@kensio/yulin 0.35.0 → 0.36.0

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js

@@ -0,0 +1,25 @@
+import { SimIamSigV4CanonicalRequest } from "./canonical/sim-iam-sigv4-canonical-request.js";
+import { SimIamSignatureDoesNotMatch } from "./error/sim-iam-sigv4.error.js";
+import { simIamSigV4SignaturesMatch } from "./sim-iam-sigv4-signature-match.js";
+import { simIamSigV4Signature, simIamSigV4StringToSign, } from "./sim-iam-sigv4-signing-key.js";
+/**
+ * Rebuild the signature the request should carry, and refuse it otherwise.
+ *
+ * The canonical request travels with the failure, because a mismatch is
+ * otherwise undiagnosable: the only way to see which byte differed is to have
+ * the bytes the simulator signed over.
+ */
+export function simIamSigV4CheckSignature(input) {
+    const { signedRequest, authorization, signingKey, amzDate } = input;
+    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, authorization.signedHeaderNames).toString();
+    const expected = simIamSigV4Signature(signingKey, simIamSigV4StringToSign({
+        amzDate,
+        scope: authorization.scope,
+        canonicalRequest,
+    }));
+    if (!simIamSigV4SignaturesMatch(expected, authorization.signature)) {
+        throw new SimIamSignatureDoesNotMatch(`Request signature does not match the signature the simulator ` +
+            `calculated for access key ${authorization.accessKeyId}`, canonicalRequest);
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-signature-check.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AASxC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEpE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,aAAa,CAAC,iBAAiB,CAChC,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,aAAa,CAAC,WAAW,EAAE,EAC1D,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-match.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Compare a calculated signature with the one a request presented.
+ *
+ * The comparison is over the decoded bytes and takes the same time whatever
+ * they are, so nothing about the expected signature can be learned by measuring
+ * how quickly a wrong one is rejected.
+ */
+export declare function simIamSigV4SignaturesMatch(expected: string, presented: string): boolean;
+//# sourceMappingURL=sim-iam-sigv4-signature-match.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-match.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-match.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAaT"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-match.js

@@ -0,0 +1,26 @@
+import { timingSafeEqual } from "node:crypto";
+/**
+ * A SigV4 signature is a SHA-256 digest, so it is always exactly 64 hex
+ * characters. Requiring that here means nothing shorter, longer or oddly sized
+ * reaches the decoder, rather than relying on how it handles such input.
+ */
+const hexSignaturePattern = /^[\da-f]{64}$/i;
+/**
+ * Compare a calculated signature with the one a request presented.
+ *
+ * The comparison is over the decoded bytes and takes the same time whatever
+ * they are, so nothing about the expected signature can be learned by measuring
+ * how quickly a wrong one is rejected.
+ */
+export function simIamSigV4SignaturesMatch(expected, presented) {
+    if (!hexSignaturePattern.test(presented)) {
+        return false;
+    }
+    const expectedBytes = Buffer.from(expected, "hex");
+    const presentedBytes = Buffer.from(presented, "hex");
+    if (expectedBytes.length !== presentedBytes.length) {
+        return false;
+    }
+    return timingSafeEqual(expectedBytes, presentedBytes);
+}
+//# sourceMappingURL=sim-iam-sigv4-signature-match.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-match.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,SAAiB;IAEjB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAErD,IAAI,aAAa,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signed-request.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A request as received, in the shape SigV4 verification needs it.
+ *
+ * The body is passed alongside rather than read from the request, because a
+ * request body can only be consumed once and the caller serving the request
+ * needs it too. Whoever receives the request buffers it once and hands the same
+ * bytes to both.
+ */
+export interface SimIamSigV4SignedRequest {
+    readonly method: string;
+    readonly url: URL;
+    readonly headers: Headers;
+    readonly body?: Uint8Array | undefined;
+}
+/**
+ * Build the verification input from a Fetch request and its buffered body.
+ */
+export declare function simIamSigV4SignedRequest(request: Request, body?: Uint8Array): SimIamSigV4SignedRequest;
+//# sourceMappingURL=sim-iam-sigv4-signed-request.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signed-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signed-request.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signed-request.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,UAAU,GAChB,wBAAwB,CAO1B"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signed-request.js

@@ -0,0 +1,12 @@
+/**
+ * Build the verification input from a Fetch request and its buffered body.
+ */
+export function simIamSigV4SignedRequest(request, body) {
+    return {
+        method: request.method,
+        url: new URL(request.url),
+        headers: request.headers,
+        body,
+    };
+}
+//# sourceMappingURL=sim-iam-sigv4-signed-request.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signed-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signed-request.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signed-request.ts"],"names":[],"mappings":"AAeA;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgB,EAChB,IAAiB;IAEjB,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.d.ts

@@ -0,0 +1,13 @@
+import type { SimIamSigningCredential, SimIamSigningCredentialResolver } from "../credential/sim-iam-signing-credential.js";
+import type { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
+import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js";
+/**
+ * Find the signing key the request claims to have been signed with.
+ *
+ * A signed request never presents its secret, so this asks for the key the
+ * named access key would have derived rather than for the secret itself, and
+ * the signature comparison settles whether the signer really held it. Any
+ * rejection is restated in the vocabulary a signed request is answered in.
+ */
+export declare function simIamSigV4SigningCredential(credentials: SimIamSigningCredentialResolver, signedRequest: SimIamSigV4SignedRequest, authorization: SimIamSigV4Authorization, now: Date | undefined): SimIamSigningCredential;
+//# sourceMappingURL=sim-iam-sigv4-signing-credentials.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signing-credentials.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,+BAA+B,EAC5C,aAAa,EAAE,wBAAwB,EACvC,aAAa,EAAE,wBAAwB,EACvC,GAAG,EAAE,IAAI,GAAG,SAAS,GACpB,uBAAuB,CAUzB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.js

@@ -0,0 +1,18 @@
+import { simIamSigV4CredentialFailure } from "./sim-iam-sigv4-credential-failure.js";
+/**
+ * Find the signing key the request claims to have been signed with.
+ *
+ * A signed request never presents its secret, so this asks for the key the
+ * named access key would have derived rather than for the secret itself, and
+ * the signature comparison settles whether the signer really held it. Any
+ * rejection is restated in the vocabulary a signed request is answered in.
+ */
+export function simIamSigV4SigningCredential(credentials, signedRequest, authorization, now) {
+    return simIamSigV4CredentialFailure(authorization.accessKeyId, () => credentials.signingCredentialFor({
+        accessKeyId: authorization.accessKeyId,
+        sessionToken: signedRequest.headers.get("x-amz-security-token") ?? undefined,
+        scope: authorization.scope,
+        now,
+    }));
+}
+//# sourceMappingURL=sim-iam-sigv4-signing-credentials.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signing-credentials.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAGrF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAA4C,EAC5C,aAAuC,EACvC,aAAuC,EACvC,GAAqB;IAErB,OAAO,4BAA4B,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,CAClE,WAAW,CAAC,oBAAoB,CAAC;QAC/B,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY,EACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS;QAChE,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,GAAG;KACJ,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-key.d.ts

@@ -0,0 +1,26 @@
+import type { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+/**
+ * Derive the signing key for one secret access key in one scope.
+ *
+ * The chain is what stops a signature being reusable outside the scope it was
+ * made in: the date, Region and service are inputs to the key itself, so a
+ * signature for another day or another service cannot be produced without the
+ * secret, whatever the request claims.
+ */
+export declare function simIamSigV4SigningKey(secretAccessKey: string, scope: SimIamSigV4CredentialScope): Buffer;
+/**
+ * Build the string a SigV4 signature is actually computed over.
+ *
+ * The canonical request is hashed rather than signed directly, so the string to
+ * sign is a fixed size whatever the request was.
+ */
+export declare function simIamSigV4StringToSign(properties: {
+    readonly amzDate: string;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly canonicalRequest: string;
+}): string;
+/**
+ * Sign a string to sign with a derived signing key.
+ */
+export declare function simIamSigV4Signature(signingKey: Buffer, stringToSign: string): string;
+//# sourceMappingURL=sim-iam-sigv4-signing-key.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signing-key.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-key.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE,0BAA0B,GAChC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,GAAG,MAAM,CAOT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,MAAM,CAER"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-key.js

@@ -0,0 +1,40 @@
+import { createHash, createHmac } from "node:crypto";
+import { simIamSigV4Algorithm } from "./sim-iam-sigv4-authorization.js";
+/**
+ * Derive the signing key for one secret access key in one scope.
+ *
+ * The chain is what stops a signature being reusable outside the scope it was
+ * made in: the date, Region and service are inputs to the key itself, so a
+ * signature for another day or another service cannot be produced without the
+ * secret, whatever the request claims.
+ */
+export function simIamSigV4SigningKey(secretAccessKey, scope) {
+    let key = createHmac("sha256", `AWS4${secretAccessKey}`)
+        .update(scope.dateStamp)
+        .digest();
+    for (const part of [scope.regionName, scope.serviceName, "aws4_request"]) {
+        key = createHmac("sha256", key).update(part).digest();
+    }
+    return key;
+}
+/**
+ * Build the string a SigV4 signature is actually computed over.
+ *
+ * The canonical request is hashed rather than signed directly, so the string to
+ * sign is a fixed size whatever the request was.
+ */
+export function simIamSigV4StringToSign(properties) {
+    return [
+        simIamSigV4Algorithm,
+        properties.amzDate,
+        properties.scope.toString(),
+        createHash("sha256").update(properties.canonicalRequest).digest("hex"),
+    ].join("\n");
+}
+/**
+ * Sign a string to sign with a derived signing key.
+ */
+export function simIamSigV4Signature(signingKey, stringToSign) {
+    return createHmac("sha256", signingKey).update(stringToSign).digest("hex");
+}
+//# sourceMappingURL=sim-iam-sigv4-signing-key.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signing-key.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAGxE;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAuB,EACvB,KAAiC;IAEjC,IAAI,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,eAAe,EAAE,CAAC;SACrD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;SACvB,MAAM,EAAE,CAAC;IAEZ,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;QACzE,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAIvC;IACC,OAAO;QACL,oBAAoB;QACpB,UAAU,CAAC,OAAO;QAClB,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC3B,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,YAAoB;IAEpB,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.d.ts

@@ -0,0 +1,32 @@
+import type { SimIamCredentialIdentity } from "../credential/sim-aws-credentials.js";
+import type { SimIamSigningCredentialResolver } from "../credential/sim-iam-signing-credential.js";
+import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js";
+import type { SimIamSigV4VerifyOptions } from "./sim-iam-sigv4-verify-options.js";
+interface SimIamSigV4VerifierProperties {
+    readonly credentials: SimIamSigningCredentialResolver;
+}
+/**
+ * Verifies the SigV4 signature on a request and resolves who signed it.
+ *
+ * This is authentication, not authorization: the answer is which simulated
+ * principal made the request, which is exactly the question the IAM
+ * authorization already built has no way to ask of an HTTP request.
+ *
+ * Verification needs no clock. The signing date is an input to the signing key
+ * and comes from the request, so a correctly signed request verifies whenever
+ * it arrives. Only the credentials behind it can go stale, and that is judged in
+ * simulated time by the registry.
+ */
+export declare class SimIamSigV4Verifier {
+    private readonly credentials;
+    constructor(properties: SimIamSigV4VerifierProperties);
+    /**
+     * Verify a signed request, returning the identity that signed it.
+     *
+     * Throws a SimIamSigV4Error carrying the AWS error code real AWS would answer
+     * with when the request cannot be attributed to a registered access key.
+     */
+    verify(signedRequest: SimIamSigV4SignedRequest, options?: SimIamSigV4VerifyOptions): SimIamCredentialIdentity;
+}
+export {};
+//# sourceMappingURL=sim-iam-sigv4-verifier.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-verifier.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAKnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;CACvD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAE9D,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAa,EAAE,wBAAwB,EACvC,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CA4B1B;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js

@@ -0,0 +1,45 @@
+import { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
+import { simIamSigV4CheckExpectedScope } from "./sim-iam-sigv4-expected-scope.js";
+import { simIamSigV4CheckSignature } from "./sim-iam-sigv4-signature-check.js";
+import { simIamSigV4RequestDate } from "./sim-iam-sigv4-request-date.js";
+import { simIamSigV4SigningCredential } from "./sim-iam-sigv4-signing-credentials.js";
+/**
+ * Verifies the SigV4 signature on a request and resolves who signed it.
+ *
+ * This is authentication, not authorization: the answer is which simulated
+ * principal made the request, which is exactly the question the IAM
+ * authorization already built has no way to ask of an HTTP request.
+ *
+ * Verification needs no clock. The signing date is an input to the signing key
+ * and comes from the request, so a correctly signed request verifies whenever
+ * it arrives. Only the credentials behind it can go stale, and that is judged in
+ * simulated time by the registry.
+ */
+export class SimIamSigV4Verifier {
+    credentials;
+    constructor(properties) {
+        this.credentials = properties.credentials;
+    }
+    /**
+     * Verify a signed request, returning the identity that signed it.
+     *
+     * Throws a SimIamSigV4Error carrying the AWS error code real AWS would answer
+     * with when the request cannot be attributed to a registered access key.
+     */
+    verify(signedRequest, options = {}) {
+        const authorization = SimIamSigV4Authorization.parse(signedRequest.headers.get("authorization"));
+        // Checked before anything else can fail on it, so a signature made for the
+        // wrong endpoint says so rather than looking like a bad secret.
+        simIamSigV4CheckExpectedScope(options.expectedScope, authorization.scope);
+        const amzDate = simIamSigV4RequestDate(signedRequest.headers, authorization.scope);
+        const { signingKey, identity } = simIamSigV4SigningCredential(this.credentials, signedRequest, authorization, options.now);
+        simIamSigV4CheckSignature({
+            signedRequest,
+            authorization,
+            signingKey,
+            amzDate,
+        });
+        return identity;
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-verifier.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-verifier.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOtF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAkC;IAE9D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAuC,EACvC,OAAO,GAA6B,EAAE;QAEtC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAClD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAC;QAEF,2EAA2E;QAC3E,gEAAgE;QAChE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,sBAAsB,CACpC,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAC3D,IAAI,CAAC,WAAW,EAChB,aAAa,EACb,aAAa,EACb,OAAO,CAAC,GAAG,CACZ,CAAC;QAEF,yBAAyB,CAAC;YACxB,aAAa;YACb,aAAa;YACb,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verify-options.d.ts

@@ -0,0 +1,17 @@
+import type { SimIamSigV4ExpectedScope } from "./sim-iam-sigv4-expected-scope.js";
+/**
+ * Anything verifying a signature needs beyond the request itself.
+ */
+export interface SimIamSigV4VerifyOptions {
+    /**
+     * The service and Region the signature should have been scoped to. Omitted
+     * when nothing about the receiving endpoint is known, as when a test verifies
+     * a signature on its own.
+     */
+    readonly expectedScope?: SimIamSigV4ExpectedScope | undefined;
+    /**
+     * Simulated time that credential expiry is judged against.
+     */
+    readonly now?: Date | undefined;
+}
+//# sourceMappingURL=sim-iam-sigv4-verify-options.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verify-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-verify-options.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verify-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC9D;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACjC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verify-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-sigv4-verify-options.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verify-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-verify-options.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verify-options.ts"],"names":[],"mappings":""}

package/dist/service/iam/sim-iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AACrE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,iEAAiE,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AAErE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qEAAqE,CAAC;AACxH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,UAAU,gBAAgB;IACxB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;CAClE;AAED;;;;;;;GAOG;AACH,qBAAa,MAAO,YAAW,uBAAuB;IACpD;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;IAEtD,SAAgB,QAAQ,wFAA0C;IAClE,SAAgB,KAAK,kCAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,YAAY,UAAU,GAAE,gBAAqB,EA+C5C;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAE3C;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAElC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAE1C;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AACrE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,iEAAiE,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AAErE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qEAAqE,CAAC;AACxH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,UAAU,gBAAgB;IACxB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;CAClE;AAED;;;;;;;GAOG;AACH,qBAAa,MAAO,YAAW,uBAAuB;IACpD;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;IAEtD,SAAgB,QAAQ,wFAA0C;IAClE,SAAgB,KAAK,kCAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,YAAY,UAAU,GAAE,gBAAqB,EAoD5C;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAE3C;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAElC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAE1C;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/iam/sim-iam.js

@@ -36,7 +36,11 @@ export class SimIam {
     accountAuthZ;
     sdkRouter = new SimIamSdkCommandRouter(this);
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), credentialRegistry = new SimIamCredentialRegistry(), sessionCredentialGenerator = new SimIamRandomSessionCredentialGenerator(), userCredentialGenerator = new SimIamRandomUserCredentialGenerator(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), sessionCredentialGenerator = new SimIamRandomSessionCredentialGenerator(), userCredentialGenerator = new SimIamRandomUserCredentialGenerator(), } = properties;
+        // The scheduler is this simulation's clock, so session expiry is judged in
+        // the same time as every other simulated timestamp.
+        const credentialRegistry = properties.credentialRegistry ??
+            new SimIamCredentialRegistry({ clock: background });
         this.background = background;
         this.credentials = credentialRegistry;
         this.sessionManager = new SimIamSessionManager({

package/dist/service/iam/sim-iam.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.js","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAcjG,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAc7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAW5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EACL,sCAAsC,GAEvC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EACL,mCAAmC,GAEpC,MAAM,wDAAwD,CAAC;AAUhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAM3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAG5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAW7E;;;;;;;GAOG;AACH,MAAM,OAAO,MAAM;IACjB;;OAEG;IACa,cAAc,CAAuB;IAErC,WAAW,CAA2B;IAEtC,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7C,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE9C,UAAU,CAAsB;IAChC,UAAU,CAA+B;IACzC,YAAY,CAA4B;IACxC,YAAY,CAA4B;IACxC,cAAc,CAA8B;IAC5C,YAAY,CAAqB;IACjC,SAAS,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9D,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,kBAAkB,GAAG,IAAI,wBAAwB,EAAE,EACnD,0BAA0B,GAAG,IAAI,sCAAsC,EAAE,EACzE,uBAAuB,GAAG,IAAI,mCAAmC,EAAE,GACpE,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,0BAA0B;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC;YACzC,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,0BAA0B,EAAE,kBAAkB;SAC/C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,GAAG,IAAI,yBAAyB,CAAC;YAChD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,yBAAyB,CAAC;YAChD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,uBAAuB;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAmC,EACnC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,OAA0B,EAC1B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAkC,EAClC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-iam.js","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAcjG,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAc7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAW5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EACL,sCAAsC,GAEvC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EACL,mCAAmC,GAEpC,MAAM,wDAAwD,CAAC;AAUhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAM3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAG5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAW7E;;;;;;;GAOG;AACH,MAAM,OAAO,MAAM;IACjB;;OAEG;IACa,cAAc,CAAuB;IAErC,WAAW,CAA2B;IAEtC,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7C,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE9C,UAAU,CAAsB;IAChC,UAAU,CAA+B;IACzC,YAAY,CAA4B;IACxC,YAAY,CAA4B;IACxC,cAAc,CAA8B;IAC5C,YAAY,CAAqB;IACjC,SAAS,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9D,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,0BAA0B,GAAG,IAAI,sCAAsC,EAAE,EACzE,uBAAuB,GAAG,IAAI,mCAAmC,EAAE,GACpE,GAAG,UAAU,CAAC;QAEf,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB;YAC7B,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,0BAA0B;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC;YACzC,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,0BAA0B,EAAE,kBAAkB;SAC/C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,GAAG,IAAI,yBAAyB,CAAC;YAChD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,yBAAyB,CAAC;YAChD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,uBAAuB;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAmC,EACnC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,OAA0B,EAC1B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAkC,EAClC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.d.ts

@@ -3,12 +3,14 @@ import type { SimCfnLambdaFunctionProperties } from "./sim-cfn-lambda-function-p
 /**
  * Skips functions whose code lives in a missing CDK bootstrap assets bucket.
  *
- * CDK-synthesized templates include helper functions, such as the CDK
- * BucketDeployment provider, whose code zip lives in the CDK bootstrap assets
- * bucket. That bucket does not exist in sim AWS, and sim CloudFormation
- * simulates the CDK custom resources directly instead of running their
- * provider functions. The "Unsupported sim ... CloudFormation" wording marks
- * the Resource as skipped rather than failing the stack.
+ * Deploying from a synthesized template file publishes the cloud assembly's
+ * assets into that bucket in sim S3 first, so asset-bundled function code is
+ * normally found there. This skip covers what is left: a CDK-shaped template
+ * deployed without its cloud assembly, such as a template object passed
+ * inline, where there is no asset to publish and nothing to fetch.
+ *
+ * The "Unsupported sim ... CloudFormation" wording marks the Resource as
+ * skipped rather than failing the stack.
  */
 export declare class SimCfnLambdaCdkAssetsSkip {
     /**

package/dist/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-cdk-assets-skip.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAE3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAQrG;;;;;;;;;GASG;AACH,qBAAa,yBAAyB;IACpC;;;OAGG;IACH,aAAa,CACX,QAAQ,EAAE,cAAc,EACxB,kBAAkB,EAAE,8BAA8B,EAClD,KAAK,EAAE,OAAO,GACb,KAAK,GAAG,SAAS,CAWnB;IAED,OAAO,CAAC,iCAAiC;CAa1C"}
+{"version":3,"file":"sim-cfn-lambda-cdk-assets-skip.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAE3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAQrG;;;;;;;;;;;GAWG;AACH,qBAAa,yBAAyB;IACpC;;;OAGG;IACH,aAAa,CACX,QAAQ,EAAE,cAAc,EACxB,kBAAkB,EAAE,8BAA8B,EAClD,KAAK,EAAE,OAAO,GACb,KAAK,GAAG,SAAS,CAcnB;IAED,OAAO,CAAC,iCAAiC;CAa1C"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.js

@@ -6,12 +6,14 @@ const cdkBootstrapAssetsBucketPattern = /^cdk-[a-z0-9]+-assets-\d{12}-[a-z0-9-]+
 /**
  * Skips functions whose code lives in a missing CDK bootstrap assets bucket.
  *
- * CDK-synthesized templates include helper functions, such as the CDK
- * BucketDeployment provider, whose code zip lives in the CDK bootstrap assets
- * bucket. That bucket does not exist in sim AWS, and sim CloudFormation
- * simulates the CDK custom resources directly instead of running their
- * provider functions. The "Unsupported sim ... CloudFormation" wording marks
- * the Resource as skipped rather than failing the stack.
+ * Deploying from a synthesized template file publishes the cloud assembly's
+ * assets into that bucket in sim S3 first, so asset-bundled function code is
+ * normally found there. This skip covers what is left: a CDK-shaped template
+ * deployed without its cloud assembly, such as a template object passed
+ * inline, where there is no asset to publish and nothing to fetch.
+ *
+ * The "Unsupported sim ... CloudFormation" wording marks the Resource as
+ * skipped rather than failing the stack.
  */
 export class SimCfnLambdaCdkAssetsSkip {
     /**
@@ -24,7 +26,10 @@ export class SimCfnLambdaCdkAssetsSkip {
         }
         const bucketName = functionProperties.code?.S3Bucket ?? "";
         return new Error(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
-            `function code from missing CDK bootstrap assets bucket ${bucketName}`);
+            `function code from missing CDK bootstrap assets bucket ${bucketName}. ` +
+            `Deploy from a synthesized CDK template file so its cloud assembly ` +
+            `assets can be published, or bind a real in-process handler to this ` +
+            `function.`);
     }
     isMissingCdkBootstrapAssetsBucket(functionProperties, error) {
         const bucketName = functionProperties.code?.S3Bucket;

package/dist/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-cdk-assets-skip.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uCAAuC,EAAE,MAAM,iCAAiC,CAAC;AAG1F;;GAEG;AACH,MAAM,+BAA+B,GACnC,2CAA2C,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,OAAO,yBAAyB;IACpC;;;OAGG;IACH,aAAa,CACX,QAAwB,EACxB,kBAAkD,EAClD,KAAc;QAEd,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;QAE3D,OAAO,IAAI,KAAK,CACd,kDAAkD,QAAQ,CAAC,SAAS,IAAI;YACtE,0DAA0D,UAAU,EAAE,CACzE,CAAC;IACJ,CAAC;IAEO,iCAAiC,CACvC,kBAAkD,EAClD,KAAc;QAEd,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAErD,OAAO,CACL,UAAU,KAAK,SAAS;YACxB,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC;YAChD,KAAK,YAAY,uCAAuC;YACxD,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CACvC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-lambda-cdk-assets-skip.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-cdk-assets-skip.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uCAAuC,EAAE,MAAM,iCAAiC,CAAC;AAG1F;;GAEG;AACH,MAAM,+BAA+B,GACnC,2CAA2C,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yBAAyB;IACpC;;;OAGG;IACH,aAAa,CACX,QAAwB,EACxB,kBAAkD,EAClD,KAAc;QAEd,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;QAE3D,OAAO,IAAI,KAAK,CACd,kDAAkD,QAAQ,CAAC,SAAS,IAAI;YACtE,0DAA0D,UAAU,IAAI;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,WAAW,CACd,CAAC;IACJ,CAAC;IAEO,iCAAiC,CACvC,kBAAkD,EAClD,KAAc;QAEd,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAErD,OAAO,CACL,UAAU,KAAK,SAAS;YACxB,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC;YAChD,KAAK,YAAY,uCAAuC;YACxD,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CACvC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-code-input.d.ts

@@ -7,6 +7,14 @@ interface SimCfnLambdaCodeInputProperties {
     readonly functionProperties: SimCfnLambdaFunctionProperties;
     readonly bindings?: readonly SimCfnExecutableResourceBinding[] | undefined;
 }
+/**
+ * The code a Resource's function will be created with, and whether an
+ * executable binding supplied it.
+ */
+export interface SimCfnLambdaCodeInput {
+    readonly code: SimLambdaFunctionCode | undefined;
+    readonly bound: boolean;
+}
 /**
  * The CreateFunction code input for an AWS::Lambda::Function Resource: an
  * executable binding's real handler when one targets the Resource, otherwise
@@ -18,6 +26,6 @@ interface SimCfnLambdaCodeInputProperties {
  * replaces the code wholesale. Bindings can target the logical ID (or CDK
  * construct ID), the resolved function name, or the function ARN.
  */
-export declare function simCfnLambdaCodeInput(properties: SimCfnLambdaCodeInputProperties): SimLambdaFunctionCode | undefined;
+export declare function simCfnLambdaCodeInput(properties: SimCfnLambdaCodeInputProperties): SimCfnLambdaCodeInput;
 export {};
 //# sourceMappingURL=sim-cfn-lambda-code-input.d.ts.map

package/dist/service/lambda/cfn/function/sim-cfn-lambda-code-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-code-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-code-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAEjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAItG,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAErG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,+BAA+B,EAAE,GAAG,SAAS,CAAC;CAC5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,+BAA+B,GAC1C,qBAAqB,GAAG,SAAS,CAoBnC"}
+{"version":3,"file":"sim-cfn-lambda-code-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-code-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AAEjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAItG,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAErG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,+BAA+B,EAAE,GAAG,SAAS,CAAC;CAC5E;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,+BAA+B,GAC1C,qBAAqB,CAuBvB"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-code-input.js

@@ -23,8 +23,11 @@ export function simCfnLambdaCodeInput(properties) {
         arn: simLambdaFunctionArn(resource.accountRegionScope, functionProperties.functionName),
     });
     if (binding === undefined) {
-        return functionProperties.code;
+        return { code: functionProperties.code, bound: false };
     }
-    return { ZipFile: makeLambdaZipFileInput(binding.handler) };
+    return {
+        code: { ZipFile: makeLambdaZipFileInput(binding.handler) },
+        bound: true,
+    };
 }
 //# sourceMappingURL=sim-cfn-lambda-code-input.js.map

package/dist/service/lambda/cfn/function/sim-cfn-lambda-code-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-code-input.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-code-input.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAG/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAU7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAA2C;IAE3C,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC;IAE9D,MAAM,aAAa,GAAG,IAAI,uBAAuB,CAAmB;QAClE,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC;QACxC,YAAY,EAAE,kBAAkB,CAAC,YAAY;QAC7C,GAAG,EAAE,oBAAoB,CACvB,QAAQ,CAAC,kBAAkB,EAC3B,kBAAkB,CAAC,YAAY,CAChC;KACF,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,kBAAkB,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"sim-cfn-lambda-code-input.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-code-input.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAG/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAmB7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAA2C;IAE3C,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC;IAE9D,MAAM,aAAa,GAAG,IAAI,uBAAuB,CAAmB;QAClE,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC;QACxC,YAAY,EAAE,kBAAkB,CAAC,YAAY;QAC7C,GAAG,EAAE,oBAAoB,CACvB,QAAQ,CAAC,kBAAkB,EAC3B,kBAAkB,CAAC,YAAY,CAChC;KACF,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC1D,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-creator.d.ts

@@ -13,6 +13,7 @@ export declare class SimCfnLambdaFunctionCreator {
     private readonly lambda;
     private readonly propertiesParser;
     private readonly cdkAssetsSkip;
+    private readonly runtimeSkip;
     constructor(properties: SimCfnLambdaFunctionCreatorProperties);
     /**
      * Create a simulated Lambda function from an AWS::Lambda::Function Resource.

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-function-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AACjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAQrD,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED;;GAEG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CACY;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IAEjE,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;;;OAOG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,EACrC,QAAQ,CAAC,EAAE,SAAS,+BAA+B,EAAE,GACpD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;CACF"}
+{"version":3,"file":"sim-cfn-lambda-function-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2DAA2D,CAAC;AACjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED;;GAEG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CACY;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IACjE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;;;OAOG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,EACrC,QAAQ,CAAC,EAAE,SAAS,+BAA+B,EAAE,GACpD,OAAO,CAAC,iBAAiB,CAAC,CA8C5B;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-creator.js

@@ -1,6 +1,7 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimCfnLambdaCdkAssetsSkip } from "./sim-cfn-lambda-cdk-assets-skip.js";
 import { simCfnLambdaCodeInput } from "./sim-cfn-lambda-code-input.js";
+import { SimCfnLambdaRuntimeSkip } from "./sim-cfn-lambda-runtime-skip.js";
 import { simCfnLambdaCreateFunctionInput, SimCfnLambdaFunctionPropertiesParser, } from "./sim-cfn-lambda-function-properties-parser.js";
 /**
  * Creates simulated Lambda functions from CloudFormation Resources.
@@ -9,6 +10,7 @@ export class SimCfnLambdaFunctionCreator {
     lambda;
     propertiesParser = new SimCfnLambdaFunctionPropertiesParser();
     cdkAssetsSkip = new SimCfnLambdaCdkAssetsSkip();
+    runtimeSkip = new SimCfnLambdaRuntimeSkip();
     constructor(properties) {
         this.lambda = properties.lambda;
     }
@@ -22,11 +24,15 @@ export class SimCfnLambdaFunctionCreator {
      */
     async create(resource, properties, bindings) {
         const functionProperties = this.propertiesParser.parse(resource, properties);
-        const code = simCfnLambdaCodeInput({
+        const { code, bound } = simCfnLambdaCodeInput({
             resource,
             functionProperties,
             bindings,
         });
+        const runtimeSkipError = this.runtimeSkip.findSkipError(resource, functionProperties, bound);
+        if (runtimeSkipError !== undefined) {
+            throw runtimeSkipError;
+        }
         try {
             await this.lambda.createFunction({
                 input: simCfnLambdaCreateFunctionInput(functionProperties, code),

package/dist/service/lambda/cfn/function/sim-cfn-lambda-function-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-function-creator.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-creator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,gDAAgD,CAAC;AAMxD;;GAEG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAY;IAClB,gBAAgB,GAC/B,IAAI,oCAAoC,EAAE,CAAC;IAC5B,aAAa,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAEjE,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC,EACrC,QAAqD;QAErD,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CACpD,QAAQ,EACR,UAAU,CACX,CAAC;QACF,MAAM,IAAI,GAAG,qBAAqB,CAAC;YACjC,QAAQ;YACR,kBAAkB;YAClB,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC/B,KAAK,EAAE,+BAA+B,CAAC,kBAAkB,EAAE,IAAI,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAChD,QAAQ,EACR,kBAAkB,EAClB,KAAK,CACN,CAAC;YACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,SAAS,CAAC;YAClB,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAClD,kBAAkB,CAAC,YAAY,CAChC,CAAC;QACF,aAAa,CACX,WAAW,EACX,uBAAuB,kBAAkB,CAAC,YAAY,gCAAgC,CACvF,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-lambda-function-creator.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-function-creator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,gDAAgD,CAAC;AAMxD;;GAEG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAY;IAClB,gBAAgB,GAC/B,IAAI,oCAAoC,EAAE,CAAC;IAC5B,aAAa,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAChD,WAAW,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE7D,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC,EACrC,QAAqD;QAErD,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CACpD,QAAQ,EACR,UAAU,CACX,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC;YAC5C,QAAQ;YACR,kBAAkB;YAClB,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CACrD,QAAQ,EACR,kBAAkB,EAClB,KAAK,CACN,CAAC;QACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,gBAAgB,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC/B,KAAK,EAAE,+BAA+B,CAAC,kBAAkB,EAAE,IAAI,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAChD,QAAQ,EACR,kBAAkB,EAClB,KAAK,CACN,CAAC;YACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,SAAS,CAAC;YAClB,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAClD,kBAAkB,CAAC,YAAY,CAChC,CAAC;QACF,aAAa,CACX,WAAW,EACX,uBAAuB,kBAAkB,CAAC,YAAY,gCAAgC,CACvF,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}