@kensio/yulin 0.32.0 → 0.34.0

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js

@@ -1,141 +0,0 @@
-import { simIamWildcardMatch } from "../sim-iam-wildcard.js";
-/**
- * Matches one parsed IAM policy statement against one authorization request.
- *
- * This class owns the statement-level matching rules so
- * `SimIamPolicyDecision` can stay focused on policy iteration and final
- * Deny/Allow/ImplicitDeny aggregation.
- *
- * The matcher currently covers the IAM dimensions supported by the simulator:
- *
- * - Principal and NotPrincipal for resource policies;
- * - Action and NotAction;
- * - Resource and NotResource.
- *
- * Conditions are not evaluated yet. A statement with a Condition is treated as
- * non-matching so the simulator does not grant access from a statement whose
- * condition semantics it cannot prove.
- */
-export class SimIamPolicyStatementMatcher {
-    context;
-    constructor(context) {
-        this.context = context;
-    }
-    /**
-     * Check whether a parsed statement applies to the current request.
-     */
-    matches(policy, statement) {
-        /* v8 ignore if -- policy conditions are TODO */
-        if (statement.condition !== undefined) {
-            return false;
-        }
-        return (this.principalMatches(policy, statement) &&
-            this.actionMatches(statement) &&
-            this.resourceMatches(statement));
-    }
-    /**
-     * Check the principal part of a statement.
-     *
-     * Identity policies do not carry Principal or NotPrincipal because they are
-     * already attached to the caller identity. Resource policies must name the
-     * caller with Principal, or exclude the caller with NotPrincipal.
-     */
-    principalMatches(policy, statement) {
-        if (policy.sourceType !== "resource") {
-            return (statement.principal === undefined &&
-                statement.notPrincipal === undefined);
-        }
-        if (statement.principal !== undefined) {
-            return this.principalValueMatches(statement.principal);
-        }
-        if (statement.notPrincipal !== undefined) {
-            return !this.principalValueMatches(statement.notPrincipal);
-        }
-        return false;
-    }
-    /**
-     * Check every Principal shape supported by the parsed policy model.
-     *
-     * IAM allows Principal to be a string, an array, or an object keyed by
-     * principal type. The simulator currently recognizes AWS and Service
-     * principal objects because those are the forms used by supported services.
-     */
-    principalValueMatches(principal) {
-        if (typeof principal === "string") {
-            return this.principalPatternMatches(principal);
-        }
-        if (Array.isArray(principal)) {
-            return principal.some((value) => this.principalPatternMatches(value));
-        }
-        return Object.entries(principal).some(([principalType, values]) => {
-            if (principalType !== "AWS" && principalType !== "Service") {
-                return false;
-            }
-            if (typeof values === "string") {
-                return this.principalPatternMatches(values);
-            }
-            return values.some((value) => this.principalPatternMatches(value));
-        });
-    }
-    /**
-     * Match a single principal pattern against the caller ARN.
-     *
-     * The wildcard principal `*` matches anonymous and signed requests. Any other
-     * principal pattern requires a caller ARN because there is no stable value to
-     * compare when the request has no caller principal.
-     */
-    principalPatternMatches(pattern) {
-        if (pattern === "*") {
-            return true;
-        }
-        if (this.context.callerPrincipal?.arn === undefined) {
-            return false;
-        }
-        return simIamWildcardMatch(pattern, this.context.callerPrincipal.arn, {
-            caseSensitive: true,
-        });
-    }
-    /**
-     * Check Action or NotAction against the requested IAM action.
-     *
-     * AWS action names are case-insensitive, so wildcard matching follows that
-     * behavior. The parser guarantees one of Action or NotAction exists; the final
-     * throw protects future parser changes from producing invalid statements.
-     */
-    actionMatches(statement) {
-        if (statement.actions !== undefined) {
-            return statement.actions.some((pattern) => simIamWildcardMatch(pattern, this.context.action, {
-                caseSensitive: false,
-            }));
-        }
-        if (statement.notActions !== undefined) {
-            return !statement.notActions.some((pattern) => simIamWildcardMatch(pattern, this.context.action, {
-                caseSensitive: false,
-            }));
-        }
-        /* v8 ignore next -- defensive diagnostic error */
-        throw new TypeError("IAM policy statement must define either Action or NotAction");
-    }
-    /**
-     * Check Resource or NotResource against the requested resource ARN.
-     *
-     * Resource ARNs are matched case-sensitively. This mirrors IAM's ARN matching
-     * behavior and prevents policies from matching resources that differ only by
-     * case.
-     */
-    resourceMatches(statement) {
-        if (statement.resources !== undefined) {
-            return statement.resources.some((pattern) => simIamWildcardMatch(pattern, this.context.resource, {
-                caseSensitive: true,
-            }));
-        }
-        if (statement.notResources !== undefined) {
-            return !statement.notResources.some((pattern) => simIamWildcardMatch(pattern, this.context.resource, {
-                caseSensitive: true,
-            }));
-        }
-        /* v8 ignore next -- defensive diagnostic error */
-        throw new TypeError("IAM policy statement must define either Resource or NotResource");
-    }
-}
-//# sourceMappingURL=sim-iam-policy-statement-matcher.js.map

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;OAEG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,gDAAgD;QAChD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CACL,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC;YACxC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,CACL,SAAS,CAAC,SAAS,KAAK,SAAS;gBACjC,SAAS,CAAC,YAAY,KAAK,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAC3B,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAC/C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CACpC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE;YAChE,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAAC,OAAe;QAC7C,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YACpE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,SAAsC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAChD,aAAa,EAAE,KAAK;aACrB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,SAAsC;QAC5D,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE,IAAI;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,SAAS,CACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -1,65 +0,0 @@
-import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js";
-import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
-import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-doc-parser.js";
-export declare const SimIamPolicyDecisionValue: {
-    readonly ExplicitDeny: "ExplicitDeny";
-    readonly Allow: "Allow";
-    readonly ImplicitDeny: "ImplicitDeny";
-};
-export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];
-/**
- * Decision for one simulated IAM policy authorization attempt.
- *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
- *
- * The simulator currently models the common IAM authorization union:
- *
- * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
- * - otherwise the request is implicitly denied.
- *
- * Resource policies are expected to be supplied by the service that owns the
- * target resource.
- */
-export declare class SimIamPolicyDecision {
-    private readonly request;
-    private readonly policyDocumentParser;
-    private readonly statementMatcher;
-    private readonly explicitDenyStatementRecords;
-    private readonly allowStatementRecords;
-    constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
-    /**
-     * Final IAM decision value.
-     */
-    get value(): SimIamPolicyDecisionValue;
-    /**
-     * Whether the request is allowed.
-     */
-    get isAllowed(): boolean;
-    /**
-     * Whether the request is denied either explicitly or implicitly.
-     */
-    get isDenied(): boolean;
-    /**
-     * Whether the request is denied by a matching Deny statement.
-     */
-    get isExplicitDeny(): boolean;
-    /**
-     * Whether the request is denied because no Allow statement matched.
-     */
-    get isImplicitDeny(): boolean;
-    /**
-     * Matching explicit Deny statements.
-     */
-    get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
-    /**
-     * Matching Allow statements.
-     */
-    get allowStatements(): readonly SimIamPolicyDocumentStatement[];
-    private evaluate;
-    private evaluatePolicy;
-}
-//# sourceMappingURL=sim-iam-decision.d.ts.map

package/dist/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAGnF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAE7E,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAgBvB"}

package/dist/service/iam/authorize/sim-iam-decision.js

@@ -1,107 +0,0 @@
-import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-doc-parser.js";
-import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
-export const SimIamPolicyDecisionValue = {
-    ExplicitDeny: "ExplicitDeny",
-    Allow: "Allow",
-    ImplicitDeny: "ImplicitDeny",
-};
-/**
- * Decision for one simulated IAM policy authorization attempt.
- *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
- *
- * The simulator currently models the common IAM authorization union:
- *
- * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
- * - otherwise the request is implicitly denied.
- *
- * Resource policies are expected to be supplied by the service that owns the
- * target resource.
- */
-export class SimIamPolicyDecision {
-    request;
-    policyDocumentParser;
-    statementMatcher;
-    explicitDenyStatementRecords = [];
-    allowStatementRecords = [];
-    constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
-        this.request = request;
-        this.policyDocumentParser = policyDocumentParser;
-        this.statementMatcher = new SimIamPolicyStatementMatcher(request);
-        this.evaluate();
-    }
-    /**
-     * Final IAM decision value.
-     */
-    get value() {
-        if (this.explicitDenyStatementRecords.length > 0) {
-            return SimIamPolicyDecisionValue.ExplicitDeny;
-        }
-        if (this.allowStatementRecords.length > 0) {
-            return SimIamPolicyDecisionValue.Allow;
-        }
-        return SimIamPolicyDecisionValue.ImplicitDeny;
-    }
-    /**
-     * Whether the request is allowed.
-     */
-    get isAllowed() {
-        return this.value === SimIamPolicyDecisionValue.Allow;
-    }
-    /**
-     * Whether the request is denied either explicitly or implicitly.
-     */
-    get isDenied() {
-        return this.value !== SimIamPolicyDecisionValue.Allow;
-    }
-    /**
-     * Whether the request is denied by a matching Deny statement.
-     */
-    get isExplicitDeny() {
-        return this.value === SimIamPolicyDecisionValue.ExplicitDeny;
-    }
-    /**
-     * Whether the request is denied because no Allow statement matched.
-     */
-    get isImplicitDeny() {
-        return this.value === SimIamPolicyDecisionValue.ImplicitDeny;
-    }
-    /**
-     * Matching explicit Deny statements.
-     */
-    get explicitDenyStatements() {
-        return this.explicitDenyStatementRecords;
-    }
-    /**
-     * Matching Allow statements.
-     */
-    get allowStatements() {
-        return this.allowStatementRecords;
-    }
-    evaluate() {
-        for (const policy of [
-            ...this.request.identityPolicies,
-            ...this.request.resourcePolicies,
-        ]) {
-            this.evaluatePolicy(policy);
-        }
-    }
-    evaluatePolicy(policy) {
-        const parsedPolicy = this.policyDocumentParser.parse(policy.document);
-        for (const statement of parsedPolicy.statements) {
-            if (!this.statementMatcher.matches(policy, statement)) {
-                continue;
-            }
-            if (statement.effect === "Deny") {
-                this.explicitDenyStatementRecords.push(statement.source);
-                continue;
-            }
-            this.allowStatementRecords.push(statement.source);
-        }
-    }
-}
-//# sourceMappingURL=sim-iam-decision.js.map

package/dist/service/iam/authorize/sim-iam-decision.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,qBAAqB,GAAoC,EAAE,CAAC;IAE7E,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-wildcard.d.ts

@@ -1,11 +0,0 @@
-interface SimIamWildcardMatchOptions {
-    readonly caseSensitive: boolean;
-}
-/**
- * Match an IAM-style wildcard pattern.
- *
- * Initial support is small: "*" means zero or more characters.
- */
-export declare function simIamWildcardMatch(pattern: string, value: string, options: SimIamWildcardMatchOptions): boolean;
-export {};
-//# sourceMappingURL=sim-iam-wildcard.d.ts.map

package/dist/service/iam/authorize/sim-iam-wildcard.js

@@ -1,21 +0,0 @@
-/**
- * Match an IAM-style wildcard pattern.
- *
- * Initial support is small: "*" means zero or more characters.
- */
-export function simIamWildcardMatch(pattern, value, options) {
-    return wildcardMatch(pattern, value, options);
-}
-function wildcardMatch(pattern, value, options) {
-    const regexPattern = pattern
-        .replaceAll(/[\\^$.*+?()[\]{}|]/gu, String.raw `\$&`)
-        .replaceAll(String.raw `\*`, ".*");
-    /*
-     * IAM wildcard patterns are not accepted as regex syntax. They are converted
-     * from a small wildcard language where only "*" has special meaning. All other
-     * characters are escaped above.
-     */
-    // eslint-disable-next-line security/detect-non-literal-regexp
-    return new RegExp(`^${regexPattern}$`, options.caseSensitive ? "u" : "iu").test(value);
-}
-//# sourceMappingURL=sim-iam-wildcard.js.map

package/dist/service/iam/authorize/sim-iam-wildcard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-wildcard.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-wildcard.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,KAAa,EACb,OAAmC;IAEnC,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CACpB,OAAe,EACf,KAAa,EACb,OAAmC;IAEnC,MAAM,YAAY,GAAG,OAAO;SACzB,UAAU,CAAC,sBAAsB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC;SACnD,UAAU,CAAC,MAAM,CAAC,GAAG,CAAA,IAAI,EAAE,IAAI,CAAC,CAAC;IAEpC;;;;OAIG;IACH,8DAA8D;IAC9D,OAAO,IAAI,MAAM,CACf,IAAI,YAAY,GAAG,EACnB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACnC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChB,CAAC"}

package/dist/service/iam/command/role/get-role/get-role.cmd.d.ts

@@ -1,19 +0,0 @@
-import type { SimArn } from "../../../../aws/arn.js";
-export interface SimGetRoleCommandInput {
-    readonly RoleName?: string | undefined;
-}
-export interface SimGetRoleCommand {
-    readonly input: SimGetRoleCommandInput;
-}
-export interface SimGetRoleCommandOutput {
-    readonly Role: {
-        readonly Path: string;
-        readonly RoleName: string;
-        readonly RoleId: string;
-        readonly Arn: SimArn;
-        readonly CreateDate: Date;
-        readonly AssumeRolePolicyDocument?: string | undefined;
-        readonly Description?: string | undefined;
-    };
-}
-//# sourceMappingURL=get-role.cmd.d.ts.map

package/dist/service/iam/command/role/get-role/get-role.cmd.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"get-role.cmd.d.ts","sourceRoot":"","sources":["../../../../../../src/service/iam/command/role/get-role/get-role.cmd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;QAC1B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3C,CAAC;CACH"}

package/dist/service/iam/error/sim-iam.error.d.ts

@@ -1,42 +0,0 @@
-/**
- * Minimal metadata shape for simulated IAM errors.
- */
-export interface SimIamErrorMetadata {
-    readonly httpStatusCode?: number;
-}
-/**
- * Base class for simulated IAM errors.
- */
-export declare class SimIamError extends Error {
-    readonly $metadata: SimIamErrorMetadata;
-    constructor(message: string, $metadata?: SimIamErrorMetadata);
-}
-/**
- * Simulated IAM NoSuchEntity error.
- */
-export declare class SimIamNoSuchEntity extends SimIamError {
-    readonly name = "NoSuchEntity";
-    constructor(message: string);
-}
-/**
- * Simulated IAM EntityAlreadyExists error.
- */
-export declare class SimIamEntityAlreadyExists extends SimIamError {
-    readonly name = "EntityAlreadyExists";
-    constructor(message: string);
-}
-/**
- * Simulated IAM InvalidMarker error.
- */
-export declare class SimIamInvalidMarkerException extends SimIamError {
-    readonly name = "InvalidMarkerException";
-    constructor(message: string);
-}
-/**
- * Simulated IAM MalformedPolicyDocument error.
- */
-export declare class SimIamMalformedPolicyDocument extends SimIamError {
-    readonly name = "MalformedPolicyDocument";
-    constructor(message: string);
-}
-//# sourceMappingURL=sim-iam.error.d.ts.map

package/dist/service/iam/error/sim-iam.error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam.error.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,SAAyB,IAAI,kBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAC5D,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/iam/error/sim-iam.error.js

@@ -1,47 +0,0 @@
-/**
- * Base class for simulated IAM errors.
- */
-export class SimIamError extends Error {
-    $metadata;
-    constructor(message, $metadata = {}) {
-        super(message);
-        this.$metadata = $metadata;
-    }
-}
-/**
- * Simulated IAM NoSuchEntity error.
- */
-export class SimIamNoSuchEntity extends SimIamError {
-    name = "NoSuchEntity";
-    constructor(message) {
-        super(message, { httpStatusCode: 404 });
-    }
-}
-/**
- * Simulated IAM EntityAlreadyExists error.
- */
-export class SimIamEntityAlreadyExists extends SimIamError {
-    name = "EntityAlreadyExists";
-    constructor(message) {
-        super(message, { httpStatusCode: 409 });
-    }
-}
-/**
- * Simulated IAM InvalidMarker error.
- */
-export class SimIamInvalidMarkerException extends SimIamError {
-    name = "InvalidMarkerException";
-    constructor(message) {
-        super(message, { httpStatusCode: 400 });
-    }
-}
-/**
- * Simulated IAM MalformedPolicyDocument error.
- */
-export class SimIamMalformedPolicyDocument extends SimIamError {
-    name = "MalformedPolicyDocument";
-    constructor(message) {
-        super(message, { httpStatusCode: 400 });
-    }
-}
-//# sourceMappingURL=sim-iam.error.js.map

package/dist/service/iam/error/sim-iam.error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam.error.js","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACxB,IAAI,GAAG,cAAc,CAAC;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,WAAW;IACnC,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/iam/policy/sim-iam-policy.d.ts

@@ -1,50 +0,0 @@
-import type { JSONString } from "../../../util/type-guard/json.js";
-import type { Brand } from "../../../util/brand.type.js";
-import type { SimArn } from "../../aws/arn.js";
-export type SimIamPolicyName = Brand<string, "SimIamPolicyName">;
-export type SimIamPolicyId = Brand<string, "SimIamPolicyId">;
-export interface SimIamPolicyDocument {
-    readonly Version?: string | undefined;
-    readonly Id?: string | undefined;
-    readonly Statement?: SimIamPolicyDocumentStatement | readonly SimIamPolicyDocumentStatement[];
-}
-export interface SimIamPolicyDocumentStatement {
-    readonly Sid?: string | undefined;
-    readonly Effect: "Allow" | "Deny";
-    readonly Action?: string | readonly string[] | undefined;
-    readonly NotAction?: string | readonly string[] | undefined;
-    readonly Resource?: string | readonly string[] | undefined;
-    readonly NotResource?: string | readonly string[] | undefined;
-    readonly Principal?: SimIamPolicyDocumentPrincipal | undefined;
-    readonly NotPrincipal?: SimIamPolicyDocumentPrincipal | undefined;
-    readonly Condition?: SimIamPolicyDocumentCondition | undefined;
-}
-export type SimIamPolicyDocumentPrincipal = string | readonly string[] | Readonly<Record<string, string | readonly string[]>>;
-export type SimIamPolicyDocumentCondition = Readonly<Record<string, Readonly<Record<string, string | number | boolean | readonly string[]>>>>;
-/**
- * IAM managed policy record.
- *
- * This represents customer-managed or AWS-managed IAM policy metadata and its
- * default policy document. Inline policies and resource policies are stored on
- * their owning identity/resource instead of in this global managed-policy
- * store.
- */
-export interface SimIamManagedPolicy {
-    readonly arn: SimArn;
-    readonly policyId: SimIamPolicyId;
-    readonly policyName: SimIamPolicyName;
-    readonly path: string;
-    readonly defaultVersionId: string;
-    readonly attachmentCount: number;
-    readonly permissionsBoundaryUsageCount: number;
-    readonly isAttachable: boolean;
-    readonly description?: string | undefined;
-    readonly createDate: Date;
-    readonly updateDate: Date;
-    readonly policyDocument?: JSONString<SimIamPolicyDocument> | undefined;
-}
-/**
- * Backwards-compatible alias while the IAM command handlers are migrated.
- */
-export type SimIamPolicy = SimIamManagedPolicy;
-//# sourceMappingURL=sim-iam-policy.d.ts.map

package/dist/service/iam/policy/sim-iam-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EACjB,6BAA6B,GAAG,SAAS,6BAA6B,EAAE,CAAC;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAChE;AAED,MAAM,MAAM,6BAA6B,GACrC,MAAM,GACN,SAAS,MAAM,EAAE,GACjB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAEzD,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAClD,MAAM,CACJ,MAAM,EACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC,CACxE,CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC"}

package/dist/service/iam/registry/sim-iam-registry.d.ts

@@ -1,84 +0,0 @@
-export interface SimIamDisableEvent {
-    readonly reason: string;
-    readonly detail?: string | undefined;
-    readonly disabledAt: Date;
-}
-/**
- * Simulated IAM registry for state that is global within one SimAws instance.
- *
- * IAM service facades are Account-scoped, but IAM activation is sim AWS-wide so
- * cross-account behaviour does not depend on which Account first interacted
- * with sim IAM.
- */
-export declare class SimIamRegistry {
-    private activated;
-    private disableEventRecord;
-    private readonly activationEventRecords;
-    /**
-     * Whether sim IAM is currently activated for this sim AWS instance.
-     */
-    get isActivated(): boolean;
-    /**
-     * Whether sim IAM has been explicitly and permanently disabled for this sim
-     * AWS instance.
-     */
-    get isDisabled(): boolean;
-    /**
-     * Recorded reasons why sim IAM activation was attempted.
-     *
-     * Events include both successful activations and later activation attempts that
-     * were ignored because sim IAM had been permanently disabled.
-     */
-    get activationEvents(): SimIamActivationEvent[];
-    /**
-     * The permanent disable event, if the user explicitly disabled sim IAM.
-     */
-    get disableEvent(): SimIamDisableEvent | undefined;
-    /**
-     * Human-readable diagnostic summary of why sim IAM is activated or not yet
-     * activated.
-     */
-    get statusReason(): string;
-    /**
-     * Activate sim IAM for this simulated AWS instance.
-     *
-     * If sim IAM has previously been explicitly disabled, the activation attempt is
-     * recorded for diagnostics but does not reactivate IAM semantics.
-     */
-    activate(reason?: string, detail?: string): void;
-    /**
-     * Disable IAM semantics for this simulated AWS instance.
-     *
-     * Disabling is permanent for the lifetime of this sim AWS instance. Automatic
-     * activations from other simulated services are still recorded after disable,
-     * but they are ignored.
-     *
-     * Disabling does not clear activation history because the history is useful
-     * diagnostic information for tests and debugging.
-     */
-    disable(reason?: string, detail?: string): void;
-    private latestSuccessfulActivationEvent;
-    private formatEventReason;
-}
-interface SimIamActivationEvent {
-    readonly reason: string;
-    readonly detail?: string | undefined;
-    readonly activatedAt: Date;
-    /**
-     * Whether this activation attempt actually made sim IAM activated.
-     *
-     * This is false when the registry had previously been permanently disabled.
-     */
-    readonly activated: boolean;
-    /**
-     * Whether sim IAM had already been permanently disabled when this activation
-     * was attempted.
-     */
-    readonly registryDisabled: boolean;
-    /**
-     * Diagnostic explanation when an activation attempt was recorded but ignored.
-     */
-    readonly ignoredReason?: string | undefined;
-}
-export {};
-//# sourceMappingURL=sim-iam-registry.d.ts.map

package/dist/service/iam/registry/sim-iam-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,kBAAkB,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA+B;IAEtE;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;OAGG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,qBAAqB,EAAE,CAE9C;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,kBAAkB,GAAG,SAAS,CAEjD;IAED;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,CAkBzB;IAED;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,SAAsB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5D;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,SAAmB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAQxD;IAED,OAAO,CAAC,+BAA+B;IAIvC,OAAO,CAAC,iBAAiB;CAG1B;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C"}