@kensio/yulin 0.34.0 → 0.35.0

package/dist/dist-hidden/service/s3/storage/s3-filesystem-storage.js

@@ -1,301 +0,0 @@
-import { SimS3Object, SimS3ObjectMetadata } from "../object/s3-object.js";
-import path from "node:path";
-import { homedir } from "node:os";
-import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
-/**
- * Maps simulated S3 Objects to files under a directory.
- * This is useful for local development, such as serving a static website
- * locally out of simulated S3.
- * This class has some simple checks to reduce the risk of reading or writing
- * files that might be unsafe, but it cannot completely protect against all
- * potential safety issues.
- */
-export class FilesystemS3BucketStorage {
-    directoryPath;
-    allowedDirectoryNames;
-    constructor(props) {
-        const { allowedDirectoryNames = defaultAllowedDirectoryNames } = props;
-        this.allowedDirectoryNames = allowedDirectoryNames;
-        this.assertSafeDirectoryPath(props.directoryPath);
-        this.directoryPath = path.resolve(props.directoryPath);
-    }
-    /**
-     * Get a simulated Object from a file in the directory.
-     */
-    async getObject(key) {
-        if (!this.isAllowedObjectKeyExtension(key)) {
-            this.assertSafeObjectKeyPath(key);
-            return undefined;
-        }
-        const filePath = this.filePathForObjectKey(key);
-        try {
-            // eslint-disable-next-line security/detect-non-literal-fs-filename
-            const body = await readFile(filePath);
-            return new SimS3Object({
-                key,
-                body,
-                metadata: this.metadataForObjectKey(key),
-            });
-        }
-        catch (error) {
-            if (error instanceof Error &&
-                "code" in error &&
-                error.code === "ENOENT") {
-                return undefined;
-            }
-            /* v8 ignore next */
-            throw error;
-        }
-    }
-    /**
-     * List simulated Objects based on files in the directory.
-     */
-    async listObjects(prefix) {
-        const objectKeys = await this.listObjectKeys();
-        return await Promise.all(objectKeys
-            .filter((key) => prefix === undefined || key.startsWith(prefix))
-            .map(async (key) => {
-            const object = await this.getObject(key);
-            /* v8 ignore next -- defensive guard for filesystem race */
-            if (object === undefined) {
-                throw new Error(`Object listed but not found: ${key}`);
-            }
-            return object;
-        }));
-    }
-    /**
-     * Store a simulated Object as a file in the directory.
-     */
-    async putObject(object) {
-        const filePath = this.filePathForObjectKey(object.key);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        await mkdir(path.dirname(filePath), { recursive: true });
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        await writeFile(filePath, object.body);
-    }
-    /**
-     * Is it OK to change to a different storage implementation?
-     * For now, we're assuming that a user should not need to change from a
-     * filesystem storage at runtime, so this is always false.
-     */
-    allowChangeStorage() {
-        return false;
-    }
-    filePathForObjectKey(key) {
-        this.assertSafeObjectKey(key);
-        const filePath = path.resolve(this.directoryPath, key);
-        /* v8 ignore if -- defensive guard after object key validation */
-        if (filePath !== this.directoryPath &&
-            !filePath.startsWith(`${this.directoryPath}${path.sep}`)) {
-            throw new Error(`Invalid S3 Object key outside storage directory: ${key}`);
-        }
-        return filePath;
-    }
-    async listObjectKeys() {
-        try {
-            // eslint-disable-next-line security/detect-non-literal-fs-filename
-            await stat(this.directoryPath);
-        }
-        catch (error) {
-            if (error instanceof Error &&
-                "code" in error &&
-                error.code === "ENOENT") {
-                return [];
-            }
-            /* v8 ignore next */
-            throw error;
-        }
-        return await this.listObjectKeysInDirectory(this.directoryPath);
-    }
-    async listObjectKeysInDirectory(directoryPath) {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        const entries = await readdir(directoryPath, { withFileTypes: true });
-        const keys = [];
-        const nestedKeyPromises = [];
-        for (const entry of entries) {
-            const entryPath = path.join(directoryPath, entry.name);
-            if (entry.isDirectory()) {
-                nestedKeyPromises.push(this.listObjectKeysInDirectory(entryPath));
-                continue;
-            }
-            if (entry.isFile()) {
-                const key = path
-                    .relative(this.directoryPath, entryPath)
-                    .split(path.sep)
-                    .join("/");
-                if (this.isAllowedObjectKeyExtension(key)) {
-                    keys.push(key);
-                }
-            }
-        }
-        const nestedKeys = await Promise.all(nestedKeyPromises);
-        return [...keys, ...nestedKeys.flat()];
-    }
-    /**
-     * Make up reasonable metadata for an Object based on the file on disk.
-     */
-    metadataForObjectKey(key) {
-        const contentType = this.contentTypeForObjectKey(key);
-        /* v8 ignore if -- defensive fallback */
-        if (contentType === undefined) {
-            return new SimS3ObjectMetadata();
-        }
-        return new SimS3ObjectMetadata({
-            "content-type": contentType,
-        });
-    }
-    /**
-     * Guess a reasonable content type for an Object key based on its file
-     * extension on disk.
-     */
-    contentTypeForObjectKey(key) {
-        const extension = path.extname(key).toLowerCase();
-        switch (extension) {
-            case ".css": {
-                return "text/css";
-            }
-            case ".eot": {
-                return "application/vnd.ms-fontobject";
-            }
-            case ".gif": {
-                return "image/gif";
-            }
-            case ".html":
-            case ".htm": {
-                return "text/html";
-            }
-            case ".ico": {
-                return "image/x-icon";
-            }
-            case ".jpeg":
-            case ".jpg": {
-                return "image/jpeg";
-            }
-            case ".js":
-            case ".mjs": {
-                return "text/javascript";
-            }
-            case ".json": {
-                return "application/json";
-            }
-            case ".map": {
-                return "application/json";
-            }
-            case ".png": {
-                return "image/png";
-            }
-            case ".otf": {
-                return "font/otf";
-            }
-            case ".svg": {
-                return "image/svg+xml";
-            }
-            case ".ttc": {
-                return "font/collection";
-            }
-            case ".ttf": {
-                return "font/ttf";
-            }
-            case ".txt": {
-                return "text/plain";
-            }
-            case ".webp": {
-                return "image/webp";
-            }
-            case ".woff": {
-                return "font/woff";
-            }
-            case ".woff2": {
-                return "font/woff2";
-            }
-            case ".xml": {
-                return "application/xml";
-            }
-            default: {
-                /* v8 ignore next */
-                return undefined;
-            }
-        }
-    }
-    assertSafeDirectoryPath(directoryPath) {
-        if (!path.isAbsolute(directoryPath)) {
-            throw new Error(`Filesystem S3 storage directory path must be absolute: ${directoryPath}`);
-        }
-        if (this.pathContainsParentDirectorySegment(directoryPath)) {
-            throw new Error(`Filesystem S3 storage directory path must not contain '..': ${directoryPath}`);
-        }
-        const resolvedDirectoryPath = path.resolve(directoryPath);
-        const parsedDirectoryPath = path.parse(resolvedDirectoryPath);
-        if (resolvedDirectoryPath === parsedDirectoryPath.root) {
-            throw new Error(`Filesystem S3 storage directory path must not be a filesystem root: ${directoryPath}`);
-        }
-        if (resolvedDirectoryPath === path.resolve(homedir())) {
-            throw new Error(`Filesystem S3 storage directory path must not be the user home directory: ${directoryPath}`);
-        }
-        const directoryName = path.basename(resolvedDirectoryPath);
-        if (!this.allowedDirectoryNames.includes(directoryName)) {
-            throw new Error(`Filesystem S3 storage directory name must be one of: ${this.allowedDirectoryNames.join(", ")}. Got: ${directoryName}`);
-        }
-    }
-    assertSafeObjectKey(key) {
-        this.assertSafeObjectKeyPath(key);
-        if (!this.isAllowedObjectKeyExtension(key)) {
-            throw new Error(`S3 Object key has unsupported file extension: ${key}`);
-        }
-    }
-    assertSafeObjectKeyPath(key) {
-        if (path.isAbsolute(key)) {
-            throw new Error(`S3 Object key must not be an absolute path: ${key}`);
-        }
-        if (this.pathContainsParentDirectorySegment(key)) {
-            throw new Error(`S3 Object key must not contain '..': ${key}`);
-        }
-    }
-    pathContainsParentDirectorySegment(value) {
-        return value.split(/[\\/]/u).includes("..");
-    }
-    isAllowedObjectKeyExtension(key) {
-        return allowedObjectFileExtensions.has(path.extname(key).toLowerCase());
-    }
-}
-/**
- * Default directory names that are safe to use as filesystem storage roots.
- */
-const defaultAllowedDirectoryNames = [
-    "assets",
-    "build",
-    "dist",
-    "out",
-    "public",
-    "static",
-    "www",
-];
-/**
- * Cautious list of allowed file extensions for simulated S3 objects. This is to
- * try and avoid reading or writing other files that might be unsafe.
- */
-const allowedObjectFileExtensions = new Set([
-    ".css",
-    ".eot",
-    ".gif",
-    ".htm",
-    ".html",
-    ".ico",
-    ".jpeg",
-    ".jpg",
-    ".js",
-    ".json",
-    ".map",
-    ".mjs",
-    ".otf",
-    ".png",
-    ".svg",
-    ".ttc",
-    ".ttf",
-    ".txt",
-    ".webp",
-    ".woff",
-    ".woff2",
-    ".xml",
-]);
-//# sourceMappingURL=s3-filesystem-storage.js.map

package/dist/dist-hidden/service/s3/storage/s3-filesystem-storage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"s3-filesystem-storage.js","sourceRoot":"","sources":["../../../../src/service/s3/storage/s3-filesystem-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAO7E;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,aAAa,CAAS;IACtB,qBAAqB,CAAoB;IAE1D,YAAY,KAAqC;QAC/C,MAAM,EAAE,qBAAqB,GAAG,4BAA4B,EAAE,GAAG,KAAK,CAAC;QACvE,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,IAAI,WAAW,CAAC;gBACrB,GAAG;gBACH,IAAI;gBACJ,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,KAAK;gBACtB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,oBAAoB;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAe;QAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE/C,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,UAAU;aACP,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aAC/D,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAEzC,2DAA2D;YAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEvD,mEAAmE;QACnE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,mEAAmE;QACnE,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,GAAW;QACtC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAEvD,iEAAiE;QACjE,IACE,QAAQ,KAAK,IAAI,CAAC,aAAa;YAC/B,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,EAAE,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,KAAK;gBACtB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,oBAAoB;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,aAAqB;QAErB,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAwB,EAAE,CAAC;QAElD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAEvD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;gBAClE,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,IAAI;qBACb,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;qBACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;qBACf,IAAI,CAAC,GAAG,CAAC,CAAC;gBAEb,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,GAAW;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAEtD,wCAAwC;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,mBAAmB,EAAE,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC;YAC7B,cAAc,EAAE,WAAW;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,GAAW;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAElD,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,+BAA+B,CAAC;YACzC,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,KAAK,OAAO,CAAC;YACb,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,KAAK,OAAO,CAAC;YACb,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,KAAK,KAAK,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,eAAe,CAAC;YACzB,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,oBAAoB;gBACpB,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,uBAAuB,CAAC,aAAqB;QACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,0DAA0D,aAAa,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,kCAAkC,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,+DAA+D,aAAa,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE9D,IAAI,qBAAqB,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,uEAAuE,aAAa,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,IAAI,qBAAqB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,6EAA6E,aAAa,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAE3D,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,wDAAwD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CACrF,IAAI,CACL,UAAU,aAAa,EAAE,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,GAAW;QACrC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,uBAAuB,CAAC,GAAW;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,kCAAkC,CAAC,KAAa;QACtD,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEO,2BAA2B,CAAC,GAAW;QAC7C,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;CACF;AAYD;;GAEG;AACH,MAAM,4BAA4B,GAAG;IACnC,QAAQ;IACR,OAAO;IACP,MAAM;IACN,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,KAAK;CACG,CAAC;AAEX;;;GAGG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;CACP,CAAC,CAAC"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.d.ts

@@ -1,57 +0,0 @@
-import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
-import { IamRoleArnParser, type IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
-import type { SimAssumeRoleCommand } from "../command/assume-role/assume-role.cmd.js";
-export interface ParsedAssumeRoleRequest {
-    readonly roleArn: string;
-    readonly roleArnParts: IamRoleArnParts;
-    readonly roleSessionName: string;
-    readonly durationSeconds: number;
-    readonly conditionContext: Readonly<Record<string, SimIamConditionValue>> | undefined;
-}
-/**
- * Validates and normalizes an STS AssumeRole command.
- *
- * SDK command fields are optional at the TypeScript boundary because the AWS
- * SDK validates required values at runtime. The rest of the simulated STS flow
- * should not need to repeat those checks or work with optional values.
- *
- * This parser converts the command into a request with:
- *
- * - required Role ARN and session name values;
- * - parsed Role ARN parts used for target-account lookup;
- * - a positive duration with the STS default applied when omitted;
- * - IAM condition context derived from AssumeRole-specific command fields.
- *
- * Authorization and session creation consume the normalized request and remain
- * independent of SDK input validation details.
- */
-export declare class SimStsAssumeRoleRequestParser {
-    private readonly roleArnParser;
-    constructor(roleArnParser?: IamRoleArnParser);
-    /**
-     * Parse one AssumeRole command into the values used by authorization and
-     * temporary session creation.
-     *
-     * Parsing fails before any authorization or session state changes occur. This
-     * keeps malformed requests from reaching policy evaluation or IAM registries.
-     */
-    parse(cmd: SimAssumeRoleCommand): ParsedAssumeRoleRequest;
-    /**
-     * Apply the default session duration and reject invalid explicit values.
-     *
-     * Session duration is represented in whole seconds. Zero, negative numbers,
-     * fractional values, NaN, and infinities are rejected because they cannot
-     * describe a valid credential lifetime.
-     */
-    private durationSeconds;
-    /**
-     * Convert AssumeRole-specific request fields into IAM condition values.
-     *
-     * ExternalId participates in trust-policy authorization through the
-     * `sts:ExternalId` condition key. An omitted ExternalId produces no condition
-     * entry, allowing the IAM matcher to treat policies requiring that key as
-     * non-matching.
-     */
-    private conditionContext;
-}
-//# sourceMappingURL=sim-sts-assume-role-request-parser.d.ts.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-sts-assume-role-request-parser.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-request-parser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,KAAK,eAAe,EACrB,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAItF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,6BAA6B;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAA1C,YAA6B,aAAa,mBAAyB,EAAI;IAEvE;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,oBAAoB,GAAG,uBAAuB,CAmBxD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAWvB;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;CAWzB"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.js

@@ -1,79 +0,0 @@
-import { assertDefined } from "../../../util/type-guard/defined.js";
-import { IamRoleArnParser, } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
-const defaultRoleSessionDurationSeconds = 3600;
-/**
- * Validates and normalizes an STS AssumeRole command.
- *
- * SDK command fields are optional at the TypeScript boundary because the AWS
- * SDK validates required values at runtime. The rest of the simulated STS flow
- * should not need to repeat those checks or work with optional values.
- *
- * This parser converts the command into a request with:
- *
- * - required Role ARN and session name values;
- * - parsed Role ARN parts used for target-account lookup;
- * - a positive duration with the STS default applied when omitted;
- * - IAM condition context derived from AssumeRole-specific command fields.
- *
- * Authorization and session creation consume the normalized request and remain
- * independent of SDK input validation details.
- */
-export class SimStsAssumeRoleRequestParser {
-    roleArnParser;
-    constructor(roleArnParser = new IamRoleArnParser()) {
-        this.roleArnParser = roleArnParser;
-    }
-    /**
-     * Parse one AssumeRole command into the values used by authorization and
-     * temporary session creation.
-     *
-     * Parsing fails before any authorization or session state changes occur. This
-     * keeps malformed requests from reaching policy evaluation or IAM registries.
-     */
-    parse(cmd) {
-        const roleArn = cmd.input.RoleArn;
-        assertDefined(roleArn, "STS AssumeRole RoleArn is required");
-        const roleSessionName = cmd.input.RoleSessionName;
-        assertDefined(roleSessionName, "STS AssumeRole RoleSessionName is required");
-        const durationSeconds = this.durationSeconds(cmd.input.DurationSeconds);
-        return {
-            roleArn,
-            roleArnParts: this.roleArnParser.parse(roleArn),
-            roleSessionName,
-            durationSeconds,
-            conditionContext: this.conditionContext(cmd.input.ExternalId),
-        };
-    }
-    /**
-     * Apply the default session duration and reject invalid explicit values.
-     *
-     * Session duration is represented in whole seconds. Zero, negative numbers,
-     * fractional values, NaN, and infinities are rejected because they cannot
-     * describe a valid credential lifetime.
-     */
-    durationSeconds(value) {
-        const durationSeconds = value ?? defaultRoleSessionDurationSeconds;
-        /* v8 ignore if */
-        if (!Number.isSafeInteger(durationSeconds) || durationSeconds <= 0) {
-            throw new Error("DurationSeconds must be a positive integer");
-        }
-        return durationSeconds;
-    }
-    /**
-     * Convert AssumeRole-specific request fields into IAM condition values.
-     *
-     * ExternalId participates in trust-policy authorization through the
-     * `sts:ExternalId` condition key. An omitted ExternalId produces no condition
-     * entry, allowing the IAM matcher to treat policies requiring that key as
-     * non-matching.
-     */
-    conditionContext(externalId) {
-        if (externalId === undefined) {
-            return undefined;
-        }
-        return {
-            "sts:ExternalId": externalId,
-        };
-    }
-}
-//# sourceMappingURL=sim-sts-assume-role-request-parser.js.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-request-parser.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-sts-assume-role-request-parser.js","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-request-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACL,gBAAgB,GAEjB,MAAM,+CAA+C,CAAC;AAGvD,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAW/C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,6BAA6B;IACX,aAAa;IAA1C,YAA6B,aAAa,GAAG,IAAI,gBAAgB,EAAE;6BAAtC,aAAa;IAA4B,CAAC;IAEvE;;;;;;OAMG;IACH,KAAK,CAAC,GAAyB;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAClC,aAAa,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;QAE7D,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;QAClD,aAAa,CACX,eAAe,EACf,4CAA4C,CAC7C,CAAC;QAEF,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAExE,OAAO;YACL,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/C,eAAe;YACf,eAAe;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,KAAyB;QAC/C,MAAM,eAAe,GAAG,KAAK,IAAI,iCAAiC,CAAC;QAEnE,kBAAkB;QAClB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CACtB,UAA8B;QAE9B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,gBAAgB,EAAE,UAAU;SAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.d.ts

@@ -1,52 +0,0 @@
-import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
-import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
-import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
-import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
-import type { SimAssumeRoleCommandOutput } from "../command/assume-role/assume-role.cmd.js";
-interface AssumeRoleSessionCreatorProps {
-    readonly iamResolver: SimIamAccountResolver;
-}
-interface CreateAssumeRoleSessionInput {
-    readonly roleArnParts: IamRoleArnParts;
-    readonly role: SimGetRoleCommandOutput["Role"];
-    readonly roleSessionName: string;
-    readonly sourcePrincipal: SimArnPrincipal;
-    readonly durationSeconds: number;
-}
-/**
- * Creates the temporary IAM Role session returned by STS AssumeRole.
- *
- * Authorization must be completed before this class is called. This class does
- * not inspect policies or decide whether the caller may assume the Role. Its
- * responsibility starts after authorization and covers:
- *
- * - resolving the target account's IAM session manager;
- * - calculating the session creation and expiration timestamps;
- * - creating the temporary Role session and its credentials;
- * - mapping internal session data to the public AssumeRole response shape.
- *
- * Keeping these operations together ensures the same expiration timestamp is
- * stored in the session and returned to the SDK caller.
- */
-export declare class SimStsAssumeRoleSessionCreator {
-    private readonly iamResolver;
-    constructor(props: AssumeRoleSessionCreatorProps);
-    /**
-     * Create a temporary session for an authorized AssumeRole request.
-     *
-     * `roleArnParts.accountId` selects the IAM facade that owns the target Role.
-     * The Role name and ID come from the resolved Role, while the session name and
-     * source principal come from the original request context.
-     */
-    create(input: CreateAssumeRoleSessionInput): SimAssumeRoleCommandOutput;
-    /**
-     * Calculate the credential expiration from the session creation time.
-     *
-     * STS durations are expressed in seconds, while JavaScript Date arithmetic
-     * uses milliseconds. Using the supplied creation timestamp as the base keeps
-     * session metadata and returned credential metadata on the same timeline.
-     */
-    private expiration;
-}
-export {};
-//# sourceMappingURL=sim-sts-assume-role-session-creator.d.ts.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-sts-assume-role-session-creator.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-session-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAE5F,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,KAAK,EAAE,6BAA6B,EAE/C;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,4BAA4B,GAAG,0BAA0B,CA4BtE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;CAGnB"}

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.js

@@ -1,64 +0,0 @@
-/**
- * Creates the temporary IAM Role session returned by STS AssumeRole.
- *
- * Authorization must be completed before this class is called. This class does
- * not inspect policies or decide whether the caller may assume the Role. Its
- * responsibility starts after authorization and covers:
- *
- * - resolving the target account's IAM session manager;
- * - calculating the session creation and expiration timestamps;
- * - creating the temporary Role session and its credentials;
- * - mapping internal session data to the public AssumeRole response shape.
- *
- * Keeping these operations together ensures the same expiration timestamp is
- * stored in the session and returned to the SDK caller.
- */
-export class SimStsAssumeRoleSessionCreator {
-    iamResolver;
-    constructor(props) {
-        this.iamResolver = props.iamResolver;
-    }
-    /**
-     * Create a temporary session for an authorized AssumeRole request.
-     *
-     * `roleArnParts.accountId` selects the IAM facade that owns the target Role.
-     * The Role name and ID come from the resolved Role, while the session name and
-     * source principal come from the original request context.
-     */
-    create(input) {
-        const createDate = new Date();
-        const expiration = this.expiration(createDate, input.durationSeconds);
-        const targetIam = this.iamResolver.iamForAccount(input.roleArnParts.accountId);
-        const createdSession = targetIam.sessionManager.createRoleSession({
-            roleName: input.role.RoleName,
-            sessionName: input.roleSessionName,
-            sourcePrincipal: input.sourcePrincipal,
-            createDate,
-            expiration,
-        });
-        return {
-            Credentials: {
-                AccessKeyId: createdSession.credentials.accessKeyId,
-                SecretAccessKey: createdSession.credentials.secretAccessKey,
-                SessionToken: createdSession.credentials.sessionToken,
-                Expiration: expiration,
-            },
-            AssumedRoleUser: {
-                AssumedRoleId: `${input.role.RoleId}:${input.roleSessionName}`,
-                Arn: createdSession.session.principal.arn,
-            },
-            $metadata: {},
-        };
-    }
-    /**
-     * Calculate the credential expiration from the session creation time.
-     *
-     * STS durations are expressed in seconds, while JavaScript Date arithmetic
-     * uses milliseconds. Using the supplied creation timestamp as the base keeps
-     * session metadata and returned credential metadata on the same timeline.
-     */
-    expiration(createDate, durationSeconds) {
-        return new Date(createDate.getTime() + durationSeconds * 1000);
-    }
-}
-//# sourceMappingURL=sim-sts-assume-role-session-creator.js.map

package/dist/dist-hidden/service/sts/assume/sim-sts-assume-role-session-creator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-sts-assume-role-session-creator.js","sourceRoot":"","sources":["../../../../src/service/sts/assume/sim-sts-assume-role-session-creator.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,8BAA8B;IACxB,WAAW,CAAwB;IAEpD,YAAY,KAAoC;QAC9C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAmC;QACxC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAC9C,KAAK,CAAC,YAAY,CAAC,SAAS,CAC7B,CAAC;QAEF,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,iBAAiB,CAAC;YAChE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,WAAW,EAAE,KAAK,CAAC,eAAe;YAClC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU;YACV,UAAU;SACX,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE;gBACX,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,WAAW;gBACnD,eAAe,EAAE,cAAc,CAAC,WAAW,CAAC,eAAe;gBAC3D,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,YAAY;gBACrD,UAAU,EAAE,UAAU;aACvB;YACD,eAAe,EAAE;gBACf,aAAa,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE;gBAC9D,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG;aAC1C;YACD,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,UAAgB,EAAE,eAAuB;QAC1D,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts

@@ -1,57 +0,0 @@
-import type { SimArnPrincipal } from "../../aws/caller/sim-aws-caller.js";
-import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
-import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
-import type { SimIamAccountResolver } from "../../iam/registry/sim-iam-account-resolver.js";
-import type { IamRoleArnParts } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
-interface AssumeRoleAuthorizationCoordinatorProps {
-    readonly sourceAccountId: SimAwsAccountId;
-    readonly iamResolver: SimIamAccountResolver;
-}
-interface AssumeRoleAuthorizationInput {
-    readonly roleArn: string;
-    readonly roleArnParts: IamRoleArnParts;
-    readonly caller: SimArnPrincipal;
-    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
-}
-type AssumeRoleAuthorizedRole = SimGetRoleCommandOutput["Role"];
-/**
- * Coordinates source identity authorization and target Role trust authorization
- * for an STS AssumeRole request.
- *
- * AssumeRole normally requires both an identity-policy Allow in the caller's
- * Account and a matching trust-policy Allow in the target Role's Account.
- * A directly trusted IAM User in the same Account is an exception: the Role
- * trust policy can grant that User access without a separate identity-policy
- * Allow. Matching explicit identity-policy Deny statements still reject the
- * request.
- *
- * The target trust policy is evaluated first because its matching grant must be
- * classified before the source authorization requirement can be selected.
- */
-export declare class AssumeRoleAuthorizationCoordinator {
-    private readonly sourceAccountId;
-    private readonly sourcePrincipalAuthorizer;
-    private readonly targetRoleAuthorizer;
-    constructor(props: AssumeRoleAuthorizationCoordinatorProps);
-    /**
-     * Require the applicable source identity and target trust permissions.
-     *
-     * The returned Role has passed target lookup and trust authorization and can
-     * therefore be used to create the assumed-role session.
-     */
-    authorize(input: AssumeRoleAuthorizationInput): Promise<AssumeRoleAuthorizedRole>;
-    /**
-     * Whether the target trust policy is sufficient without an identity Allow.
-     *
-     * All three conditions are required:
-     *
-     * - the caller and target Role belong to the same Account;
-     * - the caller is an IAM User rather than a Role, session, or root principal;
-     * - a matching trust statement grants access directly rather than delegating
-     *   authorization to the caller's Account.
-     */
-    private hasDirectSameAccountUserGrant;
-}
-export {};
-//# sourceMappingURL=assume-role-auth-z-coordinator.d.ts.map

package/dist/dist-hidden/service/sts/auth-z/assume-role-auth-z-coordinator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assume-role-auth-z-coordinator.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-auth-z-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAIrF,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,KAAK,wBAAwB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAsC;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IAEtE,YAAY,KAAK,EAAE,uCAAuC,EASzD;IAED;;;;;OAKG;IACG,SAAS,CACb,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAmBnC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,6BAA6B;CAYtC"}