@actsecurity/iam-simulate 0.1.173

package/dist/cjs/core_engine/CoreSimulatorEngine.js

@@ -0,0 +1,444 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validSimulationModes = void 0;
+exports.authorize = authorize;
+exports.getServiceAuthorizer = getServiceAuthorizer;
+exports.analyzeIdentityPolicies = analyzeIdentityPolicies;
+exports.analyzeControlPolicies = analyzeControlPolicies;
+exports.analyzeResourcePolicy = analyzeResourcePolicy;
+exports.analyzePermissionBoundaryPolicies = analyzePermissionBoundaryPolicies;
+exports.analyzeVpcEndpointPolicies = analyzeVpcEndpointPolicies;
+const action_js_1 = require("../action/action.js");
+const condition_js_1 = require("../condition/condition.js");
+const allowedConditions_js_1 = require("../analysis/allowedConditions.js");
+const principal_js_1 = require("../principal/principal.js");
+const resource_js_1 = require("../resource/resource.js");
+const DefaultServiceAuthorizer_js_1 = require("../services/DefaultServiceAuthorizer.js");
+const IamServiceAuthorizer_js_1 = require("../services/IamServiceAuthorizer.js");
+const KmsServiceAuthorizer_js_1 = require("../services/KmsServiceAuthorizer.js");
+const S3ServiceAuthorizer_js_1 = require("../services/s3/S3ServiceAuthorizer.js");
+const StsServiceAuthorizer_js_1 = require("../services/StsServiceAuthorizer.js");
+const StatementAnalysis_js_1 = require("../StatementAnalysis.js");
+exports.validSimulationModes = ['Strict', 'Discovery'];
+const serviceEngines = {
+    kms: KmsServiceAuthorizer_js_1.KmsServiceAuthorizer,
+    sts: StsServiceAuthorizer_js_1.StsServiceAuthorizer,
+    iam: IamServiceAuthorizer_js_1.IamServiceAuthorizer,
+    s3: S3ServiceAuthorizer_js_1.S3ServiceAuthorizer
+};
+/**
+ * Authorizes a request.
+ *
+ * This assumes all policies have been validated and the request is fully complete and valid.
+ *
+ * @param request the request to authorize
+ * @returns the result of the authorization
+ */
+function authorize(request) {
+    const principalHasPermissionBoundary = !!request.permissionBoundaries && request.permissionBoundaries.length > 0;
+    const simulationParameters = request.simulationParameters;
+    const sessionAnalysis = request.sessionPolicy
+        ? analyzeIdentityPolicies([request.sessionPolicy], request.request, simulationParameters, 'session')
+        : undefined;
+    const identityAnalysis = analyzeIdentityPolicies(request.identityPolicies, request.request, simulationParameters, 'identity');
+    const permissionBoundaryAnalysis = analyzePermissionBoundaryPolicies(request.permissionBoundaries, request.request, simulationParameters);
+    const scpAnalysis = analyzeControlPolicies(request.serviceControlPolicies, request.request, simulationParameters, 'scp');
+    const rcpAnalysis = analyzeControlPolicies(request.resourceControlPolicies, request.request, simulationParameters, 'rcp');
+    const resourceAnalysis = analyzeResourcePolicy(request.resourcePolicy, request.request, principalHasPermissionBoundary, simulationParameters);
+    const endpointAnalysis = analyzeVpcEndpointPolicies(request.vpcEndpointPolicies, request.request, simulationParameters);
+    const serviceAuthorizer = getServiceAuthorizer(request);
+    const result = serviceAuthorizer.authorize({
+        request: request.request,
+        sessionAnalysis,
+        identityAnalysis,
+        scpAnalysis,
+        rcpAnalysis,
+        resourceAnalysis,
+        resourcePolicy: request.resourcePolicy,
+        permissionBoundaryAnalysis,
+        endpointAnalysis,
+        simulationParameters,
+        serviceSettings: request.serviceSettings
+    });
+    if (simulationParameters.simulationMode === 'Discovery') {
+        result.ignoredConditions = ignoredConditionsAnalysis(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis, endpointAnalysis);
+        result.ignoredRoleSessionName = roleSessionNameIgnored(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis);
+    }
+    return result;
+}
+/**
+ * Get the appropriate service authorizer for the request. Some services have specific authorization logic in
+ * them. If there is no service specific authorizer, a default one will be used.
+ *
+ * @param request the request to get the authorizer for
+ * @returns the service authorizer for the request
+ */
+function getServiceAuthorizer(request) {
+    const serviceName = request.request.action.service().toLowerCase();
+    if (serviceEngines[serviceName]) {
+        return new serviceEngines[serviceName]();
+    }
+    return new DefaultServiceAuthorizer_js_1.DefaultServiceAuthorizer();
+}
+/**
+ * Analyzes a set of identity policies
+ *
+ * @param identityPolicies the identity policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+function analyzeIdentityPolicies(identityPolicies, request, simulationParameters, policyType) {
+    const identityAnalysis = {
+        result: 'ImplicitlyDenied',
+        allowStatements: [],
+        denyStatements: [],
+        unmatchedStatements: []
+    };
+    for (const policy of identityPolicies) {
+        for (const statement of policy.statements()) {
+            const { matches: resourceMatch, details: resourceDetails } = (0, resource_js_1.requestMatchesStatementResources)(request, statement, policyType);
+            const { matches: actionMatch, details: actionDetails } = (0, action_js_1.requestMatchesStatementActions)(request, statement);
+            const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = (0, condition_js_1.requestMatchesConditions)(request, statement.conditions(), statement.effect(), simulationParameters);
+            const principalMatch = 'Match';
+            const overallMatch = (0, StatementAnalysis_js_1.statementMatches)({
+                actionMatch,
+                conditionMatch,
+                principalMatch,
+                resourceMatch
+            });
+            const shouldReportIgnoredConditions = (0, StatementAnalysis_js_1.reportIgnoredConditions)({
+                actionMatch,
+                principalMatch,
+                resourceMatch
+            });
+            const statementAnalysis = {
+                policyId: policy.metadata().name,
+                statement,
+                resourceMatch,
+                actionMatch,
+                conditionMatch,
+                principalMatch,
+                ignoredConditions: shouldReportIgnoredConditions ? ignoredConditions : undefined,
+                explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
+            };
+            if ((0, StatementAnalysis_js_1.identityStatementExplicitDeny)(statementAnalysis)) {
+                identityAnalysis.denyStatements.push(statementAnalysis);
+            }
+            else if ((0, StatementAnalysis_js_1.identityStatementAllows)(statementAnalysis)) {
+                identityAnalysis.allowStatements.push(statementAnalysis);
+            }
+            else {
+                identityAnalysis.unmatchedStatements.push(statementAnalysis);
+            }
+        }
+    }
+    if (identityAnalysis.denyStatements.length > 0) {
+        identityAnalysis.result = 'ExplicitlyDenied';
+    }
+    else if (identityAnalysis.allowStatements.length > 0) {
+        identityAnalysis.result = 'Allowed';
+    }
+    return identityAnalysis;
+}
+/**
+ * Analyzes a set of service or resource control policies and the statements within them.
+ *
+ * @param controlPolicies the control policies to analyze
+ * @param request the request to analyze against
+ * @returns an array of SCP or RCP analysis results
+ */
+function analyzeControlPolicies(controlPolicies, request, simulationParameters, policyType) {
+    const analysis = [];
+    for (const controlPolicy of controlPolicies) {
+        const ouAnalysis = {
+            orgIdentifier: controlPolicy.orgIdentifier,
+            result: 'ImplicitlyDenied',
+            allowStatements: [],
+            denyStatements: [],
+            unmatchedStatements: [],
+            conditions: (0, allowedConditions_js_1.never)('noApplicableAllow')
+        };
+        for (const policy of controlPolicy.policies) {
+            for (const statement of policy.statements()) {
+                const { matches: resourceMatch, details: resourceDetails } = (0, resource_js_1.requestMatchesStatementResources)(request, statement, policyType);
+                const { matches: actionMatch, details: actionDetails } = (0, action_js_1.requestMatchesStatementActions)(request, statement);
+                const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = (0, condition_js_1.requestMatchesConditions)(request, statement.conditions(), statement.effect(), simulationParameters);
+                const principalMatch = 'Match';
+                const overallMatch = (0, StatementAnalysis_js_1.statementMatches)({
+                    actionMatch,
+                    conditionMatch,
+                    principalMatch,
+                    resourceMatch
+                });
+                const shouldReportIgnoredConditions = (0, StatementAnalysis_js_1.reportIgnoredConditions)({
+                    actionMatch,
+                    principalMatch,
+                    resourceMatch
+                });
+                const statementAnalysis = {
+                    policyId: policy.metadata().name,
+                    statement,
+                    resourceMatch,
+                    actionMatch,
+                    conditionMatch,
+                    principalMatch,
+                    ignoredConditions: shouldReportIgnoredConditions ? ignoredConditions : [],
+                    explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...conditionDetails })
+                };
+                if ((0, StatementAnalysis_js_1.identityStatementAllows)(statementAnalysis)) {
+                    ouAnalysis.allowStatements.push(statementAnalysis);
+                }
+                else if ((0, StatementAnalysis_js_1.identityStatementExplicitDeny)(statementAnalysis)) {
+                    ouAnalysis.denyStatements.push(statementAnalysis);
+                }
+                else {
+                    ouAnalysis.unmatchedStatements.push(statementAnalysis);
+                }
+            }
+        }
+        if (ouAnalysis.denyStatements.length > 0) {
+            ouAnalysis.result = 'ExplicitlyDenied';
+        }
+        else if (ouAnalysis.allowStatements.length > 0) {
+            ouAnalysis.result = 'Allowed';
+        }
+        if (ouAnalysis.result === 'Allowed') {
+            ouAnalysis.conditions = (0, allowedConditions_js_1.or)(ouAnalysis.allowStatements.map((statement) => (0, allowedConditions_js_1.allowStatementExpression)(statement, policyType, controlPolicy.orgIdentifier)));
+        }
+        analysis.push(ouAnalysis);
+    }
+    let overallResult = 'ImplicitlyDenied';
+    if (analysis.some((ou) => ou.result === 'ExplicitlyDenied')) {
+        overallResult = 'ExplicitlyDenied';
+    }
+    else if (analysis.some((ou) => ou.allowStatements.length === 0)) {
+        overallResult = 'ImplicitlyDenied';
+    }
+    else if (analysis.every((ou) => ou.result === 'Allowed')) {
+        overallResult = 'Allowed';
+    }
+    return {
+        result: overallResult,
+        ouAnalysis: analysis,
+        conditions: analysis.length === 0
+            ? (0, allowedConditions_js_1.always)()
+            : overallResult === 'Allowed'
+                ? (0, allowedConditions_js_1.and)(analysis.map((ou) => ou.conditions))
+                : (0, allowedConditions_js_1.never)('noApplicableAllow')
+    };
+}
+/**
+ * Analyze a resource policy and return the results
+ *
+ * @param resourcePolicy the resource policy to analyze
+ * @param request the request to analyze against
+ * @returns an array of statement analysis results
+ */
+function analyzeResourcePolicy(resourcePolicy, request, principalHasPermissionBoundary, simulationParameters) {
+    const resourceAnalysis = {
+        result: 'NotApplicable',
+        allowStatements: [],
+        denyStatements: [],
+        unmatchedStatements: []
+    };
+    if (!resourcePolicy) {
+        return resourceAnalysis;
+    }
+    const principalMatchOptions = [
+        'Match',
+        'SessionRoleMatch',
+        'SessionUserMatch'
+    ];
+    for (const statement of resourcePolicy.statements()) {
+        const { matches: resourceMatch, details: resourceDetails } = (0, resource_js_1.requestMatchesStatementResources)(request, statement, 'resource');
+        const { matches: actionMatch, details: actionDetails } = (0, action_js_1.requestMatchesStatementActions)(request, statement);
+        let { matches: principalMatch, details: principalDetails, ignoredRoleSessionName } = (0, principal_js_1.requestMatchesStatementPrincipals)(request, statement, simulationParameters);
+        const permissionBoundaryDetails = {};
+        /**
+         * "Don't use resource-based policy statements that include a NotPrincipal policy element with a
+         * Deny effect for IAM users or roles that have a permissions boundary policy attached.
+         * The NotPrincipal element with a Deny effect will always deny any IAM principal that
+         * has a permissions boundary policy attached, regardless of the values specified in the
+         * NotPrincipal element. This causes some IAM users or roles that would otherwise have access
+         * to the resource to lose access. We recommend changing your resource-based policy statements
+         * to use the condition operator ArnNotEquals with the aws:PrincipalArn context key to limit
+         * access instead of the NotPrincipal element. For information about permissions boundaries, see
+         * Permissions boundaries for IAM entities."
+         * https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
+         */
+        if (principalHasPermissionBoundary &&
+            statement.isNotPrincipalStatement() &&
+            statement.effect() === 'Deny') {
+            principalMatch = 'Match';
+            permissionBoundaryDetails.denyBecauseNpInRpAndPb = true;
+        }
+        const { matches: conditionMatch, details: conditionDetails, ignoredConditions } = (0, condition_js_1.requestMatchesConditions)(request, statement.conditions(), statement.effect(), simulationParameters);
+        const overallMatch = (0, StatementAnalysis_js_1.statementMatches)({
+            actionMatch,
+            conditionMatch,
+            principalMatch,
+            resourceMatch
+        });
+        const shouldReportIgnoredConditions = (0, StatementAnalysis_js_1.reportIgnoredConditions)({
+            actionMatch,
+            principalMatch,
+            resourceMatch
+        });
+        const analysis = {
+            policyId: resourcePolicy.metadata().name,
+            statement,
+            resourceMatch: resourceMatch,
+            actionMatch,
+            conditionMatch,
+            principalMatch,
+            ignoredConditions: shouldReportIgnoredConditions ? ignoredConditions : undefined,
+            ignoredRoleSessionName,
+            explain: makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, { ...resourceDetails, ...actionDetails, ...principalDetails, ...conditionDetails })
+        };
+        if ((0, StatementAnalysis_js_1.identityStatementExplicitDeny)(analysis) && analysis.principalMatch !== 'NoMatch') {
+            resourceAnalysis.denyStatements.push(analysis);
+        }
+        else if ((0, StatementAnalysis_js_1.identityStatementAllows)(analysis) && analysis.principalMatch !== 'NoMatch') {
+            resourceAnalysis.allowStatements.push(analysis);
+        }
+        else {
+            resourceAnalysis.unmatchedStatements.push(analysis);
+        }
+    }
+    if (resourceAnalysis.denyStatements.some((s) => principalMatchOptions.includes(s.principalMatch))) {
+        resourceAnalysis.result = 'ExplicitlyDenied';
+    }
+    else if (resourceAnalysis.denyStatements.some((s) => s.principalMatch === 'AccountLevelMatch')) {
+        resourceAnalysis.result = 'DeniedForAccount';
+    }
+    else if (resourceAnalysis.allowStatements.some((s) => principalMatchOptions.includes(s.principalMatch))) {
+        resourceAnalysis.result = 'Allowed';
+    }
+    else if (resourceAnalysis.allowStatements.some((s) => s.principalMatch === 'AccountLevelMatch')) {
+        resourceAnalysis.result = 'AllowedForAccount';
+    }
+    else {
+        resourceAnalysis.result = 'ImplicitlyDenied';
+    }
+    return resourceAnalysis;
+}
+function analyzePermissionBoundaryPolicies(permissionBoundaries, request, simulationParameters) {
+    if (!permissionBoundaries || permissionBoundaries.length === 0) {
+        return undefined;
+    }
+    return analyzeIdentityPolicies(permissionBoundaries, request, simulationParameters, 'pb');
+}
+function analyzeVpcEndpointPolicies(vpcEndPointPolicies, request, simulationParameters) {
+    if (!vpcEndPointPolicies || vpcEndPointPolicies.length === 0) {
+        return undefined;
+    }
+    return analyzeIdentityPolicies(vpcEndPointPolicies, request, simulationParameters, 'vpce');
+}
+function makeStatementExplain(statement, overallMatch, actionMatch, principalMatch, resourceMatch, conditionMatch, details) {
+    return {
+        effect: statement.effect(),
+        identifier: statement.sid() || statement.index().toString(),
+        matches: overallMatch,
+        actionMatch,
+        principalMatch,
+        resourceMatch,
+        conditionMatch: conditionMatch === 'Match',
+        ...details
+    };
+}
+/**
+ * Create an analysis of the ignored conditions in all statements.
+ *
+ * @param scpAnalysis the SCP analysis
+ * @param rcpAnalysis the RCP analysis
+ * @param identityAnalysis the identity analysis
+ * @param resourceAnalysis the resource analysis
+ * @param permissionBoundaryAnalysis the permission boundary analysis (optional)
+ * @returns an object containing the ignored conditions for each analysis
+ */
+function ignoredConditionsAnalysis(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis, endpointAnalysis) {
+    const ignoredConditions = {};
+    if (sessionAnalysis) {
+        addIgnoredConditionsToAnalysis(ignoredConditions, 'session', [sessionAnalysis]);
+    }
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'scp', scpAnalysis.ouAnalysis);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'rcp', rcpAnalysis.ouAnalysis);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'identity', [identityAnalysis]);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'resource', [resourceAnalysis]);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'permissionBoundary', permissionBoundaryAnalysis ? [permissionBoundaryAnalysis] : []);
+    addIgnoredConditionsToAnalysis(ignoredConditions, 'endpointPolicy', endpointAnalysis ? [endpointAnalysis] : []);
+    if (Object.keys(ignoredConditions).length > 0) {
+        return ignoredConditions;
+    }
+    return undefined;
+}
+/**
+ * Adds the specified ignored conditions to the analysis.
+ *
+ * @param analyses the analyses to map ignored conditions from
+ * @returns the ignored conditions for allow and deny statements
+ */
+function addIgnoredConditionsToAnalysis(ignoredConditions, key, analyses) {
+    const allow = [];
+    const deny = [];
+    const allStatements = analyses.flatMap((analysis) => [
+        ...analysis.allowStatements,
+        ...analysis.denyStatements,
+        ...analysis.unmatchedStatements
+    ]);
+    for (const statement of allStatements) {
+        if (statement.ignoredConditions && statement.ignoredConditions.length > 0) {
+            if (statement.statement.isAllow()) {
+                allow.push(...statement.ignoredConditions.map((c) => ({
+                    op: c.operation().value(),
+                    key: c.conditionKey(),
+                    values: c.conditionValues()
+                })));
+            }
+            else {
+                deny.push(...statement.ignoredConditions.map((c) => ({
+                    op: c.operation().value(),
+                    key: c.conditionKey(),
+                    values: c.conditionValues()
+                })));
+            }
+        }
+    }
+    if (allow.length === 0 && deny.length === 0) {
+        return;
+    }
+    const newValue = {};
+    if (allow.length > 0) {
+        newValue.allow = allow;
+    }
+    if (deny.length > 0) {
+        newValue.deny = deny;
+    }
+    ignoredConditions[key] = newValue;
+}
+/**
+ * Checks all analyses to see if any of them have statements that ignore the role session name.
+ *
+ * @param scpAnalysis the SCP analysis
+ * @param rcpAnalysis the RCP analysis
+ * @param identityAnalysis the identity analysis
+ * @param resourceAnalysis the resource analysis
+ * @param permissionBoundaryAnalysis the permission boundary analysis (optional)
+ * @returns true if any analysis has statements that ignore the role session name, false otherwise
+ */
+function roleSessionNameIgnored(sessionAnalysis, scpAnalysis, rcpAnalysis, identityAnalysis, resourceAnalysis, permissionBoundaryAnalysis) {
+    return (sessionAnalysis?.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        sessionAnalysis?.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        scpAnalysis.ouAnalysis.some((ou) => ou.allowStatements.some((s) => s.ignoredRoleSessionName)) ||
+        scpAnalysis.ouAnalysis.some((ou) => ou.unmatchedStatements.some((s) => s.ignoredRoleSessionName)) ||
+        rcpAnalysis.ouAnalysis.some((ou) => ou.allowStatements.some((s) => s.ignoredRoleSessionName)) ||
+        rcpAnalysis.ouAnalysis.some((ou) => ou.unmatchedStatements.some((s) => s.ignoredRoleSessionName)) ||
+        identityAnalysis.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        identityAnalysis.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        resourceAnalysis.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        resourceAnalysis.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        permissionBoundaryAnalysis?.allowStatements.some((s) => s.ignoredRoleSessionName) ||
+        permissionBoundaryAnalysis?.unmatchedStatements.some((s) => s.ignoredRoleSessionName) ||
+        false);
+}
+//# sourceMappingURL=CoreSimulatorEngine.js.map

package/dist/cjs/core_engine/CoreSimulatorEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CoreSimulatorEngine.js","sourceRoot":"","sources":["../../../src/core_engine/CoreSimulatorEngine.ts"],"names":[],"mappings":";;;AAwJA,8BA0FC;AASD,oDAMC;AASD,0DAqFC;AASD,wDAqHC;AASD,sDAuIC;AAED,8EAUC;AAED,gEASC;AAnoBD,mDAAoE;AACpE,4DAA+F;AAC/F,2EAAmG;AAcnG,4DAGkC;AAGlC,yDAA0E;AAC1E,yFAAkF;AAClF,iFAA0E;AAC1E,iFAA0E;AAE1E,kFAA2E;AAC3E,iFAA0E;AAC1E,kEAMgC;AAEnB,QAAA,oBAAoB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAA;AAmGpE,MAAM,cAAc,GAAgD;IAClE,GAAG,EAAE,8CAAoB;IACzB,GAAG,EAAE,8CAAoB;IACzB,GAAG,EAAE,8CAAoB;IACzB,EAAE,EAAE,4CAAmB;CACxB,CAAA;AAED;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,OAA6B;IACrD,MAAM,8BAA8B,GAClC,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3E,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAA;IAEzD,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa;QAC3C,CAAC,CAAC,uBAAuB,CACrB,CAAC,OAAO,CAAC,aAAa,CAAC,EACvB,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,SAAS,CACV;QACH,CAAC,CAAC,SAAS,CAAA;IAEb,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,UAAU,CACX,CAAA;IAED,MAAM,0BAA0B,GAAG,iCAAiC,CAClE,OAAO,CAAC,oBAAoB,EAC5B,OAAO,CAAC,OAAO,EACf,oBAAoB,CACrB,CAAA;IAED,MAAM,WAAW,GAAG,sBAAsB,CACxC,OAAO,CAAC,sBAAsB,EAC9B,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,KAAK,CACS,CAAA;IAEhB,MAAM,WAAW,GAAG,sBAAsB,CACxC,OAAO,CAAC,uBAAuB,EAC/B,OAAO,CAAC,OAAO,EACf,oBAAoB,EACpB,KAAK,CACS,CAAA;IAEhB,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,OAAO,EACf,8BAA8B,EAC9B,oBAAoB,CACrB,CAAA;IAED,MAAM,gBAAgB,GAAG,0BAA0B,CACjD,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,OAAO,EACf,oBAAoB,CACrB,CAAA;IAED,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;QACf,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,gBAAgB;QAChB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,0BAA0B;QAC1B,gBAAgB;QAChB,oBAAoB;QACpB,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAA;IAEF,IAAI,oBAAoB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;QACxD,MAAM,CAAC,iBAAiB,GAAG,yBAAyB,CAClD,eAAe,EACf,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,CACjB,CAAA;QACD,MAAM,CAAC,sBAAsB,GAAG,sBAAsB,CACpD,eAAe,EACf,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,0BAA0B,CAC3B,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAA6B;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAA;IAClE,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAA;IAC1C,CAAC;IACD,OAAO,IAAI,sDAAwB,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,gBAAkC,EAClC,OAAmB,EACnB,oBAA0C,EAC1C,UAAsB;IAEtB,MAAM,gBAAgB,GAAqB;QACzC,MAAM,EAAE,kBAAkB;QAC1B,eAAe,EAAE,EAAE;QACnB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,EAAE;KACxB,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5C,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAA,8CAAgC,EAC3F,OAAO,EACP,SAAS,EACT,UAAU,CACX,CAAA;YACD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAA,0CAA8B,EACrF,OAAO,EACP,SAAS,CACV,CAAA;YACD,MAAM,EACJ,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,EAClB,GAAG,IAAA,uCAAwB,EAC1B,OAAO,EACP,SAAS,CAAC,UAAU,EAAE,EACtB,SAAS,CAAC,MAAM,EAAsB,EACtC,oBAAoB,CACrB,CAAA;YAED,MAAM,cAAc,GAAyB,OAAO,CAAA;YACpD,MAAM,YAAY,GAAG,IAAA,uCAAgB,EAAC;gBACpC,WAAW;gBACX,cAAc;gBACd,cAAc;gBACd,aAAa;aACd,CAAC,CAAA;YAEF,MAAM,6BAA6B,GAAG,IAAA,8CAAuB,EAAC;gBAC5D,WAAW;gBACX,cAAc;gBACd,aAAa;aACd,CAAC,CAAA;YAEF,MAAM,iBAAiB,GAAsB;gBAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI;gBAChC,SAAS;gBACT,aAAa;gBACb,WAAW;gBACX,cAAc;gBACd,cAAc;gBACd,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;gBAChF,OAAO,EAAE,oBAAoB,CAC3B,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,CAC9D;aACF,CAAA;YAED,IAAI,IAAA,oDAA6B,EAAC,iBAAiB,CAAC,EAAE,CAAC;gBACrD,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YACzD,CAAC;iBAAM,IAAI,IAAA,8CAAuB,EAAC,iBAAiB,CAAC,EAAE,CAAC;gBACtD,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC1D,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACrC,CAAC;IAED,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,eAAkC,EAClC,OAAmB,EACnB,oBAA0C,EAC1C,UAAsB;IAEtB,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,KAAK,MAAM,aAAa,IAAI,eAAe,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAkB;YAChC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,MAAM,EAAE,kBAAkB;YAC1B,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,mBAAmB,EAAE,EAAE;YACvB,UAAU,EAAE,IAAA,4BAAK,EAAC,mBAAmB,CAAC;SACvC,CAAA;QACD,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5C,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,GACxD,IAAA,8CAAgC,EAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;gBAClE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAA,0CAA8B,EACrF,OAAO,EACP,SAAS,CACV,CAAA;gBACD,MAAM,EACJ,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,EAClB,GAAG,IAAA,uCAAwB,EAC1B,OAAO,EACP,SAAS,CAAC,UAAU,EAAE,EACtB,SAAS,CAAC,MAAM,EAAsB,EACtC,oBAAoB,CACrB,CAAA;gBAED,MAAM,cAAc,GAAyB,OAAO,CAAA;gBACpD,MAAM,YAAY,GAAG,IAAA,uCAAgB,EAAC;oBACpC,WAAW;oBACX,cAAc;oBACd,cAAc;oBACd,aAAa;iBACd,CAAC,CAAA;gBAEF,MAAM,6BAA6B,GAAG,IAAA,8CAAuB,EAAC;oBAC5D,WAAW;oBACX,cAAc;oBACd,aAAa;iBACd,CAAC,CAAA;gBAEF,MAAM,iBAAiB,GAAsB;oBAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI;oBAChC,SAAS;oBACT,aAAa;oBACb,WAAW;oBACX,cAAc;oBACd,cAAc;oBACd,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;oBACzE,OAAO,EAAE,oBAAoB,CAC3B,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,CAC9D;iBACF,CAAA;gBAED,IAAI,IAAA,8CAAuB,EAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC/C,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBACpD,CAAC;qBAAM,IAAI,IAAA,oDAA6B,EAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC5D,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBACnD,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,UAAU,CAAC,MAAM,GAAG,kBAAkB,CAAA;QACxC,CAAC;aAAM,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,MAAM,GAAG,SAAS,CAAA;QAC/B,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,UAAU,CAAC,UAAU,GAAG,IAAA,yBAAE,EACxB,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3C,IAAA,+CAAwB,EACtB,SAAS,EACT,UAA2B,EAC3B,aAAa,CAAC,aAAa,CAC5B,CACF,CACF,CAAA;QACH,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC;IAED,IAAI,aAAa,GAAqB,kBAAkB,CAAA;IACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC5D,aAAa,GAAG,kBAAkB,CAAA;IACpC,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClE,aAAa,GAAG,kBAAkB,CAAA;IACpC,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3D,aAAa,GAAG,SAAS,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,QAAQ;QACpB,UAAU,EACR,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,IAAA,6BAAM,GAAE;YACV,CAAC,CAAC,aAAa,KAAK,SAAS;gBAC3B,CAAC,CAAC,IAAA,0BAAG,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;gBAC1C,CAAC,CAAC,IAAA,4BAAK,EAAC,mBAAmB,CAAC;KACnC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,cAA0C,EAC1C,OAAmB,EACnB,8BAAuC,EACvC,oBAA0C;IAE1C,MAAM,gBAAgB,GAAqB;QACzC,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,EAAE;QACnB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,EAAE;KACxB,CAAA;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,MAAM,qBAAqB,GAA2B;QACpD,OAAO;QACP,kBAAkB;QAClB,kBAAkB;KACnB,CAAA;IAED,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAA,8CAAgC,EAC3F,OAAO,EACP,SAAS,EACT,UAAU,CACX,CAAA;QACD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAA,0CAA8B,EACrF,OAAO,EACP,SAAS,CACV,CAAA;QACD,IAAI,EACF,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,sBAAsB,EACvB,GAAG,IAAA,gDAAiC,EAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAA;QAE/E,MAAM,yBAAyB,GAAqD,EAAE,CAAA;QAEtF;;;;;;;;;;;WAWG;QACH,IACE,8BAA8B;YAC9B,SAAS,CAAC,uBAAuB,EAAE;YACnC,SAAS,CAAC,MAAM,EAAE,KAAK,MAAM,EAC7B,CAAC;YACD,cAAc,GAAG,OAAO,CAAA;YACxB,yBAAyB,CAAC,sBAAsB,GAAG,IAAI,CAAA;QACzD,CAAC;QAED,MAAM,EACJ,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,gBAAgB,EACzB,iBAAiB,EAClB,GAAG,IAAA,uCAAwB,EAC1B,OAAO,EACP,SAAS,CAAC,UAAU,EAAE,EACtB,SAAS,CAAC,MAAM,EAAsB,EACtC,oBAAoB,CACrB,CAAA;QAED,MAAM,YAAY,GAAG,IAAA,uCAAgB,EAAC;YACpC,WAAW;YACX,cAAc;YACd,cAAc;YACd,aAAa;SACd,CAAC,CAAA;QAEF,MAAM,6BAA6B,GAAG,IAAA,8CAAuB,EAAC;YAC5D,WAAW;YACX,cAAc;YACd,aAAa;SACd,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAsB;YAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI;YACxC,SAAS;YACT,aAAa,EAAE,aAAa;YAC5B,WAAW;YACX,cAAc;YACd,cAAc;YACd,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAChF,sBAAsB;YACtB,OAAO,EAAE,oBAAoB,CAC3B,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,EACb,cAAc,EACd,EAAE,GAAG,eAAe,EAAE,GAAG,aAAa,EAAE,GAAG,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CACnF;SACF,CAAA;QACD,IAAI,IAAA,oDAA6B,EAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACrF,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,IAAI,IAAA,8CAAuB,EAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtF,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,IACE,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAC7F,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IACL,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,mBAAmB,CAAC,EACrF,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;SAAM,IACL,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAC9F,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACrC,CAAC;SAAM,IACL,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,mBAAmB,CAAC,EACtF,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,mBAAmB,CAAA;IAC/C,CAAC;SAAM,CAAC;QACN,gBAAgB,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC9C,CAAC;IAED,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,SAAgB,iCAAiC,CAC/C,oBAAkD,EAClD,OAAmB,EACnB,oBAA0C;IAE1C,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,uBAAuB,CAAC,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAA;AAC3F,CAAC;AAED,SAAgB,0BAA0B,CACxC,mBAAiD,EACjD,OAAmB,EACnB,oBAA0C;IAE1C,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,uBAAuB,CAAC,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAA;AAC5F,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAAoB,EACpB,YAAqB,EACrB,WAAoB,EACpB,cAAqC,EACrC,aAAsB,EACtB,cAAoC,EACpC,OAAkC;IAElC,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QAC1B,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QAC3D,OAAO,EAAE,YAAY;QACrB,WAAW;QACX,cAAc;QACd,aAAa;QACb,cAAc,EAAE,cAAc,KAAK,OAAO;QAC1C,GAAG,OAAO;KACX,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAChC,eAA6C,EAC7C,WAAwB,EACxB,WAAwB,EACxB,gBAAkC,EAClC,gBAAkC,EAClC,0BAA6C,EAC7C,gBAAmC;IAEnC,MAAM,iBAAiB,GAAsB,EAAE,CAAA;IAC/C,IAAI,eAAe,EAAE,CAAC;QACpB,8BAA8B,CAAC,iBAAiB,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,CAAC,CAAA;IACjF,CAAC;IACD,8BAA8B,CAAC,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAChF,8BAA8B,CAAC,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAChF,8BAA8B,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAA;IACjF,8BAA8B,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAA;IACjF,8BAA8B,CAC5B,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA;IACD,8BAA8B,CAC5B,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAA;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,8BAA8B,CACrC,iBAA6C,EAC7C,GAA4B,EAC5B,QAIG;IAEH,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAuB,EAAE,CAAA;IACnC,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnD,GAAG,QAAQ,CAAC,eAAe;QAC3B,GAAG,QAAQ,CAAC,cAAc;QAC1B,GAAG,QAAQ,CAAC,mBAAmB;KAChC,CAAC,CAAA;IAEF,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CACR,GAAG,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACzB,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE;oBACrB,MAAM,EAAE,CAAC,CAAC,eAAe,EAAE;iBAC5B,CAAC,CAAC,CACJ,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CACP,GAAG,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE;oBACzB,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE;oBACrB,MAAM,EAAE,CAAC,CAAC,eAAe,EAAE;iBAC5B,CAAC,CAAC,CACJ,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAA+C,EAAE,CAAA;IAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAA;IACxB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA;IACtB,CAAC;IACD,iBAAiB,CAAC,GAAG,CAAC,GAAG,QAAsD,CAAA;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,eAA6C,EAC7C,WAAwB,EACxB,WAAwB,EACxB,gBAAkC,EAClC,gBAAkC,EAClC,0BAA6C;IAE7C,OAAO,CACL,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACtE,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC7F,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACjC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAC7D;QACD,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC7F,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACjC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAC7D;QACD,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACtE,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACtE,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,0BAA0B,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACjF,0BAA0B,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACrF,KAAK,CACN,CAAA;AACH,CAAC"}

package/dist/cjs/evaluate.d.ts

@@ -0,0 +1,199 @@
+import { type StatementAnalysis } from './StatementAnalysis.js';
+export type EvaluationResult = 'Allowed' | 'ExplicitlyDenied' | 'ImplicitlyDenied';
+export type ResourceEvaluationResult = 'NotApplicable' | 'Allowed' | 'ExplicitlyDenied' | 'AllowedForAccount' | 'DeniedForAccount' | 'ImplicitlyDenied';
+export type BlockedReason = 'scp' | 'rcp' | 'vpce' | 'identity' | 'resource' | 'pb' | 's3-bpa';
+export interface IdentityAnalysis {
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+}
+export interface ResourceAnalysis {
+    result: ResourceEvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+}
+export interface OuScpAnalysis {
+    orgIdentifier: string;
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface ScpAnalysis {
+    /**
+     * OU Result
+     */
+    result: EvaluationResult;
+    ouAnalysis: OuScpAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface OuRcpAnalysis {
+    orgIdentifier: string;
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface RcpAnalysis {
+    /**
+     * OU Result
+     */
+    result: EvaluationResult;
+    ouAnalysis: OuRcpAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface IgnoredCondition {
+    op: string;
+    key: string;
+    values: string[];
+}
+/**
+ * Conditions that were ignored during discovery mode.
+ */
+export type AllowedConditionExpression = AlwaysAllowedCondition | NeverAllowedCondition | AllowedConditionGroup | AllowedConditionLeaf | AllowedSessionNameCondition;
+/** A condition expression that is always satisfied. */
+export interface AlwaysAllowedCondition {
+    conditionType: 'always';
+}
+/** A condition expression that cannot be satisfied. */
+export interface NeverAllowedCondition {
+    conditionType: 'never';
+    reason: 'explicitDenyWithoutConditions' | 'noApplicableAllow';
+}
+/** A boolean grouping of allowed-condition expressions. */
+export interface AllowedConditionGroup {
+    conditionType: 'group';
+    operator: 'and' | 'or';
+    conditions: AllowedConditionExpression[];
+}
+/** A policy condition that must hold for access to be allowed. */
+export interface AllowedConditionLeaf {
+    conditionType: 'condition';
+    op: string;
+    key: string;
+    values: string[];
+    sources: AllowedConditionSource[];
+    inverted?: true;
+}
+/** A role session-name constraint that must hold for access to be allowed. */
+export interface AllowedSessionNameCondition {
+    conditionType: 'sessionName';
+    sessionName: string[];
+    sources: AllowedConditionSource[];
+}
+/** Metadata for the statement that contributed an allowed condition. */
+export interface AllowedConditionSource {
+    policyType: 'session' | 'identity' | 'resource' | 'scp' | 'rcp' | 'permissionBoundary' | 'endpointPolicy';
+    effect: 'Allow' | 'Deny';
+    policyIdentifier?: string;
+    orgIdentifier?: string;
+    statementId?: string;
+    statementIndex: number;
+}
+export interface IgnoredConditions {
+    session?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    scp?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    rcp?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    identity?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    resource?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    permissionBoundary?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    endpointPolicy?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+}
+/**
+ * The analysis of a request.
+ */
+export interface RequestAnalysis {
+    /**
+     * The result of the evaluation.
+     */
+    result: EvaluationResult;
+    /**
+     * Whether the principal and the resource are in the same account.
+     */
+    sameAccount: boolean;
+    /**
+     * The result of the evaluation of the session policy, if any.
+     */
+    sessionAnalysis?: IdentityAnalysis | undefined;
+    /**
+     * The result of the evaluation of the resource policy.
+     */
+    identityAnalysis?: IdentityAnalysis;
+    /**
+     * The result of the evaluation of the resource policy.
+     */
+    resourceAnalysis?: ResourceAnalysis;
+    /**
+     * The result of the evaluation of the SCPs
+     */
+    scpAnalysis?: ScpAnalysis;
+    /**
+     * The result of the evaluation of the RCPs
+     */
+    rcpAnalysis?: RcpAnalysis;
+    /**
+     * The result of the evaluation of the permission boundary.
+     */
+    permissionBoundaryAnalysis?: IdentityAnalysis | undefined;
+    /**
+     * The result of the evaluation of the VPC endpoint policies, if any.
+     */
+    endpointAnalysis?: IdentityAnalysis | undefined;
+    /**
+     * The conditions under which a Discovery-mode request is allowed.
+     *
+     * This is only present for final Allowed results when access depends on conditions
+     * ignored because their request-context presence or value was unknown.
+     */
+    conditions?: AllowedConditionExpression;
+    /**
+     * Any conditions that were ignored during discovery mode.
+     */
+    ignoredConditions?: IgnoredConditions;
+    /**
+     * If the role session name was ignored during discovery mode.
+     */
+    ignoredRoleSessionName?: boolean;
+    /**
+     * If the request has policies to allow the request in session, identity, and/or resource policies required, but was blocked
+     * by another policy, this includes the policy types that blocked the request.
+     *
+     * It is possible for a request to have been allowed by the identity policy but blocked by the resource policy and vice versa.
+     *
+     * If this array is undefined or empty, it means that the core session, identity, and/or resource policies did
+     * not grant permission. It does not mean that there are no guardrails in place, just that the request was
+     * not allowed by the core policies, so there is no need to look for guardrails that block an otherwise allowed request.
+     *
+     * "Allowed by core policies" means that it would have been allowed if not for the policies identified in `blockedBy`. So
+     * by removing the policies identified in `blockedBy`, the request would be allowed.
+     *
+     * Use this to discover what guardrails are in place that might block access even if it may be allowed by other policies.
+     */
+    blockedBy?: BlockedReason[];
+}
+//# sourceMappingURL=evaluate.d.ts.map