@cloud-copilot/iam-lens 0.1.136 → 0.1.138

package/dist/cjs/principalCan/permissionSet.d.ts

@@ -109,8 +109,12 @@ export declare class PermissionSet {
  * Returns a PermissionSet containing one Permission object for each (service, action, resource, notResource, condition)
  * triple where Effect == "Allow".
  */
-export declare function buildPermissionSetFromPolicies(effect: PermissionEffect, policies: Policy[]): Promise<PermissionSet>;
-export declare function addPoliciesToPermissionSet(permissionSet: PermissionSet, effect: PermissionEffect, policies: Policy[]): Promise<void>;
+export interface AddStatementToPermissionSetOptions {
+    /** Preserve Principal and NotPrincipal values from statements when converting to permissions. */
+    includePrincipals?: boolean;
+}
+export declare function buildPermissionSetFromPolicies(effect: PermissionEffect, policies: Policy[], options?: AddStatementToPermissionSetOptions): Promise<PermissionSet>;
+export declare function addPoliciesToPermissionSet(permissionSet: PermissionSet, effect: PermissionEffect, policies: Policy[], options?: AddStatementToPermissionSetOptions): Promise<void>;
 /**
  * Add a single Statement to a PermissionSet, expanding it into one or more Permissions as needed.
  *
@@ -118,7 +122,7 @@ export declare function addPoliciesToPermissionSet(permissionSet: PermissionSet,
  * @param permissionSet the PermissionSet to add the statement to
  * @returns nothing; the PermissionSet is modified in place
  */
-export declare function addStatementToPermissionSet(statement: Statement, permissionSet: PermissionSet): Promise<void>;
+export declare function addStatementToPermissionSet(statement: Statement, permissionSet: PermissionSet, options?: AddStatementToPermissionSetOptions): Promise<void>;
 /**
  * Convert a PermissionSet into an array of IAM policy statements.
  *

package/dist/cjs/principalCan/permissionSet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissionSet.d.ts","sourceRoot":"","sources":["../../../src/principalCan/permissionSet.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEnE;;;;GAIG;AACH,qBAAa,aAAa;aAGI,MAAM,EAAE,gBAAgB;IAFpD,OAAO,CAAC,WAAW,CAAmD;gBAE1C,MAAM,EAAE,gBAAgB;IAEpD;;;;;OAKG;IACI,aAAa,CAAC,aAAa,EAAE,UAAU,GAAG,IAAI;IA0DrD;;;;;;OAMG;IACI,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE;IAOpE;;;;;OAKG;IACI,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI3C;;;;;;OAMG;IACI,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAI1D;;;OAGG;IACI,OAAO,IAAI,OAAO;IAIzB;;;;OAIG;IACI,iBAAiB,IAAI,UAAU,EAAE;IAUxC;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa;IA8BxD;;;;;;;;OAQG;IACI,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE;IAyDnF;;;;;OAKG;IACI,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,GAAG,IAAI;IAkB5D;;;;OAIG;IACH,KAAK,IAAI,aAAa;CAUvB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,aAAa,CAAC,CAKxB;AAED,wBAAsB,0BAA0B,CAC9C,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa,iBA6B7B;AAoCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,CA2C1D"}
+{"version":3,"file":"permissionSet.d.ts","sourceRoot":"","sources":["../../../src/principalCan/permissionSet.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAA6B,MAAM,iBAAiB,CAAA;AAO9F;;;;GAIG;AACH,qBAAa,aAAa;aAGI,MAAM,EAAE,gBAAgB;IAFpD,OAAO,CAAC,WAAW,CAAmD;gBAE1C,MAAM,EAAE,gBAAgB;IAEpD;;;;;OAKG;IACI,aAAa,CAAC,aAAa,EAAE,UAAU,GAAG,IAAI;IA0DrD;;;;;;OAMG;IACI,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE;IAOpE;;;;;OAKG;IACI,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI3C;;;;;;OAMG;IACI,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAI1D;;;OAGG;IACI,OAAO,IAAI,OAAO;IAIzB;;;;OAIG;IACI,iBAAiB,IAAI,UAAU,EAAE;IAUxC;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa;IA8BxD;;;;;;;;OAQG;IACI,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE;IAyDnF;;;;;OAKG;IACI,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,GAAG,IAAI;IAkB5D;;;;OAIG;IACH,KAAK,IAAI,aAAa;CAUvB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,kCAAkC;IACjD,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,aAAa,CAAC,CAKxB;AAED,wBAAsB,0BAA0B,CAC9C,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa,EAC5B,OAAO,GAAE,kCAAuC,iBAwCjD;AA0ED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,CA8D1D"}

package/dist/cjs/principalCan/permissionSet.js

@@ -7,6 +7,7 @@ exports.addStatementToPermissionSet = addStatementToPermissionSet;
 exports.toPolicyStatements = toPolicyStatements;
 const iam_expand_1 = require("@cloud-copilot/iam-expand");
 const permission_js_1 = require("./permission.js");
+const principalConstraints_js_1 = require("./principalConstraints.js");
 /**
  * A permission set will be a collection of permissions for a specific effect (Allow or Deny).
  * So this will be used to represent things like "all the allowed permissions in a set of SCPs"
@@ -156,8 +157,8 @@ class PermissionSet {
                 const otherPermissions = other.getPermissions(service, action);
                 for (const thisPermission of thisPermissions) {
                     for (const otherPermission of otherPermissions) {
-                        const ix = thisPermission.intersection(otherPermission);
-                        if (ix) {
+                        const intersections = thisPermission.intersections(otherPermission);
+                        for (const ix of intersections) {
                             result.addPermission(ix);
                         }
                     }
@@ -264,35 +265,13 @@ class PermissionSet {
     }
 }
 exports.PermissionSet = PermissionSet;
-/**
- * Given an array of IAM Policy objects, extract every "Allow" statement
- * and load it into a PermissionSet.  Each AWS action is split into its
- * service ("s3", "ec2", etc.) and the individual action name ("GetObject", "StartInstances", etc.).
- *
- * Assumptions:
- * 1. The Policy type comes from `@cloud-copilot/iam-policy`.  Each Policy has a `.statements` array.
- * 2. Each Statement has at least these fields (per AWS IAM JSON):
- *      - Effect: "Allow" | "Deny"
- *      - Action: string | string[]
- *      - Resource?: string | string[]
- *      - NotResource?: string | string[]
- *      - Condition?: Record<string, Record<string, string | string[]>>
- *
- * 3. We ignore any statements whose Effect ≠ "Allow".
- * 4. We do not expand wildcards here—if a statement’s Action is "s3:*",
- *    we leave it as the pattern "s3:*".  (If you want to expand all wildcards,
- *    run these policies through iam-expand first, then call this function.)
- *
- * Returns a PermissionSet containing one Permission object for each (service, action, resource, notResource, condition)
- * triple where Effect == "Allow".
- */
-async function buildPermissionSetFromPolicies(effect, policies) {
+async function buildPermissionSetFromPolicies(effect, policies, options = {}) {
     // We'll collect all "Allow" statements across all policies
     const permissionSet = new PermissionSet(effect);
-    await addPoliciesToPermissionSet(permissionSet, effect, policies);
+    await addPoliciesToPermissionSet(permissionSet, effect, policies, options);
     return permissionSet;
 }
-async function addPoliciesToPermissionSet(permissionSet, effect, policies) {
+async function addPoliciesToPermissionSet(permissionSet, effect, policies, options = {}) {
     for (const policy of policies) {
         // Each Policy object has a `.statements` array of raw Statement JSON
         for (const stmt of policy.statements()) {
@@ -302,7 +281,7 @@ async function addPoliciesToPermissionSet(permissionSet, effect, policies) {
             else if (effect === 'Deny' && !stmt.isDeny()) {
                 continue; // skip Allow statements if we're building a Deny set
             }
-            await addStatementToPermissionSet(stmt, permissionSet);
+            await addStatementToPermissionSet(stmt, permissionSet, options);
         }
     }
 }
@@ -313,7 +292,7 @@ async function addPoliciesToPermissionSet(permissionSet, effect, policies) {
  * @param permissionSet the PermissionSet to add the statement to
  * @returns nothing; the PermissionSet is modified in place
  */
-async function addStatementToPermissionSet(statement, permissionSet) {
+async function addStatementToPermissionSet(statement, permissionSet, options = {}) {
     const effect = statement.effect();
     let statementActions;
     if (statement.isActionStatement()) {
@@ -338,9 +317,40 @@ async function addStatementToPermissionSet(statement, permissionSet) {
         else if (statement.isNotResourceStatement()) {
             notResource = statement.notResources().map((r) => r.value());
         }
-        permissionSet.addPermission(new permission_js_1.Permission(effect, service, actionName, resource, notResource, statement.conditionMap()));
+        const { principal, notPrincipal } = principalFieldsFromStatement(statement, options);
+        permissionSet.addPermission(new permission_js_1.Permission(effect, service, actionName, resource, notResource, statement.conditionMap(), principal, notPrincipal));
     }
 }
+/**
+ * Extract opt-in Principal or NotPrincipal fields from a statement.
+ *
+ * @param statement the statement to inspect
+ * @param options conversion options controlling principal preservation
+ * @returns principal fields for a Permission constructor
+ */
+function principalFieldsFromStatement(statement, options) {
+    if (!options.includePrincipals) {
+        return { principal: undefined, notPrincipal: undefined };
+    }
+    const rawStatement = statement.toJSON();
+    if (statement.isPrincipalStatement()) {
+        return {
+            principal: statement.hasSingleWildcardPrincipal()
+                ? { wildcard: true }
+                : (0, principalConstraints_js_1.principalsFromRawPolicyValue)(rawStatement.Principal),
+            notPrincipal: undefined
+        };
+    }
+    if (statement.isNotPrincipalStatement()) {
+        return {
+            principal: undefined,
+            notPrincipal: statement.hasSingleWildcardNotPrincipal()
+                ? { wildcard: true }
+                : (0, principalConstraints_js_1.principalsFromRawPolicyValue)(rawStatement.NotPrincipal)
+        };
+    }
+    return { principal: undefined, notPrincipal: undefined };
+}
 /**
  * Create a consistent key for any permission
  *
@@ -363,8 +373,10 @@ function canonicalKey(p) {
                 .map(([k, v]) => [k, [...v].sort()]))
         ])))
         : null;
+    const principal = (0, principalConstraints_js_1.canonicalPrincipal)(p.principal);
+    const notPrincipal = (0, principalConstraints_js_1.canonicalPrincipal)(p.notPrincipal);
     // Effect is fixed for the whole PermissionSet, so not needed in the key.
-    return JSON.stringify({ resources, notResource, canonicalCond });
+    return JSON.stringify({ resources, notResource, principal, notPrincipal, canonicalCond });
 }
 /**
  * Convert a PermissionSet into an array of IAM policy statements.
@@ -379,6 +391,8 @@ function toPolicyStatements(set) {
         const bucket = buckets.get(key) ?? {
             res: perm.resource ? [...perm.resource] : undefined,
             notRes: perm.notResource ? [...perm.notResource] : undefined,
+            principal: perm.principal,
+            notPrincipal: perm.notPrincipal,
             cond: perm.conditions ? perm.conditions : undefined,
             actions: []
         };
@@ -391,6 +405,15 @@ function toPolicyStatements(set) {
             Effect: set.effect,
             Action: b.actions.length === 1 ? b.actions[0] : [...new Set(b.actions)].sort()
         };
+        if (b.principal && b.notPrincipal) {
+            throw new Error('Permission cannot have both Principal and NotPrincipal defined');
+        }
+        if (b.principal) {
+            value['Principal'] = (0, principalConstraints_js_1.principalsToPolicyValue)(b.principal);
+        }
+        else if (b.notPrincipal) {
+            value['NotPrincipal'] = (0, principalConstraints_js_1.principalsToPolicyValue)(b.notPrincipal);
+        }
         if (b.cond) {
             value['Condition'] = b.cond;
         }

package/dist/cjs/principalCan/permissionSet.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissionSet.js","sourceRoot":"","sources":["../../../src/principalCan/permissionSet.ts"],"names":[],"mappings":";;;AAgTA,wEAQC;AAED,gEAgBC;AASD,kEA+BC;AA0CD,gDA2CC;AAvcD,0DAA8E;AAE9E,mDAAmE;AAEnE;;;;GAIG;AACH,MAAa,aAAa;IAGI;IAFpB,WAAW,GAAiD,EAAE,CAAA;IAEtE,YAA4B,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IAAG,CAAC;IAExD;;;;;OAKG;IACI,aAAa,CAAC,aAAyB;QAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,CAAC,MAAM,wCAAwC,IAAI,CAAC,MAAM,EAAE,CAC/F,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;QAC7D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACvC,OAAM;QACR,CAAC;QAED,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,IAAI,kBAAkB,GAAG,KAAK,CAAA;QAC9B,IAAI,KAAK,GAA2B,mBAAmB,CAAC,CAAC,CAAC,CAAA;QAC1D,IAAI,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;gBACxC,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;oBAC/B,wFAAwF;oBACxF,OAAM;gBACR,CAAC;gBACD,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;oBACvC,gBAAgB,GAAG,IAAI,CAAA;oBACvB,kFAAkF;gBACpF,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;oBACtC,kBAAkB,GAAG,IAAI,CAAA;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;QAED,IAAI,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;aAAM,IAAI,CAAC,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACpD,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,cAAc,CAAA;IACpD,CAAC;IAED;;;;;;OAMG;IACI,cAAc,CAAC,OAAe,EAAE,MAAc;QACnD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,OAAe;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,OAAe,EAAE,MAAc;QAC9C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED;;;OAGG;IACI,OAAO;QACZ,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;IACnD,CAAC;IAED;;;;OAIG;IACI,iBAAiB;QACtB,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAoB;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,SAAQ;gBAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE9D,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;wBAC/C,MAAM,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;wBACvD,IAAI,EAAE,EAAE,CAAC;4BACP,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;wBAC1B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACI,QAAQ,CAAC,IAAmB;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;QAEzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,0EAA0E;gBAC1E,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBACnE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;gBACnF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;oBACrC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;oBACpC,CAAC;oBACD,yEAAyE;oBACzE,sEAAsE;oBACtE,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;oBACjF,SAAQ;gBACV,CAAC;gBAED,IAAI,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE5D,+HAA+H;gBAC/H,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,MAAM,cAAc,GAAiB,EAAE,CAAA;oBACvC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;wBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;wBAC1D,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;4BAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gCAC5B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;4BAC3B,CAAC;iCAAM,CAAC;gCACN,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,eAAe,GAAG,cAAc,CAAA;gBAClC,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAuC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;YAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AA/QD,sCA+QC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,8BAA8B,CAClD,MAAwB,EACxB,QAAkB;IAElB,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjE,OAAO,aAAa,CAAA;AACtB,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC9C,aAA4B,EAC5B,MAAwB,EACxB,QAAkB;IAElB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,qEAAqE;QACrE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,SAAQ,CAAC,0CAA0C;YACrD,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,SAAQ,CAAC,qDAAqD;YAChE,CAAC;YACD,MAAM,2BAA2B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,2BAA2B,CAC/C,SAAoB,EACpB,aAA4B;IAE5B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAsB,CAAA;IACrD,IAAI,gBAA0B,CAAA;IAC9B,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC5D,gBAAgB,GAAG,MAAM,IAAA,6BAAgB,EAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,gBAAgB,GAAG,MAAM,IAAA,6BAAgB,EAAC,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACzF,CAAC;SAAM,CAAC;QACN,OAAM;IACR,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;YAAE,SAAQ;QAErC,IAAI,QAAQ,GAAyB,SAAS,CAAA;QAC9C,IAAI,WAAW,GAAyB,SAAS,CAAA;QACjD,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACxD,CAAC;aAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAC9C,WAAW,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,aAAa,CAAC,aAAa,CACzB,IAAI,0BAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAC7F,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAa;IACjC,iDAAiD;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IAEzD,4DAA4D;IAC5D,0EAA0E;IAC1E,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU;QAChC,CAAC,CAAC,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;aACzB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACjB,EAAE;YACF,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;iBACf,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACvC;SACF,CAAC,CACL,CACF;QACH,CAAC,CAAC,IAAI,CAAA;IAER,yEAAyE;IACzE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,GAAkB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAA;IAEH,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACpD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACnD,OAAO,EAAE,EAAE;SACZ,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,KAAK,GAAQ;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;SAC/E,CAAA;QAED,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;QAC7B,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;QAC3B,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACjC,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC"}
+{"version":3,"file":"permissionSet.js","sourceRoot":"","sources":["../../../src/principalCan/permissionSet.ts"],"names":[],"mappings":";;;AA0TA,wEASC;AAED,gEAiBC;AASD,kEA2CC;AAgFD,gDA8DC;AAxhBD,0DAA8E;AAE9E,mDAA8F;AAC9F,uEAIkC;AAElC;;;;GAIG;AACH,MAAa,aAAa;IAGI;IAFpB,WAAW,GAAiD,EAAE,CAAA;IAEtE,YAA4B,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IAAG,CAAC;IAExD;;;;;OAKG;IACI,aAAa,CAAC,aAAyB;QAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,CAAC,MAAM,wCAAwC,IAAI,CAAC,MAAM,EAAE,CAC/F,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;QAC7D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACvC,OAAM;QACR,CAAC;QAED,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,IAAI,kBAAkB,GAAG,KAAK,CAAA;QAC9B,IAAI,KAAK,GAA2B,mBAAmB,CAAC,CAAC,CAAC,CAAA;QAC1D,IAAI,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;gBACxC,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;oBAC/B,wFAAwF;oBACxF,OAAM;gBACR,CAAC;gBACD,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;oBACvC,gBAAgB,GAAG,IAAI,CAAA;oBACvB,kFAAkF;gBACpF,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;oBACtC,kBAAkB,GAAG,IAAI,CAAA;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC5B,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;QAED,IAAI,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;aAAM,IAAI,CAAC,gBAAgB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACpD,2FAA2F;YAC3F,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACpC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,cAAc,CAAA;IACpD,CAAC;IAED;;;;;;OAMG;IACI,cAAc,CAAC,OAAe,EAAE,MAAc;QACnD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,OAAe;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,OAAe,EAAE,MAAc;QAC9C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED;;;OAGG;IACI,OAAO;QACZ,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;IACnD,CAAC;IAED;;;;OAIG;IACI,iBAAiB;QACtB,MAAM,cAAc,GAAiB,EAAE,CAAA;QACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAoB;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,SAAQ;gBAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE9D,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;wBAC/C,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC,eAAe,CAAC,CAAA;wBACnE,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;4BAC/B,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;wBAC1B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACI,QAAQ,CAAC,IAAmB;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;QAEzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,0EAA0E;gBAC1E,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBACnE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;gBACnF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;oBACrC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;oBACpC,CAAC;oBACD,yEAAyE;oBACzE,sEAAsE;oBACtE,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;oBACjF,SAAQ;gBACV,CAAC;gBAED,IAAI,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAE5D,+HAA+H;gBAC/H,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;oBAC7C,MAAM,cAAc,GAAiB,EAAE,CAAA;oBACvC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;wBAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;wBAC1D,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;4BAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gCAC5B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;4BAC3B,CAAC;iCAAM,CAAC;gCACN,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,eAAe,GAAG,cAAc,CAAA;gBAClC,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAuC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;YAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AA/QD,sCA+QC;AA6BM,KAAK,UAAU,8BAA8B,CAClD,MAAwB,EACxB,QAAkB,EAClB,UAA8C,EAAE;IAEhD,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC1E,OAAO,aAAa,CAAA;AACtB,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAC9C,aAA4B,EAC5B,MAAwB,EACxB,QAAkB,EAClB,UAA8C,EAAE;IAEhD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,qEAAqE;QACrE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,SAAQ,CAAC,0CAA0C;YACrD,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,SAAQ,CAAC,qDAAqD;YAChE,CAAC;YACD,MAAM,2BAA2B,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,2BAA2B,CAC/C,SAAoB,EACpB,aAA4B,EAC5B,UAA8C,EAAE;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAsB,CAAA;IACrD,IAAI,gBAA0B,CAAA;IAC9B,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC5D,gBAAgB,GAAG,MAAM,IAAA,6BAAgB,EAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC;SAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC5C,gBAAgB,GAAG,MAAM,IAAA,6BAAgB,EAAC,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACzF,CAAC;SAAM,CAAC;QACN,OAAM;IACR,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;YAAE,SAAQ;QAErC,IAAI,QAAQ,GAAyB,SAAS,CAAA;QAC9C,IAAI,WAAW,GAAyB,SAAS,CAAA;QACjD,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACxD,CAAC;aAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAC9C,WAAW,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,4BAA4B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAEpF,aAAa,CAAC,aAAa,CACzB,IAAI,0BAAU,CACZ,MAAM,EACN,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,CAAC,YAAY,EAAE,EACxB,SAAS,EACT,YAAY,CACb,CACF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CACnC,SAAoB,EACpB,OAA2C;IAE3C,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,CAAA;IACvC,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,SAAS,CAAC,0BAA0B,EAAE;gBAC/C,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,IAAA,sDAA4B,EAAC,YAAY,CAAC,SAAS,CAAC;YACxD,YAAY,EAAE,SAAS;SACxB,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,SAAS,CAAC,6BAA6B,EAAE;gBACrD,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,IAAA,sDAA4B,EAAC,YAAY,CAAC,YAAY,CAAC;SAC5D,CAAA;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAa;IACjC,iDAAiD;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;IAEzD,4DAA4D;IAC5D,0EAA0E;IAC1E,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU;QAChC,CAAC,CAAC,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;aACzB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACjB,EAAE;YACF,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;iBACf,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACvC;SACF,CAAC,CACL,CACF;QACH,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,SAAS,GAAG,IAAA,4CAAkB,EAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACjD,MAAM,YAAY,GAAG,IAAA,4CAAkB,EAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAEvD,yEAAyE;IACzE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,GAAkB;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAUpB,CAAA;IAEH,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACpD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACnD,OAAO,EAAE,EAAE;SACZ,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,KAAK,GAAQ;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;SAC/E,CAAA;QAED,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,KAAK,CAAC,WAAW,CAAC,GAAG,IAAA,iDAAuB,EAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;aAAM,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,CAAC,GAAG,IAAA,iDAAuB,EAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;QAC7B,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;QAC3B,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACjC,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/cjs/principalCan/principalConstraints.d.ts

@@ -0,0 +1,147 @@
+/** IAM principal type keys supported in Principal and NotPrincipal policy elements. */
+export type PermissionPrincipalType = 'AWS' | 'Service' | 'Federated' | 'CanonicalUser';
+/** Principal values grouped by IAM principal type for Permission algebra and policy output. */
+export type PermissionPrincipals = Partial<Record<PermissionPrincipalType, string[]>> & {
+    /** True when the policy used Principal: "*" rather than a typed principal map. */
+    wildcard?: true;
+};
+/** Internal normalized representation of a Principal or NotPrincipal dimension. */
+export type PrincipalConstraint = {
+    kind: 'any';
+    explicit: boolean;
+} | {
+    kind: 'principal';
+    principals: PermissionPrincipals;
+} | {
+    kind: 'notPrincipal';
+    principals: PermissionPrincipals;
+};
+/** A normalized principal entry with semantic scope metadata used for comparisons. */
+export interface NormalizedPrincipalEntry {
+    /** The IAM principal type or Any for Principal: "*". */
+    type: PermissionPrincipalType | 'Any';
+    /** The normalized string value retained for round-tripping and debugging. */
+    value: string;
+    /** The semantic category used for containment and overlap comparisons. */
+    semanticKind: 'wildcard' | 'account' | 'arn' | 'service' | 'federated' | 'canonicalUser' | 'organization' | 'network';
+    /** Account IDs covered by this principal or derived principal-related condition scope. */
+    accountIds?: string[];
+    /** Organization IDs covered by this principal-related condition scope. */
+    organizationIds?: string[];
+    /** AWS service principal names covered by this entry. */
+    servicePrincipals?: string[];
+    /** VPC IDs covered by this principal-related condition scope. */
+    vpcIds?: string[];
+    /** CIDR blocks covered by this principal-related condition scope. */
+    cidrBlocks?: string[];
+}
+/** The relationship between two normalized principal sets. */
+export type PrincipalSetRelation = 'equal' | 'subset' | 'superset' | 'overlap' | 'disjoint' | 'unknown';
+/**
+ * Build an unconstrained principal dimension.
+ *
+ * @param explicit - True when the source policy explicitly used Principal: "*".
+ * @returns The unconstrained principal constraint.
+ */
+export declare function anyPrincipalConstraint(explicit: boolean): PrincipalConstraint;
+/**
+ * Build a positive principal constraint.
+ *
+ * @param principals - The positive principal values.
+ * @returns A normalized principal constraint.
+ */
+export declare function principalConstraint(principals: PermissionPrincipals | undefined): PrincipalConstraint;
+/**
+ * Build a negative principal constraint.
+ *
+ * @param notPrincipals - The excluded principal values.
+ * @returns A normalized not-principal constraint.
+ */
+export declare function notPrincipalConstraint(notPrincipals: PermissionPrincipals | undefined): PrincipalConstraint;
+/**
+ * Normalize optional Principal and NotPrincipal values into an internal constraint.
+ *
+ * @param principal - Positive principals, if present.
+ * @param notPrincipal - Negative principals, if present.
+ * @returns The normalized principal constraint.
+ */
+export declare function normalizePrincipalConstraint(principal: PermissionPrincipals | undefined, notPrincipal: PermissionPrincipals | undefined): PrincipalConstraint;
+/**
+ * Normalize principal values by validating wildcard usage, de-duplicating values, and normalizing STS sessions.
+ *
+ * @param principals - Principal values to normalize.
+ * @returns Normalized principal values.
+ */
+export declare function normalizePermissionPrincipals(principals: PermissionPrincipals): PermissionPrincipals;
+/**
+ * Determine whether one principal constraint fully includes another.
+ *
+ * @param a - Candidate including constraint.
+ * @param b - Candidate included constraint.
+ * @returns True when every principal in b is also in a.
+ */
+export declare function principalIncludes(a: PrincipalConstraint, b: PrincipalConstraint): boolean;
+/**
+ * Determine whether two principal constraints have any possible overlap.
+ *
+ * @param a - First principal constraint.
+ * @param b - Second principal constraint.
+ * @returns True when at least one principal can satisfy both constraints.
+ */
+export declare function principalConstraintsOverlap(a: PrincipalConstraint, b: PrincipalConstraint): boolean;
+/**
+ * Return compact principal constraints representing a union.
+ *
+ * @param a - First principal constraint.
+ * @param b - Second principal constraint.
+ * @returns One or more constraints representing the union.
+ */
+export declare function unionPrincipalConstraints(a: PrincipalConstraint, b: PrincipalConstraint): PrincipalConstraint[];
+/**
+ * Return constraints representing the intersection of two principal constraints.
+ *
+ * @param a - First principal constraint.
+ * @param b - Second principal constraint.
+ * @returns Constraints for the overlap, or an empty array when disjoint.
+ */
+export declare function intersectPrincipalConstraints(a: PrincipalConstraint, b: PrincipalConstraint): PrincipalConstraint[];
+/**
+ * Return constraints for allow minus deny on the principal dimension.
+ *
+ * @param allow - Allow principal constraint.
+ * @param deny - Deny principal constraint.
+ * @returns Principal constraints that remain allowed.
+ */
+export declare function subtractPrincipalConstraint(allow: PrincipalConstraint, deny: PrincipalConstraint): PrincipalConstraint[];
+/**
+ * Convert a constraint into Permission constructor principal arguments.
+ *
+ * @param constraint - The principal constraint to convert.
+ * @returns Principal and NotPrincipal fields for a Permission.
+ */
+export declare function principalArgsForConstraint(constraint: PrincipalConstraint): {
+    principal: PermissionPrincipals | undefined;
+    notPrincipal: PermissionPrincipals | undefined;
+};
+/**
+ * Convert principal values to a stable JSON value for bucketing policy statements.
+ *
+ * @param principal - Principal values to canonicalize.
+ * @returns A JSON-compatible canonical representation.
+ */
+export declare function canonicalPrincipal(principal: PermissionPrincipals | undefined): unknown;
+/**
+ * Convert a Principal/NotPrincipal raw policy value into PermissionPrincipals.
+ *
+ * @param value - The raw Principal or NotPrincipal value.
+ * @returns Permission principal values.
+ */
+export declare function principalsFromRawPolicyValue(value: unknown): PermissionPrincipals | undefined;
+/**
+ * Convert PermissionPrincipals into a raw policy Principal or NotPrincipal value.
+ *
+ * @param principals - Principal values to convert.
+ * @returns A raw policy value.
+ */
+export declare function principalsToPolicyValue(principals: PermissionPrincipals): unknown;
+//# sourceMappingURL=principalConstraints.d.ts.map

package/dist/cjs/principalCan/principalConstraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalConstraints.d.ts","sourceRoot":"","sources":["../../../src/principalCan/principalConstraints.ts"],"names":[],"mappings":"AAEA,uFAAuF;AACvF,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG,SAAS,GAAG,WAAW,GAAG,eAAe,CAAA;AAEvF,+FAA+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG;IACtF,kFAAkF;IAClF,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAE9D,sFAAsF;AACtF,MAAM,WAAW,wBAAwB;IACvC,wDAAwD;IACxD,IAAI,EAAE,uBAAuB,GAAG,KAAK,CAAA;IACrC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,YAAY,EACR,UAAU,GACV,SAAS,GACT,KAAK,GACL,SAAS,GACT,WAAW,GACX,eAAe,GACf,cAAc,GACd,SAAS,CAAA;IACb,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAC9B,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;AAItE;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG,mBAAmB,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAAG,SAAS,GAC3C,mBAAmB,CAErB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,oBAAoB,GAAG,SAAS,GAC9C,mBAAmB,CAErB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,oBAAoB,GAAG,SAAS,EAC3C,YAAY,EAAE,oBAAoB,GAAG,SAAS,GAC7C,mBAAmB,CAerB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,oBAAoB,GAC/B,oBAAoB,CAwBtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAuBzF;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,CAAC,EAAE,mBAAmB,EACtB,CAAC,EAAE,mBAAmB,GACrB,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,mBAAmB,EACtB,CAAC,EAAE,mBAAmB,GACrB,mBAAmB,EAAE,CA2BvB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,mBAAmB,EACtB,CAAC,EAAE,mBAAmB,GACrB,mBAAmB,EAAE,CAqBvB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,mBAAmB,GACxB,mBAAmB,EAAE,CAyBvB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,mBAAmB,GAAG;IAC3E,SAAS,EAAE,oBAAoB,GAAG,SAAS,CAAA;IAC3C,YAAY,EAAE,oBAAoB,GAAG,SAAS,CAAA;CAC/C,CAWA;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,oBAAoB,GAAG,SAAS,GAAG,OAAO,CASvF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,GAAG,SAAS,CAa7F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAUjF"}