@actsecurity/iam-simulate 0.1.173

package/dist/esm/simulation_engine/simulationEngine.js

@@ -0,0 +1,430 @@
+import { iamActionExists, iamServiceExists } from '@actsecurity/iam-data';
+import { isValidatedPolicy, loadPolicy, validateEndpointPolicy, validateIdentityPolicy, validateResourceControlPolicy, validateResourcePolicy, validateServiceControlPolicy } from '@actsecurity/iam-policy';
+import { isAssumedRoleArn, isFederatedUserArn, isIamRoleArn } from '@actsecurity/iam-utils';
+import { isConditionKeyArray } from '../context_keys/contextKeyTypes.js';
+import { normalizeContextKeyCase, typeForContextKey } from '../context_keys/contextKeys.js';
+import { DiscoveryContextKeyConstraints } from '../context_keys/discoveryContextKeyConstraints.js';
+import { authorize, validSimulationModes } from '../core_engine/CoreSimulatorEngine.js';
+import {} from '../evaluate.js';
+import { AwsRequestImpl } from '../request/request.js';
+import { RequestContextImpl } from '../requestContext.js';
+import { isWildcardOnlyAction } from '../util.js';
+import { allowedContextKeysForRequest } from './contextKeys.js';
+import { calculateOverallResult } from './overallResult.js';
+import { getMatchingResourceStringsForPolicies } from './policyResources.js';
+import { expandShortArn } from '../util/resourceStrings.js';
+import { getResourceTypesForAction } from './resourceTypes.js';
+import { isAnonymousRequestPrincipal, isSimulationRequestPrincipal } from './simulation.js';
+import {} from './simulationOptions.js';
+const DEFAULT_RCP = {
+    arn: 'arn:aws:organizations::aws:policy/resource_control_policy/p-RCPFullAWSAccess',
+    policy: {
+        Version: '2012-10-17',
+        Statement: [
+            {
+                Effect: 'Allow',
+                Principal: '*',
+                Action: '*',
+                Resource: '*'
+            }
+        ]
+    }
+};
+/**
+ * Returns pre-computed validation errors from a ValidatedPolicy, or runs the
+ * validation function against a raw policy document.
+ *
+ * @param policy a raw policy document or a ValidatedPolicy
+ * @param validateFn the validation function to apply if the policy is not already validated
+ * @returns the array of validation errors (empty if valid)
+ */
+function validateOrReuse(policy, validateFn) {
+    if (isValidatedPolicy(policy)) {
+        return [...policy.errors];
+    }
+    return validateFn(policy);
+}
+/**
+ * Finds principal-side policy inputs that are invalid for anonymous requests.
+ *
+ * @param simulation the simulation input to validate.
+ * @returns anonymous request validation error message identifiers.
+ */
+function anonymousRequestValidationErrors(simulation) {
+    const errors = [];
+    if (simulation.sessionPolicy) {
+        errors.push('anonymous.sessionPolicy.invalid');
+    }
+    if (simulation.identityPolicies.length > 0) {
+        errors.push('anonymous.identityPolicies.invalid');
+    }
+    if ((simulation.permissionBoundaryPolicies?.length ?? 0) > 0) {
+        errors.push('anonymous.permissionBoundaryPolicies.invalid');
+    }
+    if (simulation.serviceControlPolicies.length > 0) {
+        errors.push('anonymous.serviceControlPolicies.invalid');
+    }
+    return errors;
+}
+/**
+ * Run a simulation with validation
+ *
+ * @param simulation The simulation to run
+ * @param simulationOptions Options for the simulation
+ * @returns The results of the simulation, or errors if the simulation could not be run
+ */
+export async function runSimulation(simulation, simulationOptions) {
+    const principal = simulation.request.principal;
+    const resourceArn = simulation.request.resource.resource;
+    const resourceHasWildcard = resourceArn.includes('*');
+    if (!isSimulationRequestPrincipal(principal)) {
+        return {
+            resultType: 'error',
+            errors: {
+                message: 'invalid.principal'
+            }
+        };
+    }
+    if (isAnonymousRequestPrincipal(principal)) {
+        const anonymousRequestErrors = anonymousRequestValidationErrors(simulation);
+        if (anonymousRequestErrors.length > 0) {
+            return {
+                resultType: 'error',
+                errors: {
+                    anonymousRequestErrors,
+                    message: anonymousRequestErrors.length === 1
+                        ? anonymousRequestErrors[0]
+                        : 'anonymous.policies.invalid'
+                }
+            };
+        }
+    }
+    if (simulation.sessionPolicy) {
+        if (typeof principal !== 'string' ||
+            (!isIamRoleArn(principal) && !isAssumedRoleArn(principal) && !isFederatedUserArn(principal))) {
+            return {
+                resultType: 'error',
+                errors: {
+                    message: 'session.policy.invalid.principal'
+                }
+            };
+        }
+    }
+    const sessionPolicyErrors = simulation.sessionPolicy
+        ? validateOrReuse(simulation.sessionPolicy, validateIdentityPolicy)
+        : [];
+    const sessionPolicy = simulation.sessionPolicy
+        ? loadPolicy(simulation.sessionPolicy, { name: 'SessionPolicy' })
+        : undefined;
+    const identityPolicyErrors = {};
+    const identityPolicies = [];
+    simulation.identityPolicies.forEach((value) => {
+        const { name, policy } = value;
+        const validationErrors = validateOrReuse(policy, validateIdentityPolicy);
+        if (validationErrors.length == 0) {
+            identityPolicies.push(loadPolicy(policy, { name }));
+        }
+        else {
+            identityPolicyErrors[name] = validationErrors;
+        }
+    });
+    const serviceControlPolicyErrors = {};
+    const serviceControlPolicies = simulation.serviceControlPolicies.map((scp) => {
+        const ouId = scp.orgIdentifier;
+        const validPolicies = [];
+        scp.policies.forEach((value) => {
+            const { name, policy } = value;
+            const validationErrors = validateOrReuse(policy, validateServiceControlPolicy);
+            if (validationErrors.length > 0) {
+                serviceControlPolicyErrors[name] = validationErrors;
+            }
+            else {
+                validPolicies.push(loadPolicy(policy, { name }));
+            }
+        });
+        return {
+            orgIdentifier: ouId,
+            policies: validPolicies
+        };
+    });
+    const resourceControlPolicyErrors = {};
+    const resourceControlPolicies = simulation.resourceControlPolicies.map((rcp) => {
+        const ouId = rcp.orgIdentifier;
+        const validPolicies = [];
+        validPolicies.push(loadPolicy(DEFAULT_RCP.policy, { name: DEFAULT_RCP.arn }));
+        rcp.policies.forEach((value) => {
+            const { name, policy } = value;
+            const validationErrors = validateOrReuse(policy, validateResourceControlPolicy);
+            if (validationErrors.length > 0) {
+                resourceControlPolicyErrors[name] = validationErrors;
+            }
+            else {
+                validPolicies.push(loadPolicy(policy, { name }));
+            }
+        });
+        return {
+            orgIdentifier: ouId,
+            policies: validPolicies
+        };
+    });
+    const resourcePolicyErrors = simulation.resourcePolicy
+        ? validateOrReuse(simulation.resourcePolicy, validateResourcePolicy)
+        : [];
+    const permissionBoundaries = simulation.permissionBoundaryPolicies
+        ? []
+        : undefined;
+    const permissionBoundaryErrors = {};
+    simulation.permissionBoundaryPolicies?.map((pb) => {
+        const { name, policy } = pb;
+        const validationErrors = validateOrReuse(policy, validateIdentityPolicy);
+        if (validationErrors.length == 0) {
+            permissionBoundaries.push(loadPolicy(policy, { name }));
+        }
+        else {
+            permissionBoundaryErrors[name] = validationErrors;
+        }
+    });
+    const vpcEndpointPolicies = simulation.vpcEndpointPolicies
+        ? []
+        : undefined;
+    const vpcEndpointErrors = {};
+    simulation.vpcEndpointPolicies?.map((endpointPolicy) => {
+        const { name, policy } = endpointPolicy;
+        const validationErrors = validateOrReuse(policy, validateEndpointPolicy);
+        if (validationErrors.length == 0) {
+            vpcEndpointPolicies.push(loadPolicy(policy, { name }));
+        }
+        else {
+            vpcEndpointErrors[name] = validationErrors;
+        }
+    });
+    if (Object.keys(identityPolicyErrors).length > 0 ||
+        Object.keys(serviceControlPolicyErrors).length > 0 ||
+        Object.keys(resourceControlPolicyErrors).length > 0 ||
+        Object.keys(permissionBoundaryErrors).length > 0 ||
+        Object.keys(vpcEndpointErrors).length > 0 ||
+        resourcePolicyErrors.length > 0 ||
+        sessionPolicyErrors.length > 0) {
+        return {
+            resultType: 'error',
+            errors: {
+                ...(sessionPolicyErrors.length > 0 && { sessionPolicyErrors }),
+                ...(Object.keys(identityPolicyErrors).length > 0 && { identityPolicyErrors }),
+                ...(Object.keys(serviceControlPolicyErrors).length > 0 && { serviceControlPolicyErrors }),
+                ...(Object.keys(resourceControlPolicyErrors).length > 0 && { resourceControlPolicyErrors }),
+                ...(resourcePolicyErrors.length > 0 && { resourcePolicyErrors }),
+                ...(Object.keys(permissionBoundaryErrors).length > 0 && { permissionBoundaryErrors }),
+                ...(Object.keys(vpcEndpointErrors).length > 0 && { vpcEndpointErrors }),
+                message: 'policy.errors'
+            }
+        };
+    }
+    const resourcePolicy = simulation.resourcePolicy
+        ? loadPolicy(simulation.resourcePolicy, {
+            name: simulation.resourcePolicy.name
+        })
+        : undefined;
+    if (simulation.request.action.split(':').length != 2) {
+        return {
+            resultType: 'error',
+            errors: {
+                message: 'invalid.action'
+            }
+        };
+    }
+    const [service, action] = simulation.request.action.split(':');
+    const validService = await iamServiceExists(service);
+    if (!validService) {
+        return {
+            resultType: 'error',
+            errors: {
+                message: 'invalid.service'
+            }
+        };
+    }
+    const validAction = await iamActionExists(service, action);
+    if (!validAction) {
+        return {
+            resultType: 'error',
+            errors: {
+                message: 'invalid.action'
+            }
+        };
+    }
+    const isWildCardOnlyAction = await isWildcardOnlyAction(service, action);
+    const runMultipleSimulations = resourceHasWildcard && !isWildCardOnlyAction;
+    let resourceTypes = undefined;
+    if (isWildCardOnlyAction) {
+        if (resourceArn !== '*') {
+            return {
+                resultType: 'error',
+                errors: {
+                    message: 'must.use.wildcard'
+                }
+            };
+        }
+    }
+    else {
+        const actionResourceTypes = await getResourceTypesForAction(service, action, resourceArn);
+        if (actionResourceTypes.length === 0) {
+            return {
+                resultType: 'error',
+                errors: {
+                    message: 'no.resource.types'
+                }
+            };
+        }
+        else if (actionResourceTypes.length > 1 && !resourceHasWildcard) {
+            return {
+                resultType: 'error',
+                errors: {
+                    message: 'multiple.resource.types'
+                }
+            };
+        }
+        else {
+            resourceTypes = actionResourceTypes.map((item) => item);
+        }
+    }
+    const simulationMode = validSimulationModes.includes(simulationOptions.simulationMode)
+        ? simulationOptions.simulationMode
+        : 'Strict';
+    // For each resource type, find the resource patterns, for each pattern, run a simulation
+    const discoveryContextKeyConstraints = simulationMode === 'Discovery'
+        ? new DiscoveryContextKeyConstraints(simulationOptions.discoveryContextKeyConstraints || [])
+        : new DiscoveryContextKeyConstraints([]);
+    const curriedAuthorize = (curriedResourceString, curriedContextValues) => authorize({
+        request: new AwsRequestImpl(principal, {
+            resource: expandShortArn(curriedResourceString),
+            accountId: simulation.request.resource.accountId
+        }, simulation.request.action, new RequestContextImpl(curriedContextValues), isWildCardOnlyAction),
+        sessionPolicy,
+        identityPolicies,
+        serviceControlPolicies,
+        resourceControlPolicies,
+        resourcePolicy,
+        permissionBoundaries,
+        vpcEndpointPolicies,
+        simulationParameters: {
+            simulationMode: simulationMode,
+            discoveryContextKeyConstraints
+        },
+        serviceSettings: {
+            s3: {
+                blockPublicAccess: simulation.additionalSettings?.s3?.blockPublicAccess
+            }
+        }
+    });
+    const identityPoliciesThatGrantAccess = [...identityPolicies];
+    const resourcePoliciesThatGrantAccess = [resourcePolicy];
+    // If there is only one simulation to run, run it
+    if (!runMultipleSimulations) {
+        const { validContextValues, ignoredContextKeys } = await normalizeSimulationParameters(simulation, undefined);
+        const singleResult = curriedAuthorize(resourceArn, validContextValues);
+        return {
+            resultType: 'single',
+            overallResult: singleResult.result,
+            result: {
+                analysis: singleResult,
+                ...(resourceTypes?.length === 1 ? { resourceType: resourceTypes[0].key } : {}),
+                ignoredContextKeys
+            }
+        };
+    }
+    // Here, we know it is a wildcard resource and not a wildcard-only action, so we need to run multiple simulations
+    const simulationResults = [];
+    const resourceTypesToSimulate = resourceTypes && resourceTypes.length > 0 ? resourceTypes : [];
+    for (const resourceType of resourceTypesToSimulate) {
+        // If "run multiple" get the resource strings that match the wildcard pattern, otherwise, just run the one.
+        const { validContextValues, ignoredContextKeys } = await normalizeSimulationParameters(simulation, resourceType);
+        //Run the pattern directly first.
+        const exactPatternResult = curriedAuthorize(resourceArn, validContextValues);
+        if (exactPatternResult.result === 'ExplicitlyDenied') {
+            simulationResults.push({
+                analysis: exactPatternResult,
+                ignoredContextKeys,
+                resourceType: resourceType.key,
+                resourcePattern: resourceArn
+            });
+        }
+        else if (exactPatternResult.result !== 'ImplicitlyDenied') {
+            // If the requested pattern is implicitly denied, narrower overlapping policy patterns cannot
+            // make the overall request allowed because exact-pattern evaluation already considers any
+            // overlapping identity, resource, and guardrail policy statements.
+            let resourceStrings = [simulation.request.resource.resource];
+            const identityResourceStrings = getMatchingResourceStringsForPolicies(identityPoliciesThatGrantAccess, simulation.request.action, resourceType, simulation.request.resource.resource, true);
+            const resourcePolicyResourceStrings = getMatchingResourceStringsForPolicies(resourcePoliciesThatGrantAccess, simulation.request.action, resourceType, simulation.request.resource.resource, false);
+            resourceStrings = [...new Set([...identityResourceStrings, ...resourcePolicyResourceStrings])];
+            for (const resourceString of resourceStrings) {
+                const simulationResult = curriedAuthorize(resourceString, validContextValues);
+                simulationResults.push({
+                    analysis: simulationResult,
+                    ignoredContextKeys,
+                    resourceType: resourceType.key,
+                    resourcePattern: resourceString
+                });
+            }
+        }
+    }
+    const overallResult = calculateOverallResult(simulationResults);
+    return {
+        resultType: 'wildcard',
+        overallResult,
+        results: simulationResults
+    };
+}
+export async function normalizeSimulationParameters(simulation, suggestedResourceType) {
+    const [service, action] = simulation.request.action.split(':');
+    const resourceArn = simulation.request.resource.resource;
+    const contextVariablesForAction = new Set(await allowedContextKeysForRequest(service, action, resourceArn, !!simulation.additionalSettings?.s3?.bucketAbacEnabled, suggestedResourceType));
+    //Get the types of the context variables and set a string or array of strings based on that.
+    const validContextValues = {};
+    const ignoredContextKeys = [];
+    for (const key of Object.keys(simulation.request.contextVariables)) {
+        const value = simulation.request.contextVariables[key];
+        const lowerCaseKey = key.toLowerCase();
+        if (contextVariablesForAction.has(lowerCaseKey) ||
+            listHasVariableKeyMatch(lowerCaseKey, contextVariablesForAction)) {
+            const conditionType = await typeForContextKey(lowerCaseKey);
+            const normalizedKey = await normalizeContextKeyCase(key);
+            if (isConditionKeyArray(conditionType)) {
+                validContextValues[normalizedKey] = [value].flat();
+            }
+            else if (Array.isArray(value)) {
+                validContextValues[normalizedKey] = value[0];
+            }
+            else {
+                validContextValues[normalizedKey] = value;
+            }
+        }
+        else {
+            ignoredContextKeys.push(key);
+        }
+    }
+    return {
+        validContextValues,
+        ignoredContextKeys
+    };
+}
+/**
+ * Evaluates a context key with a variable such as `aws:PrincipalTag/Foo` to see
+ * if it matches any of the context variables in the allowed variables set.
+ *
+ * @param lowerCaseKey The lower case key to check for a match.
+ * @param contextVariables The set of context variables to check against.
+ * @returns True if the key has a variable match, false otherwise.
+ */
+function listHasVariableKeyMatch(lowerCaseKey, contextVariables) {
+    const firstSlashIndex = lowerCaseKey.indexOf('/');
+    if (firstSlashIndex === -1) {
+        return false;
+    }
+    const prefix = lowerCaseKey.slice(0, firstSlashIndex + 1);
+    for (const variable of contextVariables) {
+        if (variable.startsWith(prefix)) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=simulationEngine.js.map

package/dist/esm/simulation_engine/simulationEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulationEngine.js","sourceRoot":"","sources":["../../../src/simulation_engine/simulationEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAqB,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAE7B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAA;AAClG,OAAO,EACL,SAAS,EAIT,oBAAoB,EACrB,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EAA+C,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,qCAAqC,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAE7B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAA0B,MAAM,wBAAwB,CAAA;AAE/D,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,8EAA8E;IACnF,MAAM,EAAE;QACN,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT;gBACE,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,GAAG;gBACd,MAAM,EAAE,GAAG;gBACX,QAAQ,EAAE,GAAG;aACd;SACF;KACF;CACF,CAAA;AAmID;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,MAAW,EACX,UAA8C;IAE9C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,SAAS,gCAAgC,CAAC,UAAsB;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,0BAA0B,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,UAAU,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAsB,EACtB,iBAA6C;IAE7C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAA;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACxD,MAAM,mBAAmB,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAErD,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE;gBACN,OAAO,EAAE,mBAAmB;aAC7B;SACF,CAAA;IACH,CAAC;IAED,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,sBAAsB,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAA;QAC3E,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE;oBACN,sBAAsB;oBACtB,OAAO,EACL,sBAAsB,CAAC,MAAM,KAAK,CAAC;wBACjC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;wBAC3B,CAAC,CAAC,4BAA4B;iBACnC;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7B,IACE,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAC5F,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE;oBACN,OAAO,EAAE,kCAAkC;iBAC5C;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,UAAU,CAAC,aAAa;QAClD,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,EAAE,sBAAsB,CAAC;QACnE,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa;QAC5C,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACjE,CAAC,CAAC,SAAS,CAAA;IAEb,MAAM,oBAAoB,GAAsC,EAAE,CAAA;IAClE,MAAM,gBAAgB,GAAqB,EAAE,CAAA;IAC7C,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;QAC9B,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;QACxE,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACrD,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAA;QAC/C,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,0BAA0B,GAAsC,EAAE,CAAA;IACxE,MAAM,sBAAsB,GAAsB,UAAU,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,aAAa,GAAqB,EAAE,CAAA;QAE1C,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;YAC9B,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAA;YAC9E,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,0BAA0B,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAA;YACrD,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAClD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,aAAa;SACxB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,2BAA2B,GAAsC,EAAE,CAAA;IACzE,MAAM,uBAAuB,GAAsB,UAAU,CAAC,uBAAuB,CAAC,GAAG,CACvF,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,aAAa,GAAqB,EAAE,CAAA;QAC1C,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAE7E,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;YAC9B,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAA;YAC/E,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,2BAA2B,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAA;YACtD,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAClD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,aAAa;SACxB,CAAA;IACH,CAAC,CACF,CAAA;IAED,MAAM,oBAAoB,GAAG,UAAU,CAAC,cAAc;QACpD,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,EAAE,sBAAsB,CAAC;QACpE,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,oBAAoB,GAAiC,UAAU,CAAC,0BAA0B;QAC9F,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,wBAAwB,GAAsC,EAAE,CAAA;IACtE,UAAU,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAChD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QAC3B,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;QACxE,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjC,oBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC1D,CAAC;aAAM,CAAC;YACN,wBAAwB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,mBAAmB,GAAiC,UAAU,CAAC,mBAAmB;QACtF,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,iBAAiB,GAAsC,EAAE,CAAA;IAC/D,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAAA;QACvC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;QACxE,IAAI,gBAAgB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjC,mBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACzD,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAA;QAC5C,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IACE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,MAAM,GAAG,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,MAAM,GAAG,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC;QACzC,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAC/B,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE;gBACN,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;gBAC9D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAC;gBAC7E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,CAAC;gBACzF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,2BAA2B,EAAE,CAAC;gBAC3F,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAC;gBAChE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,wBAAwB,EAAE,CAAC;gBACrF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;gBACvE,OAAO,EAAE,eAAe;aACzB;SACF,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc;QAC9C,CAAC,CAAC,UAAU,CAAmB,UAAU,CAAC,cAAc,EAAE;YACtD,IAAI,EAAE,UAAU,CAAC,cAAc,CAAC,IAAI;SACrC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE;gBACN,OAAO,EAAE,gBAAgB;aAC1B;SACF,CAAA;IACH,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE;gBACN,OAAO,EAAE,iBAAiB;aAC3B;SACF,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE;gBACN,OAAO,EAAE,gBAAgB;aAC1B;SACF,CAAA;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACxE,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,CAAC,oBAAoB,CAAA;IAC3E,IAAI,aAAa,GAA+B,SAAS,CAAA;IACzD,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE;oBACN,OAAO,EAAE,mBAAmB;iBAC7B;aACF,CAAA;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,mBAAmB,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;QACzF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE;oBACN,OAAO,EAAE,mBAAmB;iBAC7B;aACF,CAAA;QACH,CAAC;aAAM,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClE,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE;oBACN,OAAO,EAAE,yBAAyB;iBACnC;aACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,CAClD,iBAAiB,CAAC,cAAgC,CACnD;QACC,CAAC,CAAE,iBAAiB,CAAC,cAAiC;QACtD,CAAC,CAAC,QAAQ,CAAA;IAEZ,yFAAyF;IAEzF,MAAM,8BAA8B,GAClC,cAAc,KAAK,WAAW;QAC5B,CAAC,CAAC,IAAI,8BAA8B,CAAC,iBAAiB,CAAC,8BAA8B,IAAI,EAAE,CAAC;QAC5F,CAAC,CAAC,IAAI,8BAA8B,CAAC,EAAE,CAAC,CAAA;IAE5C,MAAM,gBAAgB,GAAG,CACvB,qBAA6B,EAC7B,oBAAuD,EACvD,EAAE,CACF,SAAS,CAAC;QACR,OAAO,EAAE,IAAI,cAAc,CACzB,SAAS,EACT;YACE,QAAQ,EAAE,cAAc,CAAC,qBAAqB,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS;SACjD,EACD,UAAU,CAAC,OAAO,CAAC,MAAM,EACzB,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,EAC5C,oBAAoB,CACrB;QACD,aAAa;QACb,gBAAgB;QAChB,sBAAsB;QACtB,uBAAuB;QACvB,cAAc;QACd,oBAAoB;QACpB,mBAAmB;QACnB,oBAAoB,EAAE;YACpB,cAAc,EAAE,cAAc;YAC9B,8BAA8B;SAC/B;QACD,eAAe,EAAE;YACf,EAAE,EAAE;gBACF,iBAAiB,EAAE,UAAU,CAAC,kBAAkB,EAAE,EAAE,EAAE,iBAAiB;aACxE;SACF;KACF,CAAC,CAAA;IAEJ,MAAM,+BAA+B,GAAmC,CAAC,GAAG,gBAAgB,CAAC,CAAA;IAC7F,MAAM,+BAA+B,GAAmC,CAAC,cAAc,CAAC,CAAA;IAExF,iDAAiD;IACjD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,MAAM,6BAA6B,CACpF,UAAU,EACV,SAAS,CACV,CAAA;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAA;QACtE,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,YAAY,CAAC,MAAM;YAClC,MAAM,EAAE;gBACN,QAAQ,EAAE,YAAY;gBACtB,GAAG,CAAC,aAAa,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,aAAc,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,kBAAkB;aACnB;SACF,CAAA;IACH,CAAC;IAED,iHAAiH;IACjH,MAAM,iBAAiB,GAAuC,EAAE,CAAA;IAChE,MAAM,uBAAuB,GAC3B,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,KAAK,MAAM,YAAY,IAAI,uBAAuB,EAAE,CAAC;QACnD,2GAA2G;QAE3G,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,MAAM,6BAA6B,CACpF,UAAU,EACV,YAAY,CACb,CAAA;QAED,iCAAiC;QACjC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAA;QAC5E,IAAI,kBAAkB,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACrD,iBAAiB,CAAC,IAAI,CAAC;gBACrB,QAAQ,EAAE,kBAAkB;gBAC5B,kBAAkB;gBAClB,YAAY,EAAE,YAAY,CAAC,GAAG;gBAC9B,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,kBAAkB,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC5D,6FAA6F;YAC7F,0FAA0F;YAC1F,mEAAmE;YACnE,IAAI,eAAe,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,uBAAuB,GAAG,qCAAqC,CACnE,+BAA+B,EAC/B,UAAU,CAAC,OAAO,CAAC,MAAM,EACzB,YAAY,EACZ,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EACpC,IAAI,CACL,CAAA;YACD,MAAM,6BAA6B,GAAG,qCAAqC,CACzE,+BAA+B,EAC/B,UAAU,CAAC,OAAO,CAAC,MAAM,EACzB,YAAY,EACZ,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EACpC,KAAK,CACN,CAAA;YACD,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,uBAAuB,EAAE,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAA;YAE9F,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;gBAC7C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;gBAE7E,iBAAiB,CAAC,IAAI,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,kBAAkB;oBAClB,YAAY,EAAE,YAAY,CAAC,GAAG;oBAC9B,eAAe,EAAE,cAAc;iBAChC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,CAAA;IAC/D,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,aAAa;QACb,OAAO,EAAE,iBAAiB;KAC3B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,UAAsB,EACtB,qBAA+C;IAK/C,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACxD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,MAAM,4BAA4B,CAChC,OAAO,EACP,MAAM,EACN,WAAW,EACX,CAAC,CAAC,UAAU,CAAC,kBAAkB,EAAE,EAAE,EAAE,iBAAiB,EACtD,qBAAqB,CACtB,CACF,CAAA;IAED,4FAA4F;IAC5F,MAAM,kBAAkB,GAAsC,EAAE,CAAA;IAChE,MAAM,kBAAkB,GAAa,EAAE,CAAA;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QACtD,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QACtC,IACE,yBAAyB,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,uBAAuB,CAAC,YAAY,EAAE,yBAAyB,CAAC,EAChE,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAA;YAC3D,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAA;YAExD,IAAI,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC;gBACvC,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;YACpD,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,kBAAkB,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YAC9C,CAAC;iBAAM,CAAC;gBACN,kBAAkB,CAAC,aAAa,CAAC,GAAG,KAAK,CAAA;YAC3C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,OAAO;QACL,kBAAkB;QAClB,kBAAkB;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,YAAoB,EAAE,gBAA6B;IAClF,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjD,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACzD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/esm/simulation_engine/simulationOptions.d.ts

@@ -0,0 +1,21 @@
+import { type SimulationMode } from '../core_engine/CoreSimulatorEngine.js';
+import { type DiscoveryContextKeyConstraint } from '../context_keys/discoveryContextKeyConstraints.js';
+/**
+ * Options that control how a simulation is evaluated.
+ */
+export interface SimulationOptions {
+    /**
+     * The simulation mode to run. Strict mode evaluates the request exactly as
+     * supplied; Discovery mode can report conditional access for unknown or
+     * intentionally non-authoritative context keys.
+     */
+    simulationMode?: SimulationMode;
+    /**
+     * Discovery-only knowledge constraints for context keys.
+     *
+     * These constraints tell Discovery mode whether a key's presence and concrete
+     * value are authoritative. They are ignored in Strict mode.
+     */
+    discoveryContextKeyConstraints?: DiscoveryContextKeyConstraint[];
+}
+//# sourceMappingURL=simulationOptions.d.ts.map

package/dist/esm/simulation_engine/simulationOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulationOptions.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/simulationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAC3E,OAAO,EAAE,KAAK,6BAA6B,EAAE,MAAM,mDAAmD,CAAA;AAEtG;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,6BAA6B,EAAE,CAAA;CACjE"}

package/dist/esm/simulation_engine/simulationOptions.js

@@ -0,0 +1,3 @@
+import {} from '../core_engine/CoreSimulatorEngine.js';
+import {} from '../context_keys/discoveryContextKeyConstraints.js';
+//# sourceMappingURL=simulationOptions.js.map

package/dist/esm/simulation_engine/simulationOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulationOptions.js","sourceRoot":"","sources":["../../../src/simulation_engine/simulationOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,MAAM,uCAAuC,CAAA;AAC3E,OAAO,EAAsC,MAAM,mDAAmD,CAAA"}

package/dist/esm/simulation_engine/unsafeSimulationEngine.d.ts

@@ -0,0 +1,13 @@
+import { type EvaluationResult } from '../evaluate.js';
+import { type Simulation } from './simulation.js';
+import { type SimulationOptions } from './simulationOptions.js';
+/**
+ * Runs a simulation without input validation or context variable verification.
+ * Use this if you know what you're doing.
+ *
+ * @param simulation The simulation to run.
+ * @param simulationOptions Options for the simulation.
+ * @returns The result of the simulation.
+ */
+export declare function runUnsafeSimulation(simulation: Simulation, simulationOptions: Partial<SimulationOptions>): EvaluationResult;
+//# sourceMappingURL=unsafeSimulationEngine.d.ts.map

package/dist/esm/simulation_engine/unsafeSimulationEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafeSimulationEngine.d.ts","sourceRoot":"","sources":["../../../src/simulation_engine/unsafeSimulationEngine.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGtD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAC5C,gBAAgB,CA+DlB"}

package/dist/esm/simulation_engine/unsafeSimulationEngine.js

@@ -0,0 +1,62 @@
+import { loadPolicy } from '@actsecurity/iam-policy';
+import { DiscoveryContextKeyConstraints } from '../context_keys/discoveryContextKeyConstraints.js';
+import { authorize } from '../core_engine/CoreSimulatorEngine.js';
+import {} from '../evaluate.js';
+import { AwsRequestImpl } from '../request/request.js';
+import { RequestContextImpl } from '../requestContext.js';
+import {} from './simulation.js';
+import {} from './simulationOptions.js';
+/**
+ * Runs a simulation without input validation or context variable verification.
+ * Use this if you know what you're doing.
+ *
+ * @param simulation The simulation to run.
+ * @param simulationOptions Options for the simulation.
+ * @returns The result of the simulation.
+ */
+export function runUnsafeSimulation(simulation, simulationOptions) {
+    const identityPolicies = Object.values(simulation.identityPolicies).map((p) => loadPolicy(p.policy, { name: p.name }));
+    const serviceControlPolicies = simulation.serviceControlPolicies.map((scp) => {
+        const ouId = scp.orgIdentifier;
+        const policies = scp.policies.map((val) => loadPolicy(val.policy, { name: val.name }));
+        return {
+            orgIdentifier: ouId,
+            policies: policies
+        };
+    });
+    const resourceControlPolicies = simulation.resourceControlPolicies.map((rcp) => {
+        const ouId = rcp.orgIdentifier;
+        const policies = rcp.policies.map((val) => loadPolicy(val.policy, { name: val.name }));
+        return {
+            orgIdentifier: ouId,
+            policies: policies
+        };
+    });
+    const permissionBoundaries = simulation.permissionBoundaryPolicies?.map((val) => loadPolicy(val.policy, { name: val.name })) ?? undefined;
+    const requestContext = new RequestContextImpl(simulation.request.contextVariables);
+    const request = new AwsRequestImpl(simulation.request.principal, {
+        resource: simulation.request.resource.resource,
+        accountId: simulation.request.resource.accountId
+    }, simulation.request.action, requestContext);
+    const analysis = authorize({
+        request,
+        sessionPolicy: undefined,
+        identityPolicies,
+        serviceControlPolicies,
+        resourceControlPolicies,
+        resourcePolicy: simulation.resourcePolicy ? loadPolicy(simulation.resourcePolicy) : undefined,
+        permissionBoundaries,
+        vpcEndpointPolicies: undefined,
+        simulationParameters: {
+            simulationMode: 'Strict',
+            discoveryContextKeyConstraints: new DiscoveryContextKeyConstraints([])
+        },
+        serviceSettings: {
+            s3: {
+                blockPublicAccess: simulation.additionalSettings?.s3?.blockPublicAccess
+            }
+        }
+    });
+    return analysis.result;
+}
+//# sourceMappingURL=unsafeSimulationEngine.js.map

package/dist/esm/simulation_engine/unsafeSimulationEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafeSimulationEngine.js","sourceRoot":"","sources":["../../../src/simulation_engine/unsafeSimulationEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAA;AAClG,OAAO,EAAE,SAAS,EAAwB,MAAM,uCAAuC,CAAA;AACvF,OAAO,EAAyB,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAmB,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAA0B,MAAM,wBAAwB,CAAA;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAsB,EACtB,iBAA6C;IAE7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5E,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CACvC,CAAA;IACD,MAAM,sBAAsB,GAAsB,UAAU,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAEtF,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,QAAQ;SACnB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,uBAAuB,GAAsB,UAAU,CAAC,uBAAuB,CAAC,GAAG,CACvF,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAA;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAEtF,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,QAAQ;SACnB,CAAA;IACH,CAAC,CACF,CAAA;IAED,MAAM,oBAAoB,GACxB,UAAU,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAC3C,IAAI,SAAS,CAAA;IAEhB,MAAM,cAAc,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,cAAc,CAChC,UAAU,CAAC,OAAO,CAAC,SAAS,EAC5B;QACE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ;QAC9C,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS;KACjD,EACD,UAAU,CAAC,OAAO,CAAC,MAAM,EACzB,cAAc,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC;QACzB,OAAO;QACP,aAAa,EAAE,SAAS;QACxB,gBAAgB;QAChB,sBAAsB;QACtB,uBAAuB;QACvB,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,oBAAoB;QACpB,mBAAmB,EAAE,SAAS;QAC9B,oBAAoB,EAAE;YACpB,cAAc,EAAE,QAAQ;YACxB,8BAA8B,EAAE,IAAI,8BAA8B,CAAC,EAAE,CAAC;SACvE;QACD,eAAe,EAAE;YACf,EAAE,EAAE;gBACF,iBAAiB,EAAE,UAAU,CAAC,kBAAkB,EAAE,EAAE,EAAE,iBAAiB;aACxE;SACF;KACF,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAA;AACxB,CAAC"}

package/dist/esm/util/resourceStrings.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Determines if two AWS ARN patterns have any overlap in the resources they could match.
+ * Handles wildcards (*) and single-character patterns (?) in both ARN strings.
+ *
+ * @param arn1 First ARN pattern to compare
+ * @param arn2 Second ARN pattern to compare
+ * @returns true if the patterns could match some of the same resources, false if they are completely disjoint
+ */
+export declare function resourceArnsOverlap(arn1: string, arn2: string): boolean;
+/**
+ * Expands a short ARN (fewer than 6 colon-separated segments) by padding
+ * missing trailing segments with `*`. Non-ARN strings and full ARNs are
+ * returned unchanged.
+ *
+ * @param arn the ARN string to expand
+ * @returns the expanded ARN string with missing segments filled with `*`
+ */
+export declare function expandShortArn(arn: string): string;
+//# sourceMappingURL=resourceStrings.d.ts.map

package/dist/esm/util/resourceStrings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceStrings.d.ts","sourceRoot":"","sources":["../../../src/util/resourceStrings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAqDvE;AA4BD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYlD"}