@actsecurity/iam-lens 0.1.156

package/dist/esm/whoCan/requestAnalysis.js

@@ -0,0 +1,83 @@
+import { getDenialReasons } from '@actsecurity/iam-simulate';
+/**
+ * Convert a RequestAnalysis to a LightResourceAnalysis.
+ *
+ * @param analysis - The full RequestAnalysis to convert
+ * @returns A LightResourceAnalysis with only the essential result fields
+ */
+function toLightResourceAnalysis(analysis) {
+    return {
+        result: analysis.result,
+        sameAccount: analysis.sameAccount,
+        identityAnalysis: analysis.identityAnalysis
+            ? { result: analysis.identityAnalysis.result }
+            : undefined,
+        resourceAnalysis: analysis.resourceAnalysis
+            ? { result: analysis.resourceAnalysis.result }
+            : undefined,
+        scpAnalysis: analysis.scpAnalysis ? { result: analysis.scpAnalysis.result } : undefined,
+        rcpAnalysis: analysis.rcpAnalysis ? { result: analysis.rcpAnalysis.result } : undefined,
+        permissionBoundaryAnalysis: analysis.permissionBoundaryAnalysis
+            ? { result: analysis.permissionBoundaryAnalysis.result }
+            : undefined,
+        blockedBy: new Set(analysis.blockedBy)
+    };
+}
+/**
+ * Convert a full RequestAnalysis to a LightRequestAnalysis.
+ *
+ * @param executionResult - The denied execution result containing the RequestAnalysis to convert
+ * @returns A LightRequestAnalysis with only the essential fields
+ */
+export function toLightRequestAnalysis(executionResult) {
+    if (executionResult.type === 'denied_single') {
+        return {
+            type: 'single',
+            overallResult: executionResult.analysis.result,
+            ...toLightResourceAnalysis(executionResult.analysis)
+        };
+    }
+    // Wildcard case
+    const patterns = executionResult.deniedPatterns.map((details) => ({
+        pattern: details.pattern,
+        resourceType: details.resourceType,
+        ...toLightResourceAnalysis(details.analysis)
+    }));
+    return {
+        type: 'wildcard',
+        overallResult: executionResult.overallResult,
+        patterns
+    };
+}
+/**
+ * Gets the denial reasons for a denied SimulationResult.
+ *
+ * @param executionResult - The denied execution result containing the RequestAnalysis with denial reasons
+ * @returns A WhoCanDenyDetail object containing the denial reasons and other details to be returned to the user
+ */
+export function convertToDenialDetails(executionResult) {
+    const { principal, action } = executionResult.workItem;
+    const [service, actionName] = action.split(':');
+    if (executionResult.type === 'denied_single') {
+        return {
+            type: 'single',
+            principal,
+            service,
+            action: actionName,
+            details: getDenialReasons(executionResult.analysis)
+        };
+    }
+    // Wildcard case
+    return {
+        type: 'wildcard',
+        principal,
+        service,
+        action: actionName,
+        deniedResources: executionResult.deniedPatterns.map((pattern) => ({
+            pattern: pattern.pattern,
+            resourceType: pattern.resourceType,
+            details: getDenialReasons(pattern.analysis)
+        }))
+    };
+}
+//# sourceMappingURL=requestAnalysis.js.map

package/dist/esm/whoCan/requestAnalysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAnalysis.js","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAIjB,MAAM,2BAA2B,CAAA;AAsElC;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAyB;IACxD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;YAC7D,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,0BAA0B,CAAC,MAAM,EAAE;YACxD,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;KACvC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuD;IAEvD,IAAI,eAAe,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM;YAC9C,GAAG,uBAAuB,CAAC,eAAe,CAAC,QAAQ,CAAC;SACrD,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC;KAC7C,CAAC,CAAC,CAAA;IAEH,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,eAAe,CAAC,aAAa;QAC5C,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuD;IAEvD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAA;IACtD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAE/C,IAAI,eAAe,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,gBAAgB,CAAC,eAAe,CAAC,QAAQ,CAAC;SACpD,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,SAAS;QACT,OAAO;QACP,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5C,CAAC,CAAC;KACJ,CAAA;AACH,CAAC"}

package/dist/esm/whoCan/untrustingActions.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Get a set of actions that do not automatically trust the current account, in all lower case.
+ *
+ * @returns the set of actions that do not automatically trust the current account in all lower case
+ */
+export declare function actionsThatDoNotAutomaticallyTrustTheCurrentAccount(): Promise<Set<string>>;
+//# sourceMappingURL=untrustingActions.d.ts.map

package/dist/esm/whoCan/untrustingActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrustingActions.d.ts","sourceRoot":"","sources":["../../../src/whoCan/untrustingActions.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,wBAAsB,mDAAmD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAmBhG"}

package/dist/esm/whoCan/untrustingActions.js

@@ -0,0 +1,27 @@
+import { iamActionDetails, iamActionsForService } from '@actsecurity/iam-data';
+const kms = 'kms';
+const kmsKey = 'key';
+const stsAssumeRole = 'sts:AssumeRole';
+let cachedActions = undefined;
+/**
+ * Get a set of actions that do not automatically trust the current account, in all lower case.
+ *
+ * @returns the set of actions that do not automatically trust the current account in all lower case
+ */
+export async function actionsThatDoNotAutomaticallyTrustTheCurrentAccount() {
+    if (cachedActions) {
+        return cachedActions;
+    }
+    const kmsActions = await iamActionsForService(kms);
+    const allActions = new Set([stsAssumeRole.toLowerCase()]);
+    for (const action of kmsActions) {
+        const details = await iamActionDetails(kms, action);
+        if (details.resourceTypes.length === 1 &&
+            details.resourceTypes.some((rt) => rt.name === kmsKey)) {
+            allActions.add(`${kms}:${action.toLowerCase()}`);
+        }
+    }
+    cachedActions = allActions;
+    return allActions;
+}
+//# sourceMappingURL=untrustingActions.js.map

package/dist/esm/whoCan/untrustingActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrustingActions.js","sourceRoot":"","sources":["../../../src/whoCan/untrustingActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE9E,MAAM,GAAG,GAAG,KAAK,CAAA;AACjB,MAAM,MAAM,GAAG,KAAK,CAAA;AACpB,MAAM,aAAa,GAAG,gBAAgB,CAAA;AAEtC,IAAI,aAAa,GAA4B,SAAS,CAAA;AAEtD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mDAAmD;IACvE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACjE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnD,IACE,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAClC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EACtD,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,aAAa,GAAG,UAAU,CAAA;IAC1B,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/esm/whoCan/whoCan.d.ts

@@ -0,0 +1,295 @@
+import { type TopLevelConfig } from '@actsecurity/iam-collect';
+import { IamCollectClient } from '../collect/client.js';
+import { type ClientFactoryPlugin } from '../collect/collect.js';
+import { type ResourceType } from '@actsecurity/iam-data';
+import { type AllowedConditionExpression, type IgnoredConditions, type RequestDenial, type RequestGrant } from '@actsecurity/iam-simulate';
+import { type S3AbacOverride } from '../utils/s3Abac.js';
+import { type LightRequestAnalysis } from './requestAnalysis.js';
+import { type WorkerBootstrapPlugin } from './WhoCanProcessor.js';
+/**
+ * Limits the set of principals that `whoCan` tests. The scope is a union of
+ * principal ARNs, account IDs, and OU paths. It is **intersected** with the
+ * resource-policy-derived scope so that principals outside the resource
+ * policy's reach are still excluded.
+ */
+export interface WhoCanPrincipalScope {
+    /** Exact principal ARNs to test individually (does NOT expand to whole-account search). */
+    principals?: string[];
+    /** Account IDs — test all principals in these accounts. */
+    accounts?: string[];
+    /** OU paths — test all principals in accounts under these OUs. Each string is a slash-separated path like `o-aaa/r-bbb/ou-ccc`, matching the format used by `aws:PrincipalOrgPaths` and `specificOrganizationalUnits`. */
+    ous?: string[];
+}
+export interface ResourceAccessRequest {
+    /**
+     * The ARN of the resource to check access for. If not provided, actions must be specified.
+     */
+    resource?: string;
+    /**
+     * The account ID the resource belongs to.
+     * By default this will be looked up based on the resource ARN, but that may
+     * not be possible for all actions, such as wildcard actions like `s3:ListAllMyBuckets`.
+     */
+    resourceAccount?: string;
+    /**
+     * The actions to check access for. If not provided, actions will be looked up based on the resource ARN.
+     */
+    actions: string[];
+    /**
+     * Whether to sort the results for consistent output.
+     */
+    sort?: boolean;
+    /**
+     * An override for S3 ABAC being enabled when checking access to S3 Bucket resources.
+     */
+    s3AbacOverride?: S3AbacOverride;
+    /**
+     * The number of worker threads to use for simulations beyond the main thread.
+     * If not provided, defaults to number of CPUs - 1.
+     */
+    workerThreads?: number;
+    /**
+     * Deny details callback for simulations. If the callback returns true, deny details will be included for that simulation.
+     */
+    denyDetailsCallback?: (details: LightRequestAnalysis) => boolean;
+    /**
+     * If true, grant details will be collected for allowed simulations.
+     */
+    collectGrantDetails?: boolean;
+    /**
+     * Optional context keys to consider strict when running simulations for this whoCan request.
+     * These will be added to the simulation strict context keys used by default.
+     */
+    strictContextKeys?: string[];
+    /**
+     * Optional plugin to wrap the collect client with a custom implementation.
+     * Used for scenario testing where a layered client needs to be used in worker threads.
+     */
+    clientFactoryPlugin?: ClientFactoryPlugin;
+    /**
+     * Optional plugin that runs once per worker thread at startup before any work
+     * is processed. Use this for loading instrumentation, initializing logging
+     * context, or other worker-lifetime setup.
+     */
+    workerBootstrapPlugin?: WorkerBootstrapPlugin;
+    /**
+     * Optional scope to limit the set of principals tested. When provided, the
+     * scope is intersected with the resource-policy-derived scope to narrow the
+     * search space.
+     */
+    principalScope?: WhoCanPrincipalScope;
+    /**
+     * Whether to ignore an existing principal index. This is for testing purposes.
+     */
+    ignorePrincipalIndex?: boolean;
+}
+/**
+ * Represents a resource pattern that is allowed for a principal, used when wildcards
+ * are in the simulation request.
+ */
+export interface WhoCanAllowedResourcePattern {
+    /**
+     * The resource pattern that allows access.
+     */
+    pattern: string;
+    /**
+     * The resource type for the pattern.
+     */
+    resourceType: string;
+    /**
+     * The structured expression describing the conditions under which access is allowed
+     * for this pattern. Undefined when access is unconditional.
+     */
+    conditions?: AllowedConditionExpression;
+    /**
+     * Discovery-mode condition diagnostics that were ignored while determining this
+     * pattern could be allowed. This was returned in `conditions` in earlier versions.
+     */
+    ignoredConditions?: IgnoredConditions;
+    /**
+     * If true, access is only allowed when the session has a specific session name.
+     */
+    dependsOnSessionName?: boolean;
+    /**
+     * The policy statements that granted access for this resource pattern.
+     */
+    details?: RequestGrant[];
+}
+export interface WhoCanAllowed {
+    principal: string;
+    service: string;
+    action: string;
+    level: string;
+    /**
+     * The structured expression describing the conditions under which access is allowed.
+     * This will be undefined if access is allowed unconditionally or if `allowedPatterns`
+     * are provided.
+     */
+    conditions?: AllowedConditionExpression;
+    /**
+     * Discovery-mode condition diagnostics that were ignored while determining access
+     * could be allowed. This was returned in `conditions` in earlier versions.
+     */
+    ignoredConditions?: IgnoredConditions;
+    /**
+     * The resource type for the allowed action. This will be undefined if `allowedPatterns` are provided,
+     * since those patterns specify the resource type directly.
+     */
+    resourceType?: string;
+    /**
+     * If true, indicates that access is only allowed when the session has a specific session name.
+     * This will be false or undefined if `allowedPatterns` are provided, since those patterns would specify the session name condition directly.
+     */
+    dependsOnSessionName?: boolean;
+    /**
+     * If there are multiple "allowed" patterns for a single principal because of wildcards
+     * in the simulation request, this array will contain the different resource patterns that allow access.
+     */
+    allowedPatterns?: WhoCanAllowedResourcePattern[];
+    /**
+     * The policy statements that granted access for this result.
+     * Only populated for single resource simulations. For wildcard
+     * simulations, see `details` on each entry in `allowedPatterns`.
+     */
+    details?: RequestGrant[];
+}
+/**
+ * Base type for WhoCanDenyDetails
+ */
+interface BaseWhoCanDenyDetail {
+    /**
+     * The principal that was denied
+     */
+    principal: string;
+    /**
+     * The service the denied action belongs to
+     */
+    service: string;
+    /**
+     * The action that was denied, without the service prefix (e.g. "GetObject" instead of "s3:GetObject")
+     */
+    action: string;
+}
+/**
+ * Denial details for a single resource request.
+ */
+export interface SingleWhoCanDenyDetail extends BaseWhoCanDenyDetail {
+    type: 'single';
+    /**
+     * The specific details of why the request was denied
+     */
+    details: RequestDenial[];
+}
+/**
+ * Denial details for a wildcard resource request that may have matched multiple patterns.
+ */
+export interface WildcardWhoCanDenyDetail extends BaseWhoCanDenyDetail {
+    type: 'wildcard';
+    /**
+     * The resource patterns that were denied. Could be empty if there
+     * were no patterns found that matched the resource for the principal and action.
+     *
+     * The same pattern can be returned multiple times if there are multiple resource
+     * types for that pattern/action combination.
+     */
+    deniedResources: {
+        /**
+         * The pattern tested in the simulation that resulted in a denial.
+         */
+        pattern: string;
+        /**
+         * The resource type the pattern was tested against.
+         */
+        resourceType: string;
+        /**
+         * The specific details of why the request was denied for this pattern.
+         */
+        details: RequestDenial[];
+    }[];
+}
+/**
+ * Details on why a principal was denied access to a resource for a specific action, including the specific patterns that were tested and resulted in denials.
+ */
+export type WhoCanDenyDetail = SingleWhoCanDenyDetail | WildcardWhoCanDenyDetail;
+export interface WhoCanResponse {
+    simulationCount: number;
+    allowed: WhoCanAllowed[];
+    allAccountsChecked: boolean;
+    accountsNotFound: string[];
+    organizationsNotFound: string[];
+    organizationalUnitsNotFound: string[];
+    principalsNotFound: string[];
+    denyDetails?: WhoCanDenyDetail[] | undefined;
+}
+/**
+ * Processes a single whoCan request by creating a temporary WhoCanProcessor,
+ * enqueuing the request, waiting for it to settle, and shutting down. This
+ * preserves the original one-shot behavior where workers and cache are created
+ * and destroyed per call.
+ *
+ * For better performance when running multiple requests, use WhoCanProcessor
+ * directly to keep workers and cache alive across calls.
+ *
+ * @param collectConfigs the collect configurations for loading IAM data
+ * @param partition the AWS partition (e.g. 'aws', 'aws-cn')
+ * @param request the whoCan request parameters
+ * @returns the whoCan response with allowed principals and optional deny details
+ */
+export declare function whoCan(collectConfigs: TopLevelConfig[], partition: string, request: ResourceAccessRequest): Promise<WhoCanResponse>;
+export declare function uniqueAccountsToCheck(collectClient: IamCollectClient, accountsToCheck: AccountsToCheck): Promise<{
+    accountsNotFound: string[];
+    organizationsNotFound: string[];
+    organizationalUnitsNotFound: string[];
+    accounts: string[];
+}>;
+export interface AccountsToCheck {
+    allAccounts: boolean;
+    specificAccounts: string[];
+    specificPrincipals: string[];
+    specificOrganizations: string[];
+    specificOrganizationalUnits: string[];
+    checkAnonymous: boolean;
+    /**
+     * Whether every principal from the resource account should be checked.
+     */
+    checkAllFromResourceAccount: boolean;
+    /**
+     * Whether the resource policy explicitly grants access to principals in the
+     * resource account. This is true when:
+     * - The policy has no narrowing conditions (open wildcard or NotPrincipal), or
+     * - The policy conditions explicitly reference the resource account, or
+     * - The policy narrows to orgs/OUs (which may include the resource account).
+     */
+    resourceAccountTrustedByPolicy: boolean;
+}
+/**
+ * Derives the accounts and specific principals that should be considered from a resource policy.
+ *
+ * Specific STS session principals are resolved through collect data so account-enumeration
+ * paths can de-duplicate path-qualified roles that resolve from pathless session ARNs.
+ *
+ * @param resourcePolicy The resource policy document to inspect.
+ * @param resourceAccount The account ID that owns the resource, when known.
+ * @param collectClient The collect client used to resolve canonical principal ARNs.
+ * @returns The accounts, principals, organizations, and related flags to consider for whoCan.
+ */
+export declare function accountsToCheckBasedOnResourcePolicy(resourcePolicy: any, resourceAccount: string | undefined, collectClient: IamCollectClient): Promise<AccountsToCheck>;
+export declare function actionsForWhoCan(request: Pick<ResourceAccessRequest, 'actions' | 'resource'>): Promise<string[]>;
+/**
+ * Get the the possible resource types for an action and resource
+ *
+ * @param service the service the action belongs to
+ * @param action the action to get the resource type for
+ * @param resourceArn the resource type matching the action, if any
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
+ */
+export declare function lookupActionsForResourceArn(resourceArn: string): Promise<string[]>;
+export declare function findResourceTypeForArn(resourceArn: string): Promise<[string, ResourceType]>;
+/**
+ * Sort the results in a WhoCanResponse in place for consistent output
+ *
+ * @param whoCanResponse the WhoCanResponse to sort
+ */
+export declare function sortWhoCanResults(whoCanResponse: WhoCanResponse): void;
+export {};
+//# sourceMappingURL=whoCan.d.ts.map

package/dist/esm/whoCan/whoCan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoCan.d.ts","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAOL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,2BAA2B,CAAA;AAGlC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,0NAA0N;IAC1N,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IAEd;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;OAEG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAA;IAEhE;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAE7B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE5B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IAEzC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAA;IAErC;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,YAAY,EAAE,MAAM,CAAA;IAEpB;;;OAGG;IACH,UAAU,CAAC,EAAE,0BAA0B,CAAA;IAEvC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IAErC;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B;;OAEG;IACH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IAEb;;;;OAIG;IACH,UAAU,CAAC,EAAE,0BAA0B,CAAA;IAEvC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IAErC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B;;;OAGG;IACH,eAAe,CAAC,EAAE,4BAA4B,EAAE,CAAA;IAEhD;;;;OAIG;IACH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;CACzB;AAED;;GAEG;AACH,UAAU,oBAAoB;IAC5B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,IAAI,EAAE,QAAQ,CAAA;IAEd;;OAEG;IACH,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,IAAI,EAAE,UAAU,CAAA;IAEhB;;;;;;OAMG;IACH,eAAe,EAAE;QACf;;WAEG;QACH,OAAO,EAAE,MAAM,CAAA;QAEf;;WAEG;QACH,YAAY,EAAE,MAAM,CAAA;QAEpB;;WAEG;QACH,OAAO,EAAE,aAAa,EAAE,CAAA;KACzB,EAAE,CAAA;CACJ;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,GAAG,wBAAwB,CAAA;AAEhF,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,gBAAgB,EAAE,GAAG,SAAS,CAAA;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,MAAM,CAC1B,cAAc,EAAE,cAAc,EAAE,EAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAED,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,gBAAgB,EAC/B,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC;IACT,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CAAC,CAiDD;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,2BAA2B,EAAE,MAAM,EAAE,CAAA;IACrC,cAAc,EAAE,OAAO,CAAA;IACvB;;OAEG;IACH,2BAA2B,EAAE,OAAO,CAAA;IACpC;;;;;;OAMG;IACH,8BAA8B,EAAE,OAAO,CAAA;CACxC;AAoKD;;;;;;;;;;GAUG;AACH,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,GAAG,EACnB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,eAAe,CAAC,CA8L1B;AAyBD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,GAAG,UAAU,CAAC,GAC3D,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BnB;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBxF;AAED,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAsBjG;AAcD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,cAAc,QAyB/D"}