@actsecurity/iam-policy 0.1.109

package/dist/cjs/lint/lint.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lintPolicy = lintPolicy;
+exports.lintResourcePolicy = lintResourcePolicy;
+exports.findEmptyActions = findEmptyActions;
+exports.findDuplicateSids = findDuplicateSids;
+const validate_js_1 = require("../validate/validate.js");
+const validateTypes_js_1 = require("../validate/validateTypes.js");
+/**
+ * Lints an IAM policy document by running all syntax validation checks from
+ * {@link validatePolicySyntax} plus additional best-practice checks that AWS
+ * technically allows but that may indicate authoring mistakes.
+ *
+ * @param policyDocument - the raw policy document object to lint
+ * @param validationCallbacks - optional callbacks to customize validation behavior per policy type
+ * @returns an array of validation errors including both syntax errors and lint warnings
+ */
+function lintPolicy(policyDocument, validationCallbacks = {}) {
+    const allErrors = (0, validate_js_1.validatePolicySyntax)(policyDocument, validationCallbacks);
+    allErrors.push(...findDuplicateSids(policyDocument));
+    allErrors.push(...findEmptyActions(policyDocument));
+    return allErrors;
+}
+/**
+ * Lints a resource policy document. Runs the resource-policy syntax validation
+ * plus the generic lint rules and the resource-policy-specific check for
+ * statements missing both `Principal` and `NotPrincipal`. AWS accepts such
+ * statements syntactically, but they can never match a request.
+ *
+ * @param policyDocument - the raw resource policy document to lint
+ * @returns an array of validation errors including syntax errors and lint warnings
+ */
+function lintResourcePolicy(policyDocument) {
+    const errors = (0, validateTypes_js_1.validateResourcePolicy)(policyDocument);
+    errors.push(...findDuplicateSids(policyDocument));
+    errors.push(...findEmptyActions(policyDocument));
+    errors.push(...findStatementsWithoutPrincipal(policyDocument));
+    return errors;
+}
+/**
+ * Finds statements in a resource policy that have neither a `Principal` nor a
+ * `NotPrincipal` element. AWS accepts these syntactically but they can never
+ * match a request, which is almost always an authoring mistake.
+ *
+ * @param policyDocument - the raw resource policy document to check
+ * @returns an array of validation errors, one for each statement missing both Principal and NotPrincipal
+ */
+function findStatementsWithoutPrincipal(policyDocument) {
+    if (typeof policyDocument !== 'object' || policyDocument === null) {
+        return [];
+    }
+    const rawStatements = policyDocument.Statement;
+    if (rawStatements === undefined) {
+        return [];
+    }
+    const statements = Array.isArray(rawStatements) ? rawStatements : [rawStatements];
+    const isArray = Array.isArray(rawStatements);
+    const errors = [];
+    for (let i = 0; i < statements.length; i++) {
+        const statement = statements[i];
+        if (typeof statement !== 'object' || statement === null) {
+            continue;
+        }
+        if (statement.Principal === undefined && statement.NotPrincipal === undefined) {
+            errors.push({
+                path: isArray ? `Statement[${i}]` : 'Statement',
+                message: 'One of Principal or NotPrincipal is required in a resource policy'
+            });
+        }
+    }
+    return errors;
+}
+/**
+ * Checks a single action string for issues with the action part after the
+ * colon. Flags two cases:
+ * - Empty or whitespace-only action (e.g. "s3:" or "s3:   ")
+ * - Action containing whitespace (e.g. "s3:GetObject   " or "s3: GetObject")
+ *
+ * AWS technically allows these, but they almost always indicate authoring
+ * mistakes.
+ *
+ * @param action - the raw action string value
+ * @param path - the JSON-path location of this action in the policy document
+ * @returns an array of validation errors for any issues found
+ */
+function lintActionString(action, path) {
+    if (typeof action !== 'string') {
+        return [];
+    }
+    const colonIndex = action.indexOf(':');
+    if (colonIndex === -1 || action.indexOf(':', colonIndex + 1) !== -1) {
+        return [];
+    }
+    const actionName = action.slice(colonIndex + 1);
+    if (actionName.trim().length === 0) {
+        return [
+            {
+                path,
+                message: 'Action is empty for the service'
+            }
+        ];
+    }
+    if (actionName !== actionName.trim()) {
+        return [
+            {
+                path,
+                message: 'Action contains whitespace'
+            }
+        ];
+    }
+    return [];
+}
+/**
+ * Finds actions in a policy document that have the format "service:" — a
+ * service prefix followed by a colon but no action name. AWS allows this
+ * but it likely indicates an authoring mistake.
+ *
+ * @param policyDocument - the raw policy document object to check
+ * @returns an array of validation errors, one for each action that has an empty action part
+ */
+function findEmptyActions(policyDocument) {
+    if (typeof policyDocument !== 'object' || policyDocument === null) {
+        return [];
+    }
+    const statements = Array.isArray(policyDocument.Statement)
+        ? policyDocument.Statement
+        : policyDocument.Statement !== undefined
+            ? [policyDocument.Statement]
+            : [];
+    const errors = [];
+    for (let i = 0; i < statements.length; i++) {
+        const statement = statements[i];
+        if (typeof statement !== 'object' || statement === null) {
+            continue;
+        }
+        const basePath = Array.isArray(policyDocument.Statement) ? `Statement[${i}]` : 'Statement';
+        for (const field of ['Action', 'NotAction']) {
+            const value = statement[field];
+            if (value === undefined) {
+                continue;
+            }
+            const fieldPath = `${basePath}.${field}`;
+            if (typeof value === 'string') {
+                errors.push(...lintActionString(value, fieldPath));
+            }
+            else if (Array.isArray(value)) {
+                for (let j = 0; j < value.length; j++) {
+                    errors.push(...lintActionString(value[j], `${fieldPath}[${j}]`));
+                }
+            }
+        }
+    }
+    return errors;
+}
+/**
+ * Finds duplicate Statement Ids (Sid) within a policy document.
+ *
+ * AWS allows duplicate Sids in resource policies, but they can indicate
+ * copy-paste mistakes or authoring errors.
+ *
+ * @param policyDocument - the raw policy document object to check
+ * @returns an array of validation errors, one for each statement that shares a duplicate Sid
+ */
+function findDuplicateSids(policyDocument) {
+    if (typeof policyDocument !== 'object' || !Array.isArray(policyDocument?.Statement)) {
+        return [];
+    }
+    const statementIdCounts = policyDocument.Statement.reduce((acc, statement, index) => {
+        if (statement.Sid) {
+            if (!acc[statement.Sid]) {
+                acc[statement.Sid] = [];
+            }
+            acc[statement.Sid].push(`Statement[${index}].Sid`);
+        }
+        return acc;
+    }, {});
+    const errors = [];
+    for (const [, paths] of Object.entries(statementIdCounts)) {
+        if (paths.length > 1) {
+            for (const path of paths) {
+                errors.push({
+                    path,
+                    message: `Statement Ids (Sid) must be unique`
+                });
+            }
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=lint.js.map

package/dist/cjs/lint/lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../../src/lint/lint.ts"],"names":[],"mappings":";;AAgBA,gCAQC;AAWD,gDAMC;AAyFD,4CAoCC;AAWD,8CA8BC;AA/MD,yDAIgC;AAChC,mEAAqE;AAErE;;;;;;;;GAQG;AACH,SAAgB,UAAU,CACxB,cAAmB,EACnB,sBAA2C,EAAE;IAE7C,MAAM,SAAS,GAAG,IAAA,kCAAoB,EAAC,cAAc,EAAE,mBAAmB,CAAC,CAAA;IAC3E,SAAS,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAA;IACpD,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAA;IACnD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAAC,cAAmB;IACpD,MAAM,MAAM,GAAG,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAA;IACrD,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAA;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAA;IAChD,MAAM,CAAC,IAAI,CAAC,GAAG,8BAA8B,CAAC,cAAc,CAAC,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CAAC,cAAmB;IACzD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAClE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAA;IAC9C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IACjF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,SAAQ;QACV,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW;gBAC/C,OAAO,EAAE,mEAAmE;aAC7E,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAY;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;IAC/C,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;YACL;gBACE,IAAI;gBACJ,OAAO,EAAE,iCAAiC;aAC3C;SACF,CAAA;IACH,CAAC;IACD,IAAI,UAAU,KAAK,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,OAAO;YACL;gBACE,IAAI;gBACJ,OAAO,EAAE,4BAA4B;aACtC;SACF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,cAAmB;IAClD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAClE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;QACxD,CAAC,CAAC,cAAc,CAAC,SAAS;QAC1B,CAAC,CAAC,cAAc,CAAC,SAAS,KAAK,SAAS;YACtC,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC;YAC5B,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAA;QAE1F,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAQ;YACV,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAA;YACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;YACpD,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,cAAmB;IACnD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,CACvD,CAAC,GAA6B,EAAE,SAAc,EAAE,KAAa,EAAE,EAAE;QAC/D,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAA;YACzB,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,EACD,EAA8B,CAC/B,CAAA;IAED,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAW,iBAAiB,CAAC,EAAE,CAAC;QACpE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI;oBACJ,OAAO,EAAE,oCAAoC;iBAC9C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+    "type": "commonjs"
+}

package/dist/cjs/parser.d.ts

@@ -0,0 +1,13 @@
+import { type Policy } from './policies/policy.js';
+/**
+ * Load a Policy from a policy document. If a {@link ValidatedPolicy} is passed,
+ * the raw document and metadata are extracted from it automatically. When both
+ * the ValidatedPolicy carries metadata and the caller supplies explicit metadata,
+ * the explicit metadata takes precedence.
+ *
+ * @param policyDocument the policy document JSON object, or a ValidatedPolicy
+ * @param metadata optional metadata to attach to the loaded Policy
+ * @returns the Policy object for the backing policy document
+ */
+export declare function loadPolicy<T = undefined>(policyDocument: any, metadata?: T): Policy<T>;
+//# sourceMappingURL=parser.d.ts.map

package/dist/cjs/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,sBAAsB,CAAA;AAG9D;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,CAAC,GAAG,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAKtF"}

package/dist/cjs/parser.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPolicy = loadPolicy;
+const policy_js_1 = require("./policies/policy.js");
+const validatedPolicy_js_1 = require("./validatedPolicy.js");
+/**
+ * Load a Policy from a policy document. If a {@link ValidatedPolicy} is passed,
+ * the raw document and metadata are extracted from it automatically. When both
+ * the ValidatedPolicy carries metadata and the caller supplies explicit metadata,
+ * the explicit metadata takes precedence.
+ *
+ * @param policyDocument the policy document JSON object, or a ValidatedPolicy
+ * @param metadata optional metadata to attach to the loaded Policy
+ * @returns the Policy object for the backing policy document
+ */
+function loadPolicy(policyDocument, metadata) {
+    if ((0, validatedPolicy_js_1.isValidatedPolicy)(policyDocument)) {
+        return new policy_js_1.PolicyImpl(policyDocument.policyDocument, metadata ?? policyDocument.metadata);
+    }
+    return new policy_js_1.PolicyImpl(policyDocument, metadata);
+}
+//# sourceMappingURL=parser.js.map

package/dist/cjs/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/parser.ts"],"names":[],"mappings":";;AAaA,gCAKC;AAlBD,oDAA8D;AAC9D,6DAAwD;AAExD;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAgB,cAAmB,EAAE,QAAY;IACzE,IAAI,IAAA,sCAAiB,EAAC,cAAc,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,sBAAU,CAAC,cAAc,CAAC,cAAc,EAAE,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC3F,CAAC;IACD,OAAO,IAAI,sBAAU,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AACjD,CAAC"}

package/dist/cjs/policies/policy.d.ts

@@ -0,0 +1,41 @@
+import { type Statement } from '../statements/statement.js';
+export interface Policy<T = undefined> {
+    /**
+     * The version of the policy
+     */
+    version(): string | undefined;
+    /**
+     * The ID of the policy
+     */
+    id(): string | undefined;
+    /**
+     * The statements in the policy
+     */
+    statements(): Statement[];
+    /**
+     * Whether the statement is an array
+     */
+    statementIsArray(): boolean;
+    /**
+     * The raw policy object as JSON
+     */
+    toJSON(): any;
+    /**
+     * Metadata is any object to store additional information about the policy.
+     * Up to you as a user to define the type of the metadata and is optional.
+     */
+    metadata(): T;
+}
+export declare class PolicyImpl<T = undefined> implements Policy<T> {
+    private readonly policyObject;
+    private readonly theMetadata?;
+    constructor(policyObject: any, theMetadata?: T | undefined);
+    version(): string | undefined;
+    id(): string | undefined;
+    statements(): Statement[];
+    private newStatements;
+    statementIsArray(): boolean;
+    toJSON(): any;
+    metadata(): T;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/cjs/policies/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/policies/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAiB,MAAM,4BAA4B,CAAA;AAE1E,MAAM,WAAW,MAAM,CAAC,CAAC,GAAG,SAAS;IACnC;;OAEG;IACH,OAAO,IAAI,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,EAAE,IAAI,MAAM,GAAG,SAAS,CAAA;IAExB;;OAEG;IACH,UAAU,IAAI,SAAS,EAAE,CAAA;IAEzB;;OAEG;IACH,gBAAgB,IAAI,OAAO,CAAA;IAE3B;;OAEG;IACH,MAAM,IAAI,GAAG,CAAA;IAEb;;;OAGG;IACH,QAAQ,IAAI,CAAC,CAAA;CACd;AAED,qBAAa,UAAU,CAAC,CAAC,GAAG,SAAS,CAAE,YAAW,MAAM,CAAC,CAAC,CAAC;IAEvD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBADZ,YAAY,EAAE,GAAG,EACjB,WAAW,CAAC,EAAE,CAAC,YAAA;IAG3B,OAAO,IAAI,MAAM,GAAG,SAAS;IAI7B,EAAE,IAAI,MAAM,GAAG,SAAS;IAIxB,UAAU,IAAI,SAAS,EAAE;IAIhC,OAAO,CAAC,aAAa;IASd,gBAAgB,IAAI,OAAO;IAI3B,MAAM,IAAI,GAAG;IAIb,QAAQ,IAAI,CAAC;CAGrB"}

package/dist/cjs/policies/policy.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyImpl = void 0;
+const statement_js_1 = require("../statements/statement.js");
+class PolicyImpl {
+    policyObject;
+    theMetadata;
+    constructor(policyObject, theMetadata) {
+        this.policyObject = policyObject;
+        this.theMetadata = theMetadata;
+    }
+    version() {
+        return this.policyObject.Version;
+    }
+    id() {
+        return this.policyObject.Id;
+    }
+    statements() {
+        return this.newStatements();
+    }
+    newStatements() {
+        if (!this.statementIsArray()) {
+            return [new statement_js_1.StatementImpl(this.policyObject.Statement, 1, { path: 'Statement' })];
+        }
+        return [this.policyObject.Statement].flat().map((statement, index) => {
+            return new statement_js_1.StatementImpl(statement, index + 1, { path: `Statement[${index}]` });
+        });
+    }
+    statementIsArray() {
+        return Array.isArray(this.policyObject.Statement);
+    }
+    toJSON() {
+        return this.policyObject;
+    }
+    metadata() {
+        return this.theMetadata;
+    }
+}
+exports.PolicyImpl = PolicyImpl;
+//# sourceMappingURL=policy.js.map

package/dist/cjs/policies/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/policies/policy.ts"],"names":[],"mappings":";;;AAAA,6DAA0E;AAmC1E,MAAa,UAAU;IAEF;IACA;IAFnB,YACmB,YAAiB,EACjB,WAAe;QADf,iBAAY,GAAZ,YAAY,CAAK;QACjB,gBAAW,GAAX,WAAW,CAAI;IAC/B,CAAC;IAEG,OAAO;QACZ,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAA;IAClC,CAAC;IAEM,EAAE;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,CAAA;IAC7B,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,aAAa,EAAE,CAAA;IAC7B,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,4BAAa,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QACnF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,SAAc,EAAE,KAAK,EAAE,EAAE;YACxE,OAAO,IAAI,4BAAa,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,KAAK,GAAG,EAAE,CAAC,CAAA;QACjF,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,gBAAgB;QACrB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC;IAEM,MAAM;QACX,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAEM,QAAQ;QACb,OAAO,IAAI,CAAC,WAAgB,CAAA;IAC9B,CAAC;CACF;AAtCD,gCAsCC"}

package/dist/cjs/principals/principal.d.ts

@@ -0,0 +1,122 @@
+export type PrincipalType = 'AWS' | 'Service' | 'Federated' | 'CanonicalUser';
+/**
+ * A Principal in a policy statement
+ */
+export interface Principal {
+    /**
+     * The type of principal, such as "AWS", "Service", "Federated", "CanonicalUser"
+     */
+    type(): PrincipalType;
+    /**
+     * The raw string of the principal
+     */
+    value(): string;
+    /**
+     * Whether the principal is a wildcard principal: `"*"`
+     */
+    isWildcardPrincipal(): this is WildcardPrincipal;
+    /**
+     * Whether the principal is an AWS principal
+     */
+    isServicePrincipal(): this is ServicePrincipal;
+    /**
+     * Whether the principal is an AWS principal that is not an account or wildcard principal
+     */
+    isAwsPrincipal(): this is AwsPrincipal;
+    /**
+     * Whether the principal is a unique id principal
+     */
+    isUniqueIdPrincipal(): this is UniqueIdPrincipal;
+    /**
+     * Whether the principal is a federated principal
+     */
+    isFederatedPrincipal(): this is FederatedPrincipal;
+    /**
+     * Whether the principal is a canonical user principal
+     */
+    isCanonicalUserPrincipal(): this is CanonicalUserPrincipal;
+    /**
+     * Whether the principal is an account principal
+     */
+    isAccountPrincipal(): this is AccountPrincipal;
+}
+/**
+ * A wildcard principal: `"*"`
+ */
+export interface WildcardPrincipal extends Principal {
+    /**
+     * The wildcard character `"*"`, this exists to differentiate between this interface and the Principal interface
+     */
+    wildcard(): '*';
+}
+/**
+ * An AWS principal: `"arn:aws:iam::account-id:root"` or a 12 digit account id
+ */
+export interface AccountPrincipal extends Principal {
+    /**
+     * The 12 digit account id of the principal
+     */
+    accountId(): string;
+}
+/**
+ * An AWS principal this is an ARN that is not an account or wildcard principal
+ */
+export interface AwsPrincipal extends Principal {
+    arn(): string;
+}
+/**
+ * An AWS principal that is a unique Id
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids
+ */
+export interface UniqueIdPrincipal extends Principal {
+    uniqueId(): string;
+}
+/**
+ * An AWS principal that is a service principal: `"service"`
+ */
+export interface ServicePrincipal extends Principal {
+    /**
+     * The service the principal represents
+     */
+    service(): string;
+}
+/**
+ * A federated principal
+ */
+export interface FederatedPrincipal extends Principal {
+    /**
+     * The id of the federated principal
+     */
+    federated(): string;
+}
+/**
+ * A canonical user principal
+ */
+export interface CanonicalUserPrincipal extends Principal {
+    /**
+     * The canonical user id of the principal
+     */
+    canonicalUser(): string;
+}
+export declare class PrincipalImpl implements Principal, WildcardPrincipal, AccountPrincipal, UniqueIdPrincipal, AwsPrincipal, ServicePrincipal, FederatedPrincipal, CanonicalUserPrincipal {
+    private readonly principalType;
+    private readonly principalId;
+    constructor(principalType: PrincipalType, principalId: string);
+    value(): string;
+    type(): PrincipalType;
+    isWildcardPrincipal(): this is WildcardPrincipal;
+    isAccountPrincipal(): this is AccountPrincipal;
+    isUniqueIdPrincipal(): this is UniqueIdPrincipal;
+    isAwsPrincipal(): this is AwsPrincipal;
+    isServicePrincipal(): this is ServicePrincipal;
+    isFederatedPrincipal(): this is FederatedPrincipal;
+    isCanonicalUserPrincipal(): this is CanonicalUserPrincipal;
+    wildcard(): '*';
+    accountId(): string;
+    uniqueId(): string;
+    arn(): string;
+    service(): string;
+    federated(): string;
+    canonicalUser(): string;
+}
+//# sourceMappingURL=principal.d.ts.map

package/dist/cjs/principals/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../../src/principals/principal.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,WAAW,GAAG,eAAe,CAAA;AAE7E;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,IAAI,IAAI,aAAa,CAAA;IAErB;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,mBAAmB,IAAI,IAAI,IAAI,iBAAiB,CAAA;IAEhD;;OAEG;IACH,kBAAkB,IAAI,IAAI,IAAI,gBAAgB,CAAA;IAE9C;;OAEG;IACH,cAAc,IAAI,IAAI,IAAI,YAAY,CAAA;IAEtC;;OAEG;IACH,mBAAmB,IAAI,IAAI,IAAI,iBAAiB,CAAA;IAEhD;;OAEG;IACH,oBAAoB,IAAI,IAAI,IAAI,kBAAkB,CAAA;IAElD;;OAEG;IACH,wBAAwB,IAAI,IAAI,IAAI,sBAAsB,CAAA;IAE1D;;OAEG;IACH,kBAAkB,IAAI,IAAI,IAAI,gBAAgB,CAAA;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD;;OAEG;IACH,QAAQ,IAAI,GAAG,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,GAAG,IAAI,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,QAAQ,IAAI,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,SAAS;IACvD;;OAEG;IACH,aAAa,IAAI,MAAM,CAAA;CACxB;AAMD,qBAAa,aACX,YACE,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB;IAGtB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,MAAM;IAG/B,KAAK,IAAI,MAAM;IAIf,IAAI,IAAI,aAAa;IAIrB,mBAAmB,IAAI,IAAI,IAAI,iBAAiB;IAIhD,kBAAkB,IAAI,IAAI,IAAI,gBAAgB;IAO9C,mBAAmB,IAAI,IAAI,IAAI,iBAAiB;IAOhD,cAAc,IAAI,IAAI,IAAI,YAAY;IAYtC,kBAAkB,IAAI,IAAI,IAAI,gBAAgB;IAI9C,oBAAoB,IAAI,IAAI,IAAI,kBAAkB;IAIlD,wBAAwB,IAAI,IAAI,IAAI,sBAAsB;IAI1D,QAAQ,IAAI,GAAG;IASf,SAAS,IAAI,MAAM;IAYnB,QAAQ,IAAI,MAAM;IASlB,GAAG,IAAI,MAAM;IASb,OAAO,IAAI,MAAM;IASjB,SAAS,IAAI,MAAM;IASnB,aAAa,IAAI,MAAM;CAQ/B"}

package/dist/cjs/principals/principal.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrincipalImpl = void 0;
+const utils_js_1 = require("../utils.js");
+const accountIdRegex = /^[0-9]{12}$/;
+const accountArnRegex = /^arn:.*?:iam::[0-9]{12}:root$/;
+const uniqueIdRegex = /^A[0-9A-Z]+$/;
+class PrincipalImpl {
+    principalType;
+    principalId;
+    constructor(principalType, principalId) {
+        this.principalType = principalType;
+        this.principalId = principalId;
+    }
+    value() {
+        return this.principalId;
+    }
+    type() {
+        return this.principalType;
+    }
+    isWildcardPrincipal() {
+        return this.principalType === 'AWS' && (0, utils_js_1.isAllWildcards)(this.principalId);
+    }
+    isAccountPrincipal() {
+        if (this.principalType !== 'AWS') {
+            return false;
+        }
+        return accountIdRegex.test(this.principalId) || accountArnRegex.test(this.principalId);
+    }
+    isUniqueIdPrincipal() {
+        if (this.principalType !== 'AWS') {
+            return false;
+        }
+        return uniqueIdRegex.test(this.principalId);
+    }
+    isAwsPrincipal() {
+        if (this.principalType !== 'AWS') {
+            return false;
+        }
+        const anyThis = this;
+        return (!(0, utils_js_1.isAllWildcards)(anyThis.principalId) &&
+            !anyThis.isAccountPrincipal() &&
+            !anyThis.isUniqueIdPrincipal());
+    }
+    isServicePrincipal() {
+        return this.principalType === 'Service';
+    }
+    isFederatedPrincipal() {
+        return this.principalType === 'Federated';
+    }
+    isCanonicalUserPrincipal() {
+        return this.principalType === 'CanonicalUser';
+    }
+    wildcard() {
+        if (!this.isWildcardPrincipal()) {
+            throw new Error('Principal is not a wildcard principal, call isWildcardPrincipal() before calling wildcard()');
+        }
+        return '*';
+    }
+    accountId() {
+        if (!this.isAccountPrincipal()) {
+            throw new Error('Principal is not an account principal, call isAccountPrincipal() before calling accountId()');
+        }
+        if (accountArnRegex.test(this.principalId)) {
+            return (0, utils_js_1.delimitedSegmentAt)(this.principalId, ':', 4);
+        }
+        return this.principalId;
+    }
+    uniqueId() {
+        if (!this.isUniqueIdPrincipal()) {
+            throw new Error('Principal is not a unique id principal, call isUniqueIdPrincipal() before calling uniqueId()');
+        }
+        return this.principalId;
+    }
+    arn() {
+        if (!this.isAwsPrincipal()) {
+            throw new Error('Principal is not an AWS principal, call isAwsPrincipal() before calling arn()');
+        }
+        return this.principalId;
+    }
+    service() {
+        if (!this.isServicePrincipal()) {
+            throw new Error('Principal is not a service principal, call isServicePrincipal() before calling service()');
+        }
+        return this.principalId;
+    }
+    federated() {
+        if (this.principalType !== 'Federated') {
+            throw new Error('Principal is not a federated principal, call isFederatedPrincipal() before calling federated()');
+        }
+        return this.principalId;
+    }
+    canonicalUser() {
+        if (this.principalType !== 'CanonicalUser') {
+            throw new Error('Principal is not a canonical user principal, call isCanonicalUserPrincipal() before calling canonicalUser()');
+        }
+        return this.principalId;
+    }
+}
+exports.PrincipalImpl = PrincipalImpl;
+//# sourceMappingURL=principal.js.map

package/dist/cjs/principals/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../../src/principals/principal.ts"],"names":[],"mappings":";;;AAAA,0CAAgE;AAuHhE,MAAM,cAAc,GAAG,aAAa,CAAA;AACpC,MAAM,eAAe,GAAG,+BAA+B,CAAA;AACvD,MAAM,aAAa,GAAG,cAAc,CAAA;AAEpC,MAAa,aAAa;IAYL;IACA;IAFnB,YACmB,aAA4B,EAC5B,WAAmB;QADnB,kBAAa,GAAb,aAAa,CAAe;QAC5B,gBAAW,GAAX,WAAW,CAAQ;IACnC,CAAC;IAEG,KAAK;QACV,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAEM,IAAI;QACT,OAAO,IAAI,CAAC,aAAa,CAAA;IAC3B,CAAC;IAEM,mBAAmB;QACxB,OAAO,IAAI,CAAC,aAAa,KAAK,KAAK,IAAI,IAAA,yBAAc,EAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACzE,CAAC;IAEM,kBAAkB;QACvB,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;YACjC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACxF,CAAC;IAEM,mBAAmB;QACxB,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;YACjC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC7C,CAAC;IAEM,cAAc;QACnB,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;YACjC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,OAAO,GAAQ,IAAI,CAAA;QACzB,OAAO,CACL,CAAC,IAAA,yBAAc,EAAC,OAAO,CAAC,WAAW,CAAC;YACpC,CAAC,OAAO,CAAC,kBAAkB,EAAE;YAC7B,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAC/B,CAAA;IACH,CAAC;IAEM,kBAAkB;QACvB,OAAO,IAAI,CAAC,aAAa,KAAK,SAAS,CAAA;IACzC,CAAC;IAEM,oBAAoB;QACzB,OAAO,IAAI,CAAC,aAAa,KAAK,WAAW,CAAA;IAC3C,CAAC;IAEM,wBAAwB;QAC7B,OAAO,IAAI,CAAC,aAAa,KAAK,eAAe,CAAA;IAC/C,CAAC;IAEM,QAAQ;QACb,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAEM,SAAS;QACd,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAA;QACH,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAA,6BAAkB,EAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAE,CAAA;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAEM,QAAQ;QACb,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAEM,GAAG;QACR,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAEM,OAAO;QACZ,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAEM,SAAS;QACd,IAAI,IAAI,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAEM,aAAa;QAClB,IAAI,IAAI,CAAC,aAAa,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,6GAA6G,CAC9G,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;CACF;AAnID,sCAmIC"}

package/dist/cjs/resources/resource.d.ts

@@ -0,0 +1,60 @@
+/**
+ * A resource string in an IAM policy
+ */
+export interface Resource {
+    /**
+     * The raw string of the resource
+     */
+    value(): string;
+    /**
+     * Whether the resource is all resources: `"*"`
+     */
+    isAllResources(): boolean;
+    /**
+     * Whether the resource is an ARN resource
+     */
+    isArnResource(): this is ArnResource;
+    /**
+     * The path to the resource in the policy document
+     */
+    path(): string;
+}
+export interface ArnResource extends Resource {
+    /**
+     * The partition of the ARN
+     */
+    partition(): string;
+    /**
+     * The service of the ARN
+     */
+    service(): string;
+    /**
+     * The region of the ARN
+     */
+    region(): string;
+    /**
+     * The account of the ARN
+     */
+    account(): string;
+    /**
+     * The resource of the ARN
+     */
+    resource(): string;
+}
+export declare class ResourceImpl implements Resource, ArnResource {
+    private readonly rawValue;
+    private readonly otherProps;
+    constructor(rawValue: string, otherProps: {
+        path: string;
+    });
+    path(): string;
+    partition(): string;
+    service(): string;
+    region(): string;
+    account(): string;
+    resource(): string;
+    value(): string;
+    isAllResources(): boolean;
+    isArnResource(): this is ArnResource;
+}
+//# sourceMappingURL=resource.d.ts.map

package/dist/cjs/resources/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../src/resources/resource.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,cAAc,IAAI,OAAO,CAAA;IAEzB;;OAEG;IACH,aAAa,IAAI,IAAI,IAAI,WAAW,CAAA;IAEpC;;OAEG;IACH,IAAI,IAAI,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C;;OAEG;IACH,SAAS,IAAI,MAAM,CAAA;IAEnB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;IAEhB;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,QAAQ,IAAI,MAAM,CAAA;CACnB;AAED,qBAAa,YAAa,YAAW,QAAQ,EAAE,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAA;KACb;IAGH,IAAI,IAAI,MAAM;IAId,SAAS,IAAI,MAAM;IASnB,OAAO,IAAI,MAAM;IASjB,MAAM,IAAI,MAAM;IAShB,OAAO,IAAI,MAAM;IASjB,QAAQ,IAAI,MAAM;IASlB,KAAK,IAAI,MAAM;IAIf,cAAc,IAAI,OAAO;IAIzB,aAAa,IAAI,IAAI,IAAI,WAAW;CAGrC"}