@kensio/yulin 0.34.0 → 0.34.2

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.js

@@ -1,64 +0,0 @@
-/**
- * Creates the temporary IAM Role session returned by STS AssumeRole.
- *
- * Authorization must be completed before this class is called. This class does
- * not inspect policies or decide whether the caller may assume the Role. Its
- * responsibility starts after authorization and covers:
- *
- * - resolving the target account's IAM session manager;
- * - calculating the session creation and expiration timestamps;
- * - creating the temporary Role session and its credentials;
- * - mapping internal session data to the public AssumeRole response shape.
- *
- * Keeping these operations together ensures the same expiration timestamp is
- * stored in the session and returned to the SDK caller.
- */
-export class SimStsAssumeRoleSessionCreator {
-    iamResolver;
-    constructor(props) {
-        this.iamResolver = props.iamResolver;
-    }
-    /**
-     * Create a temporary session for an authorized AssumeRole request.
-     *
-     * `roleArnParts.accountId` selects the IAM facade that owns the target Role.
-     * The Role name and ID come from the resolved Role, while the session name and
-     * source principal come from the original request context.
-     */
-    create(input) {
-        const createDate = new Date();
-        const expiration = this.expiration(createDate, input.durationSeconds);
-        const targetIam = this.iamResolver.iamForAccount(input.roleArnParts.accountId);
-        const createdSession = targetIam.sessionManager.createRoleSession({
-            roleName: input.role.RoleName,
-            sessionName: input.roleSessionName,
-            sourcePrincipal: input.sourcePrincipal,
-            createDate,
-            expiration,
-        });
-        return {
-            Credentials: {
-                AccessKeyId: createdSession.credentials.accessKeyId,
-                SecretAccessKey: createdSession.credentials.secretAccessKey,
-                SessionToken: createdSession.credentials.sessionToken,
-                Expiration: expiration,
-            },
-            AssumedRoleUser: {
-                AssumedRoleId: `${input.role.RoleId}:${input.roleSessionName}`,
-                Arn: createdSession.session.principal.arn,
-            },
-            $metadata: {},
-        };
-    }
-    /**
-     * Calculate the credential expiration from the session creation time.
-     *
-     * STS durations are expressed in seconds, while JavaScript Date arithmetic
-     * uses milliseconds. Using the supplied creation timestamp as the base keeps
-     * session metadata and returned credential metadata on the same timeline.
-     */
-    expiration(createDate, durationSeconds) {
-        return new Date(createDate.getTime() + durationSeconds * 1000);
-    }
-}
-//# sourceMappingURL=sim-sts-assume-role-session-creator.js.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-sts-assume-role-session-creator.js","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-session-creator.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,8BAA8B;IACxB,WAAW,CAAwB;IAEpD,YAAY,KAAoC;QAC9C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAmC;QACxC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAC9C,KAAK,CAAC,YAAY,CAAC,SAAS,CAC7B,CAAC;QAEF,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,iBAAiB,CAAC;YAChE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,WAAW,EAAE,KAAK,CAAC,eAAe;YAClC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU;YACV,UAAU;SACX,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE;gBACX,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,WAAW;gBACnD,eAAe,EAAE,cAAc,CAAC,WAAW,CAAC,eAAe;gBAC3D,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,YAAY;gBACrD,UAAU,EAAE,UAAU;aACvB;YACD,eAAe,EAAE;gBACf,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE;gBAC9D,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG;aAC1C;YACD,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,UAAgB,EAAE,eAAuB;QAC1D,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts

@@ -1,57 +0,0 @@
-import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
-import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
-import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
-import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
-import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
-interface AssumeRoleAuthorizationCoordinatorProps {
-    readonly sourceAccountId: SimAwsAccountId;
-    readonly iamResolver: SimIamAccountResolver;
-}
-interface AssumeRoleAuthorizationInput {
-    readonly roleArn: string;
-    readonly roleArnParts: IamRoleArnParts;
-    readonly caller: SimArnPrincipal;
-    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
-}
-type AssumeRoleAuthorizedRole = SimGetRoleCommandOutput["Role"];
-/**
- * Coordinates source identity authorization and target Role trust authorization
- * for an STS AssumeRole request.
- *
- * AssumeRole normally requires both an identity-policy Allow in the caller's
- * Account and a matching trust-policy Allow in the target Role's Account.
- * A directly trusted IAM User in the same Account is an exception: the Role
- * trust policy can grant that User access without a separate identity-policy
- * Allow. Matching explicit identity-policy Deny statements still reject the
- * request.
- *
- * The target trust policy is evaluated first because its matching grant must be
- * classified before the source authorization requirement can be selected.
- */
-export declare class AssumeRoleAuthorizationCoordinator {
-    private readonly sourceAccountId;
-    private readonly sourcePrincipalAuthorizer;
-    private readonly targetRoleAuthorizer;
-    constructor(props: AssumeRoleAuthorizationCoordinatorProps);
-    /**
-     * Require the applicable source identity and target trust permissions.
-     *
-     * The returned Role has passed target lookup and trust authorization and can
-     * therefore be used to create the assumed-role session.
-     */
-    authorize(input: AssumeRoleAuthorizationInput): Promise<AssumeRoleAuthorizedRole>;
-    /**
-     * Whether the target trust policy is sufficient without an identity Allow.
-     *
-     * All three conditions are required:
-     *
-     * - the caller and target Role belong to the same Account;
-     * - the caller is an IAM User rather than a Role, session, or root principal;
-     * - a matching trust statement grants access directly rather than delegating
-     *   authorization to the caller's Account.
-     */
-    private hasDirectSameAccountUserGrant;
-}
-export {};
-//# sourceMappingURL=assume-role-auth-z-coordinator.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role-auth-z-coordinator.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-auth-z-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAIrF,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,KAAK,wBAAwB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAsC;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IAEtE,YAAY,KAAK,EAAE,uCAAuC,EASzD;IAED;;;;;OAKG;IACG,SAAS,CACb,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAmBnC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,6BAA6B;CAYtC"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.js

@@ -1,68 +0,0 @@
-import { AssumeRoleSourcePrincipalAuthorizer } from "./assume-role-src-acc-auth-z.js";
-import { AssumeRoleTargetRoleAuthorizer } from "./assume-role-target-auth-z.js";
-/**
- * Coordinates source identity authorization and target Role trust authorization
- * for an STS AssumeRole request.
- *
- * AssumeRole normally requires both an identity-policy Allow in the caller's
- * Account and a matching trust-policy Allow in the target Role's Account.
- * A directly trusted IAM User in the same Account is an exception: the Role
- * trust policy can grant that User access without a separate identity-policy
- * Allow. Matching explicit identity-policy Deny statements still reject the
- * request.
- *
- * The target trust policy is evaluated first because its matching grant must be
- * classified before the source authorization requirement can be selected.
- */
-export class AssumeRoleAuthorizationCoordinator {
-    sourceAccountId;
-    sourcePrincipalAuthorizer;
-    targetRoleAuthorizer;
-    constructor(props) {
-        this.sourceAccountId = props.sourceAccountId;
-        this.sourcePrincipalAuthorizer = new AssumeRoleSourcePrincipalAuthorizer({
-            sourceAccountId: props.sourceAccountId,
-            iamResolver: props.iamResolver,
-        });
-        this.targetRoleAuthorizer = new AssumeRoleTargetRoleAuthorizer({
-            iamResolver: props.iamResolver,
-        });
-    }
-    /**
-     * Require the applicable source identity and target trust permissions.
-     *
-     * The returned Role has passed target lookup and trust authorization and can
-     * therefore be used to create the assumed-role session.
-     */
-    async authorize(input) {
-        const targetAuthorization = await this.targetRoleAuthorizer.authorize({
-            roleArn: input.roleArn,
-            target: input.roleArnParts,
-            caller: input.caller,
-            conditionContext: input.conditionContext,
-        });
-        this.sourcePrincipalAuthorizer.authorize({
-            roleArn: input.roleArn,
-            callerPrincipal: input.caller,
-            identityPolicyAllowRequired: !this.hasDirectSameAccountUserGrant(input.caller, input.roleArnParts.accountId, targetAuthorization.trust.isDirectPrincipalGrant),
-        });
-        return targetAuthorization.role;
-    }
-    /**
-     * Whether the target trust policy is sufficient without an identity Allow.
-     *
-     * All three conditions are required:
-     *
-     * - the caller and target Role belong to the same Account;
-     * - the caller is an IAM User rather than a Role, session, or root principal;
-     * - a matching trust statement grants access directly rather than delegating
-     *   authorization to the caller's Account.
-     */
-    hasDirectSameAccountUserGrant(caller, targetAccountId, isDirectPrincipalGrant) {
-        return (targetAccountId === this.sourceAccountId &&
-            caller.kind === "arn" &&
-            caller.arn.startsWith(`arn:aws:iam::${this.sourceAccountId}:user/`) &&
-            isDirectPrincipalGrant);
-    }
-}
-//# sourceMappingURL=assume-role-auth-z-coordinator.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role-auth-z-coordinator.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-auth-z-coordinator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAiBhF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kCAAkC;IAC5B,eAAe,CAAkB;IACjC,yBAAyB,CAAsC;IAC/D,oBAAoB,CAAiC;IAEtE,YAAY,KAA8C;QACxD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,yBAAyB,GAAG,IAAI,mCAAmC,CAAC;YACvE,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,GAAG,IAAI,8BAA8B,CAAC;YAC7D,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,KAAmC;QAEnC,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;YACpE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,MAAM;YAC7B,2BAA2B,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAC9D,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,YAAY,CAAC,SAAS,EAC5B,mBAAmB,CAAC,KAAK,CAAC,sBAAsB,CACjD;SACF,CAAC,CAAC;QAEH,OAAO,mBAAmB,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;;;;;;;;OASG;IACK,6BAA6B,CACnC,MAAuB,EACvB,eAAgC,EAChC,sBAA+B;QAE/B,OAAO,CACL,eAAe,KAAK,IAAI,CAAC,eAAe;YACxC,MAAM,CAAC,IAAI,KAAK,KAAK;YACrB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,IAAI,CAAC,eAAe,QAAQ,CAAC;YACnE,sBAAsB,CACvB,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.d.ts

@@ -1,45 +0,0 @@
-import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
-import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
-interface AssumeRoleSourceAccountAuthorizerProps {
-    readonly sourceAccountId: SimAwsAccountId;
-    readonly iamResolver: SimIamAccountResolver;
-}
-export interface AssumeRoleSourceAuthorizationInput {
-    readonly roleArn: string;
-    readonly callerPrincipal?: SimAwsPrincipal | undefined;
-    /**
-     * Whether the caller must have an identity-policy Allow for sts:AssumeRole.
-     *
-     * This is false when a same-account Role trust policy grants permission
-     * directly to an IAM User. Explicit identity-policy denies always apply.
-     */
-    readonly identityPolicyAllowRequired?: boolean | undefined;
-}
-/**
- * Authorizes the caller's request to assume a role against IAM in the source
- * Account.
- *
- * This class owns only the identity-side authorization performed by the
- * caller's Account. It resolves that Account's simulated IAM facade and
- * evaluates `sts:AssumeRole` against the target role ARN. Target-account role
- * trust authorization is a separate responsibility and must be performed even
- * when the source and target Account are the same.
- *
- * When no caller principal is supplied, Sim IAM applies its normal default
- * caller behavior for the source Account.
- */
-export declare class AssumeRoleSourcePrincipalAuthorizer {
-    private readonly sourceAccountId;
-    private readonly iamResolver;
-    constructor(props: AssumeRoleSourceAccountAuthorizerProps);
-    /**
-     * Require the source Account to allow the caller to assume the target role.
-     *
-     * Throws when source IAM is unavailable or its policy decision denies the
-     * request.
-     */
-    authorize(input: AssumeRoleSourceAuthorizationInput): void;
-}
-export {};
-//# sourceMappingURL=assume-role-src-acc-auth-z.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role-src-acc-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-src-acc-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAI1E,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAEvD;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,KAAK,EAAE,sCAAsC,EAGxD;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,kCAAkC,GAAG,IAAI,CAsBzD;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.js

@@ -1,48 +0,0 @@
-import { makeSimAwsAccountRootPrincipal } from "../../aws/caller/sim-aws-account-root-principal.js";
-import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
-/**
- * Authorizes the caller's request to assume a role against IAM in the source
- * Account.
- *
- * This class owns only the identity-side authorization performed by the
- * caller's Account. It resolves that Account's simulated IAM facade and
- * evaluates `sts:AssumeRole` against the target role ARN. Target-account role
- * trust authorization is a separate responsibility and must be performed even
- * when the source and target Account are the same.
- *
- * When no caller principal is supplied, Sim IAM applies its normal default
- * caller behavior for the source Account.
- */
-export class AssumeRoleSourcePrincipalAuthorizer {
-    sourceAccountId;
-    iamResolver;
-    constructor(props) {
-        this.sourceAccountId = props.sourceAccountId;
-        this.iamResolver = props.iamResolver;
-    }
-    /**
-     * Require the source Account to allow the caller to assume the target role.
-     *
-     * Throws when source IAM is unavailable or its policy decision denies the
-     * request.
-     */
-    authorize(input) {
-        const sourceIam = this.iamResolver.iamForAccount(this.sourceAccountId);
-        const callerPrincipal = input.callerPrincipal ??
-            makeSimAwsAccountRootPrincipal(this.sourceAccountId);
-        const decision = sourceIam.authorize({
-            action: "sts:AssumeRole",
-            resource: input.roleArn,
-            caller: callerPrincipal,
-        });
-        if (decision.isExplicitDeny ||
-            (decision.isImplicitDeny && Boolean(input.identityPolicyAllowRequired))) {
-            throw new SimIamAccessDenied({
-                principal: callerPrincipal,
-                action: "sts:AssumeRole",
-                resource: input.roleArn,
-            });
-        }
-    }
-}
-//# sourceMappingURL=assume-role-src-acc-auth-z.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-src-acc-auth-z.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role-src-acc-auth-z.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-src-acc-auth-z.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAoBtE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mCAAmC;IAC7B,eAAe,CAAkB;IACjC,WAAW,CAAwB;IAEpD,YAAY,KAA6C;QACvD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAyC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,eAAe,GACnB,KAAK,CAAC,eAAe;YACrB,8BAA8B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;YACnC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;QAEH,IACE,QAAQ,CAAC,cAAc;YACvB,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.d.ts

@@ -1,48 +0,0 @@
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
-import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
-import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
-import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
-import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
-import { type AssumeRoleTrustPolicyAuthorization } from "./assume-role-trust-policy-authorizer.js";
-interface AssumeRoleTargetRoleAuthorizerProps {
-    readonly iamResolver: SimIamAccountResolver;
-}
-type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
-interface AssumeRoleTargetAuthorizationInput {
-    readonly roleArn: string;
-    readonly target: IamRoleArnParts | SimAwsAccountId;
-    readonly caller: SimAwsPrincipal;
-    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
-}
-interface AssumeRoleTargetAuthorization {
-    readonly role: AssumeRoleTargetRole;
-    readonly trust: AssumeRoleTrustPolicyAuthorization;
-}
-/**
- * Resolves the target of an AssumeRole request and coordinates authorization.
- *
- * This class owns the account and Role lookup workflow. Target ARN parsing and
- * consistency checks belong to `AssumeRoleTargetResolver`, while trust-policy
- * parsing and evaluation belong to `AssumeRoleTrustPolicyAuthorizer`.
- *
- * Separating these steps prevents target lookup rules from becoming coupled to
- * IAM policy evaluation rules.
- */
-export declare class AssumeRoleTargetRoleAuthorizer {
-    private readonly iamResolver;
-    private readonly targetResolver;
-    private readonly trustPolicyAuthorizer;
-    constructor(props: AssumeRoleTargetRoleAuthorizerProps);
-    /**
-     * Resolve the requested Role, load it from the target account, and require its
-     * trust policy to allow the caller.
-     *
-     * Resolution happens before IAM lookup so the account and Role name used to load
-     * the resource are guaranteed to agree with the ARN being authorized. The loaded
-     * Role is returned for the session-creation stage after authorization succeeds.
-     */
-    authorize(input: AssumeRoleTargetAuthorizationInput): Promise<AssumeRoleTargetAuthorization>;
-}
-export {};
-//# sourceMappingURL=assume-role-target-auth-z.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role-target-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-target-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EACL,KAAK,kCAAkC,EAExC,MAAM,0CAA0C,CAAC;AAElD,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,KAAK,oBAAoB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAE5D,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC;CACpD;AAED;;;;;;;;;GASG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IACjE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CACE;IAExC,YAAY,KAAK,EAAE,mCAAmC,EAErD;IAED;;;;;;;OAOG;IACG,SAAS,CACb,KAAK,EAAE,kCAAkC,GACxC,OAAO,CAAC,6BAA6B,CAAC,CAyBxC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.js

@@ -1,50 +0,0 @@
-import { AssumeRoleTargetResolver } from "./resolve/assume-role-target-resolver.js";
-import { AssumeRoleTrustPolicyAuthorizer, } from "./assume-role-trust-policy-authorizer.js";
-/**
- * Resolves the target of an AssumeRole request and coordinates authorization.
- *
- * This class owns the account and Role lookup workflow. Target ARN parsing and
- * consistency checks belong to `AssumeRoleTargetResolver`, while trust-policy
- * parsing and evaluation belong to `AssumeRoleTrustPolicyAuthorizer`.
- *
- * Separating these steps prevents target lookup rules from becoming coupled to
- * IAM policy evaluation rules.
- */
-export class AssumeRoleTargetRoleAuthorizer {
-    iamResolver;
-    targetResolver = new AssumeRoleTargetResolver();
-    trustPolicyAuthorizer = new AssumeRoleTrustPolicyAuthorizer();
-    constructor(props) {
-        this.iamResolver = props.iamResolver;
-    }
-    /**
-     * Resolve the requested Role, load it from the target account, and require its
-     * trust policy to allow the caller.
-     *
-     * Resolution happens before IAM lookup so the account and Role name used to load
-     * the resource are guaranteed to agree with the ARN being authorized. The loaded
-     * Role is returned for the session-creation stage after authorization succeeds.
-     */
-    async authorize(input) {
-        const roleArnParts = this.targetResolver.resolve(input.roleArn, input.target);
-        const targetIam = this.iamResolver.iamForAccount(roleArnParts.accountId);
-        const getRoleOutput = await targetIam.getRole({
-            input: {
-                RoleName: roleArnParts.roleName,
-            },
-        });
-        const role = getRoleOutput.Role;
-        const trust = this.trustPolicyAuthorizer.authorize({
-            roleArn: input.roleArn,
-            role,
-            targetIam,
-            caller: input.caller,
-            conditionContext: input.conditionContext,
-        });
-        return {
-            role,
-            trust,
-        };
-    }
-}
-//# sourceMappingURL=assume-role-target-auth-z.js.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-target-auth-z.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role-target-auth-z.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-target-auth-z.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAEL,+BAA+B,GAChC,MAAM,0CAA0C,CAAC;AAqBlD;;;;;;;;;GASG;AACH,MAAM,OAAO,8BAA8B;IACxB,WAAW,CAAwB;IACnC,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAChD,qBAAqB,GACpC,IAAI,+BAA+B,EAAE,CAAC;IAExC,YAAY,KAA0C;QACpD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,KAAyC;QAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAC9C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CACb,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE;gBACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;YACjD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI;YACJ,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/sts/command/assume-role/assume-role.handler.d.ts

@@ -1,40 +0,0 @@
-import type { CommandHandler } from "../../../../command/command-handler.js";
-import type { SimIamAccountResolver } from "../../../iam/registry/sim-iam-account-resolver.js";
-import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./assume-role.cmd.js";
-import { type BackgroundScheduler } from "../../../../util/background/background.js";
-import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
-import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
-interface AssumeRoleCommandHandlerProps {
-    readonly sourceAccountId: SimAwsAccountId;
-    readonly iamResolver: SimIamAccountResolver;
-    readonly background?: BackgroundScheduler;
-}
-/**
- * STS AssumeRoleCommand handler.
- *
- * Resolves the source caller and target Role, authorizes the caller's identity
- * policies and the Role trust policy, then delegates temporary session creation
- * and response mapping to `AssumeRoleSessionCreator`.
- *
- * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/AssumeRoleCommand/
- */
-export declare class AssumeRoleCommandHandler implements CommandHandler<SimAssumeRoleCommand, SimAssumeRoleCommandOutput> {
-    private readonly background;
-    private readonly callerResolver;
-    private readonly requestParser;
-    private readonly authorizationCoordinator;
-    private readonly sessionCreator;
-    private readonly sourceAccountId;
-    constructor(props: AssumeRoleCommandHandlerProps);
-    /**
-     * Handle an AssumeRoleCommand from the SDK.
-     *
-     * The request parser validates and normalizes SDK input before this method
-     * coordinates authorization and temporary session creation.
-     */
-    handle(cmd: SimAssumeRoleCommand, opts?: {
-        caller?: SimAwsPrincipal;
-    }): Promise<SimAssumeRoleCommandOutput>;
-}
-export {};
-//# sourceMappingURL=assume-role.handler.d.ts.map

package/dist/dist-hidden/service/sts/command/assume-role/assume-role.handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/sts/command/assume-role/assume-role.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAG7E,UAAU,6BAA6B;IACrC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,YAAW,cAAc,CAC7D,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAqC;IAC9E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAElD,YAAY,KAAK,EAAE,6BAA6B,EAgB/C;IAED;;;;;OAKG;IACG,MAAM,CACV,GAAG,EAAE,oBAAoB,EACzB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GACA,OAAO,CAAC,0BAA0B,CAAC,CAgCrC;CACF"}

package/dist/dist-hidden/service/sts/command/assume-role/assume-role.handler.js

@@ -1,69 +0,0 @@
-import { BackgroundTasks, } from "../../../../util/background/background.js";
-import { makeSimAwsAccountRootPrincipal } from "../../../aws/caller/sim-aws-account-root-principal.js";
-import { SimStsAssumeRoleSessionCreator } from "../../assume/sim-sts-assume-role-session-creator.js";
-import { SimStsAssumeRoleRequestParser } from "../../assume/sim-sts-assume-role-request-parser.js";
-import { SimAwsCallerResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
-import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
-import { AssumeRoleAuthorizationCoordinator } from "../../auth-z/assume-role-auth-z-coordinator.js";
-/**
- * STS AssumeRoleCommand handler.
- *
- * Resolves the source caller and target Role, authorizes the caller's identity
- * policies and the Role trust policy, then delegates temporary session creation
- * and response mapping to `AssumeRoleSessionCreator`.
- *
- * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/AssumeRoleCommand/
- */
-export class AssumeRoleCommandHandler {
-    background;
-    callerResolver = new SimAwsCallerResolver();
-    requestParser = new SimStsAssumeRoleRequestParser();
-    authorizationCoordinator;
-    sessionCreator;
-    sourceAccountId;
-    constructor(props) {
-        const { sourceAccountId, iamResolver, background = new BackgroundTasks(), } = props;
-        this.sourceAccountId = sourceAccountId;
-        this.background = background;
-        this.authorizationCoordinator = new AssumeRoleAuthorizationCoordinator({
-            sourceAccountId,
-            iamResolver,
-        });
-        this.sessionCreator = new SimStsAssumeRoleSessionCreator({
-            iamResolver,
-        });
-    }
-    /**
-     * Handle an AssumeRoleCommand from the SDK.
-     *
-     * The request parser validates and normalizes SDK input before this method
-     * coordinates authorization and temporary session creation.
-     */
-    async handle(cmd, opts) {
-        const request = this.requestParser.parse(cmd);
-        const caller = this.callerResolver.resolve(opts?.caller, makeSimAwsAccountRootPrincipal(this.sourceAccountId));
-        // Allow for potential non-deterministic sequencing of async events.
-        await this.background.sequence();
-        if (caller.principal.kind !== "arn") {
-            throw new SimIamAccessDenied({
-                principal: caller.principal,
-                action: "sts:AssumeRole",
-                resource: request.roleArn,
-            });
-        }
-        const role = await this.authorizationCoordinator.authorize({
-            roleArn: request.roleArn,
-            roleArnParts: request.roleArnParts,
-            caller: caller.principal,
-            conditionContext: request.conditionContext,
-        });
-        return this.sessionCreator.create({
-            roleArnParts: request.roleArnParts,
-            role,
-            roleSessionName: request.roleSessionName,
-            sourcePrincipal: caller.principal,
-            durationSeconds: request.durationSeconds,
-        });
-    }
-}
-//# sourceMappingURL=assume-role.handler.js.map

package/dist/dist-hidden/service/sts/command/assume-role/assume-role.handler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role.handler.js","sourceRoot":"","sources":["../../../../../src/service/sts/command/assume-role/assume-role.handler.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,qDAAqD,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAQpG;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAIlB,UAAU,CAAsB;IAChC,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC5C,aAAa,GAAG,IAAI,6BAA6B,EAAE,CAAC;IACpD,wBAAwB,CAAqC;IAC7D,cAAc,CAAiC;IAC/C,eAAe,CAAkB;IAElD,YAAY,KAAoC;QAC9C,MAAM,EACJ,eAAe,EACf,WAAW,EACX,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,wBAAwB,GAAG,IAAI,kCAAkC,CAAC;YACrE,eAAe;YACf,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,8BAA8B,CAAC;YACvD,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,GAAyB,EACzB,IAEC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CACxC,IAAI,EAAE,MAAM,EACZ,8BAA8B,CAAC,IAAI,CAAC,eAAe,CAAC,CACrD,CAAC;QAEF,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC;YACzD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,IAAI;YACJ,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,eAAe,EAAE,MAAM,CAAC,SAAS;YACjC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/dist-hidden/service/sts/sim-sts.d.ts

@@ -1,31 +0,0 @@
-import { type BackgroundScheduler } from "../../util/background/background.js";
-import type { SimIamAccountResolver } from "../iam/registry/sim-iam-account-resolver.js";
-import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./command/assume-role/assume-role.cmd.js";
-import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import type { SimAwsPrincipal } from "../aws/caller/sim-aws-caller.js";
-interface SimStsProps {
-    readonly accountRegionScope?: SimAwsAccountRegionScope;
-    readonly iamResolver?: SimIamAccountResolver;
-    readonly background?: BackgroundScheduler;
-}
-/**
- * Simulated AWS Security Token Service.
- *
- * STS is constructed from an Account/Region scope for consistency with other
- * simulated services. AssumeRole resolves IAM for both the source Account and
- * the target role's Account through the simulation-wide IAM registry.
- */
-export declare class SimSts {
-    private readonly accountRegionScope;
-    private readonly background;
-    private readonly iamResolver;
-    constructor(props?: SimStsProps);
-    /**
-     * Handle an AssumeRoleCommand from the SDK.
-     */
-    assumeRole(cmd: SimAssumeRoleCommand, opts?: {
-        caller?: SimAwsPrincipal;
-    }): Promise<SimAssumeRoleCommandOutput>;
-}
-export {};
-//# sourceMappingURL=sim-sts.d.ts.map

package/dist/dist-hidden/service/sts/sim-sts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-sts.d.ts","sourceRoot":"","sources":["../../../src/service/sts/sim-sts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,UAAU,WAAW;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,KAAK,GAAE,WAAgB,EAKlC;IAED;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,oBAAoB,EACzB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GACA,OAAO,CAAC,0BAA0B,CAAC,CAOrC;CACF"}

package/dist/dist-hidden/service/sts/sim-sts.js

@@ -1,34 +0,0 @@
-import { BackgroundTasks, } from "../../util/background/background.js";
-import { AssumeRoleCommandHandler } from "./command/assume-role/assume-role.handler.js";
-import { SimIamRegistry } from "../iam/registry/sim-iam-registry.js";
-import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-/**
- * Simulated AWS Security Token Service.
- *
- * STS is constructed from an Account/Region scope for consistency with other
- * simulated services. AssumeRole resolves IAM for both the source Account and
- * the target role's Account through the simulation-wide IAM registry.
- */
-export class SimSts {
-    accountRegionScope;
-    background;
-    iamResolver;
-    constructor(props = {}) {
-        this.accountRegionScope =
-            props.accountRegionScope ?? simAwsAccountRegionScopeFactory.make();
-        this.iamResolver = props.iamResolver ?? new SimIamRegistry();
-        this.background = props.background ?? new BackgroundTasks();
-    }
-    /**
-     * Handle an AssumeRoleCommand from the SDK.
-     */
-    async assumeRole(cmd, opts) {
-        const handler = new AssumeRoleCommandHandler({
-            sourceAccountId: this.accountRegionScope.accountId,
-            iamResolver: this.iamResolver,
-            background: this.background,
-        });
-        return await handler.handle(cmd, opts);
-    }
-}
-//# sourceMappingURL=sim-sts.js.map

package/dist/dist-hidden/service/sts/sim-sts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-sts.js","sourceRoot":"","sources":["../../../src/service/sts/sim-sts.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAM7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AASjG;;;;;;GAMG;AACH,MAAM,OAAO,MAAM;IACA,kBAAkB,CAA2B;IAC7C,UAAU,CAAsB;IAChC,WAAW,CAAwB;IAEpD,YAAY,KAAK,GAAgB,EAAE;QACjC,IAAI,CAAC,kBAAkB;YACrB,KAAK,CAAC,kBAAkB,IAAI,+BAA+B,CAAC,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,cAAc,EAAE,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,eAAe,EAAE,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,GAAyB,EACzB,IAEC;QAED,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC3C,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS;YAClD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}