@actsecurity/iam-lens 0.1.156

package/README.md

@@ -0,0 +1,203 @@
+# iam-lens
+
+[![NPM Version](https://img.shields.io/npm/v/@cloud-copilot/iam-lens.svg?logo=nodedotjs)](https://www.npmjs.com/package/@cloud-copilot/iam-lens) [![License: AGPL v3](https://img.shields.io/github/license/cloud-copilot/iam-lens)](LICENSE.txt) [![GuardDog](https://github.com/cloud-copilot/iam-lens/actions/workflows/guarddog.yml/badge.svg)](https://github.com/cloud-copilot/iam-lens/actions/workflows/guarddog.yml) [![Known Vulnerabilities](https://snyk.io/test/github/cloud-copilot/iam-lens/badge.svg?targetFile=package.json&style=flat-square)](https://snyk.io/test/github/cloud-copilot/iam-lens?targetFile=package.json)
+
+Get visibility into the IAM permissions in your AWS organizations and accounts. Use your actual AWS IAM policies (downloaded via [iam-collect](https://github.com/cloud-copilot/iam-collect)) and evaluate the effective permissions.
+
+## Table of Contents
+
+1. [Quick Start](#quick-start)
+2. [What is iam-lens?](#what-is-iam-lens)
+3. [Why use it?](#why-use-it)
+4. [Getting Started](#getting-started)
+5. [Commands](#commands)
+   - [simulate - Simulate a request](docs/Simulate.md)
+   - [who-can - Find who can perform an action on a resource](docs/WhoCan.md)
+   - [principal-can - Get a consolidated policy of all permissions for a principal](docs/PrincipalCan.md)
+   - [Global CLI Options](docs/GlobalCliOptions.md)
+6. [Contributing & Support](#contributing--support)
+7. [Acknowledgements](#acknowledgements)
+
+## Quick Start
+
+```bash
+# Install
+npm install -g @actsecurity/iam-collect @actsecurity/iam-lens
+
+# Download all IAM policies in your account using default credentials, run download once per account
+iam-collect init
+iam-collect download
+
+# Simulate a request
+iam-lens simulate --principal arn:aws:iam::123456789012:role/ExampleRole --resource arn:aws:s3:::example-bucket/secret-file.txt --action s3:GetObject
+
+# Find out who can do something
+iam-lens who-can --resource arn:aws:s3:::example-bucket --actions s3:ListBucket
+
+# Find out who can do all actions on a resource
+iam-lens who-can --resource arn:aws:s3:::example-bucket
+```
+
+## What is iam-lens?
+
+**iam-lens** lets you **simulate** and **audit** real IAM requests against your collected IAM data from your AWS accounts (collected via [iam-collect](https://github.com/cloud-copilot/iam-collect)) and understand the effective permissions that apply to a principal or resource.
+
+## Why use it?
+
+- **Understand** the permissions that are actually in place.
+- **Verify** allowed and denied outcomes after all policies are deployed.
+- **Discover** every principal that can access a given resource.
+- **Audit** complex policy combinations across all your AWS accounts and orgs.
+- **Debug** complex conditions locally without deployment or network calls.
+
+## Getting Started
+
+1. **Download Your Policies** with [iam-collect](https://github.com/cloud-copilot/iam-collect) to get all policies from your AWS accounts. iam-collect is highly configurable and can be customized to collect the policies you need. It only downloads information to your file system or an S3 bucket, so you're in full control of your data.
+
+```bash
+npm install -g @actsecurity/iam-collect
+iam-collect init
+iam-collect download
+```
+
+To see the effect of SCPs and RCPs, you should download data from your management account; or an account with permission to download organization information. Download data for member accounts you want to analyze. `iam-lens` will analyze cross-account and cross-organization requests if the data is available.
+
+You can download information for as many accounts, organizations, and regions as you like. The more data you have, the more accurate your answers will be.
+
+2. **Install iam-lens**
+
+```bash
+npm install -g @cloud-copilot/iam-lens
+```
+
+3. **Execute Commands** with `iam-lens` to simulate requests, discover permissions, and audit your IAM policies.
+
+Simulate a request:
+
+```bash
+iam-lens simulate \
+  --principal arn:aws:iam::123456789012:role/ExampleRole \
+  --resource arn:aws:s3:::example-bucket/secret-file.txt \
+  --action s3:GetObject
+```
+
+or
+
+Discover who can perform an action on a resource:
+
+```bash
+iam-lens who-can \
+  --resource arn:aws:iam::111111111111:role/ImportantRole \
+  --actions sts:AssumeRole iam:PassRole
+```
+
+## Commands
+
+### `simulate` - Simulate a request
+
+Evaluates whether a principal can perform a specified action on a resource (or account for wildcard only actions). Returns a decision: `Allowed`, `ImplicitlyDenied`, or `ExplicitlyDenied`. All [condition keys](docs/Simulate.md#context-keys) are supported and [many context keys are set automatically](docs/Simulate.md#default-context-keys).
+
+[Full simulate documentation](docs/Simulate.md)
+
+```bash
+# Simple simulate: can this role list objects in the bucket?
+iam-lens simulate \
+  --principal arn:aws:iam::111111111111:role/MyRole \
+  --resource arn:aws:s3:::my-bucket \
+  --action s3:ListBucket
+
+# Simulate a wildcard action (ListAllMyBuckets) – this will assume the principals account
+iam-lens simulate \
+  --principal arn:aws:iam::222222222222:user/Alice \
+  --action s3:ListAllMyBuckets
+
+# Include custom context keys
+iam-lens simulate \
+  --principal arn:aws:iam::333333333333:role/DevRole \
+  --resource arn:aws:sqs:us-east-1:333333333333:my-queue \
+  --action sqs:SendMessage \
+  --context aws:SourceVpc vpc-1234567890abcdef0 \
+  --verbose
+
+# Assert the result must be “Allowed”; exit code will be nonzero if not
+iam-lens simulate \
+  --principal arn:aws:iam::444444444444:role/ReadOnly \
+  --resource arn:aws:dynamodb:us-east-1:444444444444:table/Books \
+  --action dynamodb:Query \
+  --expect Allowed
+```
+
+[Full simulate documentation](docs/Simulate.md)
+
+### `who-can` - Find who can perform an action on a resource
+
+```bash
+iam-lens who-can [options]
+```
+
+Lists all principals in your IAM data who are allowed to perform one or more specified actions on a resource (or account for wildcard only actions). If applicable it will check the resource policy to find cross-account permissions and AWS service principals.
+
+[Full who-can documentation](docs/WhoCan.md)
+
+**Examples:**
+
+```bash
+# Who can get this object?
+iam-lens who-can \
+  --resource arn:aws:s3:::my-bucket/secret-file.txt \
+  --actions s3:GetObject
+
+# Who can list all IAM roles in this account? (wildcard action – no resource)
+iam-lens who-can \
+  --resource-account 555555555555 \
+  --actions iam:ListRoles
+
+# Check multiple actions at once
+iam-lens who-can \
+  --resource arn:aws:dynamodb:us-east-1:555555555555:table/Books \
+  --actions dynamodb:Query dynamodb:UpdateItem
+
+# Check a wildcard resource prefix and inspect allowed patterns
+iam-lens who-can \
+  --resource arn:aws:s3:::my-bucket/reports/* \
+  --actions s3:GetObject
+
+# Check all actions for a bucket
+iam-lens who-can \
+  --resource arn:aws:s3:::my-bucket
+```
+
+[Full who-can documentation](docs/WhoCan.md)
+
+### `principal-can` - Get a consolidated policy of all permissions for a principal
+
+```bash
+iam-lens principal-can --principal <arn> [--shrink-action-lists]
+```
+
+Creates a consolidated policy document showing all permissions that a principal can perform based on their identity policies, permission boundaries, SCPs, RCPs, and resource policies. The output is a synthesized IAM policy representing the effective permissions after all policy evaluations.
+
+[Full principal-can documentation](docs/PrincipalCan.md)
+
+**Examples:**
+
+```bash
+# Get all permissions for a user or role
+iam-lens principal-can \
+  --principal arn:aws:iam::123456789012:user/Alice
+
+# Get permissions for a role with shrunk action lists
+iam-lens principal-can \
+  --principal arn:aws:iam::123456789012:role/MyRole \
+  --shrink-action-lists
+```
+
+[Full principal-can documentation](docs/PrincipalCan.md)
+
+## Contributing & Support
+
+The best way to support is to [open an issue](https://github.com/cloud-copilot/iam-lens/issues) and let us know of any bugs, feature requests, or questions you have. We're always looking for ways to improve the project and make it more useful for everyone.
+
+## Acknowledgements
+
+Special thanks to [Ziyad Almbasher](https://www.linkedin.com/in/ziadmo/) for testing, validating, providing feedback, and for not letting up when the author thinks "this is fine".

package/dist/cjs/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cjs/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":""}

package/dist/cjs/cli.js

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cli_1 = require("@actsecurity/cli");
+const client_js_1 = require("./collect/client.js");
+const collect_js_1 = require("./collect/collect.js");
+const principalCan_js_1 = require("./principalCan/principalCan.js");
+const makePrincipalIndex_js_1 = require("./principalIndex/makePrincipalIndex.js");
+const simulate_js_1 = require("./simulate/simulate.js");
+const packageVersion_js_1 = require("./utils/packageVersion.js");
+const stringOrFileArgument_js_1 = require("./utils/stringOrFileArgument.js");
+const whoCan_js_1 = require("./whoCan/whoCan.js");
+const main = async () => {
+    const cli = await (0, cli_1.parseCliArguments)('iam-lens', {
+        simulate: {
+            description: 'Simulate an IAM request',
+            arguments: {
+                principal: (0, cli_1.stringArgument)({
+                    description: 'The principal to simulate. Can be a user, role, session, or AWS service'
+                }),
+                resource: (0, cli_1.stringArgument)({
+                    description: 'The ARN of the resource to simulate access to. Ignore for wildcard actions'
+                }),
+                resourceAccount: (0, cli_1.stringArgument)({
+                    description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN.'
+                }),
+                action: (0, cli_1.stringArgument)({
+                    description: 'The action to simulate; must be a valid IAM service and action such as `s3:ListBucket`'
+                }),
+                context: (0, cli_1.mapArgument)({
+                    description: 'The context keys to use for the simulation. The first value is the key and the rest are the values. Specify multiple keys by using --context multiple times',
+                    defaultValue: {}
+                }),
+                verbose: (0, cli_1.booleanArgument)({
+                    description: 'Enable verbose output for the simulation',
+                    character: 'v'
+                }),
+                expect: (0, cli_1.enumArgument)({
+                    description: 'The expected result of the simulation, if the result does not match the expected response a non-zero exit code will be returned',
+                    validValues: ['Allowed', 'ImplicitlyDenied', 'ExplicitlyDenied', 'AnyDeny']
+                }),
+                ignoreMissingPrincipal: (0, cli_1.booleanArgument)({
+                    description: 'Ignore if the principal does not exist. Useful for simulating actions from principals that may not exist or are outside your data set',
+                    character: 'i'
+                }),
+                s3AbacOverride: (0, cli_1.enumArgument)({
+                    description: 'Override the S3 ABAC setting for S3 buckets. Defaults to the bucket setting stored in your iam-collect data',
+                    validValues: ['enabled', 'disabled'],
+                    defaultValue: undefined
+                }),
+                sessionPolicy: (0, stringOrFileArgument_js_1.stringOrFileArgument)({
+                    description: 'The session policy to use for the simulation, if the principal type supports it'
+                })
+            }
+        },
+        'who-can': {
+            description: 'Find who can perform an action on a resource',
+            arguments: {
+                resource: (0, cli_1.stringArgument)({
+                    description: 'The ARN of the resource to check permissions for. Ignore for wildcard actions'
+                }),
+                resourceAccount: (0, cli_1.stringArgument)({
+                    description: 'The account ID of the resource, only required if it cannot be determined from the resource ARN. Required for wildcard actions'
+                }),
+                actions: (0, cli_1.stringArrayArgument)({
+                    description: 'The actions to check permissions for; must be a valid IAM service and action such as `s3:GetObject`',
+                    defaultValue: []
+                }),
+                s3AbacOverride: (0, cli_1.enumArgument)({
+                    description: 'Override the S3 ABAC setting for S3 buckets. Defaults to the bucket setting stored in your iam-collect data',
+                    validValues: ['enabled', 'disabled'],
+                    defaultValue: undefined
+                }),
+                sort: (0, cli_1.booleanArgument)({
+                    description: 'Sort the results before outputting',
+                    character: 's'
+                })
+            }
+        },
+        'principal-can': {
+            description: 'Create a consolidated view of all permissions for a principal, see readme for limitations',
+            arguments: {
+                principal: (0, cli_1.stringArgument)({
+                    description: 'The principal to check permissions for. Can be a user or role'
+                }),
+                shrinkActionLists: (0, cli_1.booleanArgument)({
+                    description: 'Shrink action lists to reduce policy size',
+                    character: 's'
+                })
+            }
+        },
+        'index-principals': {
+            description: 'Index all principals',
+            arguments: {}
+        }
+    }, {
+        collectConfigs: (0, cli_1.stringArrayArgument)({
+            description: 'The iam-collect configuration files to use',
+            defaultValue: []
+        }),
+        partition: (0, cli_1.stringArgument)({
+            description: 'The AWS partition to use (aws, aws-cn, aws-us-gov). Defaults to aws',
+            defaultValue: 'aws'
+        })
+    }, {
+        envPrefix: 'IAM_LENS',
+        showHelpIfNoArgs: true,
+        requireSubcommand: true,
+        expectOperands: false,
+        version: {
+            currentVersion: packageVersion_js_1.iamLensVersion,
+            checkForUpdates: '@cloud-copilot/iam-lens'
+        }
+    });
+    if (cli.args.collectConfigs.length === 0) {
+        cli.args.collectConfigs.push('./iam-collect.jsonc');
+    }
+    const collectConfigs = await (0, collect_js_1.loadCollectConfigs)(cli.args.collectConfigs);
+    const collectClient = await (0, collect_js_1.getCollectClient)(collectConfigs, cli.args.partition);
+    if (cli.subcommand === 'simulate') {
+        const { principal, resource, resourceAccount, action, context, ignoreMissingPrincipal, sessionPolicy } = cli.args;
+        const { request, result } = await (0, simulate_js_1.simulateRequest)({
+            sessionPolicy,
+            principal: principal,
+            resourceArn: resource,
+            resourceAccount: resourceAccount,
+            action: action,
+            customContextKeys: singularizeOneEntryArrays(context),
+            simulationMode: 'Strict',
+            ignoreMissingPrincipal,
+            s3AbacOverride: cli.args.s3AbacOverride
+        }, collectClient);
+        if (result.resultType === 'error') {
+            console.error('Simulation Errors:');
+            console.log(JSON.stringify(result.errors, null, 2));
+            process.exit(1);
+        }
+        console.log(`Simulation Result: ${result.overallResult}`);
+        if (cli.args.verbose) {
+            console.log(JSON.stringify({ request, result }, null, 2));
+        }
+        if (!(0, simulate_js_1.resultMatchesExpectation)(cli.args.expect, result.overallResult)) {
+            process.exit(1);
+        }
+    }
+    else if (cli.subcommand === 'who-can') {
+        const { resource, resourceAccount, actions } = cli.args;
+        if (!resourceAccount && !resource && actions.length === 0) {
+            console.error('Error: At least 1) resource or 2) resource-account and actions must be provided for who-can command');
+            process.exit(1);
+        }
+        const results = await (0, whoCan_js_1.whoCan)(collectConfigs, cli.args.partition, {
+            resource: cli.args.resource,
+            actions: cli.args.actions,
+            resourceAccount: cli.args.resourceAccount,
+            s3AbacOverride: cli.args.s3AbacOverride,
+            sort: cli.args.sort
+        });
+        console.log(JSON.stringify(results, null, 2));
+    }
+    else if (cli.subcommand === 'principal-can') {
+        const { principal, shrinkActionLists } = cli.args;
+        if (!principal) {
+            console.error('Error: Principal must be provided for principal-can command');
+            process.exit(1);
+        }
+        const results = await (0, principalCan_js_1.principalCan)(collectClient, {
+            principal: principal,
+            shrinkActionLists
+        });
+        console.log(JSON.stringify(results, null, 2));
+    }
+    else if (cli.subcommand === 'index-principals') {
+        const indexClient = await (0, collect_js_1.getCollectClient)(collectConfigs, cli.args.partition, {
+            cacheProvider: new client_js_1.NoCacheProvider()
+        });
+        await (0, makePrincipalIndex_js_1.makePrincipalIndex)(indexClient);
+    }
+};
+/**
+ * Take a record of string arrays and convert it to a record of strings or string arrays,
+ * where any array with a single element is converted to a string.
+ *
+ * @param input - The input record of string arrays.
+ * @returns A new record with singularized values.
+ */
+function singularizeOneEntryArrays(input) {
+    const output = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (value.length === 1) {
+            output[key] = value[0];
+        }
+        else {
+            output[key] = value;
+        }
+    }
+    return output;
+}
+main()
+    .catch((e) => {
+    console.error(e);
+    process.exit(1);
+})
+    .then(() => { })
+    .finally(() => { });
+//# sourceMappingURL=cli.js.map

package/dist/cjs/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;;AAEA,0CAOyB;AACzB,mDAAqD;AACrD,qDAA2E;AAC3E,oEAA6D;AAC7D,kFAA2E;AAC3E,wDAAkF;AAClF,iEAA0D;AAC1D,6EAAsE;AACtE,kDAA2C;AAE3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAiB,EACjC,UAAU,EACV;QACE,QAAQ,EAAE;YACR,WAAW,EAAE,yBAAyB;YACtC,SAAS,EAAE;gBACT,SAAS,EAAE,IAAA,oBAAc,EAAC;oBACxB,WAAW,EAAE,yEAAyE;iBACvF,CAAC;gBACF,QAAQ,EAAE,IAAA,oBAAc,EAAC;oBACvB,WAAW,EACT,4EAA4E;iBAC/E,CAAC;gBACF,eAAe,EAAE,IAAA,oBAAc,EAAC;oBAC9B,WAAW,EACT,iGAAiG;iBACpG,CAAC;gBACF,MAAM,EAAE,IAAA,oBAAc,EAAC;oBACrB,WAAW,EACT,wFAAwF;iBAC3F,CAAC;gBACF,OAAO,EAAE,IAAA,iBAAW,EAAC;oBACnB,WAAW,EACT,6JAA6J;oBAC/J,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,OAAO,EAAE,IAAA,qBAAe,EAAC;oBACvB,WAAW,EAAE,0CAA0C;oBACvD,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,MAAM,EAAE,IAAA,kBAAY,EAAC;oBACnB,WAAW,EACT,iIAAiI;oBACnI,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC;iBAC5E,CAAC;gBACF,sBAAsB,EAAE,IAAA,qBAAe,EAAC;oBACtC,WAAW,EACT,uIAAuI;oBACzI,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,cAAc,EAAE,IAAA,kBAAY,EAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,aAAa,EAAE,IAAA,8CAAoB,EAAC;oBAClC,WAAW,EACT,iFAAiF;iBACpF,CAAC;aACH;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,8CAA8C;YAC3D,SAAS,EAAE;gBACT,QAAQ,EAAE,IAAA,oBAAc,EAAC;oBACvB,WAAW,EACT,+EAA+E;iBAClF,CAAC;gBACF,eAAe,EAAE,IAAA,oBAAc,EAAC;oBAC9B,WAAW,EACT,+HAA+H;iBAClI,CAAC;gBACF,OAAO,EAAE,IAAA,yBAAmB,EAAC;oBAC3B,WAAW,EACT,qGAAqG;oBACvG,YAAY,EAAE,EAAE;iBACjB,CAAC;gBACF,cAAc,EAAE,IAAA,kBAAY,EAAC;oBAC3B,WAAW,EACT,6GAA6G;oBAC/G,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;oBACpC,YAAY,EAAE,SAAS;iBACxB,CAAC;gBACF,IAAI,EAAE,IAAA,qBAAe,EAAC;oBACpB,WAAW,EAAE,oCAAoC;oBACjD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,eAAe,EAAE;YACf,WAAW,EACT,2FAA2F;YAC7F,SAAS,EAAE;gBACT,SAAS,EAAE,IAAA,oBAAc,EAAC;oBACxB,WAAW,EAAE,+DAA+D;iBAC7E,CAAC;gBACF,iBAAiB,EAAE,IAAA,qBAAe,EAAC;oBACjC,WAAW,EAAE,2CAA2C;oBACxD,SAAS,EAAE,GAAG;iBACf,CAAC;aACH;SACF;QACD,kBAAkB,EAAE;YAClB,WAAW,EAAE,sBAAsB;YACnC,SAAS,EAAE,EAAE;SACd;KACF,EACD;QACE,cAAc,EAAE,IAAA,yBAAmB,EAAC;YAClC,WAAW,EAAE,4CAA4C;YACzD,YAAY,EAAE,EAAE;SACjB,CAAC;QACF,SAAS,EAAE,IAAA,oBAAc,EAAC;YACxB,WAAW,EAAE,qEAAqE;YAClF,YAAY,EAAE,KAAK;SACpB,CAAC;KACH,EACD;QACE,SAAS,EAAE,UAAU;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,cAAc,EAAE,kCAAc;YAC9B,eAAe,EAAE,yBAAyB;SAC3C;KACF,CACF,CAAA;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAkB,EAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEhF,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,eAAe,EACf,MAAM,EACN,OAAO,EACP,sBAAsB,EACtB,aAAa,EACd,GAAG,GAAG,CAAC,IAAI,CAAA;QAEZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,6BAAe,EAC/C;YACE,aAAa;YACb,SAAS,EAAE,SAAU;YACrB,WAAW,EAAE,QAAQ;YACrB,eAAe,EAAE,eAAe;YAChC,MAAM,EAAE,MAAO;YACf,iBAAiB,EAAE,yBAAyB,CAAC,OAAO,CAAC;YACrD,cAAc,EAAE,QAAQ;YACxB,sBAAsB;YACtB,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;SACxC,EACD,aAAa,CACd,CAAA;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC,IAAA,sCAAwB,EAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,aAAc,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACvD,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,qGAAqG,CACtG,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAM,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC/D,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAS;YAC5B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAQ;YAC1B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YACzC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC9C,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAY,EAAC,aAAa,EAAE;YAChD,SAAS,EAAE,SAAS;YACpB,iBAAiB;SAClB,CAAC,CAAA;QAEF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;SAAM,IAAI,GAAG,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAgB,EAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7E,aAAa,EAAE,IAAI,2BAAe,EAAE;SACrC,CAAC,CAAA;QACF,MAAM,IAAA,0CAAkB,EAAC,WAAW,CAAC,CAAA;IACvC,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAA+B;IAE/B,MAAM,MAAM,GAAsC,EAAE,CAAA;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC;KACD,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KACd,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA"}