@kensio/yulin 1.16.3 → 1.17.1

package/dist/service/elbv2/serve/api/sim-elbv2-query-target-operations.js

@@ -0,0 +1,64 @@
+import { queryList, queryMembers, } from "../../../../serve/http/api/query/sim-query-result.js";
+import { elbV2QueryNumber } from "./sim-elbv2-query-input.js";
+import { elbV2QueryStructure } from "./sim-elbv2-query-result.js";
+/**
+ * The members ELB names one target with.
+ */
+const targetMembers = ["Id", "Port", "AvailabilityZone"];
+/**
+ * The target operations simulated ELBv2 serves over the Query protocol.
+ */
+export function simElbV2QueryTargetOperations() {
+    return new Map([
+        [
+            "RegisterTargets",
+            {
+                input: targetsInput,
+                result: () => "",
+            },
+        ],
+        [
+            "DeregisterTargets",
+            {
+                input: targetsInput,
+                result: () => "",
+            },
+        ],
+        [
+            "DescribeTargetHealth",
+            {
+                input: targetsInput,
+                result: targetHealthResult,
+            },
+        ],
+    ]);
+}
+/**
+ * Write the health ELB reports each target is in.
+ *
+ * Every target here is healthy, since nothing makes a request to one to find
+ * out, so what this carries is the shape a caller reads a health check result
+ * out of rather than a verdict.
+ */
+function targetHealthResult(output) {
+    return queryList(output, "TargetHealthDescriptions", (described) => elbV2QueryStructure(described, "Target", (target) => queryMembers(target, targetMembers)) +
+        elbV2QueryStructure(described, "TargetHealth", (health) => queryMembers(health, ["State", "Description"])));
+}
+/**
+ * The input all three target operations share: a target group, and the targets
+ * in it the request is about.
+ *
+ * A describe that names none is asking about every target registered, which is
+ * why an omitted list stays omitted rather than becoming an empty one.
+ */
+function targetsInput(fields) {
+    return {
+        TargetGroupArn: fields.text("TargetGroupArn"),
+        Targets: fields.list("Targets", (target) => ({
+            Id: target.text("Id"),
+            Port: elbV2QueryNumber(target, "Port"),
+            AvailabilityZone: target.text("AvailabilityZone"),
+        })),
+    };
+}
+//# sourceMappingURL=sim-elbv2-query-target-operations.js.map

package/dist/service/elbv2/serve/api/sim-elbv2-query-target-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-elbv2-query-target-operations.js","sourceRoot":"","sources":["../../../../../src/service/elbv2/serve/api/sim-elbv2-query-target-operations.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,SAAS,EACT,YAAY,GACb,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAEzD;;GAEG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO,IAAI,GAAG,CAAC;QACb;YACE,iBAAiB;YACjB;gBACE,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,GAAW,EAAE,CAAC,EAAE;aACzB;SACF;QACD;YACE,mBAAmB;YACnB;gBACE,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,GAAW,EAAE,CAAC,EAAE;aACzB;SACF;QACD;YACE,sBAAsB;YACtB;gBACE,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,kBAAkB;aAC3B;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAsB;IAChD,OAAO,SAAS,CACd,MAAM,EACN,0BAA0B,EAC1B,CAAC,SAAS,EAAE,EAAE,CACZ,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAClD,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CACpC;QACD,mBAAmB,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CACxD,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAC/C,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAsB;IAC1C,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC7C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACrB,IAAI,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YACtC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;SAClD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts

@@ -0,0 +1,40 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimIam } from "../../sim-iam.js";
+import type { SimIamRoleName } from "../../role/sim-iam-role.js";
+interface SimCfnIamManagedPolicyAttacherProperties {
+    readonly iam: SimIam;
+}
+/**
+ * Attaches a CloudFormation-created Managed Policy to the principals its
+ * Resource names.
+ *
+ * `Roles` names the Roles the policy is attached to as it is created, which is
+ * the attachment AttachRolePolicy records. `Users` and `Groups` name
+ * principals with nowhere to hold a managed policy attachment here, and both
+ * fail the Resource. Dropping the grant a template asked for without saying so
+ * would be misleading.
+ */
+export declare class SimCfnIamManagedPolicyAttacher {
+    private readonly iam;
+    constructor(properties: SimCfnIamManagedPolicyAttacherProperties);
+    /**
+     * The Roles an AWS::IAM::ManagedPolicy Resource attaches itself to. Role
+     * Refs are resolved to Role names before creation, so entries arrive as
+     * plain strings.
+     *
+     * A name no simulated Role answers to fails the Resource before the policy
+     * is created. Checking afterwards would leave a policy behind with nothing
+     * attached to it.
+     */
+    roleNames(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): readonly SimIamRoleName[];
+    /**
+     * Attach the created Managed Policy to each of the Roles.
+     */
+    attach(policyArn: SimArn, roleNames: readonly SimIamRoleName[]): Promise<void>;
+    private roleName;
+    private rejectUnsimulatedPrincipals;
+}
+export {};
+//# sourceMappingURL=sim-cfn-iam-managed-policy-attacher.d.ts.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-attacher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;;;;;;OAQG;IACH,SAAS,CACP,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,SAAS,cAAc,EAAE,CAgB3B;IAED;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAQf;IAED,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,2BAA2B;CAcpC"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js

@@ -0,0 +1,65 @@
+import { SimIamNoSuchEntity } from "../../error/sim-iam.error.js";
+/**
+ * Attaches a CloudFormation-created Managed Policy to the principals its
+ * Resource names.
+ *
+ * `Roles` names the Roles the policy is attached to as it is created, which is
+ * the attachment AttachRolePolicy records. `Users` and `Groups` name
+ * principals with nowhere to hold a managed policy attachment here, and both
+ * fail the Resource. Dropping the grant a template asked for without saying so
+ * would be misleading.
+ */
+export class SimCfnIamManagedPolicyAttacher {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * The Roles an AWS::IAM::ManagedPolicy Resource attaches itself to. Role
+     * Refs are resolved to Role names before creation, so entries arrive as
+     * plain strings.
+     *
+     * A name no simulated Role answers to fails the Resource before the policy
+     * is created. Checking afterwards would leave a policy behind with nothing
+     * attached to it.
+     */
+    roleNames(resource, properties) {
+        this.rejectUnsimulatedPrincipals(resource, properties);
+        const roles = properties["Roles"];
+        if (roles === undefined) {
+            return [];
+        }
+        if (!Array.isArray(roles)) {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Roles must be an array`);
+        }
+        return roles.map((roleName) => this.roleName(resource, roleName));
+    }
+    /**
+     * Attach the created Managed Policy to each of the Roles.
+     */
+    async attach(policyArn, roleNames) {
+        await Promise.all(roleNames.map(async (roleName) => this.iam.attachRolePolicy({
+            input: { RoleName: roleName, PolicyArn: policyArn },
+        })));
+    }
+    roleName(resource, roleName) {
+        if (typeof roleName !== "string") {
+            throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: Roles entries must be strings`);
+        }
+        const simRoleName = roleName;
+        if (!this.iam.roles.has(simRoleName)) {
+            throw new SimIamNoSuchEntity(`No IAM Role with name ${roleName}`);
+        }
+        return simRoleName;
+    }
+    rejectUnsimulatedPrincipals(resource, properties) {
+        for (const principalProperty of ["Users", "Groups"]) {
+            // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
+            if (properties[principalProperty] !== undefined) {
+                throw new TypeError(`Invalid AWS::IAM::ManagedPolicy ${resource.logicalId}: ` +
+                    `${principalProperty} are not simulated`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-managed-policy-attacher.js.map

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-managed-policy-attacher.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-attacher.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAMlE;;;;;;;;;GASG;AACH,MAAM,OAAO,8BAA8B;IACxB,GAAG,CAAS;IAE7B,YAAY,UAAoD;QAC9D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CACP,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,0BAA0B,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,SAAiB,EACjB,SAAoC;QAEpC,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;SACpD,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,QAAwB,EACxB,QAAiB;QAEjB,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,iCAAiC,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,QAA0B,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,2BAA2B,CACjC,QAAwB,EACxB,UAAqC;QAErC,KAAK,MAAM,iBAAiB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,qFAAqF;YACrF,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,IAAI;oBACvD,GAAG,iBAAiB,oBAAoB,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts

@@ -10,6 +10,7 @@ interface SimCfnIamManagedPolicyCreatorProperties {
  */
 export declare class SimCfnIamManagedPolicyCreator {
     private readonly iam;
+    private readonly attacher;
     constructor(properties: SimCfnIamManagedPolicyCreatorProperties);
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-managed-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,uCAAuC,EAE9D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;CAmBvB"}
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAI1E,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAE1D,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;IAED,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js

@@ -1,16 +1,20 @@
+import { SimCfnIamManagedPolicyAttacher } from "./sim-cfn-iam-managed-policy-attacher.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 /**
  * Creates simulated IAM Managed Policies from CloudFormation Resources.
  */
 export class SimCfnIamManagedPolicyCreator {
     iam;
+    attacher;
     constructor(properties) {
         this.iam = properties.iam;
+        this.attacher = new SimCfnIamManagedPolicyAttacher({ iam: properties.iam });
     }
     /**
      * Create a simulated Managed Policy from an AWS::IAM::ManagedPolicy Resource.
      */
     async create(resource, properties) {
+        const roleNames = this.attacher.roleNames(resource, properties);
         const policyName = this.managedPolicyName(resource, properties);
         const path = this.path(resource, properties);
         const description = this.description(resource, properties);
@@ -25,6 +29,7 @@ export class SimCfnIamManagedPolicyCreator {
         });
         const policy = this.iam.policies.get(policyCreation.Policy.Arn);
         assertDefined(policy, `Sim IAM Managed Policy ${policyCreation.Policy.Arn} after CloudFormation creation`);
+        await this.attacher.attach(policy.arn, roleNames);
         return policy;
     }
     managedPolicyName(resource, properties) {

package/dist/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-managed-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAAS;IAE7B,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,aAAa,CACX,MAAM,EACN,0BAA0B,cAAc,CAAC,MAAM,CAAC,GAAG,gCAAgC,CACpF,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,sCAAsC,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,IAAI,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,yBAAyB,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,gCAAgC,CACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-managed-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/managed-policy/sim-cfn-iam-managed-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAAS;IACZ,QAAQ,CAAiC;IAE1D,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,8BAA8B,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,WAAW;gBACxB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,aAAa,CACX,MAAM,EACN,0BAA0B,cAAc,CAAC,MAAM,CAAC,GAAG,gCAAgC,CACpF,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAElD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE1D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,sCAAsC,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,IAAI,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,yBAAyB,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,QAAwB,EACxB,UAAqC;QAErC,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAE9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,gCAAgC,CACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,mCAAmC,QAAQ,CAAC,SAAS,oCAAoC,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts

@@ -5,35 +5,26 @@ interface SimCfnIamPolicyCreatorProperties {
     readonly iam: SimIam;
 }
 /**
- * Creates simulated IAM inline role policies from AWS::IAM::Policy
- * CloudFormation Resources.
+ * Creates simulated IAM inline policies from AWS::IAM::Policy CloudFormation
+ * Resources.
  *
  * AWS::IAM::Policy is an inline policy put onto the referenced principals,
- * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
- * a function's execution role (the "DefaultPolicy" resource). Only Roles are
- * simulated; the policy has no standalone stored resource, so creation
- * returns undefined and Ref resolution uses the default adapter.
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to a
+ * function's execution role, and bucket.grantRead(user) to a user (the
+ * "DefaultPolicy" resource). Roles and Users are simulated. The policy has no
+ * standalone stored resource, so creation returns undefined and Ref resolution
+ * uses the default adapter.
  */
 export declare class SimCfnIamPolicyCreator {
     private readonly iam;
+    private readonly propsParser;
     constructor(properties: SimCfnIamPolicyCreatorProperties);
     /**
-     * Put the inline policy onto each referenced Role.
+     * Put the inline policy onto each referenced Role and User.
      */
     create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<undefined>;
-    private policyName;
-    private policyDocument;
-    /**
-     * The Role names the policy attaches to. Role Refs are resolved to Role
-     * names before creation, so entries arrive as plain strings.
-     */
-    private roleNames;
-    /**
-     * IAM Users and Groups are not simulated as CloudFormation policy
-     * principals, and silently dropping a grant would be misleading, so their
-     * presence fails creation.
-     */
-    private rejectUnsimulatedPrincipals;
+    private putRolePolicies;
+    private putUserPolicies;
 }
 export {};
 //# sourceMappingURL=sim-cfn-iam-policy-creator.d.ts.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,cAAc;IAoBtB;;;OAGG;IACH,OAAO,CAAC,SAAS;IAsBjB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;CAcpC"}
+{"version":3,"file":"sim-cfn-iam-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;IAErE,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,SAAS,CAAC,CASpB;YAEa,eAAe;YAgBf,eAAe;CAe9B"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js

@@ -1,81 +1,49 @@
+import { SimCfnIamPolicyPropertiesParser, } from "./sim-cfn-iam-policy-properties-parser.js";
 /**
- * Creates simulated IAM inline role policies from AWS::IAM::Policy
- * CloudFormation Resources.
+ * Creates simulated IAM inline policies from AWS::IAM::Policy CloudFormation
+ * Resources.
  *
  * AWS::IAM::Policy is an inline policy put onto the referenced principals,
- * which is how CDK grants such as bucket.grantRead(fn) attach permissions to
- * a function's execution role (the "DefaultPolicy" resource). Only Roles are
- * simulated; the policy has no standalone stored resource, so creation
- * returns undefined and Ref resolution uses the default adapter.
+ * which is how CDK grants such as bucket.grantRead(fn) attach permissions to a
+ * function's execution role, and bucket.grantRead(user) to a user (the
+ * "DefaultPolicy" resource). Roles and Users are simulated. The policy has no
+ * standalone stored resource, so creation returns undefined and Ref resolution
+ * uses the default adapter.
  */
 export class SimCfnIamPolicyCreator {
     iam;
+    propsParser = new SimCfnIamPolicyPropertiesParser();
     constructor(properties) {
         this.iam = properties.iam;
     }
     /**
-     * Put the inline policy onto each referenced Role.
+     * Put the inline policy onto each referenced Role and User.
      */
     async create(resource, properties) {
-        this.rejectUnsimulatedPrincipals(resource, properties);
-        const policyName = this.policyName(resource, properties);
-        const policyDocument = this.policyDocument(resource, properties);
-        const roleNames = this.roleNames(resource, properties);
-        await Promise.all(roleNames.map(async (roleName) => this.iam.putRolePolicy({
+        const policyProperties = this.propsParser.parse(resource, properties);
+        await Promise.all([
+            this.putRolePolicies(policyProperties),
+            this.putUserPolicies(policyProperties),
+        ]);
+        return undefined;
+    }
+    async putRolePolicies(policyProperties) {
+        await Promise.all(policyProperties.roleNames.map(async (roleName) => this.iam.putRolePolicy({
             input: {
                 RoleName: roleName,
-                PolicyName: policyName,
-                PolicyDocument: policyDocument,
+                PolicyName: policyProperties.policyName,
+                PolicyDocument: policyProperties.policyDocument,
             },
         })));
-        return undefined;
-    }
-    policyName(resource, properties) {
-        const policyName = properties["PolicyName"];
-        if (typeof policyName !== "string") {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyName must be a string`);
-        }
-        return policyName;
     }
-    policyDocument(resource, properties) {
-        const policyDocument = properties["PolicyDocument"];
-        if (policyDocument === undefined ||
-            typeof policyDocument !== "object" ||
-            policyDocument === null ||
-            Array.isArray(policyDocument)) {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: PolicyDocument must be an object`);
-        }
-        return JSON.stringify(policyDocument);
-    }
-    /**
-     * The Role names the policy attaches to. Role Refs are resolved to Role
-     * names before creation, so entries arrive as plain strings.
-     */
-    roleNames(resource, properties) {
-        const roles = properties["Roles"];
-        if (!Array.isArray(roles) || roles.length === 0) {
-            throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles must be a non-empty array`);
-        }
-        return roles.map((roleName) => {
-            if (typeof roleName !== "string") {
-                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: Roles entries must be strings`);
-            }
-            return roleName;
-        });
-    }
-    /**
-     * IAM Users and Groups are not simulated as CloudFormation policy
-     * principals, and silently dropping a grant would be misleading, so their
-     * presence fails creation.
-     */
-    rejectUnsimulatedPrincipals(resource, properties) {
-        for (const principalProperty of ["Users", "Groups"]) {
-            // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
-            if (properties[principalProperty] !== undefined) {
-                throw new TypeError(`Invalid AWS::IAM::Policy ${resource.logicalId}: ` +
-                    `${principalProperty} are not simulated`);
-            }
-        }
+    async putUserPolicies(policyProperties) {
+        await Promise.all(policyProperties.usernames.map(async (username) => this.iam.putUserPolicy({
+            input: {
+                UserName: username,
+                PolicyName: policyProperties.policyName,
+                PolicyDocument: policyProperties.policyDocument,
+            },
+        })));
     }
 }
 //# sourceMappingURL=sim-cfn-iam-policy-creator.js.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IAE7B,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,UAAU;gBACtB,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CACH,CACF,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,+BAA+B,CAC9E,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,cAAc,KAAK,SAAS;YAC5B,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,oCAAoC,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,QAAwB,EACxB,UAAqC;QAErC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,mCAAmC,CAClF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,iCAAiC,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,2BAA2B,CACjC,QAAwB,EACxB,UAAqC;QAErC,KAAK,MAAM,iBAAiB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,qFAAqF;YACrF,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,SAAS,CACjB,4BAA4B,QAAQ,CAAC,SAAS,IAAI;oBAChD,GAAG,iBAAiB,oBAAoB,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-creator.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,+BAA+B,GAEhC,MAAM,2CAA2C,CAAC;AAMnD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAAS;IACZ,WAAW,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAErE,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEtE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;SACvC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,gBAA2C;QAE3C,MAAM,OAAO,CAAC,GAAG,CACf,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,cAAc,EAAE,gBAAgB,CAAC,cAAc;aAChD;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,gBAA2C;QAE3C,MAAM,OAAO,CAAC,GAAG,CACf,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrB,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,cAAc,EAAE,gBAAgB,CAAC,cAAc;aAChD;SACF,CAAC,CACH,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.d.ts

@@ -0,0 +1,38 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+export interface SimCfnIamPolicyProperties {
+    readonly policyName: string;
+    readonly policyDocument: string;
+    readonly roleNames: readonly string[];
+    readonly usernames: readonly string[];
+}
+/**
+ * Parses and validates AWS::IAM::Policy CloudFormation properties into the
+ * shape the sim IAM inline policy creator needs.
+ *
+ * Keeping the property-shape validation here keeps the creator focused on
+ * orchestrating IAM command calls.
+ */
+export declare class SimCfnIamPolicyPropertiesParser {
+    /**
+     * Parse the resolved CloudFormation properties for an AWS::IAM::Policy.
+     */
+    parse(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCfnIamPolicyProperties;
+    private policyName;
+    private policyDocument;
+    /**
+     * The principal names one property attaches the policy to. Role and User
+     * Refs are resolved to names before creation, so entries arrive as plain
+     * strings. An absent property is not an error on its own, because a policy
+     * naming only the other kind of principal is the usual CDK shape.
+     */
+    private principalNames;
+    /**
+     * IAM Groups are not simulated as CloudFormation policy principals, and
+     * silently dropping a grant would be misleading, so their presence fails
+     * creation.
+     */
+    private rejectGroups;
+    private invalid;
+}
+//# sourceMappingURL=sim-cfn-iam-policy-properties-parser.d.ts.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policy-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAMD;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,yBAAyB,CAmB3B;IAED,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAiBtB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAwBtB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,OAAO;CAKhB"}

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.js

@@ -0,0 +1,79 @@
+const resourceType = "AWS::IAM::Policy";
+/**
+ * Parses and validates AWS::IAM::Policy CloudFormation properties into the
+ * shape the sim IAM inline policy creator needs.
+ *
+ * Keeping the property-shape validation here keeps the creator focused on
+ * orchestrating IAM command calls.
+ */
+export class SimCfnIamPolicyPropertiesParser {
+    /**
+     * Parse the resolved CloudFormation properties for an AWS::IAM::Policy.
+     */
+    parse(resource, properties) {
+        this.rejectGroups(resource, properties);
+        const roleNames = this.principalNames(resource, properties, "Roles");
+        const usernames = this.principalNames(resource, properties, "Users");
+        if (roleNames.length === 0 && usernames.length === 0) {
+            throw this.invalid(resource, "Roles or Users must name at least one principal");
+        }
+        return {
+            policyName: this.policyName(resource, properties),
+            policyDocument: this.policyDocument(resource, properties),
+            roleNames,
+            usernames,
+        };
+    }
+    policyName(resource, properties) {
+        const policyName = properties["PolicyName"];
+        if (typeof policyName !== "string") {
+            throw this.invalid(resource, "PolicyName must be a string");
+        }
+        return policyName;
+    }
+    policyDocument(resource, properties) {
+        const policyDocument = properties["PolicyDocument"];
+        if (typeof policyDocument !== "object" ||
+            policyDocument === null ||
+            Array.isArray(policyDocument)) {
+            throw this.invalid(resource, "PolicyDocument must be an object");
+        }
+        return JSON.stringify(policyDocument);
+    }
+    /**
+     * The principal names one property attaches the policy to. Role and User
+     * Refs are resolved to names before creation, so entries arrive as plain
+     * strings. An absent property is not an error on its own, because a policy
+     * naming only the other kind of principal is the usual CDK shape.
+     */
+    principalNames(resource, properties, property) {
+        // oxlint-disable-next-line security/detect-object-injection -- fixed property names.
+        const principals = properties[property];
+        if (principals === undefined) {
+            return [];
+        }
+        if (!Array.isArray(principals)) {
+            throw this.invalid(resource, `${property} must be an array`);
+        }
+        return principals.map((name) => {
+            if (typeof name !== "string") {
+                throw this.invalid(resource, `${property} entries must be strings`);
+            }
+            return name;
+        });
+    }
+    /**
+     * IAM Groups are not simulated as CloudFormation policy principals, and
+     * silently dropping a grant would be misleading, so their presence fails
+     * creation.
+     */
+    rejectGroups(resource, properties) {
+        if (properties["Groups"] !== undefined) {
+            throw this.invalid(resource, "Groups are not simulated");
+        }
+    }
+    invalid(resource, reason) {
+        return new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${reason}`);
+    }
+}
+//# sourceMappingURL=sim-cfn-iam-policy-properties-parser.js.map

package/dist/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-iam-policy-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/policy/sim-cfn-iam-policy-properties-parser.ts"],"names":[],"mappings":"AAYA,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAErE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,OAAO,CAChB,QAAQ,EACR,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;YACjD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;YACzD,SAAS;YACT,SAAS;SACV,CAAC;IACJ,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,UAAqC;QAErC,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEpD,IACE,OAAO,cAAc,KAAK,QAAQ;YAClC,cAAc,KAAK,IAAI;YACvB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACK,cAAc,CACpB,QAAwB,EACxB,UAAqC,EACrC,QAA0C;QAE1C,qFAAqF;QACrF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,QAAQ,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,QAAQ,0BAA0B,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,YAAY,CAClB,QAAwB,EACxB,UAAqC;QAErC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,QAAwB,EAAE,MAAc;QACtD,OAAO,IAAI,SAAS,CAClB,WAAW,YAAY,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAC3D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.d.ts

@@ -1,12 +1,12 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
-import { type SimCfnIamRoleInlinePolicy } from "./sim-cfn-iam-role-policies-parser.js";
+import { type SimCfnIamInlinePolicy } from "../sim-cfn-iam-policies-parser.js";
 export interface SimCfnIamRoleProperties {
     readonly roleName: string;
     readonly path: string | undefined;
     readonly description: string | undefined;
     readonly assumeRolePolicyDocument: string;
-    readonly inlinePolicies: readonly SimCfnIamRoleInlinePolicy[];
+    readonly inlinePolicies: readonly SimCfnIamInlinePolicy[];
     readonly managedPolicyArns: readonly string[];
 }
 /**

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-role-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,uCAAuC,CAAC;AAE/C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IAEpE;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,uBAAuB,CAsBzB;IAED,OAAO,CAAC,cAAc;IAkBtB,OAAO,CAAC,UAAU;CAanB"}
+{"version":3,"file":"sim-cfn-iam-role-properties-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAE5B;IAEH;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,uBAAuB,CAsBzB;IAED,OAAO,CAAC,cAAc;IAkBtB,OAAO,CAAC,UAAU;CAanB"}

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js

@@ -1,4 +1,4 @@
-import { SimCfnIamRolePoliciesParser, } from "./sim-cfn-iam-role-policies-parser.js";
+import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 /**
  * Parses and validates AWS::IAM::Role CloudFormation properties into the shape
  * the sim IAM Role creator needs.
@@ -7,7 +7,9 @@ import { SimCfnIamRolePoliciesParser, } from "./sim-cfn-iam-role-policies-parser
  * orchestrating IAM command calls.
  */
 export class SimCfnIamRolePropertiesParser {
-    policiesParser = new SimCfnIamRolePoliciesParser();
+    policiesParser = new SimCfnIamPoliciesParser({
+        resourceType: "AWS::IAM::Role",
+    });
     /**
      * Parse the resolved CloudFormation properties for an AWS::IAM::Role.
      */

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-iam-role-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,2BAA2B,GAE5B,MAAM,uCAAuC,CAAC;AAW/C;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,cAAc,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEpE;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,OAAO;YACL,QAAQ,EACN,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;gBACjE,QAAQ,CAAC,SAAS;YACpB,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC/D,WAAW,EAAE,IAAI,CAAC,cAAc,CAC9B,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,EACzB,aAAa,CACd;YACD,wBAAwB,EAAE,IAAI,CAAC,UAAU,CACvC,QAAQ,EACR,UAAU,CAAC,0BAA0B,CAAC,EACtC,0BAA0B,CAC3B;YACD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,iBAAiB,CACtD,QAAQ,EACR,UAAU,CACX;SACF,CAAC;IACJ,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,mBAAmB,CAC1E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,oBAAoB,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-iam-role-properties-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,uBAAuB,GAExB,MAAM,mCAAmC,CAAC;AAW3C;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,cAAc,GAAG,IAAI,uBAAuB,CAAC;QAC5D,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IAEH;;OAEG;IACH,KAAK,CACH,QAAwB,EACxB,UAAqC;QAErC,OAAO;YACL,QAAQ,EACN,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;gBACjE,QAAQ,CAAC,SAAS;YACpB,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC/D,WAAW,EAAE,IAAI,CAAC,cAAc,CAC9B,QAAQ,EACR,UAAU,CAAC,aAAa,CAAC,EACzB,aAAa,CACd;YACD,wBAAwB,EAAE,IAAI,CAAC,UAAU,CACvC,QAAQ,EACR,UAAU,CAAC,0BAA0B,CAAC,EACtC,0BAA0B,CAC3B;YACD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,iBAAiB,CACtD,QAAQ,EACR,UAAU,CACX;SACF,CAAC;IACJ,CAAC;IAEO,cAAc,CACpB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,mBAAmB,CAC1E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,KAAoD,EACpD,KAAa;QAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,SAAS,CACjB,0BAA0B,QAAQ,CAAC,SAAS,KAAK,KAAK,oBAAoB,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF"}