@kensio/yulin 1.8.0 → 1.10.0

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.js

@@ -0,0 +1,44 @@
+import { simCfnSnsResourceError } from "../sim-cfn-sns-resource-error.js";
+import { snsTopicPolicyResourceType } from "../sim-cfn-sns-resource-types.js";
+/**
+ * The topic ARNs an AWS::SNS::TopicPolicy Resource names.
+ *
+ * `Ref` on an AWS::SNS::Topic gives its ARN, so a template naming its topics
+ * the way CDK does arrives here as the ARNs SetTopicAttributes takes.
+ *
+ * Creation and deletion both read them, because the Resource points at only the
+ * first of the topics it named and taking the policy back off needs all of
+ * them.
+ */
+export function simCfnSnsPolicyTopicArns(logicalId, properties) {
+    const topics = properties["Topics"];
+    if (!Array.isArray(topics) || topics.length === 0) {
+        throw topicPolicyError(logicalId, "Topics is required and must be a list of topic ARNs");
+    }
+    return topics.map((topic) => {
+        if (typeof topic !== "string") {
+            throw topicPolicyError(logicalId, `each entry of Topics must be a topic ARN string, and one is a ${typeof topic}`);
+        }
+        return topic;
+    });
+}
+/**
+ * The policy document an AWS::SNS::TopicPolicy Resource carries.
+ *
+ * A template writes it as an object where SetTopicAttributes takes a JSON
+ * string, so what comes back here is what is serialised on the way in.
+ */
+export function simCfnSnsPolicyDocument(logicalId, properties) {
+    const policyDocument = properties["PolicyDocument"];
+    if (policyDocument === undefined ||
+        policyDocument === null ||
+        typeof policyDocument !== "object" ||
+        Array.isArray(policyDocument)) {
+        throw topicPolicyError(logicalId, "PolicyDocument is required and must be an object");
+    }
+    return policyDocument;
+}
+function topicPolicyError(logicalId, reason) {
+    return simCfnSnsResourceError(snsTopicPolicyResourceType, logicalId, reason);
+}
+//# sourceMappingURL=sim-cfn-sns-topic-policy-properties.js.map

package/dist/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sns-topic-policy-properties.js","sourceRoot":"","sources":["../../../../../src/service/sns/cfn/topic-policy/sim-cfn-sns-topic-policy-properties.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,UAAqC;IAErC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,gBAAgB,CACpB,SAAS,EACT,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,gBAAgB,CACpB,SAAS,EACT,iEAAiE,OAAO,KAAK,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,UAAqC;IAErC,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IACE,cAAc,KAAK,SAAS;QAC5B,cAAc,KAAK,IAAI;QACvB,OAAO,cAAc,KAAK,QAAQ;QAClC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,CAAC;QACD,MAAM,gBAAgB,CACpB,SAAS,EACT,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,MAAc;IACzD,OAAO,sBAAsB,CAAC,0BAA0B,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC"}

package/dist/service/sns/command/authorize/sim-sns-authorizer.d.ts

@@ -0,0 +1,58 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
+import type { SimSnsRequestOptions } from "../sim-sns-request-options.js";
+interface SimSnsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimSnsTopicAuthorizationInput {
+    readonly action: string;
+    readonly topicArn: string;
+    /**
+     * The topic itself, when there is one. Its policy is what admits a caller
+     * with no identity policy of its own.
+     */
+    readonly topic?: SimSnsTopic | undefined;
+    readonly options?: SimSnsRequestOptions | undefined;
+}
+/**
+ * Applies simulated IAM authorization to SNS requests.
+ *
+ * A topic ARN has no resource type in it, so the resource an operation
+ * authorizes against is `arn:aws:sns:region:account:topic-name`. A policy
+ * written with a `topic/` in the resource matches nothing here, as it matches
+ * nothing on real AWS.
+ *
+ * The topic's own policy goes into the decision as its resource policy. That is
+ * what admits a caller from another Account or a service principal, since
+ * neither is covered by an identity policy in the Account owning the topic.
+ *
+ * ListTopics is the exception: real SNS gives it no resource type, so it
+ * authorizes against `*` rather than against a topic, and no topic policy
+ * applies to it.
+ *
+ * A denial is reported as SNS's own AuthorizationErrorException rather than the
+ * shared IAM error, because that is the error a real SNS caller would have to
+ * handle.
+ */
+export declare class SimSnsAuthorizer {
+    private readonly iam;
+    private readonly callerIdentifier;
+    constructor(properties: SimSnsAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a topic, named by its ARN.
+     *
+     * The topic need not exist. A topic that is not there contributes no policy,
+     * so a caller with no permission is refused whether or not the topic is
+     * there, and CreateTopic authorizes against the ARN the topic is about to
+     * have.
+     */
+    authorizeTopic(input: SimSnsTopicAuthorizationInput): SimAwsResolvedCaller;
+    /**
+     * Ensure the caller may perform an action that names no particular topic.
+     */
+    authorizeAnyTopic(action: string, options?: SimSnsRequestOptions): SimAwsResolvedCaller;
+    private authorizeResource;
+}
+export {};
+//# sourceMappingURL=sim-sns-authorizer.d.ts.map

package/dist/service/sns/command/authorize/sim-sns-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAE3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAc1E,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACrD;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgC;IAEjE,YAAY,UAAU,EAAE,0BAA0B,EAEjD;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,6BAA6B,GAAG,oBAAoB,CAOzE;IAED;;OAEG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,oBAAoB,CAOtB;IAED,OAAO,CAAC,iBAAiB;CAwB1B"}

package/dist/service/sns/command/authorize/sim-sns-authorizer.js

@@ -0,0 +1,83 @@
+import { SimIamCallerIdentifier } from "../../../iam/error/sim-iam-caller-identifier.js";
+import { SimSnsAuthorizationErrorException } from "../../error/sim-sns.error.js";
+import { simSnsConditionContext } from "./sim-sns-condition-context.js";
+import { simSnsTopicResourcePolicies } from "./sim-sns-topic-resource-policies.js";
+/**
+ * The resource an action with no resource type authorizes against.
+ *
+ * Real SNS gives ListTopics no resource type at all, so IAM evaluates it
+ * against `*` and only a policy whose Resource is `*` allows it. A policy
+ * naming a topic ARN, or every topic ARN in the Account and Region, allows no
+ * listing, here as on AWS.
+ */
+const noResource = "*";
+/**
+ * Applies simulated IAM authorization to SNS requests.
+ *
+ * A topic ARN has no resource type in it, so the resource an operation
+ * authorizes against is `arn:aws:sns:region:account:topic-name`. A policy
+ * written with a `topic/` in the resource matches nothing here, as it matches
+ * nothing on real AWS.
+ *
+ * The topic's own policy goes into the decision as its resource policy. That is
+ * what admits a caller from another Account or a service principal, since
+ * neither is covered by an identity policy in the Account owning the topic.
+ *
+ * ListTopics is the exception: real SNS gives it no resource type, so it
+ * authorizes against `*` rather than against a topic, and no topic policy
+ * applies to it.
+ *
+ * A denial is reported as SNS's own AuthorizationErrorException rather than the
+ * shared IAM error, because that is the error a real SNS caller would have to
+ * handle.
+ */
+export class SimSnsAuthorizer {
+    iam;
+    callerIdentifier = new SimIamCallerIdentifier();
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may perform an action on a topic, named by its ARN.
+     *
+     * The topic need not exist. A topic that is not there contributes no policy,
+     * so a caller with no permission is refused whether or not the topic is
+     * there, and CreateTopic authorizes against the ARN the topic is about to
+     * have.
+     */
+    authorizeTopic(input) {
+        return this.authorizeResource({
+            action: input.action,
+            resource: input.topicArn,
+            resourcePolicies: simSnsTopicResourcePolicies(input.topic),
+            options: input.options,
+        });
+    }
+    /**
+     * Ensure the caller may perform an action that names no particular topic.
+     */
+    authorizeAnyTopic(action, options) {
+        return this.authorizeResource({
+            action,
+            resource: noResource,
+            resourcePolicies: [],
+            options,
+        });
+    }
+    authorizeResource(input) {
+        const decision = this.iam.authorize({
+            action: input.action,
+            resource: input.resource,
+            caller: input.options?.caller,
+            resourcePolicies: input.resourcePolicies,
+            conditionContext: simSnsConditionContext(input.options),
+        });
+        if (decision.isDenied) {
+            const identifier = this.callerIdentifier.format(decision.caller.principal);
+            throw new SimSnsAuthorizationErrorException(`User: ${identifier} is not authorized to perform: ${input.action} ` +
+                `on resource: ${input.resource}`);
+        }
+        return decision.caller;
+    }
+}
+//# sourceMappingURL=sim-sns-authorizer.js.map

package/dist/service/sns/command/authorize/sim-sns-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,8BAA8B,CAAC;AAGjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,GAAG,CAAC;AA0BvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAA0B;IAC7B,gBAAgB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAEjE,YAAY,UAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,KAAoC;QACjD,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,MAAc,EACd,OAA8B;QAE9B,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,gBAAgB,EAAE,EAAE;YACpB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CACvB,KAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM;YAC7B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAC7C,QAAQ,CAAC,MAAM,CAAC,SAAS,CAC1B,CAAC;YAEF,MAAM,IAAI,iCAAiC,CACzC,SAAS,UAAU,kCAAkC,KAAK,CAAC,MAAM,GAAG;gBAClE,gBAAgB,KAAK,CAAC,QAAQ,EAAE,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;CACF"}

package/dist/service/sns/command/authorize/sim-sns-condition-context.d.ts

@@ -0,0 +1,13 @@
+import type { SimIamConditionValue } from "../../../iam/policy/sim-iam-policy.js";
+import { type SimSnsRequestOptions } from "../sim-sns-request-options.js";
+/**
+ * The request-time values a topic policy statement's conditions are matched
+ * against.
+ *
+ * A value the request does not carry is left out rather than supplied empty, so
+ * a statement conditioned on it fails to match instead of matching an empty
+ * string. That is the safe direction: a grant written for one Bucket should not
+ * admit a request that says nothing about where it came from.
+ */
+export declare function simSnsConditionContext(options: SimSnsRequestOptions | undefined): Readonly<Record<string, SimIamConditionValue>>;
+//# sourceMappingURL=sim-sns-condition-context.d.ts.map

package/dist/service/sns/command/authorize/sim-sns-condition-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-condition-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-condition-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GACxC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAShD"}

package/dist/service/sns/command/authorize/sim-sns-condition-context.js

@@ -0,0 +1,21 @@
+import { simSnsSourceAccountConditionKey, simSnsSourceArnConditionKey, } from "../sim-sns-request-options.js";
+/**
+ * The request-time values a topic policy statement's conditions are matched
+ * against.
+ *
+ * A value the request does not carry is left out rather than supplied empty, so
+ * a statement conditioned on it fails to match instead of matching an empty
+ * string. That is the safe direction: a grant written for one Bucket should not
+ * admit a request that says nothing about where it came from.
+ */
+export function simSnsConditionContext(options) {
+    return {
+        ...(options?.sourceArn !== undefined && {
+            [simSnsSourceArnConditionKey]: options.sourceArn,
+        }),
+        ...(options?.sourceAccount !== undefined && {
+            [simSnsSourceAccountConditionKey]: options.sourceAccount,
+        }),
+    };
+}
+//# sourceMappingURL=sim-sns-condition-context.js.map

package/dist/service/sns/command/authorize/sim-sns-condition-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-condition-context.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-condition-context.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAE5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAyC;IAEzC,OAAO;QACL,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,IAAI;YACtC,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC,SAAS;SACjD,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,IAAI;YAC1C,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC,aAAa;SACzD,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/service/sns/command/authorize/sim-sns-service-publish-authorizer.d.ts

@@ -0,0 +1,41 @@
+import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
+interface SimSnsServicePublishAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimSnsServicePublishAuthorizationInput {
+    readonly topic: SimSnsTopic;
+    /** The service principal the publishing service calls SNS as. */
+    readonly servicePrincipal: string;
+    /**
+     * What the service is publishing for, such as the S3 Bucket an event came
+     * from.
+     */
+    readonly sourceArn?: string | undefined;
+    /** The Account the publishing service's own resource belongs to. */
+    readonly sourceAccount?: string | undefined;
+}
+/**
+ * Decides whether a simulated AWS service may publish a message to a topic.
+ *
+ * A service principal owns no identity policies anywhere, so the topic's own
+ * policy is the whole decision. The answer is a decision rather than a thrown
+ * error because a service asks this before it has a message to publish: S3
+ * validates the destination when a notification configuration is applied, and
+ * has to report the refusal as part of refusing the configuration.
+ *
+ * A service with a message in hand publishes it through `Publish` as usual,
+ * which authorizes the same way. Nothing is remembered from the earlier
+ * question, so a topic policy changed in between stops the delivery.
+ */
+export declare class SimSnsServicePublishAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(properties: SimSnsServicePublishAuthorizerProperties);
+    /**
+     * Evaluate `sns:Publish` for a service against the topic.
+     */
+    authorize(input: SimSnsServicePublishAuthorizationInput): SimIamAuthorizationDecision;
+}
+export {};
+//# sourceMappingURL=sim-sns-service-publish-authorizer.d.ts.map

package/dist/service/sns/command/authorize/sim-sns-service-publish-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-service-publish-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-service-publish-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAIhE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAE5B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAiB;IAE/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;OAEG;IACH,SAAS,CACP,KAAK,EAAE,sCAAsC,GAC5C,2BAA2B,CAa7B;CACF"}

package/dist/service/sns/command/authorize/sim-sns-service-publish-authorizer.js

@@ -0,0 +1,40 @@
+import { simSnsConditionContext } from "./sim-sns-condition-context.js";
+import { simSnsTopicResourcePolicies } from "./sim-sns-topic-resource-policies.js";
+/**
+ * Decides whether a simulated AWS service may publish a message to a topic.
+ *
+ * A service principal owns no identity policies anywhere, so the topic's own
+ * policy is the whole decision. The answer is a decision rather than a thrown
+ * error because a service asks this before it has a message to publish: S3
+ * validates the destination when a notification configuration is applied, and
+ * has to report the refusal as part of refusing the configuration.
+ *
+ * A service with a message in hand publishes it through `Publish` as usual,
+ * which authorizes the same way. Nothing is remembered from the earlier
+ * question, so a topic policy changed in between stops the delivery.
+ */
+export class SimSnsServicePublishAuthorizer {
+    static action = "sns:Publish";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Evaluate `sns:Publish` for a service against the topic.
+     */
+    authorize(input) {
+        return this.iam.authorize({
+            action: SimSnsServicePublishAuthorizer.action,
+            resource: input.topic.arn.value,
+            caller: { kind: "service", service: input.servicePrincipal },
+            resourcePolicies: simSnsTopicResourcePolicies(input.topic),
+            conditionContext: simSnsConditionContext({
+                ...(input.sourceArn !== undefined && { sourceArn: input.sourceArn }),
+                ...(input.sourceAccount !== undefined && {
+                    sourceAccount: input.sourceAccount,
+                }),
+            }),
+        });
+    }
+}
+//# sourceMappingURL=sim-sns-service-publish-authorizer.js.map

package/dist/service/sns/command/authorize/sim-sns-service-publish-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-service-publish-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-service-publish-authorizer.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAsBnF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,8BAA8B;IACjC,MAAM,CAAU,MAAM,GAAG,aAAa,CAAC;IAE9B,GAAG,CAA0B;IAE9C,YAAY,UAAoD;QAC9D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,SAAS,CACP,KAA6C;QAE7C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,8BAA8B,CAAC,MAAM;YAC7C,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,gBAAgB,EAAE;YAC5D,gBAAgB,EAAE,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1D,gBAAgB,EAAE,sBAAsB,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI;oBACvC,aAAa,EAAE,KAAK,CAAC,aAAa;iBACnC,CAAC;aACH,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/sns/command/authorize/sim-sns-topic-resource-policies.d.ts

@@ -0,0 +1,12 @@
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimSnsTopic } from "../../topic/sim-sns-topic.js";
+/**
+ * The resource policies sim IAM should evaluate for a request against a topic.
+ *
+ * A topic that is not there contributes nothing, which is what keeps a caller
+ * with no permission refused for a topic that does not exist: an absent topic
+ * cannot admit anyone. A topic with no policy contributes nothing either, and
+ * the decision is left to the caller's identity policies.
+ */
+export declare function simSnsTopicResourcePolicies(topic: SimSnsTopic | undefined): readonly SimIamResourcePolicyInput[];
+//# sourceMappingURL=sim-sns-topic-resource-policies.d.ts.map

package/dist/service/sns/command/authorize/sim-sns-topic-resource-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-topic-resource-policies.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-topic-resource-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEhE;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,WAAW,GAAG,SAAS,GAC7B,SAAS,yBAAyB,EAAE,CAkBtC"}

package/dist/service/sns/command/authorize/sim-sns-topic-resource-policies.js

@@ -0,0 +1,25 @@
+/**
+ * The resource policies sim IAM should evaluate for a request against a topic.
+ *
+ * A topic that is not there contributes nothing, which is what keeps a caller
+ * with no permission refused for a topic that does not exist: an absent topic
+ * cannot admit anyone. A topic with no policy contributes nothing either, and
+ * the decision is left to the caller's identity policies.
+ */
+export function simSnsTopicResourcePolicies(topic) {
+    if (topic === undefined) {
+        return [];
+    }
+    const policy = topic.attributes.policy;
+    if (policy === undefined) {
+        return [];
+    }
+    return [
+        {
+            document: policy.document,
+            policyName: "TopicPolicy",
+            resourceArn: topic.arn.value,
+        },
+    ];
+}
+//# sourceMappingURL=sim-sns-topic-resource-policies.js.map

package/dist/service/sns/command/authorize/sim-sns-topic-resource-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-topic-resource-policies.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/authorize/sim-sns-topic-resource-policies.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAA8B;IAE9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;IAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK;SAC7B;KACF,CAAC;AACJ,CAAC"}

package/dist/service/sns/command/publish/publish.command.d.ts

@@ -0,0 +1,70 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimSnsMessageAttributeInput } from "../../message/sim-sns-message-attribute-value.js";
+/**
+ * The message fields shared by Publish and one PublishBatch entry.
+ */
+export interface SimSnsPublishedFields {
+    readonly Message?: string | undefined;
+    readonly Subject?: string | undefined;
+    readonly MessageStructure?: string | undefined;
+    readonly MessageAttributes?: SimSnsMessageAttributeInput | undefined;
+    readonly MessageDeduplicationId?: string | undefined;
+    readonly MessageGroupId?: string | undefined;
+}
+/**
+ * Minimal structural sim SNS Publish command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sns/command/PublishCommand/
+ */
+export interface SimPublishCommand {
+    readonly input: SimPublishCommandInput;
+}
+export interface SimPublishCommandInput extends SimSnsPublishedFields {
+    readonly TopicArn?: string | undefined;
+    /** The endpoint of a mobile application, which is not simulated. */
+    readonly TargetArn?: string | undefined;
+    /** An SMS destination, which is not simulated. */
+    readonly PhoneNumber?: string | undefined;
+}
+export interface SimPublishCommandOutput {
+    readonly MessageId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * One entry of a PublishBatch request.
+ */
+export interface SimSnsPublishBatchRequestEntry extends SimSnsPublishedFields {
+    readonly Id?: string | undefined;
+}
+/**
+ * Minimal structural sim SNS PublishBatch command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sns/command/PublishBatchCommand/
+ */
+export interface SimPublishBatchCommand {
+    readonly input: SimPublishBatchCommandInput;
+}
+export interface SimPublishBatchCommandInput {
+    readonly TopicArn?: string | undefined;
+    readonly PublishBatchRequestEntries?: readonly SimSnsPublishBatchRequestEntry[] | undefined;
+}
+export interface SimSnsPublishBatchResultEntry {
+    readonly Id: string;
+    readonly MessageId: string;
+}
+/**
+ * One entry of a batch request that failed on its own, while the rest of the
+ * batch went through.
+ */
+export interface SimSnsBatchResultErrorEntry {
+    readonly Id: string;
+    readonly SenderFault: boolean;
+    readonly Code: string;
+    readonly Message?: string | undefined;
+}
+export interface SimPublishBatchCommandOutput {
+    readonly Successful?: readonly SimSnsPublishBatchResultEntry[] | undefined;
+    readonly Failed?: readonly SimSnsBatchResultErrorEntry[] | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=publish.command.d.ts.map

package/dist/service/sns/command/publish/publish.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/publish/publish.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAEpG;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,8BAA+B,SAAQ,qBAAqB;IAC3E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,0BAA0B,CAAC,EAClC,SAAS,8BAA8B,EAAE,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,6BAA6B,EAAE,GAAG,SAAS,CAAC;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,2BAA2B,EAAE,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/sns/command/publish/publish.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=publish.command.js.map

package/dist/service/sns/command/publish/publish.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.command.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/publish/publish.command.ts"],"names":[],"mappings":""}

package/dist/service/sns/command/publish/sim-sns-batch-entries.d.ts

@@ -0,0 +1,52 @@
+import { type SimSnsPublishedMessage } from "../../message/sim-sns-published-message.js";
+import type { SimSnsBatchResultErrorEntry } from "./publish.command.js";
+/**
+ * What every batch request entry carries: an id the response reports it under.
+ */
+export interface SimSnsIdentifiedEntry {
+    readonly Id?: string | undefined;
+}
+/**
+ * One entry of a batch request whose id has been checked.
+ */
+export interface SimSnsBatchEntry<T> {
+    readonly id: string;
+    readonly entry: T;
+}
+/**
+ * The outcome of running a batch: what went through, and what failed on its own.
+ */
+export interface SimSnsBatchOutcome<T> {
+    readonly successful: readonly T[];
+    readonly failed: readonly SimSnsBatchResultErrorEntry[];
+}
+/**
+ * Check the entries of a batch request the way real SNS checks them.
+ *
+ * These are the failures that take the whole request down rather than one
+ * entry: an empty batch, more than ten entries, a malformed id, or two entries
+ * sharing one. Everything else is a per-entry failure, reported in `Failed`
+ * while the rest of the batch goes through.
+ */
+export declare function requireSnsBatchEntries<T extends SimSnsIdentifiedEntry>(entries: readonly T[] | undefined): readonly SimSnsBatchEntry<T>[];
+/**
+ * Run every entry of a batch, keeping one entry's failure out of the way of the
+ * others.
+ *
+ * Real SNS answers a batch request with two lists rather than failing it, so a
+ * message with an attribute it will not take does not stop the nine beside it
+ * being published.
+ */
+export declare function runSnsBatch<T, R>(entries: readonly SimSnsBatchEntry<T>[], run: (entry: T, id: string) => R): SimSnsBatchOutcome<R>;
+/**
+ * Refuse a batch weighing more than one publish is allowed to.
+ *
+ * Real SNS holds the whole batch to the 256 KB a single publish is held to,
+ * rather than each entry, so ten entries just inside the limit are one batch
+ * far outside it. That is why `SimSnsPublishedMessage` does not check the limit
+ * and this does.
+ */
+export declare function assertSnsBatchWithinSizeLimit(published: readonly {
+    readonly message: SimSnsPublishedMessage;
+}[]): void;
+//# sourceMappingURL=sim-sns-batch-entries.d.ts.map

package/dist/service/sns/command/publish/sim-sns-batch-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-batch-entries.d.ts","sourceRoot":"","sources":["../../../../../src/service/sns/command/publish/sim-sns-batch-entries.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAMxE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,qBAAqB,EACpE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,SAAS,GAChC,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,CA2BhC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,EAC9B,OAAO,EAAE,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,EACvC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,KAAK,CAAC,GAC/B,kBAAkB,CAAC,CAAC,CAAC,CAwBvB;AAaD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,SAAS;IAAE,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,EAAE,GACjE,IAAI,CAaN"}

package/dist/service/sns/command/publish/sim-sns-batch-entries.js

@@ -0,0 +1,85 @@
+import { SimSnsBatchEntryIdsNotDistinctException, SimSnsBatchRequestTooLongException, SimSnsEmptyBatchRequestException, SimSnsError, SimSnsInvalidBatchEntryIdException, SimSnsTooManyEntriesInBatchRequestException, } from "../../error/sim-sns.error.js";
+import { simSnsMaximumPublishBytes, } from "../../message/sim-sns-published-message.js";
+const maximumEntries = 10;
+const entryIdPattern = /^[\w-]{1,80}$/;
+/**
+ * Check the entries of a batch request the way real SNS checks them.
+ *
+ * These are the failures that take the whole request down rather than one
+ * entry: an empty batch, more than ten entries, a malformed id, or two entries
+ * sharing one. Everything else is a per-entry failure, reported in `Failed`
+ * while the rest of the batch goes through.
+ */
+export function requireSnsBatchEntries(entries) {
+    if (entries === undefined || entries.length === 0) {
+        throw new SimSnsEmptyBatchRequestException("There should be at least one PublishBatchRequestEntry in the request");
+    }
+    if (entries.length > maximumEntries) {
+        throw new SimSnsTooManyEntriesInBatchRequestException(`Maximum number of entries per request is ${String(maximumEntries)}. ` +
+            `You have sent ${String(entries.length)}.`);
+    }
+    const checked = entries.map((entry) => ({
+        id: requireEntryId(entry.Id),
+        entry,
+    }));
+    const ids = new Set(checked.map(({ id }) => id));
+    if (ids.size !== checked.length) {
+        throw new SimSnsBatchEntryIdsNotDistinctException("Two or more batch entries in the request have the same Id");
+    }
+    return checked;
+}
+/**
+ * Run every entry of a batch, keeping one entry's failure out of the way of the
+ * others.
+ *
+ * Real SNS answers a batch request with two lists rather than failing it, so a
+ * message with an attribute it will not take does not stop the nine beside it
+ * being published.
+ */
+export function runSnsBatch(entries, run) {
+    const successful = [];
+    const failed = [];
+    for (const { id, entry } of entries) {
+        try {
+            successful.push(run(entry, id));
+        }
+        catch (error) {
+            // Only an SNS failure belongs to one entry. Anything else, an IAM denial
+            // above all, is about the request as a whole.
+            if (!(error instanceof SimSnsError)) {
+                throw error;
+            }
+            failed.push({
+                Id: id,
+                SenderFault: true,
+                Code: error.name,
+                Message: error.message,
+            });
+        }
+    }
+    return { successful, failed };
+}
+function requireEntryId(id) {
+    if (id === undefined || !entryIdPattern.test(id)) {
+        throw new SimSnsInvalidBatchEntryIdException(`A batch entry id is required, and may contain up to 80 alphanumeric ` +
+            `characters, hyphens and underscores. Got '${String(id)}'.`);
+    }
+    return id;
+}
+/**
+ * Refuse a batch weighing more than one publish is allowed to.
+ *
+ * Real SNS holds the whole batch to the 256 KB a single publish is held to,
+ * rather than each entry, so ten entries just inside the limit are one batch
+ * far outside it. That is why `SimSnsPublishedMessage` does not check the limit
+ * and this does.
+ */
+export function assertSnsBatchWithinSizeLimit(published) {
+    const byteSize = published.reduce((total, { message }) => total + message.byteSize, 0);
+    if (byteSize > simSnsMaximumPublishBytes) {
+        throw new SimSnsBatchRequestTooLongException(`The batch request is longer than the permitted size. A batch may be ` +
+            `up to ${String(simSnsMaximumPublishBytes)} bytes, and this one is ` +
+            `${String(byteSize)} bytes.`);
+    }
+}
+//# sourceMappingURL=sim-sns-batch-entries.js.map

package/dist/service/sns/command/publish/sim-sns-batch-entries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-batch-entries.js","sourceRoot":"","sources":["../../../../../src/service/sns/command/publish/sim-sns-batch-entries.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uCAAuC,EACvC,kCAAkC,EAClC,gCAAgC,EAChC,WAAW,EACX,kCAAkC,EAClC,2CAA2C,GAC5C,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,GAE1B,MAAM,4CAA4C,CAAC;AAGpD,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,cAAc,GAAG,eAAe,CAAC;AAyBvC;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,gCAAgC,CACxC,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,2CAA2C,CACnD,4CAA4C,MAAM,CAAC,cAAc,CAAC,IAAI;YACpE,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK;KACN,CAAC,CAAC,CAAC;IACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,uCAAuC,CAC/C,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,OAAuC,EACvC,GAAgC;IAEhC,MAAM,UAAU,GAAQ,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAkC,EAAE,CAAC;IAEjD,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,8CAA8C;YAC9C,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,EAAE;gBACN,WAAW,EAAE,IAAI;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,cAAc,CAAC,EAAsB;IAC5C,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,kCAAkC,CAC1C,sEAAsE;YACpE,6CAA6C,MAAM,CAAC,EAAE,CAAC,IAAI,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAkE;IAElE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,EAChD,CAAC,CACF,CAAC;IAEF,IAAI,QAAQ,GAAG,yBAAyB,EAAE,CAAC;QACzC,MAAM,IAAI,kCAAkC,CAC1C,sEAAsE;YACpE,SAAS,MAAM,CAAC,yBAAyB,CAAC,0BAA0B;YACpE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAC/B,CAAC;IACJ,CAAC;AACH,CAAC"}