@cloud-copilot/iam-lens 0.1.83 → 0.1.85

package/dist/esm/whoCan/WhoCanMainThreadWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanMainThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanMainThreadWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAK9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,OAAO,EAAwB,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAEnF,OAAO,EACL,0BAA0B,EAG3B,MAAM,mBAAmB,CAAA;AAE1B,MAAM,UAAU,kCAAkC,CAChD,KAAmF,EACnF,aAA+B,EAC/B,cAA0C,EAC1C,UAA2F,EAC3F,mBAAgE,EAChE,YAAiD;IAEjD,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,CAAA;IAEhD,OAAO,IAAI,kBAAkB,CAC3B,EAAE,EACF,KAAK,IAAI,EAAE;QACT,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC,EACD,CAAC,QAAQ,EAAE,EAAE;QACX,OAAO,0BAA0B,CAAC,QAAQ,EAAE,aAAa,EAAE;YACzD,cAAc;YACd,kBAAkB;SACnB,CAAC,CAAA;IACJ,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAA;YACpC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC5B,sDAAsD;gBACtD,UAAU,CAAC;oBACT,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,eAAe,CAAC,OAAO;oBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,wBAAwB;gBACxB,UAAU,CAAC;oBACT,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,SAAS;oBAChB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAA;gBAEF,0CAA0C;gBAC1C,IAAI,mBAAmB,IAAI,YAAY,IAAI,eAAe,CAAC,YAAY,EAAE,CAAC;oBACxE,MAAM,aAAa,GAAG,sBAAsB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;oBAC1E,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAA;oBAExD,IAAI,aAAa,EAAE,CAAC;wBAClB,MAAM,aAAa,GAAG,gBAAgB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;wBACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAA;wBACpC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;wBACpD,YAAY,CAAC;4BACX,SAAS,EAAE,QAAQ,CAAC,SAAS;4BAC7B,OAAO;4BACP,MAAM;4BACN,OAAO,EAAE,aAAa;yBACvB,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,UAAU,CAAC;gBACT,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"WhoCanMainThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanMainThreadWorker.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,OAAO,EACL,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,0BAA0B,EAG3B,MAAM,mBAAmB,CAAA;AAE1B,MAAM,UAAU,kCAAkC,CAChD,KAAmF,EACnF,aAA+B,EAC/B,cAA0C,EAC1C,UAA2F,EAC3F,mBAAgE,EAChE,YAAiD;IAEjD,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,CAAA;IAEhD,OAAO,IAAI,kBAAkB,CAC3B,EAAE,EACF,KAAK,IAAI,EAAE;QACT,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC,EACD,CAAC,QAAQ,EAAE,EAAE;QACX,OAAO,0BAA0B,CAAC,QAAQ,EAAE,aAAa,EAAE;YACzD,cAAc;YACd,kBAAkB;SACnB,CAAC,CAAA;IACJ,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAA;YACpC,IAAI,eAAe,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvC,sDAAsD;gBACtD,UAAU,CAAC;oBACT,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,eAAe,CAAC,OAAO;oBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,wBAAwB;gBACxB,UAAU,CAAC;oBACT,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,SAAS;oBAChB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAA;gBAEF,0CAA0C;gBAC1C,IAAI,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBACxC,MAAM,UAAU,GACd,eAAe,CAAC,IAAI,KAAK,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,iBAAiB,CAAA;oBAExF,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,aAAa,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAA;wBAC7D,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAA;wBAExD,IAAI,aAAa,EAAE,CAAC;4BAClB,YAAY,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAA;wBACvD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,UAAU,CAAC;gBACT,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/esm/whoCan/WhoCanWorker.d.ts

@@ -1,8 +1,8 @@
-import { RequestAnalysis } from '@cloud-copilot/iam-simulate';
-import { Job } from '@cloud-copilot/job';
+import { type EvaluationResult, type RequestAnalysis } from '@cloud-copilot/iam-simulate';
+import type { Job } from '@cloud-copilot/job';
 import { IamCollectClient } from '../collect/client.js';
-import { S3AbacOverride } from '../utils/s3Abac.js';
-import { WhoCanAllowed } from './whoCan.js';
+import type { S3AbacOverride } from '../utils/s3Abac.js';
+import type { WhoCanAllowed } from './whoCan.js';
 export interface WhoCanWorkItem {
     resource: string | undefined;
     resourceAccount: string | undefined;
@@ -10,24 +10,69 @@ export interface WhoCanWorkItem {
     principal: string;
 }
 /**
- * The result of executing a whoCan work item.
- * Contains either the allowed result or the deny analysis (but not both).
+ * Execution result when the principal is allowed access.
  */
-export interface WhoCanExecutionResult {
+export interface AllowedWhoCanExecutionResult {
+    type: 'allowed';
+    workItem: WhoCanWorkItem;
+    allowed: WhoCanAllowed;
+}
+/**
+ * Execution result when the principal is denied access, without detailed analysis.
+ */
+export interface DeniedWhoCanExecutionResult {
+    type: 'denied';
+    workItem: WhoCanWorkItem;
+}
+/**
+ * Execution result when the principal is denied access for a single resource pattern,
+ * with detailed analysis included.
+ */
+export interface DeniedSingleWhoCanExecutionResult {
+    type: 'denied_single';
+    workItem: WhoCanWorkItem;
+    analysis: RequestAnalysis;
+}
+/**
+ * Details about a denied resource pattern, including the analysis for why it was denied.
+ */
+export interface WhoCanDenyResourceDetails {
     /**
-     * The allowed result if the simulation was successful
+     * The resource pattern that was tested.
      */
-    allowed?: WhoCanAllowed;
+    pattern: string;
     /**
-     * The deny analysis if the simulation was not allowed.
-     * Only populated when collectDenyDetails is true.
+     * The type of resource for the pattern.
      */
-    denyAnalysis?: RequestAnalysis;
+    resourceType: string;
     /**
-     * The work item that was executed, for context in deny details
+     * The analysis explaining why the request was denied.
      */
+    analysis: RequestAnalysis;
+}
+/**
+ * Execution result when the principal is denied access for a wildcard resource,
+ * with detailed analysis for each denied pattern.
+ */
+export interface DeniedWildcardWhoCanExecutionResult {
+    type: 'denied_wildcard';
     workItem: WhoCanWorkItem;
+    overallResult: EvaluationResult;
+    deniedPatterns: WhoCanDenyResourceDetails[];
 }
+/**
+ * The result of executing a whoCan work item.
+ * Contains either the allowed result or the deny analysis (but not both).
+ */
+export type WhoCanExecutionResult = AllowedWhoCanExecutionResult | DeniedWhoCanExecutionResult | DeniedSingleWhoCanExecutionResult | DeniedWildcardWhoCanExecutionResult;
+/**
+ * Union type for denied execution results that include detailed analysis.
+ */
+export type DeniedWhoCanExecutionResultWithDetails = DeniedSingleWhoCanExecutionResult | DeniedWildcardWhoCanExecutionResult;
+/**
+ * The possible values for the `type` discriminator of a WhoCanExecutionResult.
+ */
+export type WhoCanExecutionResultType = WhoCanExecutionResult['type'];
 export declare function createJobForWhoCanWorkItem(workItem: WhoCanWorkItem, collectClient: IamCollectClient, whoCanOptions: WhoCanOptions): Job<WhoCanExecutionResult, Record<string, unknown>>;
 export interface WhoCanOptions {
     s3AbacOverride?: S3AbacOverride;

package/dist/esm/whoCan/WhoCanWorker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanWorker.d.ts","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IAEvB;;;OAGG;IACH,YAAY,CAAC,EAAE,eAAe,CAAA;IAE9B;;OAEG;IACH,QAAQ,EAAE,cAAc,CAAA;CACzB;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOrD;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA+DhC"}
+{"version":3,"file":"WhoCanWorker.d.ts","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAErB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAgC,MAAM,aAAa,CAAA;AAE9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,SAAS,CAAA;IACf,QAAQ,EAAE,cAAc,CAAA;IACxB,OAAO,EAAE,aAAa,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,QAAQ,CAAA;IACd,QAAQ,EAAE,cAAc,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,eAAe,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;OAEG;IACH,QAAQ,EAAE,eAAe,CAAA;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,mCAAmC;IAClD,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,cAAc,CAAA;IACxB,aAAa,EAAE,gBAAgB,CAAA;IAC/B,cAAc,EAAE,yBAAyB,EAAE,CAAA;CAC5C;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAC7B,4BAA4B,GAC5B,2BAA2B,GAC3B,iCAAiC,GACjC,mCAAmC,CAAA;AAEvC;;GAEG;AACH,MAAM,MAAM,sCAAsC,GAC9C,iCAAiC,GACjC,mCAAmC,CAAA;AAEvC;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;AAErE,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOrD;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAC/B,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAsEhC"}

package/dist/esm/whoCan/WhoCanWorker.js

@@ -20,8 +20,13 @@ export async function executeWhoCan(workItem, collectClient, whoCanOptions) {
         simulationMode: 'Discovery',
         s3AbacOverride: whoCanOptions.s3AbacOverride
     }, collectClient);
-    if (discoveryResult?.result.analysis?.result === 'Allowed') {
-        const result = await simulateRequest({
+    if (discoveryResult.result.resultType === 'error') {
+        // If discovery fails, we treat it as a denial without details (since we don't have analysis to share)
+        throw new Error('Discovery simulation failed: ' + discoveryResult.result.errors);
+    }
+    const actionType = await getActionLevel(service, serviceAction);
+    if (discoveryResult?.result.overallResult === 'Allowed') {
+        const strictResult = await simulateRequest({
             principal,
             resourceArn: resource,
             resourceAccount,
@@ -30,40 +35,18 @@ export async function executeWhoCan(workItem, collectClient, whoCanOptions) {
             simulationMode: 'Strict',
             s3AbacOverride: whoCanOptions.s3AbacOverride
         }, collectClient);
-        if (result?.result.analysis?.result === 'Allowed') {
-            const actionType = await getActionLevel(service, serviceAction);
-            return {
-                workItem,
-                allowed: {
-                    principal,
-                    service,
-                    action: serviceAction,
-                    level: actionType.toLowerCase()
-                }
-            };
+        if (strictResult.result.resultType === 'error') {
+            // If discovery fails, we treat it as a denial without details (since we don't have analysis to share)
+            throw new Error('Discovery simulation failed: ' + strictResult.result.errors);
         }
-        else {
-            const actionType = await getActionLevel(service, serviceAction);
-            return {
-                workItem,
-                allowed: {
-                    principal,
-                    service: service,
-                    action: serviceAction,
-                    level: actionType.toLowerCase(),
-                    conditions: discoveryResult?.result.analysis.ignoredConditions,
-                    dependsOnSessionName: discoveryResult?.result.analysis.ignoredRoleSessionName
-                        ? true
-                        : undefined
-                }
-            };
+        if (strictResult?.result.overallResult === 'Allowed') {
+            return mapSimulationResultToWhoCanExecutionResult(workItem, service, serviceAction, actionType, strictResult.result, !!whoCanOptions.collectDenyDetails);
         }
     }
-    // Not allowed - return deny analysis if requested
-    return {
-        workItem,
-        denyAnalysis: whoCanOptions.collectDenyDetails ? discoveryResult?.result.analysis : undefined
-    };
+    else {
+        return mapSimulationResultToWhoCanExecutionResult(workItem, service, serviceAction, actionType, discoveryResult.result, !!whoCanOptions.collectDenyDetails);
+    }
+    return mapSimulationResultToWhoCanExecutionResult(workItem, service, serviceAction, actionType, discoveryResult.result, !!whoCanOptions.collectDenyDetails);
 }
 /**
  * Get the action level for a specific service action, will fail if the service or action does not exist.
@@ -76,4 +59,74 @@ async function getActionLevel(service, action) {
     const details = await iamActionDetails(service, action);
     return details.accessLevel;
 }
+function mapSimulationResultToWhoCanExecutionResult(workItem, service, action, actionType, simulationResponse, collectDenyDetails) {
+    const { principal } = workItem;
+    if (simulationResponse.overallResult === 'Allowed') {
+        // Build allowed result
+        const allowed = {
+            principal,
+            service,
+            action,
+            level: actionType.toLowerCase()
+        };
+        if (simulationResponse.resultType === 'single') {
+            const analysis = simulationResponse.result.analysis;
+            allowed.conditions = analysis.ignoredConditions;
+            allowed.dependsOnSessionName = analysis.ignoredRoleSessionName ? true : undefined;
+        }
+        else {
+            // Wildcard result - collect allowed patterns
+            const allowedPatterns = [];
+            for (const r of simulationResponse.results) {
+                if (r.analysis.result === 'Allowed') {
+                    allowedPatterns.push({
+                        pattern: r.resourcePattern,
+                        resourceType: r.resourceType,
+                        conditions: r.analysis.ignoredConditions,
+                        dependsOnSessionName: r.analysis.ignoredRoleSessionName ? true : undefined
+                    });
+                }
+            }
+            if (allowedPatterns.length > 0) {
+                allowed.allowedPatterns = allowedPatterns;
+            }
+        }
+        return {
+            type: 'allowed',
+            workItem,
+            allowed
+        };
+    }
+    // Denied result
+    if (!collectDenyDetails) {
+        // If we don't need to collect deny details, we can return a simple denied result without analysis
+        return {
+            type: 'denied',
+            workItem
+        };
+    }
+    if (simulationResponse.resultType === 'single') {
+        return {
+            type: 'denied_single',
+            workItem,
+            analysis: simulationResponse.result.analysis
+        };
+    }
+    else {
+        // Wildcard denial - collect denied patterns
+        const deniedPatterns = simulationResponse.results
+            .filter((r) => r.analysis.result !== 'Allowed')
+            .map((r) => ({
+            pattern: r.resourcePattern,
+            resourceType: r.resourceType,
+            analysis: r.analysis
+        }));
+        return {
+            type: 'denied_wildcard',
+            overallResult: simulationResponse.overallResult,
+            workItem,
+            deniedPatterns
+        };
+    }
+}
 //# sourceMappingURL=WhoCanWorker.js.map

package/dist/esm/whoCan/WhoCanWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAI1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAiCzD,MAAM,UAAU,0BAA0B,CACxC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IACjE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClD,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C;QACE,SAAS;QACT,WAAW,EAAE,QAAQ;QACrB,eAAe,EAAE,eAAe;QAChC,MAAM;QACN,iBAAiB,EAAE,EAAE;QACrB,cAAc,EAAE,WAAW;QAC3B,cAAc,EAAE,aAAa,CAAC,cAAc;KAC7C,EACD,aAAa,CACd,CAAA;IAED,IAAI,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,SAAS;YACT,WAAW,EAAE,QAAQ;YACrB,eAAe;YACf,MAAM;YACN,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,aAAa,CAAC,cAAc;SAC7C,EACD,aAAa,CACd,CAAA;QACD,IAAI,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC/D,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE;oBACP,SAAS;oBACT,OAAO;oBACP,MAAM,EAAE,aAAa;oBACrB,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;iBAChC;aACF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC/D,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE;oBACP,SAAS;oBACT,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,aAAa;oBACrB,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;oBAC/B,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB;oBAC9D,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;wBAC3E,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,SAAS;iBACd;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC9F,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC3D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,OAAO,CAAC,WAAW,CAAA;AAC5B,CAAC"}
+{"version":3,"file":"WhoCanWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAQ1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAyFzD,MAAM,UAAU,0BAA0B,CACxC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAwB,EACxB,aAA+B,EAC/B,aAA4B;IAE5B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IACjE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClD,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C;QACE,SAAS;QACT,WAAW,EAAE,QAAQ;QACrB,eAAe,EAAE,eAAe;QAChC,MAAM;QACN,iBAAiB,EAAE,EAAE;QACrB,cAAc,EAAE,WAAW;QAC3B,cAAc,EAAE,aAAa,CAAC,cAAc;KAC7C,EACD,aAAa,CACd,CAAA;IAED,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAClD,sGAAsG;QACtG,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC/D,IAAI,eAAe,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,eAAe,CACxC;YACE,SAAS;YACT,WAAW,EAAE,QAAQ;YACrB,eAAe;YACf,MAAM;YACN,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,aAAa,CAAC,cAAc;SAC7C,EACD,aAAa,CACd,CAAA;QAED,IAAI,YAAY,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAC/C,sGAAsG;YACtG,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/E,CAAC;QAED,IAAI,YAAY,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,0CAA0C,CAC/C,QAAQ,EACR,OAAO,EACP,aAAa,EACb,UAAU,EACV,YAAY,CAAC,MAAM,EACnB,CAAC,CAAC,aAAa,CAAC,kBAAkB,CACnC,CAAA;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,0CAA0C,CAC/C,QAAQ,EACR,OAAO,EACP,aAAa,EACb,UAAU,EACV,eAAe,CAAC,MAAM,EACtB,CAAC,CAAC,aAAa,CAAC,kBAAkB,CACnC,CAAA;IACH,CAAC;IAED,OAAO,0CAA0C,CAC/C,QAAQ,EACR,OAAO,EACP,aAAa,EACb,UAAU,EACV,eAAe,CAAC,MAAM,EACtB,CAAC,CAAC,aAAa,CAAC,kBAAkB,CACnC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC3D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,OAAO,CAAC,WAAW,CAAA;AAC5B,CAAC;AAED,SAAS,0CAA0C,CACjD,QAAwB,EACxB,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,kBAAkD,EAClD,kBAA2B;IAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAA;IAE9B,IAAI,kBAAkB,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACnD,uBAAuB;QACvB,MAAM,OAAO,GAAkB;YAC7B,SAAS;YACT,OAAO;YACP,MAAM;YACN,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;SAChC,CAAA;QAED,IAAI,kBAAkB,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAA;YACnD,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,iBAAiB,CAAA;YAC/C,OAAO,CAAC,oBAAoB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QACnF,CAAC;aAAM,CAAC;YACN,6CAA6C;YAC7C,MAAM,eAAe,GAAmC,EAAE,CAAA;YAC1D,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBAC3C,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACpC,eAAe,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,CAAC,CAAC,eAAe;wBAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB;wBACxC,oBAAoB,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;qBAC3E,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,eAAe,GAAG,eAAe,CAAA;YAC3C,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,EAAE,SAAS;YACf,QAAQ;YACR,OAAO;SACR,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kGAAkG;QAClG,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ;SACT,CAAA;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,QAAQ;YACR,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ;SAC7C,CAAA;IACH,CAAC;SAAM,CAAC;QACN,4CAA4C;QAC5C,MAAM,cAAc,GAAgC,kBAAkB,CAAC,OAAO;aAC3E,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,OAAO,EAAE,CAAC,CAAC,eAAe;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC,CAAA;QAEL,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,aAAa,EAAE,kBAAkB,CAAC,aAAa;YAC/C,QAAQ;YACR,cAAc;SACf,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/esm/whoCan/WhoCanWorkerThreadWorker.js

@@ -1,9 +1,8 @@
-import { getDenialReasons } from '@cloud-copilot/iam-simulate';
 import { parentPort, workerData } from 'worker_threads';
 import { getCollectClient } from '../collect/collect.js';
 import { PullBasedJobRunner } from '../workers/JobRunner.js';
 import { SharedArrayBufferWorkerCache } from '../workers/SharedArrayBufferWorkerCache.js';
-import { toLightRequestAnalysis } from './requestAnalysis.js';
+import { convertToDenialDetails, toLightRequestAnalysis } from './requestAnalysis.js';
 import { executeWhoCan } from './WhoCanWorker.js';
 if (!parentPort) {
     throw new Error('Must be run as a worker thread');
@@ -58,7 +57,7 @@ const jobRunner = new PullBasedJobRunner(concurrency, async (workerId) => {
 }, async (result) => {
     if (result.status === 'fulfilled') {
         const executionResult = result.value;
-        if (executionResult.allowed) {
+        if (executionResult.type === 'allowed') {
             // Allowed - send result back to main thread
             parentPort.postMessage({
                 type: 'result',
@@ -70,9 +69,19 @@ const jobRunner = new PullBasedJobRunner(concurrency, async (workerId) => {
             });
         }
         else {
-            // If we have deny analysis and collectDenyDetails is enabled, check with main thread
-            if (collectDenyDetails && executionResult.denyAnalysis) {
-                const lightAnalysis = toLightRequestAnalysis(executionResult.denyAnalysis);
+            // Post this so that we can count the completed simulation in the main thread.
+            parentPort.postMessage({
+                type: 'result',
+                result: {
+                    status: 'fulfilled',
+                    value: undefined,
+                    properties: result.properties
+                }
+            });
+            // Check if we should include deny details
+            const hasDetails = executionResult.type === 'denied_single' || executionResult.type === 'denied_wildcard';
+            if (collectDenyDetails && hasDetails) {
+                const lightAnalysis = toLightRequestAnalysis(executionResult);
                 const checkId = denyDetailsCheckId++;
                 // Send check request to main thread
                 parentPort.postMessage({
@@ -87,17 +96,9 @@ const jobRunner = new PullBasedJobRunner(concurrency, async (workerId) => {
                 });
                 if (shouldInclude) {
                     // Get full denial reasons and send to main thread
-                    const denialReasons = getDenialReasons(executionResult.denyAnalysis);
-                    const { workItem } = executionResult;
-                    const [service, action] = workItem.action.split(':');
                     parentPort.postMessage({
                         type: 'denyDetailsResult',
-                        denyDetail: {
-                            principal: workItem.principal,
-                            service,
-                            action,
-                            details: denialReasons
-                        }
+                        denyDetail: convertToDenialDetails(executionResult)
                     });
                 }
             }

package/dist/esm/whoCan/WhoCanWorkerThreadWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"WhoCanWorkerThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorkerThreadWorker.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAA;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAyC,MAAM,mBAAmB,CAAA;AAExF,IAAI,CAAC,UAAU,EAAE,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;AACnD,CAAC;AAED,kCAAkC;AAClC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAClF,UAMC,CAAA;AAEH,MAAM,YAAY,GAAuC,EAAE,CAAA;AAE3D,oEAAoE;AACpE,IAAI,kBAAkB,GAAG,CAAC,CAAA;AAC1B,MAAM,wBAAwB,GAAqD,EAAE,CAAA;AAErF,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;QACxD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACxC,SAAS,CAAC,mBAAmB,EAAE,CAAA;IACjC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrC,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAClC,UAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QACjD,yEAAyE;QACzE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAiB,CAAA;QACrC,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YAC5B,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,gBAAgB,CAAC,cAAc,EAAE,SAAS,EAAE;IAChE,aAAa,EAAE,IAAI,4BAA4B,CAAC,UAAU,CAAC;CAC5D,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAKtC,WAAW,EACX,KAAK,EAAE,QAAQ,EAAE,EAAE;IACjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1D,YAAY,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,EACD,CAAC,WAAW,EAAE,EAAE;IACd,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,aAAa,CAAC,WAAW,EAAE,aAAa,EAAE;gBAC/C,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;IACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAA;QAEpC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,4CAA4C;YAC5C,UAAW,CAAC,WAAW,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,eAAe,CAAC,OAAO;oBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,qFAAqF;YACrF,IAAI,kBAAkB,IAAI,eAAe,CAAC,YAAY,EAAE,CAAC;gBACvD,MAAM,aAAa,GAAG,sBAAsB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;gBAC1E,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAA;gBAEpC,oCAAoC;gBACpC,UAAW,CAAC,WAAW,CAAC;oBACtB,IAAI,EAAE,kBAAkB;oBACxB,OAAO;oBACP,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,aAAa;iBACd,CAAC,CAAA;gBAEF,qCAAqC;gBACrC,MAAM,aAAa,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;oBAC3D,wBAAwB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBAEF,IAAI,aAAa,EAAE,CAAC;oBAClB,kDAAkD;oBAClD,MAAM,aAAa,GAAG,gBAAgB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;oBACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAA;oBACpC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACpD,UAAW,CAAC,WAAW,CAAC;wBACtB,IAAI,EAAE,mBAAmB;wBACzB,UAAU,EAAE;4BACV,SAAS,EAAE,QAAQ,CAAC,SAAS;4BAC7B,OAAO;4BACP,MAAM;4BACN,OAAO,EAAE,aAAa;yBACvB;qBACF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,4BAA4B;QAC5B,UAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CACF,CAAA"}
+{"version":3,"file":"WhoCanWorkerThreadWorker.js","sourceRoot":"","sources":["../../../src/whoCan/WhoCanWorkerThreadWorker.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAA;AACzF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,EAAE,aAAa,EAAyC,MAAM,mBAAmB,CAAA;AAExF,IAAI,CAAC,UAAU,EAAE,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;AACnD,CAAC;AAED,kCAAkC;AAClC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAClF,UAMC,CAAA;AAEH,MAAM,YAAY,GAAuC,EAAE,CAAA;AAE3D,oEAAoE;AACpE,IAAI,kBAAkB,GAAG,CAAC,CAAA;AAC1B,MAAM,wBAAwB,GAAqD,EAAE,CAAA;AAErF,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;QACxD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpC,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACxC,SAAS,CAAC,mBAAmB,EAAE,CAAA;IACjC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrC,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAClC,UAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QACjD,yEAAyE;QACzE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAiB,CAAA;QACrC,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YAC5B,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,gBAAgB,CAAC,cAAc,EAAE,SAAS,EAAE;IAChE,aAAa,EAAE,IAAI,4BAA4B,CAAC,UAAU,CAAC;CAC5D,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAKtC,WAAW,EACX,KAAK,EAAE,QAAQ,EAAE,EAAE;IACjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1D,YAAY,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,EACD,CAAC,WAAW,EAAE,EAAE;IACd,OAAO;QACL,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,OAAO,aAAa,CAAC,WAAW,EAAE,aAAa,EAAE;gBAC/C,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;IACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAA;QAEpC,IAAI,eAAe,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,4CAA4C;YAC5C,UAAW,CAAC,WAAW,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,eAAe,CAAC,OAAO;oBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,UAAW,CAAC,WAAW,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,SAAS;oBAChB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC,CAAA;YAEF,0CAA0C;YAC1C,MAAM,UAAU,GACd,eAAe,CAAC,IAAI,KAAK,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,iBAAiB,CAAA;YAExF,IAAI,kBAAkB,IAAI,UAAU,EAAE,CAAC;gBACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAA;gBAC7D,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAA;gBAEpC,oCAAoC;gBACpC,UAAW,CAAC,WAAW,CAAC;oBACtB,IAAI,EAAE,kBAAkB;oBACxB,OAAO;oBACP,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,aAAa;iBACd,CAAC,CAAA;gBAEF,qCAAqC;gBACrC,MAAM,aAAa,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;oBAC3D,wBAAwB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBAEF,IAAI,aAAa,EAAE,CAAC;oBAClB,kDAAkD;oBAClD,UAAW,CAAC,WAAW,CAAC;wBACtB,IAAI,EAAE,mBAAmB;wBACzB,UAAU,EAAE,sBAAsB,CAAC,eAAe,CAAC;qBACpD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,4BAA4B;QAC5B,UAAW,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CACF,CAAA"}

package/dist/esm/whoCan/requestAnalysis.d.ts

@@ -1,11 +1,13 @@
-import { RequestAnalysis } from '@cloud-copilot/iam-simulate';
+import { type EvaluationResult, type RequestAnalysis } from '@cloud-copilot/iam-simulate';
+import type { DeniedWhoCanExecutionResultWithDetails } from './WhoCanWorker.js';
+import type { WhoCanDenyDetail } from './whoCan.js';
 /**
- * A light version of RequestAnalysis containing only the result and sameAccount fields,
- * along with the result fields of the various analyses.
+ * A lightweight representation of RequestAnalysis containing only the result fields
+ * of the various policy analyses (identity, resource, SCP, RCP, permission boundary).
  */
-export interface LightRequestAnalysis {
+export interface LightResourceAnalysis {
     result: RequestAnalysis['result'];
-    sameAccount: RequestAnalysis['sameAccount'];
+    sameAccount?: boolean;
     identityAnalysis?: Pick<NonNullable<RequestAnalysis['identityAnalysis']>, 'result'>;
     resourceAnalysis?: Pick<NonNullable<RequestAnalysis['resourceAnalysis']>, 'result'>;
     scpAnalysis?: Pick<NonNullable<RequestAnalysis['scpAnalysis']>, 'result'>;
@@ -13,10 +15,58 @@ export interface LightRequestAnalysis {
     permissionBoundaryAnalysis?: Pick<NonNullable<RequestAnalysis['permissionBoundaryAnalysis']>, 'result'>;
 }
 /**
- * Convert a full RequestAnalysis to a LightRequestAnalysis
+ * A LightResourceAnalysis extended with resource pattern and type information.
+ * Used for wildcard resource analyses to provide details on each matched pattern.
+ */
+export interface LightResourceAnalysisWithPattern extends LightResourceAnalysis {
+    /**
+     * The specific resource pattern that was analyzed, most likely found in a policy statement's Resource field. This is used to provide more granular details in wildcard resource analyses, where multiple patterns may match the requested resource.
+     */
+    pattern: string;
+    /**
+     * The resource type that was tested.
+     */
+    resourceType: string;
+}
+/**
+ * A light request analysis for a single resource.
+ */
+export interface SingleResourceLightRequestAnalysis extends LightResourceAnalysis {
+    type: 'single';
+    overallResult: EvaluationResult;
+}
+/**
+ * A light request analysis for a wildcard resource with multiple patterns.
+ * Used for wildcard resource analyses to provide details on each matched pattern.
+ */
+export interface WildcardResourceLightRequestAnalysis {
+    type: 'wildcard';
+    /**
+     * The overall result of the wildcard resource analysis, which is typically a combination of the results of the individual pattern analyses. This provides a high-level summary of whether the requested action is allowed or denied across all matched patterns, while the individual pattern analyses provide more granular details.
+     */
+    overallResult: EvaluationResult;
+    /**
+     * The details of the analyses for each matched resource pattern/resource type pair.
+     */
+    patterns: LightResourceAnalysisWithPattern[];
+}
+/**
+ * A light version of RequestAnalysis containing only the result and sameAccount fields,
+ * along with the result fields of the various analyses.
+ */
+export type LightRequestAnalysis = SingleResourceLightRequestAnalysis | WildcardResourceLightRequestAnalysis;
+/**
+ * Convert a full RequestAnalysis to a LightRequestAnalysis.
+ *
+ * @param executionResult - The denied execution result containing the RequestAnalysis to convert
+ * @returns A LightRequestAnalysis with only the essential fields
+ */
+export declare function toLightRequestAnalysis(executionResult: DeniedWhoCanExecutionResultWithDetails): LightRequestAnalysis;
+/**
+ * Gets the denial reasons for a denied SimulationResult.
  *
- * @param analysis the full RequestAnalysis to convert
- * @returns a LightRequestAnalysis with only the essential fields
+ * @param executionResult - The denied execution result containing the RequestAnalysis with denial reasons
+ * @returns A WhoCanDenyDetail object containing the denial reasons and other details to be returned to the user
  */
-export declare function toLightRequestAnalysis(analysis: RequestAnalysis): LightRequestAnalysis;
+export declare function convertToDenialDetails(executionResult: DeniedWhoCanExecutionResultWithDetails): WhoCanDenyDetail;
 //# sourceMappingURL=requestAnalysis.d.ts.map

package/dist/esm/whoCan/requestAnalysis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestAnalysis.d.ts","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE7D;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACjC,WAAW,EAAE,eAAe,CAAC,aAAa,CAAC,CAAA;IAC3C,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,0BAA0B,CAAC,EAAE,IAAI,CAC/B,WAAW,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,EAC1D,QAAQ,CACT,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,GAAG,oBAAoB,CAgBtF"}
+{"version":3,"file":"requestAnalysis.d.ts","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,mBAAmB,CAAA;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACjC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,gBAAgB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACzE,0BAA0B,CAAC,EAAE,IAAI,CAC/B,WAAW,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,EAC1D,QAAQ,CACT,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,qBAAqB;IAC7E;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E,IAAI,EAAE,QAAQ,CAAA;IACd,aAAa,EAAE,gBAAgB,CAAA;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,UAAU,CAAA;IAEhB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAA;IAE/B;;OAEG;IACH,QAAQ,EAAE,gCAAgC,EAAE,CAAA;CAC7C;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B,kCAAkC,GAClC,oCAAoC,CAAA;AA0BxC;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,sCAAsC,GACtD,oBAAoB,CAqBtB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,sCAAsC,GACtD,gBAAgB,CA0BlB"}

package/dist/esm/whoCan/requestAnalysis.js

@@ -1,10 +1,11 @@
+import { getDenialReasons } from '@cloud-copilot/iam-simulate';
 /**
- * Convert a full RequestAnalysis to a LightRequestAnalysis
+ * Convert a RequestAnalysis to a LightResourceAnalysis.
  *
- * @param analysis the full RequestAnalysis to convert
- * @returns a LightRequestAnalysis with only the essential fields
+ * @param analysis - The full RequestAnalysis to convert
+ * @returns A LightResourceAnalysis with only the essential result fields
  */
-export function toLightRequestAnalysis(analysis) {
+function toLightResourceAnalysis(analysis) {
     return {
         result: analysis.result,
         sameAccount: analysis.sameAccount,
@@ -21,4 +22,61 @@ export function toLightRequestAnalysis(analysis) {
             : undefined
     };
 }
+/**
+ * Convert a full RequestAnalysis to a LightRequestAnalysis.
+ *
+ * @param executionResult - The denied execution result containing the RequestAnalysis to convert
+ * @returns A LightRequestAnalysis with only the essential fields
+ */
+export function toLightRequestAnalysis(executionResult) {
+    if (executionResult.type === 'denied_single') {
+        return {
+            type: 'single',
+            overallResult: executionResult.analysis.result,
+            ...toLightResourceAnalysis(executionResult.analysis)
+        };
+    }
+    // Wildcard case
+    const patterns = executionResult.deniedPatterns.map((details) => ({
+        pattern: details.pattern,
+        resourceType: details.resourceType,
+        ...toLightResourceAnalysis(details.analysis)
+    }));
+    return {
+        type: 'wildcard',
+        overallResult: executionResult.overallResult,
+        patterns
+    };
+}
+/**
+ * Gets the denial reasons for a denied SimulationResult.
+ *
+ * @param executionResult - The denied execution result containing the RequestAnalysis with denial reasons
+ * @returns A WhoCanDenyDetail object containing the denial reasons and other details to be returned to the user
+ */
+export function convertToDenialDetails(executionResult) {
+    const { principal, action } = executionResult.workItem;
+    const [service, actionName] = action.split(':');
+    if (executionResult.type === 'denied_single') {
+        return {
+            type: 'single',
+            principal,
+            service,
+            action: actionName,
+            details: getDenialReasons(executionResult.analysis)
+        };
+    }
+    // Wildcard case
+    return {
+        type: 'wildcard',
+        principal,
+        service,
+        action: actionName,
+        deniedResources: executionResult.deniedPatterns.map((pattern) => ({
+            pattern: pattern.pattern,
+            resourceType: pattern.resourceType,
+            details: getDenialReasons(pattern.analysis)
+        }))
+    };
+}
 //# sourceMappingURL=requestAnalysis.js.map

package/dist/esm/whoCan/requestAnalysis.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestAnalysis.js","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAyB;IAC9D,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;YAC7D,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,0BAA0B,CAAC,MAAM,EAAE;YACxD,CAAC,CAAC,SAAS;KACd,CAAA;AACH,CAAC"}
+{"version":3,"file":"requestAnalysis.js","sourceRoot":"","sources":["../../../src/whoCan/requestAnalysis.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAGjB,MAAM,6BAA6B,CAAA;AAsEpC;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAyB;IACxD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAC9C,CAAC,CAAC,SAAS;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;QACvF,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;YAC7D,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,0BAA0B,CAAC,MAAM,EAAE;YACxD,CAAC,CAAC,SAAS;KACd,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuD;IAEvD,IAAI,eAAe,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM;YAC9C,GAAG,uBAAuB,CAAC,eAAe,CAAC,QAAQ,CAAC;SACrD,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,CAAC;KAC7C,CAAC,CAAC,CAAA;IAEH,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,eAAe,CAAC,aAAa;QAC5C,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuD;IAEvD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAA;IACtD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAE/C,IAAI,eAAe,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,OAAO;YACP,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,gBAAgB,CAAC,eAAe,CAAC,QAAQ,CAAC;SACpD,CAAA;IACH,CAAC;IAED,gBAAgB;IAChB,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,SAAS;QACT,OAAO;QACP,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5C,CAAC,CAAC;KACJ,CAAA;AACH,CAAC"}