@kensio/yulin 0.32.0 → 0.33.0

package/dist/service/iam/error/sim-iam.error.js

@@ -1,3 +1,4 @@
+import { SimIamCallerIdentifier } from "./sim-iam-caller-identifier.js";
 /**
  * Base class for simulated IAM errors.
  */
@@ -8,6 +9,30 @@ export class SimIamError extends Error {
         this.$metadata = $metadata;
     }
 }
+/**
+ * Simulated IAM AccessDenied error.
+ */
+export class SimIamAccessDenied extends SimIamError {
+    name = "AccessDenied";
+    caller;
+    action;
+    resource;
+    /**
+     * Build an AWS-style authorization failure.
+     *
+     * Caller formatting is delegated because principal variants store their
+     * identifiers differently. This class remains responsible for the IAM error
+     * contract: message structure, HTTP metadata, and diagnostic properties.
+     */
+    constructor(input) {
+        const iamCallerIdentifier = new SimIamCallerIdentifier();
+        const callerIdentifier = iamCallerIdentifier.format(input.principal);
+        super(`User: ${callerIdentifier} is not authorized to perform: ${input.action} on resource: ${input.resource}`, { httpStatusCode: 403 });
+        this.caller = input.principal;
+        this.action = input.action;
+        this.resource = input.resource;
+    }
+}
 /**
  * Simulated IAM NoSuchEntity error.
  */

package/dist/service/iam/error/sim-iam.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.error.js","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACxB,IAAI,GAAG,cAAc,CAAC;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,WAAW;IACnC,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-iam.error.js","sourceRoot":"","sources":["../../../../src/service/iam/error/sim-iam.error.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AASxE;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAWD;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACxB,IAAI,GAAG,cAAc,CAAC;IAE/B,MAAM,CAAkB;IACxB,MAAM,CAAS;IACf,QAAQ,CAAS;IAEjC;;;;;;OAMG;IACH,YAAY,KAA8B;QACxC,MAAM,mBAAmB,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAErE,KAAK,CACH,SAAS,gBAAgB,kCAAkC,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,QAAQ,EAAE,EACxG,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACxB,IAAI,GAAG,cAAc,CAAC;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,WAAW;IACnC,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/iam/policy/sim-iam-policy.d.ts

@@ -19,8 +19,10 @@ export interface SimIamPolicyDocumentStatement {
     readonly NotPrincipal?: SimIamPolicyDocumentPrincipal | undefined;
     readonly Condition?: SimIamPolicyDocumentCondition | undefined;
 }
-export type SimIamPolicyDocumentPrincipal = string | readonly string[] | Readonly<Record<string, string | readonly string[]>>;
-export type SimIamPolicyDocumentCondition = Readonly<Record<string, Readonly<Record<string, string | number | boolean | readonly string[]>>>>;
+export type SimIamPolicyDocumentPrincipalObject = Readonly<Record<string, string | readonly string[]>>;
+export type SimIamPolicyDocumentPrincipal = string | readonly string[] | SimIamPolicyDocumentPrincipalObject;
+export type SimIamConditionValue = string | number | boolean | readonly string[];
+export type SimIamPolicyDocumentCondition = Readonly<Record<string, Readonly<Record<string, SimIamConditionValue>>>>;
 /**
  * IAM managed policy record.
  *

package/dist/service/iam/policy/sim-iam-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EACjB,6BAA6B,GAAG,SAAS,6BAA6B,EAAE,CAAC;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAChE;AAED,MAAM,MAAM,6BAA6B,GACrC,MAAM,GACN,SAAS,MAAM,EAAE,GACjB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAEzD,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAClD,MAAM,CACJ,MAAM,EACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC,CACxE,CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC"}
+{"version":3,"file":"sim-iam-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EACjB,6BAA6B,GAAG,SAAS,6BAA6B,EAAE,CAAC;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAChE;AAED,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CACxD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAC3C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACvC,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,mCAAmC,CAAC;AAEnE,MAAM,MAAM,oBAAoB,GAC9B,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;AAEhD,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAClD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAC/D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC"}

package/dist/service/iam/registry/sim-iam-account-resolver.d.ts

@@ -0,0 +1,16 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIam } from "../sim-iam.js";
+/**
+ * Resolves account-scoped simulated IAM facades within one simulated AWS
+ * environment.
+ */
+export interface SimIamAccountResolver {
+    /**
+     * Resolve simulated IAM for an Account.
+     *
+     * Should throw a diagnostic error when IAM has not been instantiated and
+     * registered for the requested Account.
+     */
+    iamForAccount(accountId: SimAwsAccountId): SimIam;
+}
+//# sourceMappingURL=sim-iam-account-resolver.d.ts.map

package/dist/service/iam/registry/sim-iam-account-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-account-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAAC;CACnD"}

package/dist/service/iam/registry/sim-iam-account-resolver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-account-resolver.js.map

package/dist/service/iam/registry/sim-iam-account-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-resolver.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-account-resolver.ts"],"names":[],"mappings":""}

package/dist/service/iam/registry/sim-iam-registry.d.ts

@@ -1,84 +1,30 @@
-export interface SimIamDisableEvent {
-    readonly reason: string;
-    readonly detail?: string | undefined;
-    readonly disabledAt: Date;
-}
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIam } from "../sim-iam.js";
+import type { SimIamAccountResolver } from "./sim-iam-account-resolver.js";
 /**
- * Simulated IAM registry for state that is global within one SimAws instance.
+ * Simulation-wide registry of account-scoped IAM facades.
+ *
+ * One registry belongs to one SimAws environment. It allows cross-account
+ * services to resolve IAM state owned by a particular Account.
  *
- * IAM service facades are Account-scoped, but IAM activation is sim AWS-wide so
- * cross-account behaviour does not depend on which Account first interacted
- * with sim IAM.
+ * The registry indexes IAM facades but does not create or own them.
  */
-export declare class SimIamRegistry {
-    private activated;
-    private disableEventRecord;
-    private readonly activationEventRecords;
-    /**
-     * Whether sim IAM is currently activated for this sim AWS instance.
-     */
-    get isActivated(): boolean;
-    /**
-     * Whether sim IAM has been explicitly and permanently disabled for this sim
-     * AWS instance.
-     */
-    get isDisabled(): boolean;
-    /**
-     * Recorded reasons why sim IAM activation was attempted.
-     *
-     * Events include both successful activations and later activation attempts that
-     * were ignored because sim IAM had been permanently disabled.
-     */
-    get activationEvents(): SimIamActivationEvent[];
-    /**
-     * The permanent disable event, if the user explicitly disabled sim IAM.
-     */
-    get disableEvent(): SimIamDisableEvent | undefined;
+export declare class SimIamRegistry implements SimIamAccountResolver {
+    private readonly iamByAccountId;
     /**
-     * Human-readable diagnostic summary of why sim IAM is activated or not yet
-     * activated.
-     */
-    get statusReason(): string;
-    /**
-     * Activate sim IAM for this simulated AWS instance.
+     * Register the IAM facade belonging to an Account.
      *
-     * If sim IAM has previously been explicitly disabled, the activation attempt is
-     * recorded for diagnostics but does not reactivate IAM semantics.
+     * Re-registering the same facade is harmless. Registering a different facade
+     * for an Account that already has one fails rather than silently replacing
+     * account-owned IAM state.
      */
-    activate(reason?: string, detail?: string): void;
+    register(accountId: SimAwsAccountId, iam: SimIam): void;
     /**
-     * Disable IAM semantics for this simulated AWS instance.
-     *
-     * Disabling is permanent for the lifetime of this sim AWS instance. Automatic
-     * activations from other simulated services are still recorded after disable,
-     * but they are ignored.
+     * Resolve the registered IAM facade belonging to an Account.
      *
-     * Disabling does not clear activation history because the history is useful
-     * diagnostic information for tests and debugging.
-     */
-    disable(reason?: string, detail?: string): void;
-    private latestSuccessfulActivationEvent;
-    private formatEventReason;
-}
-interface SimIamActivationEvent {
-    readonly reason: string;
-    readonly detail?: string | undefined;
-    readonly activatedAt: Date;
-    /**
-     * Whether this activation attempt actually made sim IAM activated.
-     *
-     * This is false when the registry had previously been permanently disabled.
-     */
-    readonly activated: boolean;
-    /**
-     * Whether sim IAM had already been permanently disabled when this activation
-     * was attempted.
-     */
-    readonly registryDisabled: boolean;
-    /**
-     * Diagnostic explanation when an activation attempt was recorded but ignored.
+     * Throws a diagnostic error when no IAM facade is registered so callers can
+     * rely on receiving a usable account-scoped service.
      */
-    readonly ignoredReason?: string | undefined;
+    iamForAccount(accountId: SimAwsAccountId): SimIam;
 }
-export {};
 //# sourceMappingURL=sim-iam-registry.d.ts.map

package/dist/service/iam/registry/sim-iam-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,kBAAkB,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA+B;IAEtE;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;OAGG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,qBAAqB,EAAE,CAE9C;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,kBAAkB,GAAG,SAAS,CAEjD;IAED;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,CAkBzB;IAED;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,SAAsB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5D;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,SAAmB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAQxD;IAED,OAAO,CAAC,+BAA+B;IAIvC,OAAO,CAAC,iBAAiB;CAG1B;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C"}
+{"version":3,"file":"sim-iam-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;GAOG;AACH,qBAAa,cAAe,YAAW,qBAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CActD;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAQhD;CACF"}

package/dist/service/iam/registry/sim-iam-registry.js

@@ -1,102 +1,42 @@
 /**
- * Simulated IAM registry for state that is global within one SimAws instance.
+ * Simulation-wide registry of account-scoped IAM facades.
  *
- * IAM service facades are Account-scoped, but IAM activation is sim AWS-wide so
- * cross-account behaviour does not depend on which Account first interacted
- * with sim IAM.
+ * One registry belongs to one SimAws environment. It allows cross-account
+ * services to resolve IAM state owned by a particular Account.
+ *
+ * The registry indexes IAM facades but does not create or own them.
  */
 export class SimIamRegistry {
-    activated = false;
-    disableEventRecord;
-    activationEventRecords = [];
-    /**
-     * Whether sim IAM is currently activated for this sim AWS instance.
-     */
-    get isActivated() {
-        return this.activated && this.disableEventRecord === undefined;
-    }
-    /**
-     * Whether sim IAM has been explicitly and permanently disabled for this sim
-     * AWS instance.
-     */
-    get isDisabled() {
-        return this.disableEventRecord !== undefined;
-    }
+    iamByAccountId = new Map();
     /**
-     * Recorded reasons why sim IAM activation was attempted.
+     * Register the IAM facade belonging to an Account.
      *
-     * Events include both successful activations and later activation attempts that
-     * were ignored because sim IAM had been permanently disabled.
-     */
-    get activationEvents() {
-        return this.activationEventRecords;
-    }
-    /**
-     * The permanent disable event, if the user explicitly disabled sim IAM.
+     * Re-registering the same facade is harmless. Registering a different facade
+     * for an Account that already has one fails rather than silently replacing
+     * account-owned IAM state.
      */
-    get disableEvent() {
-        return this.disableEventRecord;
-    }
-    /**
-     * Human-readable diagnostic summary of why sim IAM is activated or not yet
-     * activated.
-     */
-    get statusReason() {
-        if (this.disableEventRecord !== undefined) {
-            return `Sim IAM is permanently disabled: ${this.formatEventReason(this.disableEventRecord.reason, this.disableEventRecord.detail)}`;
+    register(accountId, iam) {
+        const existingIam = this.iamByAccountId.get(accountId);
+        if (existingIam === iam) {
+            return;
         }
-        const latestActivationEvent = this.latestSuccessfulActivationEvent();
-        if (latestActivationEvent !== undefined) {
-            return `Sim IAM is activated: ${this.formatEventReason(latestActivationEvent.reason, latestActivationEvent.detail)}`;
+        if (existingIam !== undefined) {
+            throw new Error(`A different SimIam is already registered for Account ${accountId}`);
         }
-        return "Sim IAM is not activated because it has not been activated.";
+        this.iamByAccountId.set(accountId, iam);
     }
     /**
-     * Activate sim IAM for this simulated AWS instance.
+     * Resolve the registered IAM facade belonging to an Account.
      *
-     * If sim IAM has previously been explicitly disabled, the activation attempt is
-     * recorded for diagnostics but does not reactivate IAM semantics.
+     * Throws a diagnostic error when no IAM facade is registered so callers can
+     * rely on receiving a usable account-scoped service.
      */
-    activate(reason = "Manual activation", detail) {
-        const registryDisabled = this.disableEventRecord !== undefined;
-        const ignoredReason = registryDisabled
-            ? "Sim IAM was permanently disabled by explicit user action."
-            : undefined;
-        this.activationEventRecords.push({
-            reason,
-            detail,
-            activatedAt: new Date(),
-            activated: !registryDisabled,
-            registryDisabled,
-            ignoredReason,
-        });
-        if (!registryDisabled) {
-            this.activated = true;
+    iamForAccount(accountId) {
+        const iam = this.iamByAccountId.get(accountId);
+        if (iam === undefined) {
+            throw new Error(`Sim IAM is not registered for Account ${accountId}`);
         }
-    }
-    /**
-     * Disable IAM semantics for this simulated AWS instance.
-     *
-     * Disabling is permanent for the lifetime of this sim AWS instance. Automatic
-     * activations from other simulated services are still recorded after disable,
-     * but they are ignored.
-     *
-     * Disabling does not clear activation history because the history is useful
-     * diagnostic information for tests and debugging.
-     */
-    disable(reason = "Manual disable", detail) {
-        this.activated = false;
-        this.disableEventRecord ??= {
-            reason,
-            detail,
-            disabledAt: new Date(),
-        };
-    }
-    latestSuccessfulActivationEvent() {
-        return this.activationEventRecords.findLast((event) => event.activated);
-    }
-    formatEventReason(reason, detail) {
-        return detail === undefined ? reason : `${reason} (${detail})`;
+        return iam;
     }
 }
 //# sourceMappingURL=sim-iam-registry.js.map

package/dist/service/iam/registry/sim-iam-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,GAAG,KAAK,CAAC;IAClB,kBAAkB,CAAiC;IAC1C,sBAAsB,GAA4B,EAAE,CAAC;IAEtE;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,sBAAsB,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,IAAI,YAAY;QACd,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,oCAAoC,IAAI,CAAC,iBAAiB,CAC/D,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAC9B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAC/B,EAAE,CAAC;QACN,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAErE,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,yBAAyB,IAAI,CAAC,iBAAiB,CACpD,qBAAqB,CAAC,MAAM,EAC5B,qBAAqB,CAAC,MAAM,CAC7B,EAAE,CAAC;QACN,CAAC;QAED,OAAO,6DAA6D,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,MAAe;QACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAC/D,MAAM,aAAa,GAAG,gBAAgB;YACpC,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAC/B,MAAM;YACN,MAAM;YACN,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,SAAS,EAAE,CAAC,gBAAgB;YAC5B,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,MAAe;QAChD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QAEvB,IAAI,CAAC,kBAAkB,KAAK;YAC1B,MAAM;YACN,MAAM;YACN,UAAU,EAAE,IAAI,IAAI,EAAE;SACvB,CAAC;IACJ,CAAC;IAEO,+BAA+B;QACrC,OAAO,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAEO,iBAAiB,CAAC,MAAc,EAAE,MAAe;QACvD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,GAAG,CAAC;IACjE,CAAC;CACF"}
+{"version":3,"file":"sim-iam-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACR,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,SAA0B,EAAE,GAAW;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,wDAAwD,SAAS,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAA0B;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/service/iam/role/arn/sim-iam-role-arn-parser.d.ts

@@ -0,0 +1,16 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+export interface IamRoleArnParts {
+    readonly accountId: SimAwsAccountId;
+    readonly roleName: string;
+}
+/**
+ * Parses IAM role ARNs into the account ID and role name used by STS.
+ */
+export declare class IamRoleArnParser {
+    /**
+     * Parse an IAM role ARN.
+     */
+    parse(roleArn: string): IamRoleArnParts;
+    private isAccountId;
+}
+//# sourceMappingURL=sim-iam-role-arn-parser.d.ts.map

package/dist/service/iam/role/arn/sim-iam-role-arn-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-role-arn-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/role/arn/sim-iam-role-arn-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CA8BtC;IAED,OAAO,CAAC,WAAW;CAapB"}

package/dist/service/iam/role/arn/sim-iam-role-arn-parser.js

@@ -0,0 +1,41 @@
+/**
+ * Parses IAM role ARNs into the account ID and role name used by STS.
+ */
+export class IamRoleArnParser {
+    /**
+     * Parse an IAM role ARN.
+     */
+    parse(roleArn) {
+        const prefix = "arn:aws:iam::";
+        if (!roleArn.startsWith(prefix)) {
+            throw new Error(`Invalid IAM Role ARN: ${roleArn}`);
+        }
+        const roleSeparator = ":role/";
+        const separatorIndex = roleArn.indexOf(roleSeparator, prefix.length);
+        if (separatorIndex === -1) {
+            throw new Error(`Invalid IAM Role ARN: ${roleArn}`);
+        }
+        const accountId = roleArn.slice(prefix.length, separatorIndex);
+        const rolePathAndName = roleArn.slice(separatorIndex + roleSeparator.length);
+        const roleName = rolePathAndName.slice(rolePathAndName.lastIndexOf("/") + 1);
+        if (!this.isAccountId(accountId) || roleName.length === 0) {
+            throw new Error(`Invalid IAM Role ARN: ${roleArn}`);
+        }
+        return {
+            accountId: accountId,
+            roleName,
+        };
+    }
+    isAccountId(value) {
+        if (value.length !== 12) {
+            return false;
+        }
+        for (const character of value) {
+            if (character < "0" || character > "9") {
+                return false;
+            }
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=sim-iam-role-arn-parser.js.map

package/dist/service/iam/role/arn/sim-iam-role-arn-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-role-arn-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/role/arn/sim-iam-role-arn-parser.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAC3B;;OAEG;IACH,KAAK,CAAC,OAAe;QACnB,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,aAAa,GAAG,QAAQ,CAAC;QAE/B,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CACnC,cAAc,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC;QACF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,OAAO;YACL,SAAS,EAAE,SAA4B;YACvC,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,IAAI,SAAS,GAAG,GAAG,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACvC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/iam/role/arn/sim-iam-role-arn.d.ts

@@ -0,0 +1,14 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamRoleName } from "../sim-iam-role.js";
+interface MakeSimRoleArnProps {
+    readonly accountId: SimAwsAccountId;
+    readonly path: string;
+    readonly roleName: SimIamRoleName;
+}
+/**
+ * Make an IAM Role ARN.
+ */
+export declare function makeSimRoleArn(props: MakeSimRoleArnProps): SimArn;
+export {};
+//# sourceMappingURL=sim-iam-role-arn.d.ts.map

package/dist/service/iam/role/arn/sim-iam-role-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-role-arn.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/role/arn/sim-iam-role-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAKjE"}

package/dist/service/iam/role/arn/sim-iam-role-arn.js

@@ -0,0 +1,9 @@
+/**
+ * Make an IAM Role ARN.
+ */
+export function makeSimRoleArn(props) {
+    const { accountId, path, roleName } = props;
+    const pathPart = path === "/" ? "" : path.slice(1);
+    return `arn:aws:iam::${accountId}:role/${pathPart}${roleName}`;
+}
+//# sourceMappingURL=sim-iam-role-arn.js.map

package/dist/service/iam/role/arn/sim-iam-role-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-role-arn.js","sourceRoot":"","sources":["../../../../../src/service/iam/role/arn/sim-iam-role-arn.ts"],"names":[],"mappings":"AAUA;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnD,OAAO,gBAAgB,SAAS,SAAS,QAAQ,GAAG,QAAQ,EAAY,CAAC;AAC3E,CAAC"}

package/dist/service/iam/role/sim-iam-role.factory.js

@@ -1,6 +1,6 @@
 import { DynamicFactory } from "@kensio/part-factory";
 import { makeSimAwsAccountId } from "../../aws/sim-aws-account.js";
-import { makeSimRoleArn } from "./sim-iam-role-arn.js";
+import { makeSimRoleArn } from "./arn/sim-iam-role-arn.js";
 import { makeSimIamRoleId } from "./sim-iam-role-id.js";
 /**
  * Generates fake IAM Role records.

package/dist/service/iam/role/sim-iam-role.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-role.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,cAAc,CAAa,GAAG,EAAE;IACnE,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,iBAAmC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC;IAEjB,OAAO;QACL,GAAG,EAAE,cAAc,CAAC;YAClB,SAAS;YACT,IAAI;YACJ,QAAQ;SACT,CAAC;QACF,SAAS;QACT,aAAa,EAAE,MAAM;QACrB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,gBAAgB,EAAE;QAC1B,QAAQ;QACR,IAAI;QACJ,UAAU,EAAE,IAAI,IAAI,EAAE;QACtB,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,kBAAkB,EAAE,IAAI,GAAG,EAAE;KAC9B,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sim-iam-role.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,cAAc,CAAa,GAAG,EAAE;IACnE,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,iBAAmC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC;IAEjB,OAAO;QACL,GAAG,EAAE,cAAc,CAAC;YAClB,SAAS;YACT,IAAI;YACJ,QAAQ;SACT,CAAC;QACF,SAAS;QACT,aAAa,EAAE,MAAM;QACrB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,gBAAgB,EAAE;QAC1B,QAAQ;QACR,IAAI;QACJ,UAAU,EAAE,IAAI,IAAI,EAAE;QACtB,cAAc,EAAE,IAAI,GAAG,EAAE;QACzB,kBAAkB,EAAE,IAAI,GAAG,EAAE;KAC9B,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/service/iam/sim-iam.d.ts

@@ -3,32 +3,53 @@ import type { SimCreatePolicyCommand, SimCreatePolicyCommandOutput } from "./com
 import type { SimGetPolicyCommand, SimGetPolicyCommandOutput } from "./command/policy/get-policy/get-policy.cmd.js";
 import type { SimListPoliciesCommand, SimListPoliciesCommandOutput } from "./command/policy/list-policies/list-policies.cmd.js";
 import { type BackgroundScheduler } from "../../util/background/background.js";
-import { SimIamRegistry } from "./registry/sim-iam-registry.js";
 import type { SimCreateRoleCommand, SimCreateRoleCommandOutput } from "./command/role/create-role/create-role.cmd.js";
 import type { SimGetRoleCommand, SimGetRoleCommandOutput } from "./command/role/get-role/get-role.cmd.js";
 import type { SimListRolesCommand, SimListRolesCommandOutput } from "./command/role/list-roles/list-roles.cmd.js";
 import type { SimIamAuthorizationInput } from "./authorize/context/sim-iam-auth-z-context-builder.js";
 import type { SimIamPolicyDecision } from "./authorize/sim-iam-decision.js";
 import type { SimPutRolePolicyCommand, SimPutRolePolicyCommandOutput } from "./command/policy/put-role-policy/put-role-policy.cmd.js";
+import { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
+import type { SimAwsCredentials, SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
+import { type SimIamSessionCredentialGenerator } from "./credential/session/sim-iam-session-cred-gen.js";
+import { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
+import { type SimIamUserCredentialGenerator } from "./credential/user/sim-iam-user-credential-generator.js";
+import type { SimCreateUserCommand, SimCreateUserCommandOutput } from "./command/user/create-user/create-user.cmd.js";
+import type { SimCreateAccessKeyCommand, SimCreateAccessKeyCommandOutput } from "./command/user/create-access-key/create-access-key.cmd.js";
+import type { SimIamInterServiceAuthZ } from "./authorize/sim-iam-inter-service-auth-z.js";
+import type { SimPutUserPolicyCommand, SimPutUserPolicyCommandOutput } from "./command/policy/put-user-policy/put-user-policy.cmd.js";
 interface SimIamProps {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
     readonly background?: BackgroundScheduler;
-    readonly iamRegistry?: SimIamRegistry;
+    readonly credentialRegistry?: SimIamCredentialRegistry;
+    readonly sessionCredentialGenerator?: SimIamSessionCredentialGenerator;
+    readonly userCredentialGenerator?: SimIamUserCredentialGenerator;
 }
 /**
- * Simulated IAM. Handles SDK commands. Emulates AWS behaviour and state.
+ * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
+ * and state.
  *
  * IAM is account-scoped in AWS. Yulin constructs it from an Account/Region
  * scope for consistency with the other service factories, but memoises one
  * service facade per Account.
  */
-export declare class SimIam {
+export declare class SimIam implements SimIamInterServiceAuthZ {
+    /**
+     * Manage temporary sessions belonging to this simulated IAM Account.
+     */
+    readonly sessionManager: SimIamSessionManager;
     private readonly policies;
     private readonly roles;
+    private readonly users;
     private readonly accountRegionScope;
     private readonly background;
-    private readonly iamRegistry;
+    private readonly credentialRegistry;
+    private readonly userCredentialGenerator;
     constructor(props?: SimIamProps);
+    /**
+     * Authenticate simulated AWS credentials.
+     */
+    resolveCredentials(credentials: SimAwsCredentials, now?: Date): SimIamCredentialIdentity;
     /**
      * Evaluate an IAM authorization attempt against policies relevant to the
      * request caller.
@@ -54,6 +75,10 @@ export declare class SimIam {
      * Handle a Put Role Policy Command from the SDK.
      */
     putRolePolicy(cmd: SimPutRolePolicyCommand): Promise<SimPutRolePolicyCommandOutput>;
+    /**
+     * Handle an IAM PutUserPolicy command.
+     */
+    putUserPolicy(cmd: SimPutUserPolicyCommand): Promise<SimPutUserPolicyCommandOutput>;
     /**
      * Handle a Create Role Command from the SDK.
      */
@@ -66,6 +91,14 @@ export declare class SimIam {
      * Handle a List Roles Command from the SDK.
      */
     listRoles(cmd: SimListRolesCommand): Promise<SimListRolesCommandOutput>;
+    /**
+     * Handle an IAM CreateUser command.
+     */
+    createUser(cmd: SimCreateUserCommand): Promise<SimCreateUserCommandOutput>;
+    /**
+     * Handle an IAM CreateAccessKey command.
+     */
+    createAccessKey(cmd: SimCreateAccessKeyCommand): Promise<SimCreateAccessKeyCommandOutput>;
 }
 export {};
 //# sourceMappingURL=sim-iam.d.ts.map

package/dist/service/iam/sim-iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAE7D,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,yDAAyD,CAAC;AAIjE,UAAU,WAAW;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAE7C,YAAY,KAAK,GAAE,WAAgB,EAUlC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAQ/D;IAED;;OAEG;IACG,YAAY,CAChB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,4BAA4B,CAAC,CASvC;IAED;;OAEG;IACG,SAAS,CACb,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAQpC;IAED;;OAEG;IACG,YAAY,CAChB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,4BAA4B,CAAC,CAQvC;IAED;;OAEG;IACG,aAAa,CACjB,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,CAQxC;IAED;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,0BAA0B,CAAC,CASrC;IAED;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAQtE;IAED;;OAEG;IACG,SAAS,CACb,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAQpC;CACF"}
+{"version":3,"file":"sim-iam.d.ts","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGvF,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,qDAAqD,CAAC;AAE7D,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,yDAAyD,CAAC;AAGjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,2DAA2D,CAAC;AAEnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,yDAAyD,CAAC;AAGjE,UAAU,WAAW;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;CAClE;AAED;;;;;;;GAOG;AACH,qBAAa,MAAO,YAAW,uBAAuB;IACpD;;OAEG;IACH,SAAgB,cAAc,EAAE,oBAAoB,CAAC;IAErD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IAExE,YAAY,KAAK,GAAE,WAAgB,EAmBlC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAAW,EAAE,iBAAiB,EAC9B,GAAG,CAAC,EAAE,IAAI,GACT,wBAAwB,CAE1B;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAW/D;IAED;;OAEG;IACG,YAAY,CAChB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,4BAA4B,CAAC,CAOvC;IAED;;OAEG;IACG,SAAS,CACb,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAMpC;IAED;;OAEG;IACG,YAAY,CAChB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,4BAA4B,CAAC,CAMvC;IAED;;OAEG;IACG,aAAa,CACjB,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,CAMxC;IAED;;OAEG;IACG,aAAa,CACjB,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,CAMxC;IAED;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,0BAA0B,CAAC,CAOrC;IAED;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAMtE;IAED;;OAEG;IACG,SAAS,CACb,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAMpC;IAED;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,0BAA0B,CAAC,CAQrC;IAED;;OAEG;IACG,eAAe,CACnB,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAS1C;CACF"}