@actsecurity/iam-simulate 0.1.173

package/dist/esm/evaluate.d.ts

@@ -0,0 +1,199 @@
+import { type StatementAnalysis } from './StatementAnalysis.js';
+export type EvaluationResult = 'Allowed' | 'ExplicitlyDenied' | 'ImplicitlyDenied';
+export type ResourceEvaluationResult = 'NotApplicable' | 'Allowed' | 'ExplicitlyDenied' | 'AllowedForAccount' | 'DeniedForAccount' | 'ImplicitlyDenied';
+export type BlockedReason = 'scp' | 'rcp' | 'vpce' | 'identity' | 'resource' | 'pb' | 's3-bpa';
+export interface IdentityAnalysis {
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+}
+export interface ResourceAnalysis {
+    result: ResourceEvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+}
+export interface OuScpAnalysis {
+    orgIdentifier: string;
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface ScpAnalysis {
+    /**
+     * OU Result
+     */
+    result: EvaluationResult;
+    ouAnalysis: OuScpAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface OuRcpAnalysis {
+    orgIdentifier: string;
+    result: EvaluationResult;
+    denyStatements: StatementAnalysis[];
+    allowStatements: StatementAnalysis[];
+    unmatchedStatements: StatementAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface RcpAnalysis {
+    /**
+     * OU Result
+     */
+    result: EvaluationResult;
+    ouAnalysis: OuRcpAnalysis[];
+    conditions: AllowedConditionExpression;
+}
+export interface IgnoredCondition {
+    op: string;
+    key: string;
+    values: string[];
+}
+/**
+ * Conditions that were ignored during discovery mode.
+ */
+export type AllowedConditionExpression = AlwaysAllowedCondition | NeverAllowedCondition | AllowedConditionGroup | AllowedConditionLeaf | AllowedSessionNameCondition;
+/** A condition expression that is always satisfied. */
+export interface AlwaysAllowedCondition {
+    conditionType: 'always';
+}
+/** A condition expression that cannot be satisfied. */
+export interface NeverAllowedCondition {
+    conditionType: 'never';
+    reason: 'explicitDenyWithoutConditions' | 'noApplicableAllow';
+}
+/** A boolean grouping of allowed-condition expressions. */
+export interface AllowedConditionGroup {
+    conditionType: 'group';
+    operator: 'and' | 'or';
+    conditions: AllowedConditionExpression[];
+}
+/** A policy condition that must hold for access to be allowed. */
+export interface AllowedConditionLeaf {
+    conditionType: 'condition';
+    op: string;
+    key: string;
+    values: string[];
+    sources: AllowedConditionSource[];
+    inverted?: true;
+}
+/** A role session-name constraint that must hold for access to be allowed. */
+export interface AllowedSessionNameCondition {
+    conditionType: 'sessionName';
+    sessionName: string[];
+    sources: AllowedConditionSource[];
+}
+/** Metadata for the statement that contributed an allowed condition. */
+export interface AllowedConditionSource {
+    policyType: 'session' | 'identity' | 'resource' | 'scp' | 'rcp' | 'permissionBoundary' | 'endpointPolicy';
+    effect: 'Allow' | 'Deny';
+    policyIdentifier?: string;
+    orgIdentifier?: string;
+    statementId?: string;
+    statementIndex: number;
+}
+export interface IgnoredConditions {
+    session?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    scp?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    rcp?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    identity?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    resource?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    permissionBoundary?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+    endpointPolicy?: {
+        allow?: IgnoredCondition[];
+        deny?: IgnoredCondition[];
+    };
+}
+/**
+ * The analysis of a request.
+ */
+export interface RequestAnalysis {
+    /**
+     * The result of the evaluation.
+     */
+    result: EvaluationResult;
+    /**
+     * Whether the principal and the resource are in the same account.
+     */
+    sameAccount: boolean;
+    /**
+     * The result of the evaluation of the session policy, if any.
+     */
+    sessionAnalysis?: IdentityAnalysis | undefined;
+    /**
+     * The result of the evaluation of the resource policy.
+     */
+    identityAnalysis?: IdentityAnalysis;
+    /**
+     * The result of the evaluation of the resource policy.
+     */
+    resourceAnalysis?: ResourceAnalysis;
+    /**
+     * The result of the evaluation of the SCPs
+     */
+    scpAnalysis?: ScpAnalysis;
+    /**
+     * The result of the evaluation of the RCPs
+     */
+    rcpAnalysis?: RcpAnalysis;
+    /**
+     * The result of the evaluation of the permission boundary.
+     */
+    permissionBoundaryAnalysis?: IdentityAnalysis | undefined;
+    /**
+     * The result of the evaluation of the VPC endpoint policies, if any.
+     */
+    endpointAnalysis?: IdentityAnalysis | undefined;
+    /**
+     * The conditions under which a Discovery-mode request is allowed.
+     *
+     * This is only present for final Allowed results when access depends on conditions
+     * ignored because their request-context presence or value was unknown.
+     */
+    conditions?: AllowedConditionExpression;
+    /**
+     * Any conditions that were ignored during discovery mode.
+     */
+    ignoredConditions?: IgnoredConditions;
+    /**
+     * If the role session name was ignored during discovery mode.
+     */
+    ignoredRoleSessionName?: boolean;
+    /**
+     * If the request has policies to allow the request in session, identity, and/or resource policies required, but was blocked
+     * by another policy, this includes the policy types that blocked the request.
+     *
+     * It is possible for a request to have been allowed by the identity policy but blocked by the resource policy and vice versa.
+     *
+     * If this array is undefined or empty, it means that the core session, identity, and/or resource policies did
+     * not grant permission. It does not mean that there are no guardrails in place, just that the request was
+     * not allowed by the core policies, so there is no need to look for guardrails that block an otherwise allowed request.
+     *
+     * "Allowed by core policies" means that it would have been allowed if not for the policies identified in `blockedBy`. So
+     * by removing the policies identified in `blockedBy`, the request would be allowed.
+     *
+     * Use this to discover what guardrails are in place that might block access even if it may be allowed by other policies.
+     */
+    blockedBy?: BlockedReason[];
+}
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/esm/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;AAClF,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,SAAS,GACT,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,CAAA;AAEtB,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAA;AAE9F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,wBAAwB,CAAA;IAChC,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;IACxC,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;IACxC,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,CAAA;AAE/B,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,QAAQ,CAAA;CACxB;AAED,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAA;IACtB,MAAM,EAAE,+BAA+B,GAAG,mBAAmB,CAAA;CAC9D;AAED,2DAA2D;AAC3D,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,0BAA0B,EAAE,CAAA;CACzC;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,CAAA;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,OAAO,EAAE,sBAAsB,EAAE,CAAA;IACjC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,aAAa,CAAA;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,sBAAsB,EAAE,CAAA;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EACR,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;IAC/F,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,kBAAkB,CAAC,EAAE;QACnB,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,cAAc,CAAC,EAAE;QACf,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;IAExB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,eAAe,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAE9C;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;OAEG;IACH,0BAA0B,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAEzD;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAE/C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,0BAA0B,CAAA;IAEvC;;OAEG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IAErC;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,aAAa,EAAE,CAAA;CAC5B"}

package/dist/esm/evaluate.js

@@ -0,0 +1,2 @@
+import {} from './StatementAnalysis.js';
+//# sourceMappingURL=evaluate.js.map

package/dist/esm/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,MAAM,wBAAwB,CAAA"}

package/dist/esm/explain/displayExplainCli.d.ts

@@ -0,0 +1,3 @@
+import { type StatementExplain } from './statementExplain.js';
+export declare function printExplain(explain: StatementExplain): void;
+//# sourceMappingURL=displayExplainCli.d.ts.map

package/dist/esm/explain/displayExplainCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"displayExplainCli.d.ts","sourceRoot":"","sources":["../../../src/explain/displayExplainCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AA2M7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,QAqErD"}

package/dist/esm/explain/displayExplainCli.js

@@ -0,0 +1,258 @@
+import {} from './statementExplain.js';
+const explain1 = {
+    identifier: 'Statement1',
+    matches: true,
+    actionMatch: true,
+    resourceMatch: true,
+    principalMatch: 'Match',
+    conditionMatch: true,
+    effect: 'Allow',
+    actions: [
+        {
+            action: 's3:Get*',
+            matches: true
+        },
+        {
+            action: 's3:PutObject',
+            matches: false
+        }
+    ],
+    resources: [
+        {
+            resource: 'arn:aws:s3:::examplebucket/*',
+            errors: [],
+            matches: true
+        },
+        {
+            resource: 'arn:aws:s3:::examplebucket/${aws:PrincipalTag/Department}/*',
+            resolvedValue: 'arn:aws:s3:::examplebucket/Engineering/*',
+            errors: [],
+            matches: true
+        },
+        {
+            resource: 'arn:aws:s3:::examplebucket/abc/*',
+            errors: [],
+            matches: false
+        }
+    ],
+    conditions: [
+        {
+            conditionKeyValue: 'aws:SecureTransport',
+            resolvedConditionKeyValue: 'true',
+            operator: 'Bool',
+            matches: true,
+            values: {
+                value: 'true',
+                resolvedValue: 'true',
+                matches: true,
+                errors: []
+            }
+        },
+        {
+            conditionKeyValue: 's3:PrincipalTag/Department',
+            resolvedConditionKeyValue: 'Engineering',
+            operator: 'StringEquals',
+            matches: true,
+            values: [
+                {
+                    value: 'Engineering',
+                    resolvedValue: 'Engineering',
+                    matches: true,
+                    errors: []
+                },
+                {
+                    value: 'Quality',
+                    resolvedValue: 'Engineering',
+                    matches: false,
+                    errors: []
+                }
+            ]
+        }
+    ]
+};
+const explain2 = {
+    identifier: 'Statement2',
+    matches: true,
+    actionMatch: true,
+    resourceMatch: true,
+    principalMatch: 'Match',
+    conditionMatch: true,
+    effect: 'Allow',
+    actions: [
+        {
+            action: 's3:Put*',
+            matches: true
+        }
+    ],
+    resources: [
+        {
+            resource: 'arn:aws:s3:::examplebucket/*',
+            errors: [],
+            matches: true
+        }
+    ],
+    conditions: [
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAllValues:StringLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    matchingValues: ['Apple', 'Apricot']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    matchingValues: ['Banana', 'Blueberry']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAllValues:StringNotLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    // matchingValues: ['Color', 'Size', 'Banana', 'Blueberry'],
+                    negativeMatchingValues: ['Apple', 'Apricot']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    // matchingValues: ['Color', 'Size', 'Apple', 'Apricot'],
+                    negativeMatchingValues: ['Banana', 'Blueberry']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAnyValue:StringLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    matchingValues: ['Apple', 'Apricot']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    matchingValues: ['Banana', 'Blueberry']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAnyValue:StringNotLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    matchingValues: ['Color', 'Size', 'Banana', 'Blueberry']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    matchingValues: ['Color', 'Size', 'Apple', 'Apricot']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:PrincipalTag/Department',
+            resolvedConditionKeyValue: 'Engineering',
+            operator: 'StringEquals',
+            matches: true,
+            values: [
+                {
+                    value: 'Engineering',
+                    resolvedValue: 'Engineering',
+                    matches: true,
+                    errors: []
+                },
+                {
+                    value: 'Quality',
+                    resolvedValue: 'Engineering',
+                    matches: false,
+                    errors: []
+                }
+            ]
+        }
+    ]
+};
+function buffers(n) {
+    return '  '.repeat(n);
+}
+export function printExplain(explain) {
+    const buffer = '  ';
+    console.log(`{`);
+    if (explain.matches) {
+        console.log(`${buffer}// Statement ${explain.identifier} Matches`);
+    }
+    else {
+        console.log(`${buffer}// Statement ${explain.identifier} Does NOT Match`);
+    }
+    if (explain.actions && !Array.isArray(explain.actions)) {
+        const actionString = `${buffer}"Action": "${explain.actions.action}", // ${explain.actions.matches ? 'Match' : 'No Match'}`;
+        console.log(actionString);
+    }
+    else if (explain.actions && Array.isArray(explain.actions)) {
+        console.log(`${buffer}"Action": [`);
+        for (const action of explain.actions) {
+            console.log(`${buffers(2)}"${action.action}", // ${action.matches ? 'Match' : 'No Match'}`);
+        }
+        console.log(`${buffer}]`);
+    }
+    if (explain.resources && !Array.isArray(explain.resources)) {
+        if (explain.resources.resolvedValue) {
+            console.log(`${buffer}        //${explain.resources.resolvedValue} // Resolved Value`);
+        }
+        console.log(`${buffer}"Resource": "${explain.resources.resource}", // ${explain.resources.matches ? 'Match' : 'No Match'}`);
+    }
+    else if (explain.resources && Array.isArray(explain.resources)) {
+        console.log(`${buffer}"Resource": [`);
+        for (const resource of explain.resources) {
+            let resourceLine = `${buffers(2)}"${resource.resource}", // ${resource.matches ? 'Match' : 'No Match'}`;
+            if (resource.resolvedValue) {
+                resourceLine += ` Resolved to "${resource.resolvedValue}"`;
+            }
+            console.log(resourceLine);
+        }
+        console.log(`${buffer}]`);
+    }
+    if (explain.conditions) {
+        const operators = explain.conditions.map((c) => c.operator);
+        console.log(`${buffer}"Condition": {`);
+        for (const op of operators) {
+            const opConditions = explain.conditions.filter((c) => c.operator === op);
+            console.log(`${buffers(2)}"${op}": {`);
+            for (const c of opConditions) {
+                if (c.values && !Array.isArray(c.values)) {
+                    console.log(`${buffers(3)}"${c.conditionKeyValue}": "${c.values.value}", // ${c.matches ? 'Match' : 'No Match'}`);
+                    // console.log(`${buffers(3)}"Value": "${c.values.value}", // ${c.values.matches ? 'Match' : 'No Match'}`)
+                }
+                else if (c.values && Array.isArray(c.values)) {
+                    console.log(`${buffers(3)}"${c.conditionKeyValue}": [`);
+                    for (const v of c.values) {
+                        console.log(`${buffers(4)}"${v.value}", // ${v.matches ? 'Match' : 'No Match'}`);
+                    }
+                    console.log(`${buffers(3)}]`);
+                }
+            }
+            console.log(`${buffers(2)}}`);
+        }
+        console.log(`${buffer}}`);
+    }
+    console.log(`}`);
+}
+void explain2;
+printExplain(explain1);
+//# sourceMappingURL=displayExplainCli.js.map

package/dist/esm/explain/displayExplainCli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"displayExplainCli.js","sourceRoot":"","sources":["../../../src/explain/displayExplainCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,MAAM,uBAAuB,CAAA;AAE7D,MAAM,QAAQ,GAAqB;IACjC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,OAAO;IACvB,cAAc,EAAE,IAAI;IAEpB,MAAM,EAAE,OAAO;IACf,OAAO,EAAE;QACP;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;SACd;QACD;YACE,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,KAAK;SACf;KACF;IAED,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,8BAA8B;YACxC,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;QACD;YACE,QAAQ,EAAE,6DAA6D;YACvE,aAAa,EAAE,0CAA0C;YACzD,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;QACD;YACE,QAAQ,EAAE,kCAAkC;YAC5C,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,KAAK;SACf;KACF;IAED,UAAU,EAAE;QACV;YACE,iBAAiB,EAAE,qBAAqB;YACxC,yBAAyB,EAAE,MAAM;YACjC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,KAAK,EAAE,MAAM;gBACb,aAAa,EAAE,MAAM;gBACrB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;aACX;SACF;QACD;YACE,iBAAiB,EAAE,4BAA4B;YAC/C,yBAAyB,EAAE,aAAa;YACxC,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,EAAE;iBACX;gBACD;oBACE,KAAK,EAAE,SAAS;oBAChB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE;iBACX;aACF;SACF;KACF;CACF,CAAA;AAED,MAAM,QAAQ,GAAqB;IACjC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,OAAO;IACvB,cAAc,EAAE,IAAI;IAEpB,MAAM,EAAE,OAAO;IACf,OAAO,EAAE;QACP;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;SACd;KACF;IAED,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,8BAA8B;YACxC,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;KACF;IAED,UAAU,EAAE;QACV;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,yBAAyB;YACnC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;iBACrC;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;iBACxC;aACF;SACF;QACD;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,4BAA4B;YACtC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,4DAA4D;oBAC5D,sBAAsB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;iBAC7C;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,yDAAyD;oBACzD,sBAAsB,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;iBAChD;aACF;SACF;QACD;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;iBACrC;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;iBACxC;aACF;SACF;QACD;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,2BAA2B;YACrC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC;iBACzD;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;iBACtD;aACF;SACF;QACD;YACE,iBAAiB,EAAE,4BAA4B;YAC/C,yBAAyB,EAAE,aAAa;YACxC,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,EAAE;iBACX;gBACD;oBACE,KAAK,EAAE,SAAS;oBAChB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE;iBACX;aACF;SACF;KACF;CACF,CAAA;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAyB;IACpD,MAAM,MAAM,GAAG,IAAI,CAAA;IAEnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,OAAO,CAAC,UAAU,UAAU,CAAC,CAAA;IACpE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,OAAO,CAAC,UAAU,iBAAiB,CAAC,CAAA;IAC3E,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,YAAY,GAAG,GAAG,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;QAC3H,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC3B,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,CAAA;QACnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,OAAO,CAAC,SAAS,CAAC,aAAa,oBAAoB,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,gBAAgB,OAAO,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAC/G,CAAA;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,SAAS,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;YACvG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC3B,YAAY,IAAI,iBAAiB,QAAQ,CAAC,aAAa,GAAG,CAAA;YAC5D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAA;QACtC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAA;YACxE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACtC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,OAAO,CAAC,GAAG,CACT,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CACrG,CAAA;oBACD,0GAA0G;gBAC5G,CAAC;qBAAM,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,MAAM,CAAC,CAAA;oBACvD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;wBACzB,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;oBAClF,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC/B,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAClB,CAAC;AAED,KAAK,QAAQ,CAAA;AACb,YAAY,CAAC,QAAQ,CAAC,CAAA"}

package/dist/esm/explain/statementExplain.d.ts

@@ -0,0 +1,161 @@
+export type ExplainPrincipalMatch = 'Match' | 'NoMatch' | 'AccountLevelMatch' | 'SessionRoleMatch' | 'SessionUserMatch';
+export interface ActionExplain {
+    action: string;
+    matches: boolean;
+}
+/**
+ * Known reasons that a policy resource can fail to match a request resource.
+ *
+ * The `invertible` flag records whether the mismatch definitively proves that
+ * the request is outside a `NotResource` set. Non-invertible reasons indicate
+ * invalid policy syntax or unavailable input rather than a definitive mismatch.
+ */
+export declare const resourceMismatchReasons: {
+    readonly invalidPolicyResourceArn: {
+        readonly invertible: false;
+    };
+    readonly requestMissingResource: {
+        readonly invertible: false;
+    };
+    readonly unresolvablePolicyVariable: {
+        readonly invertible: false;
+    };
+    readonly shortArnNoMatch: {
+        readonly invertible: true;
+    };
+    readonly shortArnExpandedMismatch: {
+        readonly invertible: false;
+    };
+    readonly wildcardOnlyActionSpecificResource: {
+        readonly invertible: true;
+    };
+    readonly requestAllResourcesSpecificNotResource: {
+        readonly invertible: true;
+    };
+    readonly requestAllResourcesDenySpecificResource: {
+        readonly invertible: true;
+    };
+    readonly resourcePatternMismatch: {
+        readonly invertible: true;
+    };
+    readonly partitionMismatch: {
+        readonly invertible: true;
+    };
+    readonly serviceMismatch: {
+        readonly invertible: true;
+    };
+    readonly regionMismatch: {
+        readonly invertible: true;
+    };
+    readonly accountMismatch: {
+        readonly invertible: true;
+    };
+    readonly productMismatch: {
+        readonly invertible: true;
+    };
+    readonly resourceIdMismatch: {
+        readonly invertible: true;
+    };
+};
+/**
+ * A machine-readable key explaining why a policy resource did not match a request resource.
+ */
+export type ResourceMismatchReason = keyof typeof resourceMismatchReasons;
+export interface ResourceExplain {
+    resource: string;
+    resolvedValue?: string;
+    errors?: string[];
+    /**
+     * Machine-readable reason for a non-match, when the resource did not match.
+     */
+    mismatchReason?: ResourceMismatchReason;
+    matches: boolean;
+}
+export interface PrincipalExplain {
+    principal: string;
+    matches: ExplainPrincipalMatch;
+    roleForSessionArn?: string;
+    userForSessionArn?: string;
+    errors?: string[];
+}
+export interface ConditionValueExplain {
+    value: string;
+    resolvedValue?: string;
+    matches: boolean;
+    matchingValues?: string[];
+    negativeMatchingValues?: string[];
+    errors?: string[];
+}
+export interface ConditionExplain {
+    /**
+     * The operation that was used in the condition statement
+     */
+    operator: string;
+    /**
+     * The value being matched in the condition statement
+     */
+    conditionKeyValue: string;
+    /**
+     * The resolved value of the condition key
+     */
+    resolvedConditionKeyValue?: string;
+    values: ConditionValueExplain | ConditionValueExplain[];
+    /**
+     * The values from the request context that were not matched by a condition with a set operation
+     */
+    unmatchedValues?: string[];
+    /**
+     * Whether the condition matches the request
+     */
+    matches: boolean;
+    /**
+     *
+     */
+    matchedBecauseMissing?: boolean;
+    /**
+     * Failed because the context key was missing from the request.
+     */
+    failedBecauseMissing?: boolean;
+    /**
+     * Failed because the context key was required to be a string but was was
+     * an instead an array. Caused by a set operation being used on a single value
+     * context key.
+     */
+    failedBecauseArray?: boolean;
+    /**
+     * Was the base operator in the condition statement not found
+     */
+    missingOperator?: boolean;
+}
+export interface StatementExplain {
+    actionMatch: boolean;
+    resourceMatch: boolean;
+    principalMatch: ExplainPrincipalMatch;
+    conditionMatch: boolean;
+    matches: boolean;
+    identifier: string;
+    effect: string;
+    actions?: ActionExplain | ActionExplain[];
+    notActions?: ActionExplain | ActionExplain[];
+    resources?: ResourceExplain | ResourceExplain[];
+    notResources?: ResourceExplain | ResourceExplain[];
+    principals?: PrincipalExplain | PrincipalExplain[];
+    notPrincipals?: PrincipalExplain | PrincipalExplain[];
+    conditions?: ConditionExplain[];
+    /**
+     * The statement was denied because the resource policy has a NotPrincipal in a Deny
+     * statement and the principal has a Permission Boundary.
+     *
+     * This will always resolve to to Deny.
+     *
+     * https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
+     */
+    denyBecauseNpInRpAndPb?: boolean;
+    /**
+     * The statement in a resource policy had neither a Principal nor a NotPrincipal
+     * element. AWS accepts this syntactically, but such a statement can never match
+     * a request, so the simulator reports it as NoMatch with this flag set.
+     */
+    noPrincipalElement?: boolean;
+}
+//# sourceMappingURL=statementExplain.d.ts.map

package/dist/esm/explain/statementExplain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statementExplain.d.ts","sourceRoot":"","sources":["../../../src/explain/statementExplain.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAC/B,OAAO,GAAG,SAAS,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;AAErF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB1B,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,uBAAuB,CAAA;AAEzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,qBAAqB,CAAA;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,MAAM,EAAE,qBAAqB,GAAG,qBAAqB,EAAE,CAAA;IAEvD;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAE1B;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAE/B;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,OAAO,CAAA;IACpB,aAAa,EAAE,OAAO,CAAA;IACtB,cAAc,EAAE,qBAAqB,CAAA;IACrC,cAAc,EAAE,OAAO,CAAA;IAEvB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE,CAAA;IACzC,UAAU,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE,CAAA;IAC5C,SAAS,CAAC,EAAE,eAAe,GAAG,eAAe,EAAE,CAAA;IAC/C,YAAY,CAAC,EAAE,eAAe,GAAG,eAAe,EAAE,CAAA;IAClD,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAA;IAClD,aAAa,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAA;IACrD,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAE/B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B"}