@kensio/yulin 0.40.0 → 0.42.0

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts

@@ -0,0 +1,55 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The alias of the AWS managed key Parameter Store encrypts with when a
+ * request names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export declare const ssmDefaultKeyAlias = "alias/aws/ssm";
+/**
+ * The service Parameter Store's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what lets a caller read a `SecureString` under the
+ * `aws/ssm` managed key with no KMS permission of its own: that key's policy
+ * admits the Account's principals only when the request reached KMS through
+ * Systems Manager.
+ */
+export declare const ssmKmsViaService = "ssm";
+/**
+ * The narrow slice of simulated KMS that SecureString parameters need.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so Encrypt and Decrypt are the whole of it.
+ * SimKms structurally implements this interface.
+ */
+export interface SimSsmKmsCrypto {
+    encrypt(command: {
+        input: {
+            KeyId?: string | undefined;
+            Plaintext?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: {
+        caller?: SimAwsCaller | undefined;
+        viaService?: string | undefined;
+    }): Promise<{
+        CiphertextBlob?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+    decrypt(command: {
+        input: {
+            CiphertextBlob?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: {
+        caller?: SimAwsCaller | undefined;
+        viaService?: string | undefined;
+    }): Promise<{
+        Plaintext?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+}
+//# sourceMappingURL=sim-ssm-kms-crypto.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-crypto.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3B,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACnC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,GACA,OAAO,CAAC;QACT,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;IAEH,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACxC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,GACA,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;CACJ"}

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js

@@ -0,0 +1,20 @@
+/**
+ * The alias of the AWS managed key Parameter Store encrypts with when a
+ * request names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export const ssmDefaultKeyAlias = "alias/aws/ssm";
+/**
+ * The service Parameter Store's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what lets a caller read a `SecureString` under the
+ * `aws/ssm` managed key with no KMS permission of its own: that key's policy
+ * admits the Account's principals only when the request reached KMS through
+ * Systems Manager.
+ */
+export const ssmKmsViaService = "ssm";
+//# sourceMappingURL=sim-ssm-kms-crypto.js.map

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-crypto.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-crypto.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Run a KMS call, reporting a refusal about the key the way Parameter Store
+ * reports it.
+ *
+ * Every key problem KMS raises becomes InvalidKeyId carrying the KMS message,
+ * which is what real Parameter Store does for a key that is missing, disabled
+ * or pending deletion. An access denial is not a KMS error and passes through
+ * untouched, so a missing `kms:Decrypt` still reads as a denial rather than a
+ * bad key.
+ */
+export declare function reportingKeyProblems<TResult>(call: () => Promise<TResult>): Promise<TResult>;
+//# sourceMappingURL=sim-ssm-kms-key-problems.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-key-problems.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-key-problems.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAChD,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.js

@@ -0,0 +1,24 @@
+import { SimKmsError } from "../../kms/error/sim-kms.error.js";
+import { SimSsmInvalidKeyId } from "../error/sim-ssm.error.js";
+/**
+ * Run a KMS call, reporting a refusal about the key the way Parameter Store
+ * reports it.
+ *
+ * Every key problem KMS raises becomes InvalidKeyId carrying the KMS message,
+ * which is what real Parameter Store does for a key that is missing, disabled
+ * or pending deletion. An access denial is not a KMS error and passes through
+ * untouched, so a missing `kms:Decrypt` still reads as a denial rather than a
+ * bad key.
+ */
+export async function reportingKeyProblems(call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        if (error instanceof SimKmsError) {
+            throw new SimSsmInvalidKeyId(`The KMS key cannot be used for this parameter: ${error.message}`);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=sim-ssm-kms-key-problems.js.map

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-key-problems.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-key-problems.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA4B;IAE5B,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAC1B,kDAAkD,KAAK,CAAC,OAAO,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.d.ts

@@ -0,0 +1,33 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+/**
+ * The part of a parameter ARN that comes before the parameter's own name.
+ *
+ * It ends in a slash, and the name follows it with its own leading slash
+ * dropped, so `/myapp/prod/db-host` becomes `...:parameter/myapp/prod/db-host`
+ * rather than `...:parameter//myapp/prod/db-host`.
+ */
+export declare function ssmParameterArnPrefix(accountRegionScope: SimAwsAccountRegionScope): string;
+interface SimSsmParameterArnProperties {
+    readonly resource: string;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The ARN of one simulated parameter.
+ *
+ * The single detail worth getting right here is the leading slash. A
+ * hierarchical parameter name starts with one and its ARN does not repeat it,
+ * so an IAM policy written as `...:parameter//myapp/prod/db-host` matches
+ * nothing. Building the ARN in one place is what makes a policy that works
+ * here one that would work on real AWS.
+ */
+export declare class SimSsmParameterArn {
+    /**
+     * The parameter name with its leading slash dropped, which is the part of
+     * the ARN after `parameter/`.
+     */
+    readonly resource: string;
+    readonly value: string;
+    constructor(properties: SimSsmParameterArnProperties);
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-arn.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,kBAAkB,EAAE,wBAAwB,GAC3C,MAAM,CAIR;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B;;;OAGG;IACH,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,UAAU,EAAE,4BAA4B,EAInD;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.js

@@ -0,0 +1,34 @@
+/**
+ * The part of a parameter ARN that comes before the parameter's own name.
+ *
+ * It ends in a slash, and the name follows it with its own leading slash
+ * dropped, so `/myapp/prod/db-host` becomes `...:parameter/myapp/prod/db-host`
+ * rather than `...:parameter//myapp/prod/db-host`.
+ */
+export function ssmParameterArnPrefix(accountRegionScope) {
+    const { regionName, accountId } = accountRegionScope;
+    return `arn:aws:ssm:${regionName}:${accountId}:parameter/`;
+}
+/**
+ * The ARN of one simulated parameter.
+ *
+ * The single detail worth getting right here is the leading slash. A
+ * hierarchical parameter name starts with one and its ARN does not repeat it,
+ * so an IAM policy written as `...:parameter//myapp/prod/db-host` matches
+ * nothing. Building the ARN in one place is what makes a policy that works
+ * here one that would work on real AWS.
+ */
+export class SimSsmParameterArn {
+    /**
+     * The parameter name with its leading slash dropped, which is the part of
+     * the ARN after `parameter/`.
+     */
+    resource;
+    value;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.value =
+            ssmParameterArnPrefix(properties.accountRegionScope) + this.resource;
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-arn.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-arn.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-arn.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,kBAA4C;IAE5C,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;IAErD,OAAO,eAAe,UAAU,IAAI,SAAS,aAAa,CAAC;AAC7D,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;;OAGG;IACa,QAAQ,CAAS;IAEjB,KAAK,CAAS;IAE9B,YAAY,UAAwC;QAClD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK;YACR,qBAAqB,CAAC,UAAU,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzE,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimSsmParameter } from "./sim-ssm-parameter.js";
+import type { SimSsmKmsCrypto } from "./sim-ssm-kms-crypto.js";
+import type { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+import { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
+import type { SimSsmParameterVersion } from "./sim-ssm-parameter-version.js";
+interface SimSsmParameterEncryptionProperties {
+    readonly kms: SimSsmKmsCrypto;
+}
+/**
+ * What a SecureString value is stored as, and which key protects it.
+ */
+export interface SimSsmEncryptedValue {
+    readonly value: SimSsmParameterValue;
+    readonly keyId: string | undefined;
+}
+/**
+ * Decides when a parameter value is encrypted and when it is decrypted.
+ *
+ * These rules are worth keeping apart from the KMS calls themselves, because
+ * they are what a caller actually trips over: a value stored in the clear
+ * because the type said so, and a read that gets a ciphertext back because it
+ * did not ask for decryption.
+ */
+export declare class SimSsmParameterEncryption {
+    private readonly kms;
+    constructor(properties: SimSsmParameterEncryptionProperties);
+    /**
+     * The stored form of a submitted value, encrypted if the type calls for it.
+     */
+    stored(type: SimSsmParameterType, parameterArn: string, submitted: SimSsmParameterValue, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmEncryptedValue>;
+    /**
+     * The value a read reports, decrypted only when it was asked for.
+     *
+     * `WithDecryption` on a parameter that is not encrypted is ignored rather
+     * than refused, as real Parameter Store ignores it.
+     */
+    reported(parameter: SimSsmParameter, version: SimSsmParameterVersion, withDecryption: boolean | undefined, caller: SimAwsCaller | undefined): Promise<string>;
+    private refuseKeyIdWithoutSecureString;
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-encryption.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-encryption.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,mBAAmB,EACzB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,oBAAoB,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;IAED;;;;;OAKG;IACG,QAAQ,CACZ,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,sBAAsB,EAC/B,cAAc,EAAE,OAAO,GAAG,SAAS,EACnC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,MAAM,CAAC,CAUjB;IAED,OAAO,CAAC,8BAA8B;CAcvC"}

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.js

@@ -0,0 +1,52 @@
+import { SimSsmValidationException } from "../error/sim-ssm.error.js";
+import { SimSsmParameterKms } from "./sim-ssm-parameter-kms.js";
+import { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
+/**
+ * Decides when a parameter value is encrypted and when it is decrypted.
+ *
+ * These rules are worth keeping apart from the KMS calls themselves, because
+ * they are what a caller actually trips over: a value stored in the clear
+ * because the type said so, and a read that gets a ciphertext back because it
+ * did not ask for decryption.
+ */
+export class SimSsmParameterEncryption {
+    kms;
+    constructor(properties) {
+        this.kms = new SimSsmParameterKms(properties);
+    }
+    /**
+     * The stored form of a submitted value, encrypted if the type calls for it.
+     */
+    async stored(type, parameterArn, submitted, keyId, caller) {
+        if (!type.isSecure) {
+            this.refuseKeyIdWithoutSecureString(type, keyId);
+            return { value: submitted, keyId: undefined };
+        }
+        const encrypted = await this.kms.encrypt(parameterArn, submitted.value, keyId, caller);
+        return {
+            value: SimSsmParameterValue.encrypted(encrypted.ciphertext),
+            keyId: encrypted.keyId,
+        };
+    }
+    /**
+     * The value a read reports, decrypted only when it was asked for.
+     *
+     * `WithDecryption` on a parameter that is not encrypted is ignored rather
+     * than refused, as real Parameter Store ignores it.
+     */
+    async reported(parameter, version, withDecryption, caller) {
+        if (!parameter.type.isSecure || withDecryption !== true) {
+            return version.value.value;
+        }
+        return await this.kms.decrypt(parameter.arn.value, version.value.value, caller);
+    }
+    refuseKeyIdWithoutSecureString(type, keyId) {
+        if (keyId === undefined) {
+            return;
+        }
+        throw new SimSsmValidationException(`KeyId applies to a SecureString parameter, and this one is a ` +
+            `${type.value} parameter. A value stored in the clear is not ` +
+            `encrypted with anything.`);
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-encryption.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-encryption.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-encryption.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAepE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,GAAG,CAAqB;IAEzC,YAAY,UAA+C;QACzD,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAyB,EACzB,YAAoB,EACpB,SAA+B,EAC/B,KAAyB,EACzB,MAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAEjD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACtC,YAAY,EACZ,SAAS,CAAC,KAAK,EACf,KAAK,EACL,MAAM,CACP,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3D,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,SAA0B,EAC1B,OAA+B,EAC/B,cAAmC,EACnC,MAAgC;QAEhC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAC3B,SAAS,CAAC,GAAG,CAAC,KAAK,EACnB,OAAO,CAAC,KAAK,CAAC,KAAK,EACnB,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,8BAA8B,CACpC,IAAyB,EACzB,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,+DAA+D;YAC7D,GAAG,IAAI,CAAC,KAAK,iDAAiD;YAC9D,0BAA0B,CAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts

@@ -0,0 +1,43 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import { type SimSsmKmsCrypto } from "./sim-ssm-kms-crypto.js";
+/**
+ * What KMS produced for one parameter value.
+ */
+export interface SimSsmParameterCiphertext {
+    readonly ciphertext: string;
+    readonly keyId: string | undefined;
+}
+interface SimSsmParameterKmsProperties {
+    readonly kms: SimSsmKmsCrypto;
+}
+/**
+ * The KMS calls a SecureString parameter makes.
+ *
+ * The calls are made as the caller rather than as the service, which is the
+ * point: under a customer managed key a standard tier write needs
+ * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
+ * top of the SSM permission for the parameter itself.
+ *
+ * They are also made through the service, which is why the `aws/ssm` managed
+ * key needs no KMS permission at all: its policy admits the Account's
+ * principals when `kms:ViaService` names Systems Manager, and Parameter Store
+ * is what supplies that.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so this is one Encrypt and one Decrypt and nothing more.
+ */
+export declare class SimSsmParameterKms {
+    private readonly kms;
+    constructor(properties: SimSsmParameterKmsProperties);
+    /**
+     * Encrypt a parameter value, bound to the ARN of the parameter holding it.
+     */
+    encrypt(parameterArn: string, plaintext: string, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmParameterCiphertext>;
+    /**
+     * Decrypt a parameter value, which needs the same binding it was made with.
+     */
+    decrypt(parameterArn: string, ciphertext: string, caller: SimAwsCaller | undefined): Promise<string>;
+    private contextFor;
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-kms.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-kms.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-kms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAYjC;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IAEtC,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;OAEG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,yBAAyB,CAAC,CAwBpC;IAED;;OAEG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,MAAM,CAAC,CAoBjB;IAED,OAAO,CAAC,UAAU;CAGnB"}

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js

@@ -0,0 +1,68 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { reportingKeyProblems } from "./sim-ssm-kms-key-problems.js";
+import { ssmDefaultKeyAlias, ssmKmsViaService, } from "./sim-ssm-kms-crypto.js";
+/**
+ * The encryption context key Parameter Store binds every SecureString value
+ * to, holding the ARN of the parameter being encrypted.
+ *
+ * Binding it means a ciphertext lifted out of one parameter cannot be
+ * decrypted as another, and it is what a `kms:EncryptionContext:PARAMETER_ARN`
+ * policy condition matches on real AWS.
+ */
+const parameterArnContextKey = "PARAMETER_ARN";
+/**
+ * The KMS calls a SecureString parameter makes.
+ *
+ * The calls are made as the caller rather than as the service, which is the
+ * point: under a customer managed key a standard tier write needs
+ * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
+ * top of the SSM permission for the parameter itself.
+ *
+ * They are also made through the service, which is why the `aws/ssm` managed
+ * key needs no KMS permission at all: its policy admits the Account's
+ * principals when `kms:ViaService` names Systems Manager, and Parameter Store
+ * is what supplies that.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so this is one Encrypt and one Decrypt and nothing more.
+ */
+export class SimSsmParameterKms {
+    kms;
+    constructor(properties) {
+        this.kms = properties.kms;
+    }
+    /**
+     * Encrypt a parameter value, bound to the ARN of the parameter holding it.
+     */
+    async encrypt(parameterArn, plaintext, keyId, caller) {
+        const encrypted = await reportingKeyProblems(async () => await this.kms.encrypt({
+            input: {
+                KeyId: keyId ?? ssmDefaultKeyAlias,
+                Plaintext: Buffer.from(plaintext, "utf8"),
+                EncryptionContext: this.contextFor(parameterArn),
+            },
+        }, { caller, viaService: ssmKmsViaService }));
+        assertDefined(encrypted.CiphertextBlob, `Simulated KMS encrypted ${parameterArn} to nothing`);
+        return {
+            ciphertext: Buffer.from(encrypted.CiphertextBlob).toString("base64"),
+            keyId: encrypted.KeyId,
+        };
+    }
+    /**
+     * Decrypt a parameter value, which needs the same binding it was made with.
+     */
+    async decrypt(parameterArn, ciphertext, caller) {
+        const decrypted = await reportingKeyProblems(async () => await this.kms.decrypt({
+            input: {
+                CiphertextBlob: Buffer.from(ciphertext, "base64"),
+                EncryptionContext: this.contextFor(parameterArn),
+            },
+        }, { caller, viaService: ssmKmsViaService }));
+        assertDefined(decrypted.Plaintext, `Simulated KMS decrypted ${parameterArn} to nothing`);
+        return Buffer.from(decrypted.Plaintext).toString("utf8");
+    }
+    contextFor(parameterArn) {
+        return { [parameterArnContextKey]: parameterArn };
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-kms.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-kms.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-kms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAc/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAkB;IAEtC,YAAY,UAAwC;QAClD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,SAAiB,EACjB,KAAyB,EACzB,MAAgC;QAEhC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB;YACE,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK,IAAI,kBAAkB;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;gBACzC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;aACjD;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACzC,CACJ,CAAC;QAEF,aAAa,CACX,SAAS,CAAC,cAAc,EACxB,2BAA2B,YAAY,aAAa,CACrD,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACpE,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,UAAkB,EAClB,MAAgC;QAEhC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB;YACE,KAAK,EAAE;gBACL,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACjD,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;aACjD;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACzC,CACJ,CAAC;QAEF,aAAa,CACX,SAAS,CAAC,SAAS,EACnB,2BAA2B,YAAY,aAAa,CACrD,CAAC;QAEF,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAEO,UAAU,CAAC,YAAoB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-name.d.ts

@@ -0,0 +1,48 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+interface SimSsmParameterNameProperties {
+    readonly name: string | undefined;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The name of one simulated parameter, validated as real Parameter Store
+ * validates it.
+ *
+ * The rules are worth applying in one place because they are a common
+ * deploy-time failure rather than an obscure edge: a hierarchy missing its
+ * leading slash, a name under the reserved `/aws` prefix, or a hierarchy
+ * sixteen levels deep all fail at PutParameter on real AWS.
+ */
+export declare class SimSsmParameterName {
+    /**
+     * The name as Parameter Store stores and reports it, leading slash and all.
+     */
+    readonly value: string;
+    /**
+     * The name with any leading slash dropped, which is how it appears in the
+     * parameter's ARN and how this simulation keys it.
+     */
+    readonly resource: string;
+    constructor(properties: SimSsmParameterNameProperties);
+    /**
+     * Normalize a name to the resource part of its ARN.
+     *
+     * A parameter put as `db-host` and one read as `/db-host` are the same
+     * parameter, because both name the same ARN. Keying on this form is what
+     * makes the two interchangeable.
+     */
+    static resourceFor(name: string): string;
+    private static trimmed;
+    private requireAllowedCharacters;
+    /**
+     * Refuse a hierarchy that Parameter Store would refuse.
+     *
+     * The leading slash is the one people actually get wrong: a name written as
+     * `myapp/prod/db-host` looks fine and is rejected on real AWS, because a
+     * name containing a hierarchy has to be fully qualified.
+     */
+    private requireWellFormedHierarchy;
+    private requireUnreservedPrefix;
+    private requireWithinArnLength;
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-name.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-name.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-name.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAsB1F,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B;;OAEG;IACH,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,YAAY,UAAU,EAAE,6BAA6B,EAUpD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvC;IAED,OAAO,CAAC,MAAM,CAAC,OAAO;IAoBtB,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IA6BlC,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,sBAAsB;CAgB/B"}

package/dist/service/ssm/parameter/sim-ssm-parameter-name.js

@@ -0,0 +1,117 @@
+import { SimSsmHierarchyLevelLimitExceededException, SimSsmParameterPatternMismatchException, SimSsmValidationException, } from "../error/sim-ssm.error.js";
+import { ssmParameterArnPrefix } from "./sim-ssm-parameter-arn.js";
+const allowedCharacters = /^[\w./-]+$/;
+const maxHierarchyLevels = 15;
+const reservedPrefixes = ["aws", "ssm"];
+/**
+ * The longest a parameter name may be, counting the ARN that precedes it.
+ *
+ * Real Parameter Store reserves the rest of the 2048 character ARN for its own
+ * use, and counts the ARN prefix towards the 1011 characters left. That is why
+ * this limit needs the Account and Region: the same name is legal in one
+ * Region and too long in another.
+ */
+const maxArnLength = 1011;
+/**
+ * The name of one simulated parameter, validated as real Parameter Store
+ * validates it.
+ *
+ * The rules are worth applying in one place because they are a common
+ * deploy-time failure rather than an obscure edge: a hierarchy missing its
+ * leading slash, a name under the reserved `/aws` prefix, or a hierarchy
+ * sixteen levels deep all fail at PutParameter on real AWS.
+ */
+export class SimSsmParameterName {
+    /**
+     * The name as Parameter Store stores and reports it, leading slash and all.
+     */
+    value;
+    /**
+     * The name with any leading slash dropped, which is how it appears in the
+     * parameter's ARN and how this simulation keys it.
+     */
+    resource;
+    constructor(properties) {
+        const name = SimSsmParameterName.trimmed(properties.name);
+        this.value = name;
+        this.resource = SimSsmParameterName.resourceFor(name);
+        this.requireAllowedCharacters(name);
+        this.requireWellFormedHierarchy(name);
+        this.requireUnreservedPrefix();
+        this.requireWithinArnLength(properties.accountRegionScope);
+    }
+    /**
+     * Normalize a name to the resource part of its ARN.
+     *
+     * A parameter put as `db-host` and one read as `/db-host` are the same
+     * parameter, because both name the same ARN. Keying on this form is what
+     * makes the two interchangeable.
+     */
+    static resourceFor(name) {
+        return name.trim().replace(/^\//, "");
+    }
+    static trimmed(name) {
+        if (name === undefined || name.trim() === "") {
+            throw new SimSsmValidationException("A parameter name is required and cannot be empty");
+        }
+        // Real Parameter Store strips surrounding spaces and refuses inner ones.
+        const trimmed = name.trim();
+        if (trimmed.includes(" ")) {
+            throw new SimSsmValidationException(`Parameter name '${trimmed}' contains spaces, which Parameter Store ` +
+                `does not allow between characters`);
+        }
+        return trimmed;
+    }
+    requireAllowedCharacters(name) {
+        if (allowedCharacters.test(name)) {
+            return;
+        }
+        throw new SimSsmParameterPatternMismatchException(`Parameter name '${name}' contains characters Parameter Store does not ` +
+            `allow: only letters, digits, the characters _.- and the / hierarchy ` +
+            `separator are permitted`);
+    }
+    /**
+     * Refuse a hierarchy that Parameter Store would refuse.
+     *
+     * The leading slash is the one people actually get wrong: a name written as
+     * `myapp/prod/db-host` looks fine and is rejected on real AWS, because a
+     * name containing a hierarchy has to be fully qualified.
+     */
+    requireWellFormedHierarchy(name) {
+        if (!name.includes("/")) {
+            return;
+        }
+        if (!name.startsWith("/")) {
+            throw new SimSsmParameterPatternMismatchException(`Parameter name '${name}' is hierarchical, so it must start with a ` +
+                `forward slash: '/${name}'`);
+        }
+        const levels = this.resource.split("/");
+        if (levels.includes("")) {
+            throw new SimSsmParameterPatternMismatchException(`Parameter name '${name}' has an empty hierarchy level`);
+        }
+        if (levels.length > maxHierarchyLevels) {
+            throw new SimSsmHierarchyLevelLimitExceededException(`Parameter name '${name}' has ${String(levels.length)} hierarchy ` +
+                `levels; a hierarchy can have a maximum of ` +
+                `${String(maxHierarchyLevels)} levels`);
+        }
+    }
+    requireUnreservedPrefix() {
+        const lowerCased = this.resource.toLowerCase();
+        const reserved = reservedPrefixes.find((prefix) => lowerCased.startsWith(prefix));
+        if (reserved === undefined) {
+            return;
+        }
+        throw new SimSsmParameterPatternMismatchException(`Parameter name '${this.value}' starts with '${reserved}', which ` +
+            `Parameter Store reserves for its own parameters`);
+    }
+    requireWithinArnLength(accountRegionScope) {
+        const arnLength = ssmParameterArnPrefix(accountRegionScope).length + this.resource.length;
+        if (arnLength <= maxArnLength) {
+            return;
+        }
+        throw new SimSsmValidationException(`Parameter name '${this.value}' makes an ARN of ${String(arnLength)} ` +
+            `characters; Parameter Store allows ${String(maxArnLength)} ` +
+            `including the ARN prefix for this Account and Region`);
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-name.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-name.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-name.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0CAA0C,EAC1C,uCAAuC,EACvC,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,iBAAiB,GAAG,YAAY,CAAC;AACvC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAO1B;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;OAEG;IACa,KAAK,CAAS;IAE9B;;;OAGG;IACa,QAAQ,CAAS;IAEjC,YAAY,UAAyC;QACnD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEtD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,IAAwB;QAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CACjC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,OAAO,2CAA2C;gBACnE,mCAAmC,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,wBAAwB,CAAC,IAAY;QAC3C,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,uCAAuC,CAC/C,mBAAmB,IAAI,iDAAiD;YACtE,sEAAsE;YACtE,yBAAyB,CAC5B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,0BAA0B,CAAC,IAAY;QAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,uCAAuC,CAC/C,mBAAmB,IAAI,6CAA6C;gBAClE,oBAAoB,IAAI,GAAG,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uCAAuC,CAC/C,mBAAmB,IAAI,gCAAgC,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACvC,MAAM,IAAI,0CAA0C,CAClD,mBAAmB,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;gBAChE,4CAA4C;gBAC5C,GAAG,MAAM,CAAC,kBAAkB,CAAC,SAAS,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAC9B,CAAC;QAEF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,uCAAuC,CAC/C,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,QAAQ,WAAW;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAC5B,kBAA4C;QAE5C,MAAM,SAAS,GACb,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAE1E,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,IAAI,CAAC,KAAK,qBAAqB,MAAM,CAAC,SAAS,CAAC,GAAG;YACpE,sCAAsC,MAAM,CAAC,YAAY,CAAC,GAAG;YAC7D,sDAAsD,CACzD,CAAC;IACJ,CAAC;CACF"}