@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.d.ts

@@ -0,0 +1,16 @@
+import type { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+/**
+ * What a request states about the signature it carries.
+ *
+ * SigV4 offers the same facts in two places: an `Authorization` header, or the
+ * query string of a presigned URL. Everything downstream of parsing needs only
+ * these four, so verification is written against this rather than against
+ * either form, and the two differ only in how they are read off the request.
+ */
+export interface SimIamSigV4SignatureStatement {
+    readonly accessKeyId: string;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly signedHeaderNames: readonly string[];
+    readonly signature: string;
+}
+//# sourceMappingURL=sim-iam-sigv4-signature-statement.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-statement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-sigv4-signature-statement.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-statement.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-statement.ts"],"names":[],"mappings":""}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.d.ts

@@ -1,6 +1,11 @@
 import type { SimIamSigningCredential, SimIamSigningCredentialResolver } from "../credential/sim-iam-signing-credential.js";
-import type { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
-import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js";
+import type { SimIamSigV4SignatureStatement } from "./sim-iam-sigv4-signature-statement.js";
+interface SimIamSigV4SigningCredentialInput {
+    readonly credentials: SimIamSigningCredentialResolver;
+    readonly statement: SimIamSigV4SignatureStatement;
+    readonly sessionToken: string | undefined;
+    readonly now: Date | undefined;
+}
 /**
  * Find the signing key the request claims to have been signed with.
  *
@@ -8,6 +13,10 @@ import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js
  * named access key would have derived rather than for the secret itself, and
  * the signature comparison settles whether the signer really held it. Any
  * rejection is restated in the vocabulary a signed request is answered in.
+ *
+ * The session token comes from wherever the request carried it: a header on a
+ * header-signed request, a query parameter on a presigned URL.
  */
-export declare function simIamSigV4SigningCredential(credentials: SimIamSigningCredentialResolver, signedRequest: SimIamSigV4SignedRequest, authorization: SimIamSigV4Authorization, now: Date | undefined): SimIamSigningCredential;
+export declare function simIamSigV4SigningCredential(input: SimIamSigV4SigningCredentialInput): SimIamSigningCredential;
+export {};
 //# sourceMappingURL=sim-iam-sigv4-signing-credentials.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signing-credentials.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,+BAA+B,EAC5C,aAAa,EAAE,wBAAwB,EACvC,aAAa,EAAE,wBAAwB,EACvC,GAAG,EAAE,IAAI,GAAG,SAAS,GACpB,uBAAuB,CAUzB"}
+{"version":3,"file":"sim-iam-sigv4-signing-credentials.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,iCAAiC;IACzC,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,IAAI,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,uBAAuB,CAWzB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.js

@@ -6,12 +6,16 @@ import { simIamSigV4CredentialFailure } from "./sim-iam-sigv4-credential-failure
  * named access key would have derived rather than for the secret itself, and
  * the signature comparison settles whether the signer really held it. Any
  * rejection is restated in the vocabulary a signed request is answered in.
+ *
+ * The session token comes from wherever the request carried it: a header on a
+ * header-signed request, a query parameter on a presigned URL.
  */
-export function simIamSigV4SigningCredential(credentials, signedRequest, authorization, now) {
-    return simIamSigV4CredentialFailure(authorization.accessKeyId, () => credentials.signingCredentialFor({
-        accessKeyId: authorization.accessKeyId,
-        sessionToken: signedRequest.headers.get("x-amz-security-token") ?? undefined,
-        scope: authorization.scope,
+export function simIamSigV4SigningCredential(input) {
+    const { credentials, statement, sessionToken, now } = input;
+    return simIamSigV4CredentialFailure(statement.accessKeyId, () => credentials.signingCredentialFor({
+        accessKeyId: statement.accessKeyId,
+        sessionToken,
+        scope: statement.scope,
         now,
     }));
 }

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signing-credentials.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAGrF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAA4C,EAC5C,aAAuC,EACvC,aAAuC,EACvC,GAAqB;IAErB,OAAO,4BAA4B,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,CAClE,WAAW,CAAC,oBAAoB,CAAC;QAC/B,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY,EACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS;QAChE,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,GAAG;KACJ,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-signing-credentials.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAUrF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAwC;IAExC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAE5D,OAAO,4BAA4B,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAC9D,WAAW,CAAC,oBAAoB,CAAC;QAC/B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,YAAY;QACZ,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,GAAG;KACJ,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.d.ts

@@ -12,10 +12,16 @@ interface SimIamSigV4VerifierProperties {
  * principal made the request, which is exactly the question the IAM
  * authorization already built has no way to ask of an HTTP request.
  *
- * Verification needs no clock. The signing date is an input to the signing key
- * and comes from the request, so a correctly signed request verifies whenever
- * it arrives. Only the credentials behind it can go stale, and that is judged in
- * simulated time by the registry.
+ * A signature arrives in one of two forms, an `Authorization` header or the
+ * query string of a presigned URL, and both are verified here. The work either
+ * way is the same canonical request against the same signing key; only where
+ * the claims are read from, and whether a lifetime is stated, differ.
+ *
+ * Verifying a header-signed request needs no clock. The signing date is an
+ * input to the signing key and comes from the request, so a correctly signed
+ * request verifies whenever it arrives. Only the credentials behind it can go
+ * stale, and that is judged in simulated time by the registry. A presigned URL
+ * is the exception, because it states its own expiry.
  */
 export declare class SimIamSigV4Verifier {
     private readonly credentials;
@@ -27,6 +33,16 @@ export declare class SimIamSigV4Verifier {
      * with when the request cannot be attributed to a registered access key.
      */
     verify(signedRequest: SimIamSigV4SignedRequest, options?: SimIamSigV4VerifyOptions): SimIamCredentialIdentity;
+    private verifyHeaderSigned;
+    /**
+     * Verify a presigned URL.
+     *
+     * Expiry is checked before the signature, because an expired URL is the
+     * likeliest reason a presigned request fails and "this expired" is a far
+     * more useful thing to be told than "this signature does not match". The
+     * expiry is signed, so a URL cannot claim a longer life than it was given.
+     */
+    private verifyPresigned;
 }
 export {};
 //# sourceMappingURL=sim-iam-sigv4-verifier.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-verifier.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAKnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;CACvD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAE9D,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAa,EAAE,wBAAwB,EACvC,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CA4B1B;CACF"}
+{"version":3,"file":"sim-iam-sigv4-verifier.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAOnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAE9D,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAa,EAAE,wBAAwB,EACvC,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CAM1B;IAED,OAAO,CAAC,kBAAkB;IAkC1B;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;CA4BxB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js

@@ -1,3 +1,5 @@
+import { SimIamSigV4PayloadDeclaration } from "./canonical/sim-iam-sigv4-payload-hash.js";
+import { SimIamSigV4PresignedQuery } from "./presign/sim-iam-sigv4-presigned-query.js";
 import { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
 import { simIamSigV4CheckExpectedScope } from "./sim-iam-sigv4-expected-scope.js";
 import { simIamSigV4CheckSignature } from "./sim-iam-sigv4-signature-check.js";
@@ -10,10 +12,16 @@ import { simIamSigV4SigningCredential } from "./sim-iam-sigv4-signing-credential
  * principal made the request, which is exactly the question the IAM
  * authorization already built has no way to ask of an HTTP request.
  *
- * Verification needs no clock. The signing date is an input to the signing key
- * and comes from the request, so a correctly signed request verifies whenever
- * it arrives. Only the credentials behind it can go stale, and that is judged in
- * simulated time by the registry.
+ * A signature arrives in one of two forms, an `Authorization` header or the
+ * query string of a presigned URL, and both are verified here. The work either
+ * way is the same canonical request against the same signing key; only where
+ * the claims are read from, and whether a lifetime is stated, differ.
+ *
+ * Verifying a header-signed request needs no clock. The signing date is an
+ * input to the signing key and comes from the request, so a correctly signed
+ * request verifies whenever it arrives. Only the credentials behind it can go
+ * stale, and that is judged in simulated time by the registry. A presigned URL
+ * is the exception, because it states its own expiry.
  */
 export class SimIamSigV4Verifier {
     credentials;
@@ -27,19 +35,57 @@ export class SimIamSigV4Verifier {
      * with when the request cannot be attributed to a registered access key.
      */
     verify(signedRequest, options = {}) {
+        if (SimIamSigV4PresignedQuery.carriedBy(signedRequest.url)) {
+            return this.verifyPresigned(signedRequest, options);
+        }
+        return this.verifyHeaderSigned(signedRequest, options);
+    }
+    verifyHeaderSigned(signedRequest, options) {
         const authorization = SimIamSigV4Authorization.parse(signedRequest.headers.get("authorization"));
         // Checked before anything else can fail on it, so a signature made for the
         // wrong endpoint says so rather than looking like a bad secret.
         simIamSigV4CheckExpectedScope(options.expectedScope, authorization.scope);
         const amzDate = simIamSigV4RequestDate(signedRequest.headers, authorization.scope);
-        const { signingKey, identity } = simIamSigV4SigningCredential(this.credentials, signedRequest, authorization, options.now);
+        const { signingKey, identity } = simIamSigV4SigningCredential({
+            credentials: this.credentials,
+            statement: authorization,
+            sessionToken: signedRequest.headers.get("x-amz-security-token") ?? undefined,
+            now: options.now,
+        });
         simIamSigV4CheckSignature({
             signedRequest,
-            authorization,
+            statement: authorization,
             signingKey,
             amzDate,
         });
         return identity;
     }
+    /**
+     * Verify a presigned URL.
+     *
+     * Expiry is checked before the signature, because an expired URL is the
+     * likeliest reason a presigned request fails and "this expired" is a far
+     * more useful thing to be told than "this signature does not match". The
+     * expiry is signed, so a URL cannot claim a longer life than it was given.
+     */
+    verifyPresigned(signedRequest, options) {
+        const presigned = SimIamSigV4PresignedQuery.parse(signedRequest.url);
+        simIamSigV4CheckExpectedScope(options.expectedScope, presigned.scope);
+        presigned.checkNotExpired(options.now ?? new Date());
+        const { signingKey, identity } = simIamSigV4SigningCredential({
+            credentials: this.credentials,
+            statement: presigned,
+            sessionToken: presigned.sessionToken,
+            now: options.now,
+        });
+        simIamSigV4CheckSignature({
+            signedRequest,
+            statement: presigned,
+            signingKey,
+            amzDate: presigned.amzDate,
+            payload: SimIamSigV4PayloadDeclaration.fromPresignedQuery(signedRequest.url),
+        });
+        return identity;
+    }
 }
 //# sourceMappingURL=sim-iam-sigv4-verifier.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-verifier.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOtF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAkC;IAE9D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAuC,EACvC,OAAO,GAA6B,EAAE;QAEtC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAClD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAC;QAEF,2EAA2E;QAC3E,gEAAgE;QAChE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,sBAAsB,CACpC,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAC3D,IAAI,CAAC,WAAW,EAChB,aAAa,EACb,aAAa,EACb,OAAO,CAAC,GAAG,CACZ,CAAC;QAEF,yBAAyB,CAAC;YACxB,aAAa;YACb,aAAa;YACb,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4-verifier.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOtF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAkC;IAE9D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAuC,EACvC,OAAO,GAA6B,EAAE;QAEtC,IAAI,yBAAyB,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAEO,kBAAkB,CACxB,aAAuC,EACvC,OAAiC;QAEjC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAClD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAC;QAEF,2EAA2E;QAC3E,gEAAgE;QAChE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,sBAAsB,CACpC,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC;YAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,aAAa;YACxB,YAAY,EACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS;YAChE,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,yBAAyB,CAAC;YACxB,aAAa;YACb,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CACrB,aAAuC,EACvC,OAAiC;QAEjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAErE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACtE,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC;YAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,yBAAyB,CAAC;YACxB,aAAa;YACb,SAAS,EAAE,SAAS;YACpB,UAAU;YACV,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,OAAO,EAAE,6BAA6B,CAAC,kBAAkB,CACvD,aAAa,CAAC,GAAG,CAClB;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/service/iam/sim-iam-account-parts.d.ts

@@ -0,0 +1,58 @@
+import { type BackgroundScheduler } from "../../util/background/background.js";
+import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
+import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import { SimIamAccountAuthZ } from "./authorize/sim-iam-account-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
+import { SimIamCommandHandlers } from "./command/sim-iam-command-handlers.js";
+import { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
+import { type SimIamSessionCredentialGenerator } from "./credential/session/sim-iam-session-cred-gen.js";
+import { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
+import { type SimIamUserCredentialGenerator } from "./credential/user/sim-iam-user-credential-generator.js";
+import type { SimIamManagedPolicy } from "./policy/sim-iam-policy.js";
+import type { SimIamAccountResolver } from "./registry/sim-iam-account-resolver.js";
+import type { SimIamRole, SimIamRoleName } from "./role/sim-iam-role.js";
+import type { SimIamUser, SimIamUsername } from "./user/sim-iam-user.js";
+export interface SimIamProperties {
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly background?: BackgroundScheduler;
+    readonly credentialRegistry?: SimIamCredentialRegistry;
+    readonly sessionCredentialGenerator?: SimIamSessionCredentialGenerator;
+    readonly userCredentialGenerator?: SimIamUserCredentialGenerator;
+    /**
+     * Resolves the IAM of other Accounts in the same simulation.
+     *
+     * A cross-Account request is decided in both Accounts, so deciding one needs
+     * a way to reach the caller's own Account. A standalone SimIam has no
+     * simulation around it and so leaves this out.
+     */
+    readonly iamResolver?: SimIamAccountResolver;
+}
+/**
+ * The state and collaborators of one simulated IAM Account.
+ *
+ * SimIam is the SDK-facing facade. This class is what it is a facade over: the
+ * Account's stored Roles, Users and Policies, the credential registry and
+ * session manager, and the authorization and command-handling collaborators
+ * that work on them. Keeping the construction and defaulting rules here leaves
+ * the facade as state plus delegation.
+ */
+export declare class SimIamAccountParts {
+    readonly accountId: SimAwsAccountId;
+    readonly background: BackgroundScheduler;
+    readonly credentials: SimIamCredentialRegistry;
+    readonly sessionManager: SimIamSessionManager;
+    readonly accountAuthZ: SimIamAccountAuthZ;
+    readonly policies: Map<`arn:aws:${string}:${string}:${string}:${string}/${string}`, SimIamManagedPolicy>;
+    readonly roles: Map<SimIamRoleName, SimIamRole>;
+    readonly users: Map<SimIamUsername, SimIamUser>;
+    private readonly userCredentialGenerator;
+    constructor(properties: SimIamProperties);
+    /**
+     * Make the command handlers for this Account.
+     *
+     * IAM authorizes its own control-plane commands, so the handlers need the
+     * service facade the commands arrive at and cannot be built before it.
+     */
+    commandHandlers(iam: SimIamInterServiceAuthZ): SimIamCommandHandlers;
+}
+//# sourceMappingURL=sim-iam-account-parts.d.ts.map

package/dist/service/iam/sim-iam-account-parts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-parts.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam-account-parts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;IAEjE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAE1C,QAAQ,CAAC,QAAQ,wFAA0C;IAC3D,QAAQ,CAAC,KAAK,kCAAyC;IACvD,QAAQ,CAAC,KAAK,kCAAyC;IAEvD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IAExE,YAAY,UAAU,EAAE,gBAAgB,EAgCvC;IAED;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,uBAAuB,GAAG,qBAAqB,CAWnE;CACF"}

package/dist/service/iam/sim-iam-account-parts.js

@@ -0,0 +1,72 @@
+import { BackgroundTasks, } from "../../util/background/background.js";
+import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { SimIamAccountAuthZ } from "./authorize/sim-iam-account-auth-z.js";
+import { SimIamCommandHandlers } from "./command/sim-iam-command-handlers.js";
+import { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
+import { SimIamRandomSessionCredentialGenerator, } from "./credential/session/sim-iam-session-cred-gen.js";
+import { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
+import { SimIamRandomUserCredentialGenerator, } from "./credential/user/sim-iam-user-credential-generator.js";
+/**
+ * The state and collaborators of one simulated IAM Account.
+ *
+ * SimIam is the SDK-facing facade. This class is what it is a facade over: the
+ * Account's stored Roles, Users and Policies, the credential registry and
+ * session manager, and the authorization and command-handling collaborators
+ * that work on them. Keeping the construction and defaulting rules here leaves
+ * the facade as state plus delegation.
+ */
+export class SimIamAccountParts {
+    accountId;
+    background;
+    credentials;
+    sessionManager;
+    accountAuthZ;
+    policies = new Map();
+    roles = new Map();
+    users = new Map();
+    userCredentialGenerator;
+    constructor(properties) {
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), sessionCredentialGenerator = new SimIamRandomSessionCredentialGenerator(), userCredentialGenerator = new SimIamRandomUserCredentialGenerator(), } = properties;
+        // The scheduler is this simulation's clock, so session expiry is judged in
+        // the same time as every other simulated timestamp.
+        const credentialRegistry = properties.credentialRegistry ??
+            new SimIamCredentialRegistry({ clock: background });
+        this.accountId = accountRegionScope.accountId;
+        this.background = background;
+        this.credentials = credentialRegistry;
+        this.userCredentialGenerator = userCredentialGenerator;
+        this.sessionManager = new SimIamSessionManager({
+            accountId: this.accountId,
+            roles: this.roles,
+            credentialRegistry,
+            credentialGenerator: sessionCredentialGenerator,
+        });
+        this.accountAuthZ = new SimIamAccountAuthZ({
+            accountId: this.accountId,
+            policies: this.policies,
+            roles: this.roles,
+            users: this.users,
+            credentialIdentityResolver: credentialRegistry,
+            iamResolver: properties.iamResolver,
+        });
+    }
+    /**
+     * Make the command handlers for this Account.
+     *
+     * IAM authorizes its own control-plane commands, so the handlers need the
+     * service facade the commands arrive at and cannot be built before it.
+     */
+    commandHandlers(iam) {
+        return new SimIamCommandHandlers({
+            accountId: this.accountId,
+            policies: this.policies,
+            roles: this.roles,
+            users: this.users,
+            credentialRegistry: this.credentials,
+            userCredentialGenerator: this.userCredentialGenerator,
+            background: this.background,
+            iam,
+        });
+    }
+}
+//# sourceMappingURL=sim-iam-account-parts.js.map

package/dist/service/iam/sim-iam-account-parts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-parts.js","sourceRoot":"","sources":["../../../src/service/iam/sim-iam-account-parts.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EACL,sCAAsC,GAEvC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EACL,mCAAmC,GAEpC,MAAM,wDAAwD,CAAC;AAuBhE;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACpB,SAAS,CAAkB;IAC3B,UAAU,CAAsB;IAChC,WAAW,CAA2B;IACtC,cAAc,CAAuB;IACrC,YAAY,CAAqB;IAEjC,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEtC,uBAAuB,CAAgC;IAExE,YAAY,UAA4B;QACtC,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,0BAA0B,GAAG,IAAI,sCAAsC,EAAE,EACzE,uBAAuB,GAAG,IAAI,mCAAmC,EAAE,GACpE,GAAG,UAAU,CAAC;QAEf,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB;YAC7B,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACtC,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,0BAA0B;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,0BAA0B,EAAE,kBAAkB;YAC9C,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,GAA4B;QAC1C,OAAO,IAAI,qBAAqB,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/sim-iam.d.ts

@@ -1,9 +1,9 @@
-import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimArn } from "../aws/arn.js";
+import type { SimAwsAccountId } from "../aws/sim-aws-account.js";
 import type { SimCreatePolicyCommand, SimCreatePolicyCommandOutput } from "./command/policy/create-policy/create-policy.command.js";
 import type { SimIamManagedPolicy } from "./policy/sim-iam-policy.js";
 import type { SimGetPolicyCommand, SimGetPolicyCommandOutput } from "./command/policy/get-policy/get-policy.command.js";
 import type { SimListPoliciesCommand, SimListPoliciesCommandOutput } from "./command/policy/list-policies/list-policies.command.js";
-import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimCreateRoleCommand, SimCreateRoleCommandOutput } from "./command/role/create-role/create-role.command.js";
 import type { SimGetRoleCommand, SimGetRoleCommandOutput } from "./command/role/get-role/get-role.command.js";
 import type { SimIamRole, SimIamRoleName } from "./role/sim-iam-role.js";
@@ -12,24 +12,19 @@ import type { SimIamAuthorizationInput } from "./authorize/context/sim-iam-auth-
 import type { SimIamPolicyDecision } from "./authorize/sim-iam-decision.js";
 import type { SimPutRolePolicyCommand, SimPutRolePolicyCommandOutput } from "./command/policy/put-role-policy/put-role-policy.command.js";
 import type { SimAttachRolePolicyCommand, SimAttachRolePolicyCommandOutput } from "./command/role/attach-role-policy/attach-role-policy.command.js";
-import { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
-import { type SimIamSessionCredentialGenerator } from "./credential/session/sim-iam-session-cred-gen.js";
-import { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
-import { type SimIamUserCredentialGenerator } from "./credential/user/sim-iam-user-credential-generator.js";
 import type { SimCreateUserCommand, SimCreateUserCommandOutput } from "./command/user/create-user/create-user.command.js";
 import type { SimCreateAccessKeyCommand, SimCreateAccessKeyCommandOutput } from "./command/user/create-access-key/create-access-key.command.js";
 import type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
 import type { SimPutUserPolicyCommand, SimPutUserPolicyCommandOutput } from "./command/policy/put-user-policy/put-user-policy.command.js";
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamAccountIdentityPolicies } from "./authorize/identity/sim-iam-account-identity-policies.js";
+import type { SimIamAuthZPolicySource } from "./authorize/context/sim-iam-auth-z-context.js";
+import type { SimAwsPrincipal } from "../aws/caller/sim-aws-caller.js";
 import type { SimSdkCommandRouter } from "../../sdk/index.js";
-interface SimIamProperties {
-    readonly accountRegionScope?: SimAwsAccountRegionScope;
-    readonly background?: BackgroundScheduler;
-    readonly credentialRegistry?: SimIamCredentialRegistry;
-    readonly sessionCredentialGenerator?: SimIamSessionCredentialGenerator;
-    readonly userCredentialGenerator?: SimIamUserCredentialGenerator;
-}
+import type { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
+import type { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
+import { type SimIamProperties } from "./sim-iam-account-parts.js";
 /**
  * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
  * and state.
@@ -38,20 +33,23 @@ interface SimIamProperties {
  * scope for consistency with the other service factories, but memoises one
  * service facade per Account.
  */
-export declare class SimIam implements SimIamInterServiceAuthZ {
+export declare class SimIam implements SimIamInterServiceAuthZ, SimIamAccountIdentityPolicies {
+    /**
+     * The simulated AWS Account this IAM belongs to.
+     *
+     * A standalone SimIam generates one, so this is how a test naming its own
+     * principals finds out which Account they should belong to.
+     */
+    readonly accountId: SimAwsAccountId;
     /**
      * Manage temporary sessions belonging to this simulated IAM Account.
      */
     readonly sessionManager: SimIamSessionManager;
     readonly credentials: SimIamCredentialRegistry;
-    readonly policies: Map<`arn:aws:${string}:${string}:${string}:${string}/${string}`, SimIamManagedPolicy>;
+    readonly policies: Map<SimArn, SimIamManagedPolicy>;
     readonly roles: Map<SimIamRoleName, SimIamRole>;
-    private readonly users;
-    private readonly background;
     private readonly cfnFactory;
-    private readonly roleCommands;
-    private readonly userCommands;
-    private readonly policyCommands;
+    private readonly commands;
     private readonly accountAuthZ;
     private readonly sdkRouter;
     constructor(properties?: SimIamProperties);
@@ -60,6 +58,16 @@ export declare class SimIam implements SimIamInterServiceAuthZ {
      * request caller. An omitted caller defaults to the Account root principal.
      */
     authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
+    /**
+     * Identity-based policies this Account applies to one of its own principals.
+     *
+     * This is how another Account's IAM asks this Account what it grants a
+     * principal of its own, which is the caller's side of a cross-Account
+     * request. Real AWS requires that side to allow the action as well as the
+     * resource's own resource-based policy.
+     * @internal
+     */
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
     /**
      * Handle a Create Policy Command from the SDK.
      */
@@ -113,5 +121,4 @@ export declare class SimIam implements SimIamInterServiceAuthZ {
      */
     sdkCommandRouter(): SimSdkCommandRouter;
 }
-export {};
 //# sourceMappingURL=sim-iam.d.ts.map

package/dist/service/iam/sim-iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AACrE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,iEAAiE,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AAErE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qEAAqE,CAAC;AACxH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,UAAU,gBAAgB;IACxB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;CAClE;AAED;;;;;;;GAOG;AACH,qBAAa,MAAO,YAAW,uBAAuB;IACpD;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;IAEtD,SAAgB,QAAQ,wFAA0C;IAClE,SAAgB,KAAK,kCAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IACzD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,YAAY,UAAU,GAAE,gBAAqB,EAoD5C;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAE3C;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAElC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAE1C;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AACrE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,iEAAiE,CAAC;AACzE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,+DAA+D,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6DAA6D,CAAC;AAErE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qEAAqE,CAAC;AACxH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAC/G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAG5F,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;GAOG;AACH,qBAAa,MACX,YAAW,uBAAuB,EAAE,6BAA6B;IAEjE;;;;;OAKG;IACH,SAAgB,SAAS,EAAE,eAAe,CAAC;IAE3C;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;IAEtD,SAAgB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D,SAAgB,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAEvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,YAAY,UAAU,GAAE,gBAAqB,EAW5C;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAEpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAEvC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAExC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAE3C;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAElC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CAEpC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAErC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAE1C;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}