@kensio/yulin 0.32.0 → 0.34.0

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-safety.d.ts

@@ -0,0 +1,35 @@
+interface FilesystemS3StorageSafetyProps {
+    readonly allowedDirectoryNames?: readonly string[] | undefined;
+}
+/**
+ * Safety checks for filesystem-based simulated S3 storage.
+ *
+ * These checks reduce the risk of reading or writing files outside an intended
+ * static-asset directory, but they are not a complete sandbox.
+ */
+export declare class FilesystemS3StorageSafety {
+    private readonly allowedDirectoryNames;
+    constructor(props?: FilesystemS3StorageSafetyProps);
+    /**
+     * Throw an error if a directory path appears to be unsafe for use as S3
+     * filesystem storage.
+     */
+    assertSafeDirectoryPath(directoryPath: string): void;
+    /**
+     * Throw an error if a sim S3 Object key appears to be unsafe for use in
+     * filesystem storage.
+     */
+    assertSafeObjectKey(key: string): void;
+    /**
+     * Throw an error if a sim S3 Object key path appears to be unsafe for use in
+     * filesystem storage.
+     */
+    assertSafeObjectKeyPath(key: string): void;
+    /**
+     * Check whether a sim S3 Object key has an allowed file extension.
+     */
+    isAllowedObjectKeyExtension(key: string): boolean;
+    private pathContainsParentDirectorySegment;
+}
+export {};
+//# sourceMappingURL=s3-filesystem-safety.d.ts.map

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-filesystem-safety.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/storage/filesystem/s3-filesystem-safety.ts"],"names":[],"mappings":"AAGA,UAAU,8BAA8B;IACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAChE;AAED;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,YAAY,KAAK,GAAE,8BAAmC,EAGrD;IAED;;;OAGG;IACH,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAqCnD;IAED;;;OAGG;IACH,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMrC;IAED;;;OAGG;IACH,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQzC;IAED;;OAEG;IACH,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;IAED,OAAO,CAAC,kCAAkC;CAG3C"}

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-safety.js

@@ -0,0 +1,111 @@
+import { homedir } from "node:os";
+import path from "node:path";
+/**
+ * Safety checks for filesystem-based simulated S3 storage.
+ *
+ * These checks reduce the risk of reading or writing files outside an intended
+ * static-asset directory, but they are not a complete sandbox.
+ */
+export class FilesystemS3StorageSafety {
+    allowedDirectoryNames;
+    constructor(props = {}) {
+        const { allowedDirectoryNames = defaultAllowedDirectoryNames } = props;
+        this.allowedDirectoryNames = allowedDirectoryNames;
+    }
+    /**
+     * Throw an error if a directory path appears to be unsafe for use as S3
+     * filesystem storage.
+     */
+    assertSafeDirectoryPath(directoryPath) {
+        if (!path.isAbsolute(directoryPath)) {
+            throw new Error(`Filesystem S3 storage directory path must be absolute: ${directoryPath}`);
+        }
+        if (this.pathContainsParentDirectorySegment(directoryPath)) {
+            throw new Error(`Filesystem S3 storage directory path must not contain '..': ${directoryPath}`);
+        }
+        const resolvedDirectoryPath = path.resolve(directoryPath);
+        const parsedDirectoryPath = path.parse(resolvedDirectoryPath);
+        if (resolvedDirectoryPath === parsedDirectoryPath.root) {
+            throw new Error(`Filesystem S3 storage directory path must not be a filesystem root: ${directoryPath}`);
+        }
+        if (resolvedDirectoryPath === path.resolve(homedir())) {
+            throw new Error(`Filesystem S3 storage directory path must not be the user home directory: ${directoryPath}`);
+        }
+        const directoryName = path.basename(resolvedDirectoryPath);
+        if (!this.allowedDirectoryNames.includes(directoryName)) {
+            throw new Error(`Filesystem S3 storage directory name must be one of: ${this.allowedDirectoryNames.join(", ")}. Got: ${directoryName}`);
+        }
+    }
+    /**
+     * Throw an error if a sim S3 Object key appears to be unsafe for use in
+     * filesystem storage.
+     */
+    assertSafeObjectKey(key) {
+        this.assertSafeObjectKeyPath(key);
+        if (!this.isAllowedObjectKeyExtension(key)) {
+            throw new Error(`S3 Object key has unsupported file extension: ${key}`);
+        }
+    }
+    /**
+     * Throw an error if a sim S3 Object key path appears to be unsafe for use in
+     * filesystem storage.
+     */
+    assertSafeObjectKeyPath(key) {
+        if (path.isAbsolute(key)) {
+            throw new Error(`S3 Object key must not be an absolute path: ${key}`);
+        }
+        if (this.pathContainsParentDirectorySegment(key)) {
+            throw new Error(`S3 Object key must not contain '..': ${key}`);
+        }
+    }
+    /**
+     * Check whether a sim S3 Object key has an allowed file extension.
+     */
+    isAllowedObjectKeyExtension(key) {
+        return allowedObjectFileExtensions.has(path.extname(key).toLowerCase());
+    }
+    pathContainsParentDirectorySegment(value) {
+        return value.split(/[\\/]/u).includes("..");
+    }
+}
+/**
+ * Default directory names that are safe to use as filesystem storage roots.
+ */
+const defaultAllowedDirectoryNames = [
+    "assets",
+    "build",
+    "dist",
+    "out",
+    "public",
+    "static",
+    "www",
+];
+/**
+ * Cautious list of allowed file extensions for simulated S3 objects. This is to
+ * try and avoid reading or writing other files that might be unsafe.
+ */
+const allowedObjectFileExtensions = new Set([
+    ".css",
+    ".eot",
+    ".gif",
+    ".htm",
+    ".html",
+    ".ico",
+    ".jpeg",
+    ".jpg",
+    ".js",
+    ".json",
+    ".map",
+    ".mjs",
+    ".otf",
+    ".png",
+    ".svg",
+    ".ttc",
+    ".ttf",
+    ".txt",
+    ".webp",
+    ".woff",
+    ".woff2",
+    ".xml",
+]);
+//# sourceMappingURL=s3-filesystem-safety.js.map

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-filesystem-safety.js","sourceRoot":"","sources":["../../../../../src/service/s3/storage/filesystem/s3-filesystem-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAM7B;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,qBAAqB,CAAoB;IAE1D,YAAY,KAAK,GAAmC,EAAE;QACpD,MAAM,EAAE,qBAAqB,GAAG,4BAA4B,EAAE,GAAG,KAAK,CAAC;QACvE,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,uBAAuB,CAAC,aAAqB;QAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,0DAA0D,aAAa,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,kCAAkC,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,+DAA+D,aAAa,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE9D,IAAI,qBAAqB,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,uEAAuE,aAAa,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,IAAI,qBAAqB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,6EAA6E,aAAa,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAE3D,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,wDAAwD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CACrF,IAAI,CACL,UAAU,aAAa,EAAE,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,GAAW;QAC7B,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,uBAAuB,CAAC,GAAW;QACjC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,2BAA2B,CAAC,GAAW;QACrC,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,kCAAkC,CAAC,KAAa;QACtD,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,4BAA4B,GAAG;IACnC,QAAQ;IACR,OAAO;IACP,MAAM;IACN,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,KAAK;CACG,CAAC;AAEX;;;GAGG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;CACP,CAAC,CAAC"}

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-storage.d.ts

@@ -0,0 +1,36 @@
+import type { SimS3BucketStorage } from "../s3-bucket-storage.js";
+import { SimS3Object } from "../../object/s3-object.js";
+interface FilesystemS3BucketStorageProps {
+    readonly directoryPath: string;
+    readonly allowedDirectoryNames?: readonly string[];
+}
+/**
+ * Maps simulated S3 Objects to files under a directory.
+ * This is useful for local development, such as serving a static website
+ * locally out of simulated S3.
+ * This class has some simple checks to reduce the risk of reading or writing
+ * files that might be unsafe, but it cannot completely protect against all
+ * potential safety issues.
+ */
+export declare class FilesystemS3BucketStorage implements SimS3BucketStorage {
+    private readonly directoryPath;
+    private readonly safety;
+    constructor(props: FilesystemS3BucketStorageProps);
+    /**
+     * Get a simulated Object from a file in the directory.
+     */
+    getObject(key: string): Promise<SimS3Object | undefined>;
+    /**
+     * List simulated Objects based on files in the directory.
+     */
+    listObjects(prefix?: string): Promise<SimS3Object[]>;
+    /**
+     * Store a simulated Object as a file in the directory.
+     */
+    putObject(object: SimS3Object): Promise<void>;
+    private filePathForObjectKey;
+    private listObjectKeys;
+    private listObjectKeysInDirectory;
+}
+export {};
+//# sourceMappingURL=s3-filesystem-storage.d.ts.map

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-filesystem-storage.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/storage/filesystem/s3-filesystem-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAQxD,UAAU,8BAA8B;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAEnD,YAAY,KAAK,EAAE,8BAA8B,EAMhD;IAED;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CA4B7D;IAED;;OAEG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAazD;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlD;IAED,OAAO,CAAC,oBAAoB;YAkBd,cAAc;YAQd,yBAAyB;CAgCxC"}

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-storage.js

@@ -0,0 +1,118 @@
+import { SimS3Object } from "../../object/s3-object.js";
+import path from "node:path";
+import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { FilesystemS3StorageSafety } from "./s3-filesystem-safety.js";
+import { metadataForFilesystemS3ObjectKey } from "./s3-filesystem-object-metadata.js";
+import { filesystemPathExists } from "./filesystem-path-exists.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/**
+ * Maps simulated S3 Objects to files under a directory.
+ * This is useful for local development, such as serving a static website
+ * locally out of simulated S3.
+ * This class has some simple checks to reduce the risk of reading or writing
+ * files that might be unsafe, but it cannot completely protect against all
+ * potential safety issues.
+ */
+export class FilesystemS3BucketStorage {
+    directoryPath;
+    safety;
+    constructor(props) {
+        this.safety = new FilesystemS3StorageSafety({
+            allowedDirectoryNames: props.allowedDirectoryNames,
+        });
+        this.safety.assertSafeDirectoryPath(props.directoryPath);
+        this.directoryPath = path.resolve(props.directoryPath);
+    }
+    /**
+     * Get a simulated Object from a file in the directory.
+     */
+    async getObject(key) {
+        if (!this.safety.isAllowedObjectKeyExtension(key)) {
+            this.safety.assertSafeObjectKeyPath(key);
+            return undefined;
+        }
+        const filePath = this.filePathForObjectKey(key);
+        try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            const body = await readFile(filePath);
+            return new SimS3Object({
+                key,
+                body,
+                metadata: metadataForFilesystemS3ObjectKey(key),
+            });
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                "code" in error &&
+                error.code === "ENOENT") {
+                return undefined;
+            }
+            /* v8 ignore next */
+            throw error;
+        }
+    }
+    /**
+     * List simulated Objects based on files in the directory.
+     */
+    async listObjects(prefix) {
+        const objectKeys = await this.listObjectKeys();
+        return await Promise.all(objectKeys
+            .filter((key) => prefix === undefined || key.startsWith(prefix))
+            .map(async (key) => {
+            const object = await this.getObject(key);
+            assertDefined(object, "Sim S3 filesystem storage listed object");
+            return object;
+        }));
+    }
+    /**
+     * Store a simulated Object as a file in the directory.
+     */
+    async putObject(object) {
+        const filePath = this.filePathForObjectKey(object.key);
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        await mkdir(path.dirname(filePath), { recursive: true });
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        await writeFile(filePath, object.body);
+    }
+    filePathForObjectKey(key) {
+        this.safety.assertSafeObjectKey(key);
+        const filePath = path.resolve(this.directoryPath, key);
+        /* v8 ignore if -- defensive guard after object key validation */
+        if (filePath !== this.directoryPath &&
+            !filePath.startsWith(`${this.directoryPath}${path.sep}`)) {
+            throw new Error(`Invalid S3 Object key outside storage directory: ${key}`);
+        }
+        return filePath;
+    }
+    async listObjectKeys() {
+        if (!(await filesystemPathExists(this.directoryPath))) {
+            return [];
+        }
+        return await this.listObjectKeysInDirectory(this.directoryPath);
+    }
+    async listObjectKeysInDirectory(directoryPath) {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        const entries = await readdir(directoryPath, { withFileTypes: true });
+        const keys = [];
+        const nestedKeyPromises = [];
+        for (const entry of entries) {
+            const entryPath = path.join(directoryPath, entry.name);
+            if (entry.isDirectory()) {
+                nestedKeyPromises.push(this.listObjectKeysInDirectory(entryPath));
+                continue;
+            }
+            if (entry.isFile()) {
+                const key = path
+                    .relative(this.directoryPath, entryPath)
+                    .split(path.sep)
+                    .join("/");
+                if (this.safety.isAllowedObjectKeyExtension(key)) {
+                    keys.push(key);
+                }
+            }
+        }
+        const nestedKeys = await Promise.all(nestedKeyPromises);
+        return [...keys, ...nestedKeys.flat()];
+    }
+}
+//# sourceMappingURL=s3-filesystem-storage.js.map

package/dist/dist-hidden/service/s3/storage/filesystem/s3-filesystem-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-filesystem-storage.js","sourceRoot":"","sources":["../../../../../src/service/s3/storage/filesystem/s3-filesystem-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAOvE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,aAAa,CAAS;IACtB,MAAM,CAA4B;IAEnD,YAAY,KAAqC;QAC/C,IAAI,CAAC,MAAM,GAAG,IAAI,yBAAyB,CAAC;YAC1C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,IAAI,WAAW,CAAC;gBACrB,GAAG;gBACH,IAAI;gBACJ,QAAQ,EAAE,gCAAgC,CAAC,GAAG,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,KAAK;gBACtB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,oBAAoB;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAe;QAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE/C,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,UAAU;aACP,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aAC/D,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzC,aAAa,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC;YAEjE,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEvD,mEAAmE;QACnE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,mEAAmE;QACnE,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAEO,oBAAoB,CAAC,GAAW;QACtC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAEvD,iEAAiE;QACjE,IACE,QAAQ,KAAK,IAAI,CAAC,aAAa;YAC/B,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,EAAE,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,aAAqB;QAErB,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAwB,EAAE,CAAC;QAElD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAEvD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;gBAClE,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,IAAI;qBACb,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;qBACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;qBACf,IAAI,CAAC,GAAG,CAAC,CAAC;gBAEb,IAAI,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/dist-hidden/service/s3/storage/s3-body-buffer.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Convert an AsyncIterable<Buffer> simulated S3 Object body to a Buffer.
+ */
+export declare function simS3BodyToBuffer(body: AsyncIterable<Buffer>): Promise<Buffer>;
+//# sourceMappingURL=s3-body-buffer.d.ts.map

package/dist/dist-hidden/service/s3/storage/s3-body-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-body-buffer.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/storage/s3-body-buffer.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1B,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/dist-hidden/service/s3/storage/s3-body-buffer.js

@@ -0,0 +1,11 @@
+/**
+ * Convert an AsyncIterable<Buffer> simulated S3 Object body to a Buffer.
+ */
+export async function simS3BodyToBuffer(body) {
+    const chunks = [];
+    for await (const chunk of body) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+//# sourceMappingURL=s3-body-buffer.js.map

package/dist/dist-hidden/service/s3/storage/s3-body-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-body-buffer.js","sourceRoot":"","sources":["../../../../src/service/s3/storage/s3-body-buffer.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/dist-hidden/service/s3/storage/s3-memory-storage.js

@@ -0,0 +1,29 @@
+/**
+ * Default in-memory simulated S3 Bucket storage.
+ */
+export class MemoryS3BucketStorage {
+    objects = new Map();
+    /**
+     * Get a simulated Object from in-memory storage.
+     */
+    getObject(key) {
+        return Promise.resolve(this.objects.get(key));
+    }
+    /**
+     * List simulated Objects in in-memory storage.
+     */
+    listObjects(prefix) {
+        const objects = [...this.objects]
+            .filter(([key]) => prefix === undefined || key.startsWith(prefix))
+            .map(([, object]) => object);
+        return Promise.resolve(objects);
+    }
+    /**
+     * Put a simulated Object into in-memory storage.
+     */
+    putObject(object) {
+        this.objects.set(object.key, object);
+        return Promise.resolve();
+    }
+}
+//# sourceMappingURL=s3-memory-storage.js.map

package/dist/dist-hidden/service/s3/storage/s3-memory-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-memory-storage.js","sourceRoot":"","sources":["../../../../src/service/s3/storage/s3-memory-storage.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE1D;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAe;QACzB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;aAC9B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aACjE,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAmB;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.d.ts

@@ -0,0 +1,57 @@
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+import { IamRoleArnParser, type IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+import type { SimAssumeRoleCommand } from "../command/assume-role/assume-role.cmd.js";
+export interface ParsedAssumeRoleRequest {
+    readonly roleArn: string;
+    readonly roleArnParts: IamRoleArnParts;
+    readonly roleSessionName: string;
+    readonly durationSeconds: number;
+    readonly conditionContext: Readonly<Record<string, SimIamConditionValue>> | undefined;
+}
+/**
+ * Validates and normalizes an STS AssumeRole command.
+ *
+ * SDK command fields are optional at the TypeScript boundary because the AWS
+ * SDK validates required values at runtime. The rest of the simulated STS flow
+ * should not need to repeat those checks or work with optional values.
+ *
+ * This parser converts the command into a request with:
+ *
+ * - required Role ARN and session name values;
+ * - parsed Role ARN parts used for target-account lookup;
+ * - a positive duration with the STS default applied when omitted;
+ * - IAM condition context derived from AssumeRole-specific command fields.
+ *
+ * Authorization and session creation consume the normalized request and remain
+ * independent of SDK input validation details.
+ */
+export declare class SimStsAssumeRoleRequestParser {
+    private readonly roleArnParser;
+    constructor(roleArnParser?: IamRoleArnParser);
+    /**
+     * Parse one AssumeRole command into the values used by authorization and
+     * temporary session creation.
+     *
+     * Parsing fails before any authorization or session state changes occur. This
+     * keeps malformed requests from reaching policy evaluation or IAM registries.
+     */
+    parse(cmd: SimAssumeRoleCommand): ParsedAssumeRoleRequest;
+    /**
+     * Apply the default session duration and reject invalid explicit values.
+     *
+     * Session duration is represented in whole seconds. Zero, negative numbers,
+     * fractional values, NaN, and infinities are rejected because they cannot
+     * describe a valid credential lifetime.
+     */
+    private durationSeconds;
+    /**
+     * Convert AssumeRole-specific request fields into IAM condition values.
+     *
+     * ExternalId participates in trust-policy authorization through the
+     * `sts:ExternalId` condition key. An omitted ExternalId produces no condition
+     * entry, allowing the IAM matcher to treat policies requiring that key as
+     * non-matching.
+     */
+    private conditionContext;
+}
+//# sourceMappingURL=sim-sts-assume-role-request-parser.d.ts.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sts-assume-role-request-parser.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-request-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,KAAK,eAAe,EACrB,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAItF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,6BAA6B;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAA1C,YAA6B,aAAa,mBAAyB,EAAI;IAEvE;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,oBAAoB,GAAG,uBAAuB,CAmBxD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAWvB;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;CAWzB"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.js

@@ -0,0 +1,79 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { IamRoleArnParser, } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+const defaultRoleSessionDurationSeconds = 3600;
+/**
+ * Validates and normalizes an STS AssumeRole command.
+ *
+ * SDK command fields are optional at the TypeScript boundary because the AWS
+ * SDK validates required values at runtime. The rest of the simulated STS flow
+ * should not need to repeat those checks or work with optional values.
+ *
+ * This parser converts the command into a request with:
+ *
+ * - required Role ARN and session name values;
+ * - parsed Role ARN parts used for target-account lookup;
+ * - a positive duration with the STS default applied when omitted;
+ * - IAM condition context derived from AssumeRole-specific command fields.
+ *
+ * Authorization and session creation consume the normalized request and remain
+ * independent of SDK input validation details.
+ */
+export class SimStsAssumeRoleRequestParser {
+    roleArnParser;
+    constructor(roleArnParser = new IamRoleArnParser()) {
+        this.roleArnParser = roleArnParser;
+    }
+    /**
+     * Parse one AssumeRole command into the values used by authorization and
+     * temporary session creation.
+     *
+     * Parsing fails before any authorization or session state changes occur. This
+     * keeps malformed requests from reaching policy evaluation or IAM registries.
+     */
+    parse(cmd) {
+        const roleArn = cmd.input.RoleArn;
+        assertDefined(roleArn, "STS AssumeRole RoleArn is required");
+        const roleSessionName = cmd.input.RoleSessionName;
+        assertDefined(roleSessionName, "STS AssumeRole RoleSessionName is required");
+        const durationSeconds = this.durationSeconds(cmd.input.DurationSeconds);
+        return {
+            roleArn,
+            roleArnParts: this.roleArnParser.parse(roleArn),
+            roleSessionName,
+            durationSeconds,
+            conditionContext: this.conditionContext(cmd.input.ExternalId),
+        };
+    }
+    /**
+     * Apply the default session duration and reject invalid explicit values.
+     *
+     * Session duration is represented in whole seconds. Zero, negative numbers,
+     * fractional values, NaN, and infinities are rejected because they cannot
+     * describe a valid credential lifetime.
+     */
+    durationSeconds(value) {
+        const durationSeconds = value ?? defaultRoleSessionDurationSeconds;
+        /* v8 ignore if */
+        if (!Number.isSafeInteger(durationSeconds) || durationSeconds <= 0) {
+            throw new Error("DurationSeconds must be a positive integer");
+        }
+        return durationSeconds;
+    }
+    /**
+     * Convert AssumeRole-specific request fields into IAM condition values.
+     *
+     * ExternalId participates in trust-policy authorization through the
+     * `sts:ExternalId` condition key. An omitted ExternalId produces no condition
+     * entry, allowing the IAM matcher to treat policies requiring that key as
+     * non-matching.
+     */
+    conditionContext(externalId) {
+        if (externalId === undefined) {
+            return undefined;
+        }
+        return {
+            "sts:ExternalId": externalId,
+        };
+    }
+}
+//# sourceMappingURL=sim-sts-assume-role-request-parser.js.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sts-assume-role-request-parser.js","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-request-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACL,gBAAgB,GAEjB,MAAM,+CAA+C,CAAC;AAGvD,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAW/C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,6BAA6B;IACX,aAAa;IAA1C,YAA6B,aAAa,GAAG,IAAI,gBAAgB,EAAE;6BAAtC,aAAa;IAA4B,CAAC;IAEvE;;;;;;OAMG;IACH,KAAK,CAAC,GAAyB;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;QAE7D,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;QAClD,aAAa,CACX,eAAe,EACf,4CAA4C,CAC7C,CAAC;QAEF,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAExE,OAAO;YACL,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/C,eAAe;YACf,eAAe;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,KAAyB;QAC/C,MAAM,eAAe,GAAG,KAAK,IAAI,iCAAiC,CAAC;QAEnE,kBAAkB;QAClB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CACtB,UAA8B;QAE9B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,gBAAgB,EAAE,UAAU;SAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.d.ts

@@ -0,0 +1,52 @@
+import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
+import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
+import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+import type { SimAssumeRoleCommandOutput } from "../command/assume-role/assume-role.cmd.js";
+interface AssumeRoleSessionCreatorProps {
+    readonly iamResolver: SimIamAccountResolver;
+}
+interface CreateAssumeRoleSessionInput {
+    readonly roleArnParts: IamRoleArnParts;
+    readonly role: SimGetRoleCommandOutput["Role"];
+    readonly roleSessionName: string;
+    readonly sourcePrincipal: SimArnPrincipal;
+    readonly durationSeconds: number;
+}
+/**
+ * Creates the temporary IAM Role session returned by STS AssumeRole.
+ *
+ * Authorization must be completed before this class is called. This class does
+ * not inspect policies or decide whether the caller may assume the Role. Its
+ * responsibility starts after authorization and covers:
+ *
+ * - resolving the target account's IAM session manager;
+ * - calculating the session creation and expiration timestamps;
+ * - creating the temporary Role session and its credentials;
+ * - mapping internal session data to the public AssumeRole response shape.
+ *
+ * Keeping these operations together ensures the same expiration timestamp is
+ * stored in the session and returned to the SDK caller.
+ */
+export declare class SimStsAssumeRoleSessionCreator {
+    private readonly iamResolver;
+    constructor(props: AssumeRoleSessionCreatorProps);
+    /**
+     * Create a temporary session for an authorized AssumeRole request.
+     *
+     * `roleArnParts.accountId` selects the IAM facade that owns the target Role.
+     * The Role name and ID come from the resolved Role, while the session name and
+     * source principal come from the original request context.
+     */
+    create(input: CreateAssumeRoleSessionInput): SimAssumeRoleCommandOutput;
+    /**
+     * Calculate the credential expiration from the session creation time.
+     *
+     * STS durations are expressed in seconds, while JavaScript Date arithmetic
+     * uses milliseconds. Using the supplied creation timestamp as the base keeps
+     * session metadata and returned credential metadata on the same timeline.
+     */
+    private expiration;
+}
+export {};
+//# sourceMappingURL=sim-sts-assume-role-session-creator.d.ts.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sts-assume-role-session-creator.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-session-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAE5F,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,KAAK,EAAE,6BAA6B,EAE/C;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,4BAA4B,GAAG,0BAA0B,CA4BtE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;CAGnB"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.js

@@ -0,0 +1,64 @@
+/**
+ * Creates the temporary IAM Role session returned by STS AssumeRole.
+ *
+ * Authorization must be completed before this class is called. This class does
+ * not inspect policies or decide whether the caller may assume the Role. Its
+ * responsibility starts after authorization and covers:
+ *
+ * - resolving the target account's IAM session manager;
+ * - calculating the session creation and expiration timestamps;
+ * - creating the temporary Role session and its credentials;
+ * - mapping internal session data to the public AssumeRole response shape.
+ *
+ * Keeping these operations together ensures the same expiration timestamp is
+ * stored in the session and returned to the SDK caller.
+ */
+export class SimStsAssumeRoleSessionCreator {
+    iamResolver;
+    constructor(props) {
+        this.iamResolver = props.iamResolver;
+    }
+    /**
+     * Create a temporary session for an authorized AssumeRole request.
+     *
+     * `roleArnParts.accountId` selects the IAM facade that owns the target Role.
+     * The Role name and ID come from the resolved Role, while the session name and
+     * source principal come from the original request context.
+     */
+    create(input) {
+        const createDate = new Date();
+        const expiration = this.expiration(createDate, input.durationSeconds);
+        const targetIam = this.iamResolver.iamForAccount(input.roleArnParts.accountId);
+        const createdSession = targetIam.sessionManager.createRoleSession({
+            roleName: input.role.RoleName,
+            sessionName: input.roleSessionName,
+            sourcePrincipal: input.sourcePrincipal,
+            createDate,
+            expiration,
+        });
+        return {
+            Credentials: {
+                AccessKeyId: createdSession.credentials.accessKeyId,
+                SecretAccessKey: createdSession.credentials.secretAccessKey,
+                SessionToken: createdSession.credentials.sessionToken,
+                Expiration: expiration,
+            },
+            AssumedRoleUser: {
+                AssumedRoleId: `${input.role.RoleId}:${input.roleSessionName}`,
+                Arn: createdSession.session.principal.arn,
+            },
+            $metadata: {},
+        };
+    }
+    /**
+     * Calculate the credential expiration from the session creation time.
+     *
+     * STS durations are expressed in seconds, while JavaScript Date arithmetic
+     * uses milliseconds. Using the supplied creation timestamp as the base keeps
+     * session metadata and returned credential metadata on the same timeline.
+     */
+    expiration(createDate, durationSeconds) {
+        return new Date(createDate.getTime() + durationSeconds * 1000);
+    }
+}
+//# sourceMappingURL=sim-sts-assume-role-session-creator.js.map