@kensio/yulin 0.32.0 → 0.33.0

package/dist/service/iam/credential/session/sim-iam-session-manager.d.ts

@@ -0,0 +1,44 @@
+import { SimIamSession } from "./sim-iam-session.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
+import type { SimIamCredentialRegistry } from "../sim-iam-credential-registry.js";
+import type { SimIamSessionCredentialGenerator } from "./sim-iam-session-cred-gen.js";
+import type { SimArnPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCredentials } from "../sim-aws-credentials.js";
+interface SimIamSessionManagerProps {
+    readonly accountId: SimAwsAccountId;
+    readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
+    readonly credentialRegistry: SimIamCredentialRegistry;
+    readonly credentialGenerator: SimIamSessionCredentialGenerator;
+}
+export interface SimIamCreateRoleSessionInput {
+    readonly roleName: SimIamRoleName;
+    readonly sessionName: string;
+    readonly sourcePrincipal: SimArnPrincipal;
+    readonly createDate: Date;
+    readonly expiration: Date;
+}
+export interface SimIamCreatedRoleSession {
+    readonly credentials: SimAwsCredentials;
+    readonly session: SimIamSession;
+}
+/**
+ * Creates and registers temporary simulated IAM sessions.
+ *
+ * This manager owns the coordination between IAM Roles, temporary credentials,
+ * sessions, and the credential registry.
+ */
+export declare class SimIamSessionManager {
+    private readonly roles;
+    private readonly credentialRegistry;
+    private readonly credentialGenerator;
+    private readonly principalFactory;
+    constructor(props: SimIamSessionManagerProps);
+    /**
+     * Create and register a temporary session for an IAM Role.
+     */
+    createRoleSession(input: SimIamCreateRoleSessionInput): SimIamCreatedRoleSession;
+    private role;
+}
+export {};
+//# sourceMappingURL=sim-iam-session-manager.d.ts.map

package/dist/service/iam/credential/session/sim-iam-session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session-manager.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE,UAAU,yBAAyB;IACjC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,mBAAmB,EAAE,gCAAgC,CAAC;CAChE;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAmC;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoC;IAErE,YAAY,KAAK,EAAE,yBAAyB,EAO3C;IAED;;OAEG;IACH,iBAAiB,CACf,KAAK,EAAE,4BAA4B,GAClC,wBAAwB,CAgC1B;IAED,OAAO,CAAC,IAAI;CAUb"}

package/dist/service/iam/credential/session/sim-iam-session-manager.js

@@ -0,0 +1,62 @@
+import { SimIamSession } from "./sim-iam-session.js";
+import { SimIamAccessKey } from "../sim-iam-access-key.js";
+import { SimIamAssumedRolePrincipalFactory } from "./sim-iam-assumed-role-principal-factory.js";
+/**
+ * Creates and registers temporary simulated IAM sessions.
+ *
+ * This manager owns the coordination between IAM Roles, temporary credentials,
+ * sessions, and the credential registry.
+ */
+export class SimIamSessionManager {
+    roles;
+    credentialRegistry;
+    credentialGenerator;
+    principalFactory;
+    constructor(props) {
+        this.roles = props.roles;
+        this.credentialRegistry = props.credentialRegistry;
+        this.credentialGenerator = props.credentialGenerator;
+        this.principalFactory = new SimIamAssumedRolePrincipalFactory(props.accountId);
+    }
+    /**
+     * Create and register a temporary session for an IAM Role.
+     */
+    createRoleSession(input) {
+        const role = this.role(input.roleName);
+        const credentials = this.credentialGenerator.generate();
+        const principal = this.principalFactory.make(role, input.sessionName);
+        const session = new SimIamSession({
+            principal,
+            sourcePrincipal: input.sourcePrincipal,
+            role,
+            sessionName: input.sessionName,
+            sessionToken: credentials.sessionToken,
+            createDate: input.createDate,
+            expiration: input.expiration,
+        });
+        this.credentialRegistry.registerAccessKey(new SimIamAccessKey({
+            accessKeyId: credentials.accessKeyId,
+            secretAccessKey: credentials.secretAccessKey,
+            principal,
+            identityPolicyPrincipal: {
+                kind: "arn",
+                arn: role.arn,
+            },
+            session,
+            createDate: input.createDate,
+        }));
+        return {
+            credentials,
+            session,
+        };
+    }
+    role(roleName) {
+        const role = this.roles.get(roleName);
+        /* v8 ignore if */
+        if (role === undefined) {
+            throw new Error(`Sim IAM Role ${roleName} does not exist`);
+        }
+        return role;
+    }
+}
+//# sourceMappingURL=sim-iam-session-manager.js.map

package/dist/service/iam/credential/session/sim-iam-session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session-manager.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAOrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAsBhG;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,KAAK,CAA0C;IAC/C,kBAAkB,CAA2B;IAC7C,mBAAmB,CAAmC;IACtD,gBAAgB,CAAoC;IAErE,YAAY,KAAgC;QAC1C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC;QACnD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,IAAI,iCAAiC,CAC3D,KAAK,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,KAAmC;QAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,SAAS;YACT,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,IAAI;YACJ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CACvC,IAAI,eAAe,CAAC;YAClB,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,SAAS;YACT,uBAAuB,EAAE;gBACvB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;aACd;YACD,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,WAAW;YACX,OAAO;SACR,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,QAAwB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,kBAAkB;QAClB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,iBAAiB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/iam/credential/session/sim-iam-session.d.ts

@@ -0,0 +1,33 @@
+import type { SimArnPrincipal, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamRole } from "../../role/sim-iam-role.js";
+interface SimIamSessionProps {
+    readonly principal: SimArnPrincipal;
+    readonly sourcePrincipal: SimAwsPrincipal;
+    readonly role: SimIamRole;
+    readonly sessionName: string;
+    readonly sessionToken: string;
+    readonly createDate: Date;
+    readonly expiration: Date;
+}
+/**
+ * A temporary simulated AWS session.
+ *
+ * A session retains both the assumed-role request principal and the underlying
+ * IAM Role whose identity policies apply to requests made with the session.
+ */
+export declare class SimIamSession {
+    readonly principal: SimArnPrincipal;
+    readonly sourcePrincipal: SimAwsPrincipal;
+    readonly role: SimIamRole;
+    readonly sessionName: string;
+    readonly sessionToken: string;
+    readonly createDate: Date;
+    readonly expiration: Date;
+    constructor(props: SimIamSessionProps);
+    /**
+     * Whether this session has expired at the supplied time.
+     */
+    isExpired(now: Date): boolean;
+}
+export {};
+//# sourceMappingURL=sim-iam-session.d.ts.map

package/dist/service/iam/credential/session/sim-iam-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,eAAe,EAAE,eAAe,CAAC;IACjD,SAAgB,IAAI,EAAE,UAAU,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,UAAU,EAAE,IAAI,CAAC;IACjC,SAAgB,UAAU,EAAE,IAAI,CAAC;IAEjC,YAAY,KAAK,EAAE,kBAAkB,EAoBpC;IAED;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE5B;CACF"}

package/dist/service/iam/credential/session/sim-iam-session.js

@@ -0,0 +1,40 @@
+/**
+ * A temporary simulated AWS session.
+ *
+ * A session retains both the assumed-role request principal and the underlying
+ * IAM Role whose identity policies apply to requests made with the session.
+ */
+export class SimIamSession {
+    principal;
+    sourcePrincipal;
+    role;
+    sessionName;
+    sessionToken;
+    createDate;
+    expiration;
+    constructor(props) {
+        if (props.sessionName.length === 0) {
+            throw new Error("Sim IAM session name must not be empty");
+        }
+        if (props.sessionToken.length === 0) {
+            throw new Error("Sim IAM session token must not be empty");
+        }
+        if (props.expiration.getTime() <= props.createDate.getTime()) {
+            throw new Error("Sim IAM session expiration must follow its creation");
+        }
+        this.principal = props.principal;
+        this.sourcePrincipal = props.sourcePrincipal;
+        this.role = props.role;
+        this.sessionName = props.sessionName;
+        this.sessionToken = props.sessionToken;
+        this.createDate = new Date(props.createDate);
+        this.expiration = new Date(props.expiration);
+    }
+    /**
+     * Whether this session has expired at the supplied time.
+     */
+    isExpired(now) {
+        return now.getTime() >= this.expiration.getTime();
+    }
+}
+//# sourceMappingURL=sim-iam-session.js.map

package/dist/service/iam/credential/session/sim-iam-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-session.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACR,SAAS,CAAkB;IAC3B,eAAe,CAAkB;IACjC,IAAI,CAAa;IACjB,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,UAAU,CAAO;IACjB,UAAU,CAAO;IAEjC,YAAY,KAAyB;QACnC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAS;QACjB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/service/iam/credential/sim-aws-credentials.d.ts

@@ -0,0 +1,21 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamRole } from "../role/sim-iam-role.js";
+import type { SimIamSession } from "./session/sim-iam-session.js";
+export interface SimAwsCredentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken?: string | undefined;
+}
+/**
+ * The authenticated identity resolved from simulated AWS credentials.
+ *
+ * For temporary role credentials, `principal` is the assumed-role session
+ * principal while `identityPolicyPrincipal` is the underlying IAM Role.
+ */
+export interface SimIamCredentialIdentity {
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal: SimAwsPrincipal;
+    readonly role?: SimIamRole | undefined;
+    readonly session?: SimIamSession | undefined;
+}
+//# sourceMappingURL=sim-aws-credentials.d.ts.map

package/dist/service/iam/credential/sim-aws-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-credentials.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-aws-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,EAAE,eAAe,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC9C"}

package/dist/service/iam/credential/sim-aws-credentials.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-aws-credentials.js.map

package/dist/service/iam/credential/sim-aws-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-credentials.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-aws-credentials.ts"],"names":[],"mappings":""}

package/dist/service/iam/credential/sim-iam-access-key.d.ts

@@ -0,0 +1,44 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamCredentialIdentity } from "./sim-aws-credentials.js";
+import type { SimIamSession } from "./session/sim-iam-session.js";
+export type SimIamAccessKeyStatus = "Active" | "Inactive";
+interface SimIamAccessKeyProps {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal?: SimAwsPrincipal | undefined;
+    readonly session?: SimIamSession | undefined;
+    readonly createDate?: Date | undefined;
+    readonly status?: SimIamAccessKeyStatus | undefined;
+}
+/**
+ * A simulated AWS access key associated with an authenticated principal.
+ *
+ * Access keys can represent either long-lived credentials or temporary
+ * credentials backed by a session.
+ */
+export declare class SimIamAccessKey {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal: SimAwsPrincipal;
+    readonly session?: SimIamSession | undefined;
+    readonly createDate: Date;
+    status: SimIamAccessKeyStatus;
+    constructor(props: SimIamAccessKeyProps);
+    /**
+     * Whether a secret access key matches this access key.
+     */
+    matchesSecretAccessKey(secretAccessKey: string): boolean;
+    /**
+     * Whether a session token matches this access key's temporary session.
+     */
+    matchesSessionToken(sessionToken: string | undefined): boolean;
+    /**
+     * Return the authenticated identity represented by this access key.
+     */
+    identity(): SimIamCredentialIdentity;
+    private secretsMatch;
+}
+export {};
+//# sourceMappingURL=sim-iam-access-key.d.ts.map

package/dist/service/iam/credential/sim-iam-access-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE1D,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,eAAe,EAAE,MAAM,CAAC;IACxC,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,uBAAuB,EAAE,eAAe,CAAC;IACzD,SAAgB,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpD,SAAgB,UAAU,EAAE,IAAI,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAErC,YAAY,KAAK,EAAE,oBAAoB,EAStC;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAEvD;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAM7D;IAED;;OAEG;IACH,QAAQ,IAAI,wBAAwB,CAOnC;IAED,OAAO,CAAC,YAAY;CAMrB"}

package/dist/service/iam/credential/sim-iam-access-key.js

@@ -0,0 +1,57 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+/**
+ * A simulated AWS access key associated with an authenticated principal.
+ *
+ * Access keys can represent either long-lived credentials or temporary
+ * credentials backed by a session.
+ */
+export class SimIamAccessKey {
+    accessKeyId;
+    secretAccessKey;
+    principal;
+    identityPolicyPrincipal;
+    session;
+    createDate;
+    status;
+    constructor(props) {
+        this.accessKeyId = props.accessKeyId;
+        this.secretAccessKey = props.secretAccessKey;
+        this.principal = props.principal;
+        this.identityPolicyPrincipal =
+            props.identityPolicyPrincipal ?? props.principal;
+        this.session = props.session;
+        this.createDate = new Date(props.createDate ?? Date.now());
+        this.status = props.status ?? "Active";
+    }
+    /**
+     * Whether a secret access key matches this access key.
+     */
+    matchesSecretAccessKey(secretAccessKey) {
+        return this.secretsMatch(secretAccessKey, this.secretAccessKey);
+    }
+    /**
+     * Whether a session token matches this access key's temporary session.
+     */
+    matchesSessionToken(sessionToken) {
+        return (this.session !== undefined &&
+            sessionToken !== undefined &&
+            this.secretsMatch(sessionToken, this.session.sessionToken));
+    }
+    /**
+     * Return the authenticated identity represented by this access key.
+     */
+    identity() {
+        return {
+            principal: this.principal,
+            identityPolicyPrincipal: this.identityPolicyPrincipal,
+            role: this.session?.role,
+            session: this.session,
+        };
+    }
+    secretsMatch(actual, expected) {
+        const actualHash = createHash("sha256").update(actual).digest();
+        const expectedHash = createHash("sha256").update(expected).digest();
+        return timingSafeEqual(actualHash, expectedHash);
+    }
+}
+//# sourceMappingURL=sim-iam-access-key.js.map

package/dist/service/iam/credential/sim-iam-access-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB1D;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACV,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,SAAS,CAAkB;IAC3B,uBAAuB,CAAkB;IACzC,OAAO,CAA6B;IACpC,UAAU,CAAO;IAC1B,MAAM,CAAwB;IAErC,YAAY,KAA2B;QACrC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,uBAAuB;YAC1B,KAAK,CAAC,uBAAuB,IAAI,KAAK,CAAC,SAAS,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAuB;QAC5C,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI;YACxB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,QAAgB;QACnD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QAEpE,OAAO,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-credential-registry.d.ts

@@ -0,0 +1,21 @@
+import type { SimAwsCredentials, SimIamCredentialIdentity } from "./sim-aws-credentials.js";
+import type { SimIamAccessKey } from "./sim-iam-access-key.js";
+/**
+ * Stores and authenticates simulated IAM access keys.
+ *
+ * The registry is deliberately agnostic about the principal type represented
+ * by an access key. Temporary sessions and future IAM-user access keys share
+ * the same lookup and authentication behavior.
+ */
+export declare class SimIamCredentialRegistry {
+    private readonly accessKeys;
+    /**
+     * Register a new simulated access key.
+     */
+    registerAccessKey(accessKey: SimIamAccessKey): void;
+    /**
+     * Authenticate credentials and resolve their simulated AWS identity.
+     */
+    resolve(credentials: SimAwsCredentials, now?: Date): SimIamCredentialIdentity;
+}
+//# sourceMappingURL=sim-iam-credential-registry.d.ts.map

package/dist/service/iam/credential/sim-iam-credential-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-credential-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM/D;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IAEjE;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAMlD;IAED;;OAEG;IACH,OAAO,CACL,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACrB,wBAAwB,CAgE1B;CACF"}

package/dist/service/iam/credential/sim-iam-credential-registry.js

@@ -0,0 +1,75 @@
+import { SimIamDuplicateAccessKey, SimIamInvalidCredentials, } from "./error/sim-iam-credential.error.js";
+/**
+ * Stores and authenticates simulated IAM access keys.
+ *
+ * The registry is deliberately agnostic about the principal type represented
+ * by an access key. Temporary sessions and future IAM-user access keys share
+ * the same lookup and authentication behavior.
+ */
+export class SimIamCredentialRegistry {
+    accessKeys = new Map();
+    /**
+     * Register a new simulated access key.
+     */
+    registerAccessKey(accessKey) {
+        if (this.accessKeys.has(accessKey.accessKeyId)) {
+            throw new SimIamDuplicateAccessKey(accessKey.accessKeyId);
+        }
+        this.accessKeys.set(accessKey.accessKeyId, accessKey);
+    }
+    /**
+     * Authenticate credentials and resolve their simulated AWS identity.
+     */
+    resolve(credentials, now = new Date()) {
+        const accessKey = this.accessKeys.get(credentials.accessKeyId);
+        if (accessKey === undefined) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: credentials.accessKeyId,
+                reason: "unknown-access-key",
+            });
+        }
+        if (accessKey.status !== "Active") {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: credentials.accessKeyId,
+                reason: "inactive-access-key",
+                accessKeyStatus: accessKey.status,
+            });
+        }
+        if (!accessKey.matchesSecretAccessKey(credentials.secretAccessKey)) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: credentials.accessKeyId,
+                reason: "secret-access-key-mismatch",
+            });
+        }
+        if (accessKey.session !== undefined &&
+            credentials.sessionToken === undefined) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: credentials.accessKeyId,
+                reason: "session-token-missing",
+            });
+        }
+        if (accessKey.session === undefined &&
+            credentials.sessionToken !== undefined) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: credentials.accessKeyId,
+                reason: "session-token-unexpected",
+            });
+        }
+        if (accessKey.session !== undefined &&
+            !accessKey.matchesSessionToken(credentials.sessionToken)) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: credentials.accessKeyId,
+                reason: "session-token-mismatch",
+            });
+        }
+        if (accessKey.session?.isExpired(now) === true) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: credentials.accessKeyId,
+                reason: "expired-session",
+                expiration: accessKey.session.expiration,
+            });
+        }
+        return accessKey.identity();
+    }
+}
+//# sourceMappingURL=sim-iam-credential-registry.js.map

package/dist/service/iam/credential/sim-iam-credential-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-credential-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjE;;OAEG;IACH,iBAAiB,CAAC,SAA0B;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,OAAO,CACL,WAA8B,EAC9B,GAAG,GAAS,IAAI,IAAI,EAAE;QAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,qBAAqB;gBAC7B,eAAe,EAAE,SAAS,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,4BAA4B;aACrC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,WAAW,CAAC,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,uBAAuB;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,WAAW,CAAC,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,CAAC,SAAS,CAAC,mBAAmB,CAAC,WAAW,CAAC,YAAY,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,iBAAiB;gBACzB,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/service/iam/credential/user/sim-iam-user-credential-generator.d.ts

@@ -0,0 +1,20 @@
+export interface SimIamUserCredentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+}
+/**
+ * Generates long-lived credentials for a simulated IAM user.
+ */
+export interface SimIamUserCredentialGenerator {
+    generate(): SimIamUserCredentials;
+}
+/**
+ * Default random IAM-user credential generator.
+ */
+export declare class SimIamRandomUserCredentialGenerator implements SimIamUserCredentialGenerator {
+    /**
+     * Generate sim access key ID and secret access key for sim IAM User.
+     */
+    generate(): SimIamUserCredentials;
+}
+//# sourceMappingURL=sim-iam-user-credential-generator.d.ts.map

package/dist/service/iam/credential/user/sim-iam-user-credential-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-credential-generator.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/user/sim-iam-user-credential-generator.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,IAAI,qBAAqB,CAAC;CACnC;AAED;;GAEG;AACH,qBAAa,mCAAoC,YAAW,6BAA6B;IACvF;;OAEG;IACH,QAAQ,IAAI,qBAAqB,CAMhC;CACF"}

package/dist/service/iam/credential/user/sim-iam-user-credential-generator.js

@@ -0,0 +1,16 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Default random IAM-user credential generator.
+ */
+export class SimIamRandomUserCredentialGenerator {
+    /**
+     * Generate sim access key ID and secret access key for sim IAM User.
+     */
+    generate() {
+        return {
+            accessKeyId: `AKIA${faker.string.alphanumeric({ length: 16 })}`.toUpperCase(),
+            secretAccessKey: faker.string.alphanumeric({ length: 40 }),
+        };
+    }
+}
+//# sourceMappingURL=sim-iam-user-credential-generator.js.map

package/dist/service/iam/credential/user/sim-iam-user-credential-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-user-credential-generator.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/user/sim-iam-user-credential-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAcxC;;GAEG;AACH,MAAM,OAAO,mCAAmC;IAC9C;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,WAAW,EACT,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE;YAClE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC3D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/error/sim-iam-caller-identifier.d.ts

@@ -0,0 +1,25 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * Converts a simulated AWS principal into the identifier displayed in IAM
+ * authorization error messages.
+ *
+ * Simulated principals use a discriminated union because each principal kind
+ * stores its identifier in a different property. Keeping that mapping here
+ * prevents IAM error classes from needing to understand every principal shape.
+ *
+ * The returned values follow the existing error-message format:
+ *
+ * - anonymous callers use the literal `anonymous`;
+ * - ARN principals use their complete ARN;
+ * - AWS service principals use their service name.
+ *
+ * Add handling here when a new principal kind is introduced so all IAM
+ * authorization diagnostics continue to identify callers consistently.
+ */
+export declare class SimIamCallerIdentifier {
+    /**
+     * Return the human-readable identifier for one simulated AWS principal.
+     */
+    format(caller: SimAwsPrincipal): string;
+}
+//# sourceMappingURL=sim-iam-caller-identifier.d.ts.map

package/dist/service/iam/error/sim-iam-caller-identifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-identifier.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam-caller-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sBAAsB;IACjC;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAUtC;CACF"}

package/dist/service/iam/error/sim-iam-caller-identifier.js

@@ -0,0 +1,32 @@
+/**
+ * Converts a simulated AWS principal into the identifier displayed in IAM
+ * authorization error messages.
+ *
+ * Simulated principals use a discriminated union because each principal kind
+ * stores its identifier in a different property. Keeping that mapping here
+ * prevents IAM error classes from needing to understand every principal shape.
+ *
+ * The returned values follow the existing error-message format:
+ *
+ * - anonymous callers use the literal `anonymous`;
+ * - ARN principals use their complete ARN;
+ * - AWS service principals use their service name.
+ *
+ * Add handling here when a new principal kind is introduced so all IAM
+ * authorization diagnostics continue to identify callers consistently.
+ */
+export class SimIamCallerIdentifier {
+    /**
+     * Return the human-readable identifier for one simulated AWS principal.
+     */
+    format(caller) {
+        if (caller.kind === "anonymous") {
+            return "anonymous";
+        }
+        if (caller.kind === "arn") {
+            return caller.arn;
+        }
+        return caller.service;
+    }
+}
+//# sourceMappingURL=sim-iam-caller-identifier.js.map

package/dist/service/iam/error/sim-iam-caller-identifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-identifier.js","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam-caller-identifier.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IACjC;;OAEG;IACH,MAAM,CAAC,MAAuB;QAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF"}

package/dist/service/iam/error/sim-iam.error.d.ts

@@ -1,3 +1,4 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
 /**
  * Minimal metadata shape for simulated IAM errors.
  */
@@ -11,6 +12,31 @@ export declare class SimIamError extends Error {
     readonly $metadata: SimIamErrorMetadata;
     constructor(message: string, $metadata?: SimIamErrorMetadata);
 }
+/**
+ * Details of an IAM authorization failure.
+ */
+export interface SimIamAccessDeniedInput {
+    readonly principal: SimAwsPrincipal;
+    readonly action: string;
+    readonly resource: string;
+}
+/**
+ * Simulated IAM AccessDenied error.
+ */
+export declare class SimIamAccessDenied extends SimIamError {
+    readonly name = "AccessDenied";
+    readonly caller: SimAwsPrincipal;
+    readonly action: string;
+    readonly resource: string;
+    /**
+     * Build an AWS-style authorization failure.
+     *
+     * Caller formatting is delegated because principal variants store their
+     * identifiers differently. This class remains responsible for the IAM error
+     * contract: message structure, HTTP metadata, and diagnostic properties.
+     */
+    constructor(input: SimIamAccessDeniedInput);
+}
 /**
  * Simulated IAM NoSuchEntity error.
  */

package/dist/service/iam/error/sim-iam.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.error.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,SAAyB,IAAI,kBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAC5D,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}
+{"version":3,"file":"sim-iam.error.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam.error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAG1E;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,SAAyB,IAAI,kBAAkB;IAE/C,SAAgB,MAAM,EAAE,eAAe,CAAC;IACxC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC;;;;;;OAMG;IACH,YAAY,KAAK,EAAE,uBAAuB,EAYzC;CACF;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,SAAyB,IAAI,kBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAC5D,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}