();
+    for (const p of scope.principals ?? []) {
+        principals.add(p);
+    }
+    for (const a of scope.accounts ?? []) {
+        accounts.add(a);
+    }
+    for (const ouPath of scope.ous ?? []) {
+        const parts = ouPath.split('/');
+        const orgId = parts[0];
+        const pathParts = parts.slice(1);
+        const [, ouAccounts] = await client.getAccountsForOrgPath(orgId, pathParts);
+        for (const a of ouAccounts) {
+            accounts.add(a);
+        }
+    }
+    return { accounts, principals };
+}
+/**
+ * Intersects the resource-policy-derived scope with a caller-supplied principal scope.
+ * Returns the narrowed set of accounts (for full-account search) and principals
+ * (for individual principal testing).
+ *
+ * @param resourcePolicyAccounts Account IDs derived from the resource policy.
+ * @param resourcePolicyPrincipals Individual principal ARNs derived from the resource policy.
+ * @param resourcePolicyCheckAllAccounts Whether the resource policy implies all accounts should be checked.
+ * @param scopeAccounts Account IDs from the resolved principal scope.
+ * @param suggestedPrincipals Principal ARNs from the resolved principal scope.
+ * @returns The intersected accounts and principals to search.
+ */
+function intersectWithPrincipalScope(resourcePolicyAccounts, resourcePolicyPrincipals, resourcePolicyCheckAllAccounts, scopeAccounts, scopePrincipals) {
+    // Accounts: intersection of resource policy accounts and scope accounts
+    const rpAccountSet = new Set(resourcePolicyAccounts);
+    const accounts = resourcePolicyCheckAllAccounts
+        ? Array.from(scopeAccounts)
+        : resourcePolicyAccounts.filter((a) => scopeAccounts.has(a));
+    const accountsResultSet = new Set(accounts);
+    // Principals: merge from both sides, filtering by the other side's scope
+    const principalSet = new Set();
+    // From resource policy principals: keep if the principal's account is in scopeAccounts,
+    // OR the principal ARN is in scopePrincipals.
+    for (const p of resourcePolicyPrincipals) {
+        if ((0, iam_utils_1.isServicePrincipal)(p)) {
+            if (scopePrincipals.has(p)) {
+                principalSet.add(p);
+            }
+        }
+        else {
+            const accountId = (0, iam_utils_1.splitArnParts)(p).accountId;
+            if (accountId && accountsResultSet.has(accountId)) {
+                // Account loop already covers this principal — skip
+                continue;
+            }
+            if (accountId && scopeAccounts.has(accountId)) {
+                principalSet.add(p);
+            }
+            else if (scopePrincipals.has(p)) {
+                principalSet.add(p);
+            }
+        }
+    }
+    const rpPrincipalSet = new Set(resourcePolicyPrincipals);
+    // From scope principals: keep if the principal's account is in resource policy accounts
+    // or resourcePolicyCheckAllAccounts is true. Exclude if account is already in accounts result.
+    // Service principals only survive if resourcePolicyCheckAllAccounts or the resource policy named them.
+    for (const p of scopePrincipals) {
+        if ((0, iam_utils_1.isServicePrincipal)(p)) {
+            if (resourcePolicyCheckAllAccounts || rpPrincipalSet.has(p)) {
+                principalSet.add(p);
+            }
+        }
+        else {
+            const accountId = (0, iam_utils_1.splitArnParts)(p).accountId;
+            if (accountId && accountsResultSet.has(accountId)) {
+                // Account loop already covers this principal — skip
+                continue;
+            }
+            if (resourcePolicyCheckAllAccounts || (accountId && rpAccountSet.has(accountId))) {
+                principalSet.add(p);
+            }
+        }
+    }
+    return { accounts, principals: Array.from(principalSet) };
+}
+//# sourceMappingURL=principalScope.js.map

package/dist/cjs/whoCan/principalScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalScope.js","sourceRoot":"","sources":["../../../src/whoCan/principalScope.ts"],"names":[],"mappings":";;AAgBA,sDA0BC;AAcD,kEA8DC;AAtHD,sDAA0E;AAI1E;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAwB,EACxB,KAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IAEpC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACvC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC3E,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,2BAA2B,CACzC,sBAAgC,EAChC,wBAAkC,EAClC,8BAAuC,EACvC,aAA0B,EAC1B,eAA4B;IAE5B,wEAAwE;IACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,8BAA8B;QAC7C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;QAC3B,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAE9D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE3C,yEAAyE;IACzE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,wFAAwF;IACxF,8CAA8C;IAC9C,KAAK,MAAM,CAAC,IAAI,wBAAwB,EAAE,CAAC;QACzC,IAAI,IAAA,8BAAkB,EAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5C,IAAI,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,oDAAoD;gBACpD,SAAQ;YACV,CAAC;YACD,IAAI,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACrB,CAAC;iBAAM,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAExD,wFAAwF;IACxF,+FAA+F;IAC/F,uGAAuG;IACvG,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,IAAA,8BAAkB,EAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,IAAI,8BAA8B,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,IAAA,yBAAa,EAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5C,IAAI,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,oDAAoD;gBACpD,SAAQ;YACV,CAAC;YACD,IAAI,8BAA8B,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACjF,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAA;AAC3D,CAAC"}

package/dist/cjs/whoCan/requestAnalysis.d.ts

@@ -0,0 +1,73 @@
+import { type BlockedReason, type EvaluationResult, type RequestAnalysis } from '@actsecurity/iam-simulate';
+import type { DeniedWhoCanExecutionResultWithDetails } from './WhoCanWorker.js';
+import type { WhoCanDenyDetail } from './whoCan.js';
+/**
+ * A lightweight representation of RequestAnalysis containing only the result fields
+ * of the various policy analyses (identity, resource, SCP, RCP, permission boundary).
+ */
+export interface LightResourceAnalysis {
+    result: RequestAnalysis['result'];
+    sameAccount?: boolean;
+    identityAnalysis?: Pick<NonNullable<RequestAnalysis['identityAnalysis']>, 'result'>;
+    resourceAnalysis?: Pick<NonNullable<RequestAnalysis['resourceAnalysis']>, 'result'>;
+    scpAnalysis?: Pick<NonNullable<RequestAnalysis['scpAnalysis']>, 'result'>;
+    rcpAnalysis?: Pick<NonNullable<RequestAnalysis['rcpAnalysis']>, 'result'>;
+    permissionBoundaryAnalysis?: Pick<NonNullable<RequestAnalysis['permissionBoundaryAnalysis']>, 'result'>;
+    blockedBy: Set<BlockedReason>;
+}
+/**
+ * A LightResourceAnalysis extended with resource pattern and type information.
+ * Used for wildcard resource analyses to provide details on each matched pattern.
+ */
+export interface LightResourceAnalysisWithPattern extends LightResourceAnalysis {
+    /**
+     * The specific resource pattern that was analyzed, most likely found in a policy statement's Resource field. This is used to provide more granular details in wildcard resource analyses, where multiple patterns may match the requested resource.
+     */
+    pattern: string;
+    /**
+     * The resource type that was tested.
+     */
+    resourceType: string;
+}
+/**
+ * A light request analysis for a single resource.
+ */
+export interface SingleResourceLightRequestAnalysis extends LightResourceAnalysis {
+    type: 'single';
+    overallResult: EvaluationResult;
+}
+/**
+ * A light request analysis for a wildcard resource with multiple patterns.
+ * Used for wildcard resource analyses to provide details on each matched pattern.
+ */
+export interface WildcardResourceLightRequestAnalysis {
+    type: 'wildcard';
+    /**
+     * The overall result of the wildcard resource analysis, which is typically a combination of the results of the individual pattern analyses. This provides a high-level summary of whether the requested action is allowed or denied across all matched patterns, while the individual pattern analyses provide more granular details.
+     */
+    overallResult: EvaluationResult;
+    /**
+     * The details of the analyses for each matched resource pattern/resource type pair.
+     */
+    patterns: LightResourceAnalysisWithPattern[];
+}
+/**
+ * A light version of RequestAnalysis containing only the result and sameAccount fields,
+ * along with the result fields of the various analyses.
+ */
+export type LightRequestAnalysis = SingleResourceLightRequestAnalysis | WildcardResourceLightRequestAnalysis;
+/**
+ * Convert a full RequestAnalysis to a LightRequestAnalysis.
+ *
+ * @param executionResult - The denied execution result containing the RequestAnalysis to convert
+ * @returns A LightRequestAnalysis with only the essential fields
+ */
+export declare function toLightRequestAnalysis(executionResult: DeniedWhoCanExecutionResultWithDetails): LightRequestAnalysis;
+/**
+ * Gets the denial reasons for a denied SimulationResult.
+ *
+ * @param executionResult - The denied execution result containing the RequestAnalysis with denial reasons
+ * @returns A WhoCanDenyDetail object containing the denial reasons and other details to be returned to the user
+ */
+export declare function convertToDenialDetails(executionResult: DeniedWhoCanExecutionResultWithDetails): WhoCanDenyDetail;
+//# sourceMappingURL=requestAnalysis.d.ts.map

package/dist/cjs/whoCan/requestAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAnalysis.d.ts","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,mBAAmB,CAAA;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACjC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,0BAA0B,CAAC,EAAE,IAAI,CAC/B,WAAW,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,EAC1D,QAAQ,CACT,CAAA;IACD,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,qBAAqB;IAC7E;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E,IAAI,EAAE,QAAQ,CAAA;IACd,aAAa,EAAE,gBAAgB,CAAA;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,UAAU,CAAA;IAEhB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAA;IAE/B;;OAEG;IACH,QAAQ,EAAE,gCAAgC,EAAE,CAAA;CAC7C;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC9B,kCAAkC,GAAG,oCAAoC,CAAA;AA2B3E;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,sCAAsC,GACtD,oBAAoB,CAqBtB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,sCAAsC,GACtD,gBAAgB,CA0BlB"}