@actsecurity/iam-lens 0.1.163 → 0.1.165

package/dist/esm/simulate/contextKeys.js

@@ -1,7 +1,6 @@
 import { actionSupportsAwsResourceInfoContextKeys, bucketArn, convertAssumedRoleArnToRoleArn, isS3BucketOrObjectArn, splitArnParts } from '@actsecurity/iam-utils';
 import { IamCollectClient } from '../collect/client.js';
 import { isArnPrincipal, isServicePrincipal } from '../principals.js';
-import {} from './simulate.js';
 /**
  * Placeholder for the caller account AWS supplies on a service-mediated KMS request.
  *
@@ -40,6 +39,33 @@ export const CONTEXT_KEYS = {
     vpcEndpointOrgPaths: 'aws:VpceOrgPaths',
     vpcArn: 'aws:SourceVpcArn'
 };
+const anonymousPrincipalContextKeys = new Set([
+    'aws:assumedroot',
+    'aws:ec2instancesourceprivateipv4',
+    'aws:ec2instancesourcevpc',
+    'aws:federatedprovider',
+    'aws:multifactorauthage',
+    'aws:multifactorauthpresent',
+    'aws:sourceidentity',
+    'aws:tokenissuetime',
+    'aws:username',
+    'aws:userid',
+    'kms:calleraccount'
+]);
+/**
+ * Determine whether a context key requires an authenticated principal or its credentials.
+ *
+ * Anonymous requests cannot supply these keys as overrides because AWS treats the corresponding
+ * principal identity as absent. Principal-prefixed keys include fixed keys such as
+ * `aws:PrincipalArn` and dynamic keys such as `aws:PrincipalTag/team`.
+ *
+ * @param key context key name to classify
+ * @returns whether the key is unavailable to anonymous requests
+ */
+export function isAnonymousPrincipalContextKey(key) {
+    const normalizedKey = key.toLowerCase();
+    return (normalizedKey.startsWith('aws:principal') || anonymousPrincipalContextKeys.has(normalizedKey));
+}
 /**
  * Checks if a context has a specific key (case-insensitive).
  *
@@ -69,20 +95,22 @@ export function contextValue(context, key) {
  * @param service the service the request is for
  * @param contextKeyOverrides the context key overrides to apply
  * @param resolvedPrincipalArnForContext canonical principal ARN to use for role-backed context keys
+ * @param options controls collected resource metadata lookups
  * @returns a promise that resolves to the context keys for the simulation request
  */
-export async function createContextKeys(collectClient, simulationRequest, service, contextKeyOverrides, resolvedPrincipalArnForContext) {
+export async function createContextKeys(collectClient, simulationRequest, service, contextKeyOverrides, resolvedPrincipalArnForContext, options = {}) {
     const contextKeys = {
         'aws:SecureTransport': 'true',
         'aws:CurrentTime': new Date().toISOString(),
         'aws:EpochTime': Math.floor(Date.now() / 1000).toString()
     };
-    if (isArnPrincipal(simulationRequest.principal)) {
-        const arnParts = splitArnParts(simulationRequest.principal);
+    const principal = simulationRequest.principal;
+    if (principal && isArnPrincipal(principal)) {
+        const arnParts = splitArnParts(principal);
         const principalArnForContext = resolvedPrincipalArnForContext ??
             (arnParts.resourceType === 'assumed-role'
-                ? convertAssumedRoleArnToRoleArn(simulationRequest.principal)
-                : simulationRequest.principal);
+                ? convertAssumedRoleArnToRoleArn(principal)
+                : principal);
         contextKeys['aws:PrincipalArn'] = principalArnForContext;
         const principalAccountId = arnParts.accountId;
         contextKeys['aws:PrincipalAccount'] = arnParts.accountId || '';
@@ -100,13 +128,13 @@ export async function createContextKeys(collectClient, simulationRequest, servic
         if (service.toLowerCase() === 'kms') {
             contextKeys['kms:CallerAccount'] = principalAccountId;
         }
-        if (simulationRequest.principal.endsWith(':root')) {
+        if (principal.endsWith(':root')) {
             contextKeys['aws:PrincipalType'] = 'Account';
             contextKeys['aws:userid'] = principalAccountId;
         }
         else if (arnParts.resourceType === 'user') {
             contextKeys['aws:PrincipalType'] = 'User';
-            const userUniqueId = await collectClient.getUniqueIdForIamResource(simulationRequest.principal);
+            const userUniqueId = await collectClient.getUniqueIdForIamResource(principal);
             contextKeys['aws:userid'] = userUniqueId || 'UNKNOWN';
             const userName = arnParts.resourcePath?.split('/').at(-1);
             contextKeys['aws:username'] = userName;
@@ -120,7 +148,7 @@ export async function createContextKeys(collectClient, simulationRequest, servic
             //TODO: Set aws:userId for role principals
             if (arnParts.resourceType === 'assumed-role') {
                 const sessionName = arnParts.resourcePath?.split('/').at(-1);
-                const roleArn = convertAssumedRoleArnToRoleArn(simulationRequest.principal);
+                const roleArn = convertAssumedRoleArnToRoleArn(principal);
                 const roleUniqueId = await collectClient.getUniqueIdForIamResource(roleArn);
                 contextKeys['aws:userid'] = `${roleUniqueId || 'UNKNOWN'}:${sessionName}`;
             }
@@ -137,7 +165,7 @@ export async function createContextKeys(collectClient, simulationRequest, servic
         }
     }
     let resourceTagsAreKnown = false;
-    if (simulationRequest.resourceArn) {
+    if (simulationRequest.resourceArn && options.includeResourceMetadata !== false) {
         const isBucket = isS3BucketOrObjectArn(simulationRequest.resourceArn);
         const { tags: resourceTags, present: resourceTagsPreset } = await collectClient.getTagsForResource(isBucket ? bucketArn(simulationRequest.resourceArn) : simulationRequest.resourceArn, simulationRequest.resourceAccount);
         resourceTagsAreKnown = resourceTagsPreset;
@@ -149,9 +177,9 @@ export async function createContextKeys(collectClient, simulationRequest, servic
         }
     }
     //Service Principal context keys
-    if (isServicePrincipal(simulationRequest.principal)) {
+    if (principal && isServicePrincipal(principal)) {
         contextKeys['aws:PrincipalIsAWSService'] = 'true';
-        contextKeys['aws:PrincipalServiceName'] = simulationRequest.principal;
+        contextKeys['aws:PrincipalServiceName'] = principal;
         contextKeys['aws:SourceAccount'] = simulationRequest.resourceAccount;
         contextKeys['aws:SourceOwner'] = simulationRequest.resourceAccount;
         contextKeys['aws:SourceOrgID'] = contextKeys['aws:ResourceOrgID'];

package/dist/esm/simulate/contextKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,SAAS,EACT,8BAA8B,EAC9B,qBAAqB,EACrB,aAAa,EACd,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAA0B,MAAM,eAAe,CAAA;AAWtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,cAAc,CAAA;AAEzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IAEf,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IAEd,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IAEtB,2BAA2B;IAC3B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IAEf,mBAAmB;CACpB,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,eAAe;IACpB,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,kBAAkB;IACvC,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB,EAAE,GAAW;IAC7D,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB,EAAE,GAAW;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAA+B,EAC/B,iBAAoC,EACpC,OAAe,EACf,mBAAgC,EAChC,8BAAuC;IAEvC,MAAM,WAAW,GAAgB;QAC/B,qBAAqB,EAAE,MAAM;QAC7B,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAA;IAED,IAAI,cAAc,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAC3D,MAAM,sBAAsB,GAC1B,8BAA8B;YAC9B,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc;gBACvC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAC7D,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAClC,WAAW,CAAC,kBAAkB,CAAC,GAAG,sBAAsB,CAAA;QACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAU,CAAA;QAC9C,WAAW,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;QAE9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAA;YAEzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAA;YAC1F,WAAW,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,kBAAkB,CACrD,sBAAsB,EACtB,kBAAkB,CACnB,CAAA;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,WAAW,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;QAChD,CAAC;QAED,WAAW,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,CAAA;QACvD,CAAC;QAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,WAAW,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;YAC5C,WAAW,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAChD,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,WAAW,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;YACzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAChE,iBAAiB,CAAC,SAAS,CAC5B,CAAA;YACD,WAAW,CAAC,YAAY,CAAC,GAAG,YAAY,IAAI,SAAS,CAAA;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YAC1D,WAAW,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;QACxC,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtD,WAAW,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAA;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxF,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,0CAA0C;YAC1C,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;gBAC7D,MAAM,OAAO,GAAG,8BAA8B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;gBAC3E,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;gBAC3E,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAA;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,wCAAwC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,WAAW,CAAC,qBAAqB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QAEvE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,eAAgB,CAAC,CAAA;QAChG,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CACpE,iBAAiB,CAAC,eAAgB,CACnC,CAAA;YAED,WAAW,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,GACvD,MAAM,aAAa,CAAC,kBAAkB,CACpC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EACnF,iBAAiB,CAAC,eAAgB,CACnC,CAAA;QACH,oBAAoB,GAAG,kBAAkB,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,WAAW,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,WAAW,CAAC,gBAAgB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,WAAW,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAA;QACjD,WAAW,CAAC,0BAA0B,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAA;QACrE,WAAW,CAAC,mBAAmB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACrE,WAAW,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACnE,WAAW,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAA;QACjE,WAAW,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAEvE,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,2CAA2C,CAAA;QAChF,CAAC;QAED,IAAI,iBAAiB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACrD,8EAA8E;YAC9E,kFAAkF;YAClF,WAAW,CAAC,eAAe,CAAC,GAAG,+CAA+C,CAAA;QAChF,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;IAE1D,mFAAmF;IACnF,kFAAkF;IAClF,sBAAsB;IACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,WAAwB,EACxB,mBAAgC;IAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAChD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;QACD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzC,OAAO,WAAW,CAAC,YAAY,CAAC,CAAA;QAClC,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,OAAe,EACf,aAA+B;IAE/B,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,IAAI,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,CAAC,CAAC,aAAa,CAAA;IACtC,IAAI,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;IAEvD,iEAAiE;IACjE,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACnF,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,aAAa,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IACE,aAAa;QACb,OAAO,aAAa,KAAK,QAAQ;QACjC,mCAAmC,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC1F,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;QACpF,MAAM,uBAAuB,GAC3B,MAAM,aAAa,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAE3E,IAAI,kBAAkB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnF,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;QAC/D,CAAC;QACD,IAAI,gBAAgB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;QAC3D,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;QACvC,CAAC;QACD,IACE,gBAAgB;YAChB,uBAAuB;YACvB,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,EACzD,CAAC;YACD,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,GAAG,YAAY,CACtD,gBAAgB,EAChB,uBAAuB,CACxB,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,KAAK;IACL,KAAK;IACL,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,KAAK;IACL,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,KAAK;IACL,cAAc;IACd,aAAa;IACb,KAAK;IACL,QAAQ;IACR,sBAAsB;IACtB,OAAO;IACP,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,uCAAuC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAmB;IACtD,OAAO,CAAC,GAAG,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC"}
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wCAAwC,EACxC,SAAS,EACT,8BAA8B,EAC9B,qBAAqB,EACrB,aAAa,EACd,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAsBrE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,cAAc,CAAA;AAEzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IAEf,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IAEd,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IAEtB,2BAA2B;IAC3B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IAEf,mBAAmB;CACpB,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,eAAe;IACpB,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,kBAAkB;IACvC,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,iBAAiB;IACjB,kCAAkC;IAClC,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;IACxB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,YAAY;IACZ,mBAAmB;CACpB,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,CACL,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,aAAa,CAAC,CAC9F,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB,EAAE,GAAW;IAC7D,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB,EAAE,GAAW;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAA+B,EAC/B,iBAA4C,EAC5C,OAAe,EACf,mBAAgC,EAChC,8BAAuC,EACvC,UAAoC,EAAE;IAEtC,MAAM,WAAW,GAAgB;QAC/B,qBAAqB,EAAE,MAAM;QAC7B,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAA;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAA;IAC7C,IAAI,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QACzC,MAAM,sBAAsB,GAC1B,8BAA8B;YAC9B,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc;gBACvC,CAAC,CAAC,8BAA8B,CAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,SAAS,CAAC,CAAA;QAChB,WAAW,CAAC,kBAAkB,CAAC,GAAG,sBAAsB,CAAA;QACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAU,CAAA;QAC9C,WAAW,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;QAE9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAA;YAEzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAA;YAC1F,WAAW,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,kBAAkB,CACrD,sBAAsB,EACtB,kBAAkB,CACnB,CAAA;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,WAAW,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;QAChD,CAAC;QAED,WAAW,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,CAAA;QACvD,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,WAAW,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;YAC5C,WAAW,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAChD,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,WAAW,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;YACzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;YAC7E,WAAW,CAAC,YAAY,CAAC,GAAG,YAAY,IAAI,SAAS,CAAA;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YAC1D,WAAW,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;QACxC,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtD,WAAW,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAA;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxF,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,0CAA0C;YAC1C,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;gBAC7D,MAAM,OAAO,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAA;gBACzD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;gBAC3E,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAA;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,wCAAwC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,WAAW,CAAC,qBAAqB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QAEvE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,eAAgB,CAAC,CAAA;QAChG,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CACpE,iBAAiB,CAAC,eAAgB,CACnC,CAAA;YAED,WAAW,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,iBAAiB,CAAC,WAAW,IAAI,OAAO,CAAC,uBAAuB,KAAK,KAAK,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,GACvD,MAAM,aAAa,CAAC,kBAAkB,CACpC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EACnF,iBAAiB,CAAC,eAAgB,CACnC,CAAA;QACH,oBAAoB,GAAG,kBAAkB,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,WAAW,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,WAAW,CAAC,gBAAgB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,SAAS,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,WAAW,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAA;QACjD,WAAW,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAA;QACnD,WAAW,CAAC,mBAAmB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACrE,WAAW,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACnE,WAAW,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAA;QACjE,WAAW,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAEvE,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,2CAA2C,CAAA;QAChF,CAAC;QAED,IAAI,iBAAiB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACrD,8EAA8E;YAC9E,kFAAkF;YAClF,WAAW,CAAC,eAAe,CAAC,GAAG,+CAA+C,CAAA;QAChF,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;IAE1D,mFAAmF;IACnF,kFAAkF;IAClF,sBAAsB;IACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,WAAwB,EACxB,mBAAgC;IAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAChD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;QACD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzC,OAAO,WAAW,CAAC,YAAY,CAAC,CAAA;QAClC,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,OAAe,EACf,aAA+B;IAE/B,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,IAAI,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,CAAC,CAAC,aAAa,CAAA;IACtC,IAAI,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;IAEvD,iEAAiE;IACjE,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACnF,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,aAAa,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IACE,aAAa;QACb,OAAO,aAAa,KAAK,QAAQ;QACjC,mCAAmC,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC1F,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;QACpF,MAAM,uBAAuB,GAC3B,MAAM,aAAa,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAE3E,IAAI,kBAAkB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnF,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;QAC/D,CAAC;QACD,IAAI,gBAAgB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;QAC3D,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;QACvC,CAAC;QACD,IACE,gBAAgB;YAChB,uBAAuB;YACvB,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,EACzD,CAAC;YACD,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,GAAG,YAAY,CACtD,gBAAgB,EAChB,uBAAuB,CACxB,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,KAAK;IACL,KAAK;IACL,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,KAAK;IACL,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,KAAK;IACL,cAAc;IACd,aAAa;IACb,KAAK;IACL,QAAQ;IACR,sBAAsB;IACtB,OAAO;IACP,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,uCAAuC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAmB;IACtD,OAAO,CAAC,GAAG,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC"}

package/dist/esm/simulate/generatedPolicies.d.ts

@@ -0,0 +1,23 @@
+import { type ValidatedPolicy } from '@actsecurity/iam-policy';
+import type { InternalSimulationRequest, PrincipalPolicyInputs } from './simulate.js';
+export declare const syntheticResourcePolicyName = "iam-lens:synthetic-resource-allow-all";
+export declare const syntheticTrustPolicyName = "iam-lens:synthetic-trust-allow-all";
+export declare const syntheticIdentityPolicy: PrincipalPolicyInputs['identityPolicies'][number];
+export declare const syntheticTrustPolicy: {
+    readonly Version: "2012-10-17";
+    readonly Statement: {
+        readonly Effect: "Allow";
+        readonly Principal: "*";
+        readonly Action: "*";
+    };
+};
+/**
+ * Build and validate the caller-supplied or synthetic external resource policy.
+ *
+ * @param request the external-resource request
+ * @returns a validated resource or trust policy
+ */
+export declare function externalResourcePolicy(request: InternalSimulationRequest): ValidatedPolicy<{
+    name: string;
+}>;
+//# sourceMappingURL=generatedPolicies.d.ts.map

package/dist/esm/simulate/generatedPolicies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generatedPolicies.d.ts","sourceRoot":"","sources":["../../../src/simulate/generatedPolicies.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,KAAK,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAErF,eAAO,MAAM,2BAA2B,0CAA0C,CAAA;AAClF,eAAO,MAAM,wBAAwB,uCAAuC,CAAA;AAE5E,eAAO,MAAM,uBAAuB,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAU5E,CAAA;AAEV,eAAO,MAAM,oBAAoB;;;;;;;CAOvB,CAAA;AAEV;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,yBAAyB,GACjC,eAAe,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAanC"}

package/dist/esm/simulate/generatedPolicies.js

@@ -0,0 +1,56 @@
+import { createValidatedPolicy, validateResourcePolicy, validateTrustPolicy } from '@actsecurity/iam-policy';
+import { AssumeRoleActions } from '../utils/sts.js';
+export const syntheticResourcePolicyName = 'iam-lens:synthetic-resource-allow-all';
+export const syntheticTrustPolicyName = 'iam-lens:synthetic-trust-allow-all';
+export const syntheticIdentityPolicy = {
+    name: 'iam-lens:synthetic-identity-allow-all',
+    policy: {
+        Version: '2012-10-17',
+        Statement: {
+            Effect: 'Allow',
+            Action: '*',
+            Resource: '*'
+        }
+    }
+};
+export const syntheticTrustPolicy = {
+    Version: '2012-10-17',
+    Statement: {
+        Effect: 'Allow',
+        Principal: '*',
+        Action: '*'
+    }
+};
+/**
+ * Build and validate the caller-supplied or synthetic external resource policy.
+ *
+ * @param request the external-resource request
+ * @returns a validated resource or trust policy
+ */
+export function externalResourcePolicy(request) {
+    const useTrustPolicy = AssumeRoleActions.has(request.action.toLowerCase());
+    const policyDocument = request.resourcePolicy ??
+        (useTrustPolicy
+            ? syntheticTrustPolicy
+            : makeSyntheticResourcePolicy(request.resourceArn || '*'));
+    const name = useTrustPolicy ? syntheticTrustPolicyName : syntheticResourcePolicyName;
+    return createValidatedPolicy(policyDocument, useTrustPolicy ? validateTrustPolicy : validateResourcePolicy, { name });
+}
+/**
+ * Build the default resource policy for an external resource.
+ *
+ * @param resourceArn the concrete or wildcard resource to allow
+ * @returns an allow-all resource policy document
+ */
+function makeSyntheticResourcePolicy(resourceArn) {
+    return {
+        Version: '2012-10-17',
+        Statement: {
+            Effect: 'Allow',
+            Principal: '*',
+            Action: '*',
+            Resource: resourceArn
+        }
+    };
+}
+//# sourceMappingURL=generatedPolicies.js.map

package/dist/esm/simulate/generatedPolicies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generatedPolicies.js","sourceRoot":"","sources":["../../../src/simulate/generatedPolicies.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EAEpB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAGnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,uCAAuC,CAAA;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,oCAAoC,CAAA;AAE5E,MAAM,CAAC,MAAM,uBAAuB,GAAsD;IACxF,IAAI,EAAE,uCAAuC;IAC7C,MAAM,EAAE;QACN,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,GAAG;SACd;KACF;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,GAAG;KACZ;CACO,CAAA;AAEV;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAkC;IAElC,MAAM,cAAc,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC1E,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,cAAc;YACb,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,2BAA2B,CAAA;IACpF,OAAO,qBAAqB,CAC1B,cAAc,EACd,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,EAC7D,EAAE,IAAI,EAAE,CACT,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,WAAmB;IACtD,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,WAAW;SACtB;KACF,CAAA;AACH,CAAC"}

package/dist/esm/simulate/simulate.d.ts

@@ -1,9 +1,9 @@
 import { type DiscoveryContextKeyConstraint, type EvaluationResult, type RunSimulationResults, type Simulation, type SimulationMode } from '@actsecurity/iam-simulate';
-import { IamCollectClient } from '../collect/client.js';
+import { IamCollectClient, type SimulationOrgPolicies } from '../collect/client.js';
 import { type S3AbacOverride } from '../utils/s3Abac.js';
 import { type ContextKeys } from './contextKeys.js';
 /**
- * The request details for simulating an IAM request.
+ * The request details for simulating an IAM request from a collected principal.
  */
 export interface SimulationRequest {
     /**
@@ -31,10 +31,6 @@ export interface SimulationRequest {
      * The simulation mode to use for the request.
      */
     simulationMode: SimulationMode;
-    /**
-     * Whether to ignore missing principal errors.
-     */
-    ignoreMissingPrincipal?: boolean;
     /**
      * Override for S3 ABAC settings for the simulation.
      */
@@ -49,7 +45,31 @@ export interface SimulationRequest {
     additionalStrictContextKeys?: string[];
 }
 /**
- * The result of a simulation request, containing the original request and the simulation result.
+ * An unsigned simulation request against a concrete resource ARN.
+ * Anonymous requests have no identity, session, permission-boundary, or SCP inputs.
+ */
+export interface AnonymousSimulationRequest extends Omit<SimulationRequest, 'principal' | 'resourceArn' | 'sessionPolicy'> {
+    /**
+     * The concrete resource ARN to access. Anonymous wildcard-only requests are unsupported.
+     */
+    resourceArn: string;
+}
+/**
+ * A simulation request targeting a resource that is not expected to exist in the collected dataset.
+ */
+export interface ExternalResourceSimulationRequest extends Omit<SimulationRequest, 'resourceArn'> {
+    /**
+     * The concrete ARN of the resource outside the collected dataset.
+     */
+    resourceArn: string;
+    /**
+     * Optional raw resource policy, or trust policy for an STS assume-role action, to use instead of
+     * the synthetic allow-all policy.
+     */
+    resourcePolicy?: Record<string, unknown>;
+}
+/**
+ * The result of a simulation request, containing the normalized request and evaluation result.
  */
 export interface SimulateRequestResult {
     /**
@@ -62,29 +82,95 @@ export interface SimulateRequestResult {
     result: RunSimulationResults;
 }
 /**
- * Simulate an IAM request against the collected IAM data.
+ * Normalized request shape shared by authenticated and anonymous orchestration.
+ */
+export type InternalSimulationRequest = Omit<SimulationRequest, 'principal'> & {
+    /**
+     * Authenticated principal string, or undefined for an anonymous request.
+     */
+    principal: string | undefined;
+    /**
+     * Caller-supplied external resource or trust policy.
+     */
+    resourcePolicy?: Record<string, unknown>;
+};
+/**
+ * Fully prepared principal-side policy inputs for an iam-simulate request.
+ */
+export interface PrincipalPolicyInputs {
+    /**
+     * Identity policies applicable to the request principal.
+     */
+    identityPolicies: {
+        name: string;
+        policy: any;
+    }[];
+    /**
+     * Service control policy hierarchies applicable to the principal.
+     */
+    serviceControlPolicies: SimulationOrgPolicies[];
+    /**
+     * Permission boundary applicable to the principal, when one exists.
+     */
+    permissionBoundaryPolicies: {
+        name: string;
+        policy: any;
+    }[] | undefined;
+    /**
+     * RCP hierarchy for the principal account, used by collected wildcard-only requests.
+     */
+    principalAccountRcps: SimulationOrgPolicies[];
+}
+/**
+ * Simulate an IAM request using the collected policies for both the principal and resource.
  *
- * @param simulationRequest the simulation request details.
- * @param collectClient the IAM collect client to use for data access.
- * @returns the simulation result, including the request and the evaluation result.
+ * @param simulationRequest the simulation request details
+ * @param collectClient the IAM collect client to use for data access
+ * @returns the normalized request and simulation result
  */
 export declare function simulateRequest(simulationRequest: SimulationRequest, collectClient: IamCollectClient): Promise<SimulateRequestResult>;
 /**
- * Converts an iam-lens strict context key into an iam-simulate Discovery constraint.
+ * Simulate an unsigned request against a concrete resource ARN.
  *
- * Caller-provided keys are always authoritative. Other strict keys preserve the
- * existing behavior where both presence and value are authoritative. Service
- * source context keys are different during who-can discovery: iam-lens supplies
- * resource-derived placeholder values, but the actual source account/org for a
- * service principal request may differ. Treating those values as unknown lets
- * who-can return conditional access instead of incorrectly denying service-principal
- * statements.
+ * @param simulationRequest the anonymous request details
+ * @param collectClient the IAM collect client to use for data access
+ * @returns the normalized anonymous request and simulation result
+ */
+export declare function simulateAnonymousRequest(simulationRequest: AnonymousSimulationRequest, collectClient: IamCollectClient): Promise<SimulateRequestResult>;
+/**
+ * Simulate a request from an uncollected principal that has a synthetic administrator identity policy.
+ * SCPs and permission boundaries do not apply, while resource-side controls still apply.
+ * Wildcard-only actions are unsupported.
+ *
+ * @param simulationRequest the external principal request details
+ * @param collectClient the IAM collect client to use for resource-side data access
+ * @returns the normalized request and simulation result
+ */
+export declare function simulateExternalPrincipalRequest(simulationRequest: SimulationRequest, collectClient: IamCollectClient): Promise<SimulateRequestResult>;
+/**
+ * Simulate a collected principal accessing a resource outside the collected dataset.
+ * Wildcard-only actions are unsupported.
+ *
+ * @param simulationRequest the external resource request and optional resource/trust policy
+ * @param collectClient the IAM collect client to use for principal-side data access
+ * @returns the normalized request and simulation result
+ */
+export declare function simulateExternalResourceRequest(simulationRequest: ExternalResourceSimulationRequest, collectClient: IamCollectClient): Promise<SimulateRequestResult>;
+/**
+ * Convert an iam-lens strict context key into an iam-simulate Discovery constraint.
  *
  * @param keyName the literal context key or slash-delimited key pattern
- * @param simulationRequest the request whose context-key certainty is being modeled
+ * @param simulationRequest the normalized request whose context certainty is modeled
  * @returns the Discovery constraint to pass to iam-simulate
  * @internal
  */
-export declare function discoveryConstraintForStrictKey(keyName: string, simulationRequest: SimulationRequest): DiscoveryContextKeyConstraint;
+export declare function discoveryConstraintForStrictKey(keyName: string, simulationRequest: Pick<InternalSimulationRequest, 'customContextKeys' | 'simulationMode' | 'principal'>): DiscoveryContextKeyConstraint;
+/**
+ * Compare an actual simulation decision with an optional expected result.
+ *
+ * @param expected expected result or AnyDeny
+ * @param result actual evaluation result
+ * @returns whether the result satisfies the expectation
+ */
 export declare function resultMatchesExpectation(expected: EvaluationResult | 'AnyDeny' | undefined, result: EvaluationResult): boolean;
 //# sourceMappingURL=simulate.d.ts.map

package/dist/esm/simulate/simulate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simulate.d.ts","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AAQlC,OAAO,EAAE,gBAAgB,EAA8B,MAAM,sBAAsB,CAAA;AAanF,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAEL,KAAK,WAAW,EAIjB,MAAM,kBAAkB,CAAA;AAIzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAE/B;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAGjB;;;OAGG;IACH,iBAAiB,EAAE,WAAW,CAAA;IAE9B;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,CAAA;IAEnB;;OAEG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAE9B;;OAEG;IACH,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA+LhC;AAID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,iBAAiB,GACnC,6BAA6B,CAuC/B;AAsLD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAClD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT"}
+{"version":3,"file":"simulate.d.ts","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AAQlC,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAanF,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAEL,KAAK,WAAW,EAKjB,MAAM,kBAAkB,CAAA;AAKzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAE/B;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;OAGG;IACH,iBAAiB,EAAE,WAAW,CAAA;IAE9B;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,CAAA;IAEnB;;OAEG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,iBAAiB,EACjB,WAAW,GAAG,aAAa,GAAG,eAAe,CAC9C;IACC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iCAAkC,SAAQ,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAC/F;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAE9B;;OAEG;IACH,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAOD;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAC7E;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzC,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,CAAA;IAEjD;;OAEG;IACH,sBAAsB,EAAE,qBAAqB,EAAE,CAAA;IAE/C;;OAEG;IACH,0BAA0B,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,GAAG,SAAS,CAAA;IAEvE;;OAEG;IACH,oBAAoB,EAAE,qBAAqB,EAAE,CAAA;CAC9C;AAiBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,iBAAiB,EAAE,0BAA0B,EAC7C,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAMhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,iBAAiB,EAAE,iCAAiC,EACpD,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAwXD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,IAAI,CACrB,yBAAyB,EACzB,mBAAmB,GAAG,gBAAgB,GAAG,WAAW,CACrD,GACA,6BAA6B,CA6B/B;AAoLD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAClD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT"}