@kensio/yulin 0.32.0 → 0.33.0

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-resolver.d.ts

@@ -0,0 +1,54 @@
+import type { SimIamRole, SimIamRoleName } from "../../../role/sim-iam-role.js";
+import type { SimIamUser, SimIamUsername } from "../../../user/sim-iam-user.js";
+/**
+ * An IAM entity that can own identity-based policies.
+ *
+ * Roles and users expose the same policy storage properties, so callers can
+ * process a resolved owner without branching on the principal type.
+ */
+export type SimIamIdentityPolicyOwner = SimIamRole | SimIamUser;
+interface SimIamIdentityPolicyOwnerResolverProps {
+    readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
+    readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
+}
+/**
+ * Resolves an authenticated principal ARN to the IAM entity whose identity
+ * policies apply to that principal.
+ *
+ * Authorization requests contain a principal ARN, while IAM stores roles and
+ * users in maps keyed by their names. This resolver owns the conversion between
+ * those representations. Keeping that lookup separate allows policy-source
+ * construction to work with a resolved owner instead of knowing how each
+ * principal type is stored.
+ *
+ * Temporary assumed-role credentials supply the underlying role ARN as their
+ * identity-policy principal before reaching this resolver. As a result, this
+ * class only needs to match IAM role and user ARNs; it does not parse STS
+ * assumed-role ARNs or inspect session state.
+ */
+export declare class SimIamIdentityPolicyOwnerResolver {
+    private readonly roles;
+    private readonly users;
+    constructor(props: SimIamIdentityPolicyOwnerResolverProps);
+    /**
+     * Find the role or user whose ARN exactly matches the supplied principal ARN.
+     *
+     * An absent ARN represents a caller without an IAM identity, such as an
+     * anonymous or service principal. Such callers have no role or user identity
+     * policies, so resolution returns undefined.
+     *
+     * Exact ARN comparison also preserves account isolation: an entity with the
+     * same name in another account has a different ARN and cannot be selected.
+     */
+    resolve(principalArn: string | undefined): SimIamIdentityPolicyOwner | undefined;
+    /**
+     * Search account-scoped role state for the matching principal ARN.
+     */
+    private role;
+    /**
+     * Search account-scoped user state for the matching principal ARN.
+     */
+    private user;
+}
+export {};
+//# sourceMappingURL=sim-iam-id-pol-owner-resolver.d.ts.map

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-id-pol-owner-resolver.d.ts","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,UAAU,CAAC;AAEhE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAEhE,YAAY,KAAK,EAAE,sCAAsC,EAGxD;IAED;;;;;;;;;OASG;IACH,OAAO,CACL,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,yBAAyB,GAAG,SAAS,CAMvC;IAED;;OAEG;IACH,OAAO,CAAC,IAAI;IAIZ;;OAEG;IACH,OAAO,CAAC,IAAI;CAGb"}

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-resolver.js

@@ -0,0 +1,52 @@
+/**
+ * Resolves an authenticated principal ARN to the IAM entity whose identity
+ * policies apply to that principal.
+ *
+ * Authorization requests contain a principal ARN, while IAM stores roles and
+ * users in maps keyed by their names. This resolver owns the conversion between
+ * those representations. Keeping that lookup separate allows policy-source
+ * construction to work with a resolved owner instead of knowing how each
+ * principal type is stored.
+ *
+ * Temporary assumed-role credentials supply the underlying role ARN as their
+ * identity-policy principal before reaching this resolver. As a result, this
+ * class only needs to match IAM role and user ARNs; it does not parse STS
+ * assumed-role ARNs or inspect session state.
+ */
+export class SimIamIdentityPolicyOwnerResolver {
+    roles;
+    users;
+    constructor(props) {
+        this.roles = props.roles;
+        this.users = props.users;
+    }
+    /**
+     * Find the role or user whose ARN exactly matches the supplied principal ARN.
+     *
+     * An absent ARN represents a caller without an IAM identity, such as an
+     * anonymous or service principal. Such callers have no role or user identity
+     * policies, so resolution returns undefined.
+     *
+     * Exact ARN comparison also preserves account isolation: an entity with the
+     * same name in another account has a different ARN and cannot be selected.
+     */
+    resolve(principalArn) {
+        if (principalArn === undefined) {
+            return undefined;
+        }
+        return this.role(principalArn) ?? this.user(principalArn);
+    }
+    /**
+     * Search account-scoped role state for the matching principal ARN.
+     */
+    role(principalArn) {
+        return this.roles.values().find((role) => role.arn === principalArn);
+    }
+    /**
+     * Search account-scoped user state for the matching principal ARN.
+     */
+    user(principalArn) {
+        return this.users.values().find((user) => user.arn === principalArn);
+    }
+}
+//# sourceMappingURL=sim-iam-id-pol-owner-resolver.js.map

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-id-pol-owner-resolver.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-resolver.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,iCAAiC;IAC3B,KAAK,CAA0C;IAC/C,KAAK,CAA0C;IAEhE,YAAY,KAA6C;QACvD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;;;;;;;;OASG;IACH,OAAO,CACL,YAAgC;QAEhC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,YAAoB;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,YAAoB;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-src-builder.d.ts

@@ -0,0 +1,51 @@
+import type { SimArn } from "../../../../aws/arn.js";
+import type { SimIamPolicy } from "../../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySource } from "../sim-iam-auth-z-context.js";
+import type { SimIamIdentityPolicyOwner } from "./sim-iam-id-pol-owner-resolver.js";
+interface SimIamIdentityPolicyOwnerSourceBuilderProps {
+    readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
+}
+/**
+ * Converts policies stored on an IAM role or user into authorization sources.
+ *
+ * IAM owners store inline policy documents directly and refer to managed
+ * policies by ARN. Authorization evaluation uses one common policy-source
+ * representation for both forms. This class owns the translation from those
+ * storage models to that representation.
+ *
+ * Owner resolution remains outside this class. Callers must first identify the
+ * role or user whose policies apply to the authenticated principal.
+ */
+export declare class SimIamIdentityPolicyOwnerSourceBuilder {
+    private readonly policies;
+    constructor(props: SimIamIdentityPolicyOwnerSourceBuilderProps);
+    /**
+     * Build all available inline and managed policy sources for an IAM owner.
+     */
+    build(owner: SimIamIdentityPolicyOwner): readonly SimIamAuthZPolicySource[];
+    /**
+     * Parse policy documents stored directly on the role or user.
+     *
+     * Inline policy names come from the owning entity, so each generated source
+     * retains the name needed for authorization diagnostics.
+     */
+    private inlinePolicySources;
+    /**
+     * Resolve attached policy ARNs through the account-scoped policy store.
+     *
+     * Attachment state and policy storage can exist independently in the
+     * simulator. An ARN with no corresponding stored policy contributes no
+     * authorization statements.
+     */
+    private attachedPolicySources;
+    /**
+     * Convert a managed policy when it has a document available for evaluation.
+     *
+     * A managed policy record without a document contributes no source. This
+     * matches missing attached policies: neither case supplies statements to the
+     * authorization decision.
+     */
+    private managedPolicySource;
+}
+export {};
+//# sourceMappingURL=sim-iam-id-pol-owner-src-builder.d.ts.map

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-src-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-id-pol-owner-src-builder.d.ts","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-src-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,UAAU,2CAA2C;IACnD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sCAAsC;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAE7D,YAAY,KAAK,EAAE,2CAA2C,EAE7D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,yBAAyB,GAAG,SAAS,uBAAuB,EAAE,CAK1E;IAED;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;CAgB5B"}

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-src-builder.js

@@ -0,0 +1,74 @@
+import { jsonParse } from "../../../../../util/type-guard/json.js";
+/**
+ * Converts policies stored on an IAM role or user into authorization sources.
+ *
+ * IAM owners store inline policy documents directly and refer to managed
+ * policies by ARN. Authorization evaluation uses one common policy-source
+ * representation for both forms. This class owns the translation from those
+ * storage models to that representation.
+ *
+ * Owner resolution remains outside this class. Callers must first identify the
+ * role or user whose policies apply to the authenticated principal.
+ */
+export class SimIamIdentityPolicyOwnerSourceBuilder {
+    policies;
+    constructor(props) {
+        this.policies = props.policies;
+    }
+    /**
+     * Build all available inline and managed policy sources for an IAM owner.
+     */
+    build(owner) {
+        return [
+            ...this.inlinePolicySources(owner),
+            ...this.attachedPolicySources(owner),
+        ];
+    }
+    /**
+     * Parse policy documents stored directly on the role or user.
+     *
+     * Inline policy names come from the owning entity, so each generated source
+     * retains the name needed for authorization diagnostics.
+     */
+    inlinePolicySources(owner) {
+        return [...owner.inlinePolicies].map(([policyName, policyDocument]) => ({
+            sourceType: "identity-inline",
+            policyName,
+            document: jsonParse(policyDocument),
+        }));
+    }
+    /**
+     * Resolve attached policy ARNs through the account-scoped policy store.
+     *
+     * Attachment state and policy storage can exist independently in the
+     * simulator. An ARN with no corresponding stored policy contributes no
+     * authorization statements.
+     */
+    attachedPolicySources(owner) {
+        return [...owner.attachedPolicyArns]
+            .map((policyArn) => this.policies.get(policyArn))
+            .filter((policy) => policy !== undefined)
+            .flatMap((policy) => this.managedPolicySource(policy));
+    }
+    /**
+     * Convert a managed policy when it has a document available for evaluation.
+     *
+     * A managed policy record without a document contributes no source. This
+     * matches missing attached policies: neither case supplies statements to the
+     * authorization decision.
+     */
+    managedPolicySource(policy) {
+        if (policy.policyDocument === undefined) {
+            return [];
+        }
+        return [
+            {
+                sourceType: "identity-managed",
+                policyArn: policy.arn,
+                policyName: policy.policyName,
+                document: jsonParse(policy.policyDocument),
+            },
+        ];
+    }
+}
+//# sourceMappingURL=sim-iam-id-pol-owner-src-builder.js.map

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-src-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-id-pol-owner-src-builder.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-src-builder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAQnE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sCAAsC;IAChC,QAAQ,CAAoC;IAE7D,YAAY,KAAkD;QAC5D,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAgC;QACpC,OAAO;YACL,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAClC,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CACzB,KAAgC;QAEhC,OAAO,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,UAAU,EAAE,iBAAiB;YAC7B,UAAU;YACV,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC;SACpC,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAC3B,KAAgC;QAEhC,OAAO,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aACjC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,MAAM,EAA0B,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;aAChE,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CACzB,MAAoB;QAEpB,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,UAAU,EAAE,kBAAkB;gBAC9B,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;aAC3C;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,46 +1,28 @@
-import type { SimAwsCallerContext, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
 interface SimIamAuthZCallerContext {
-    readonly callerPrincipal: SimAwsPrincipal | undefined;
+    readonly caller: SimAwsResolvedCaller;
     readonly rootPolicySources: readonly SimIamAuthZPolicySource[];
 }
 /**
- * Resolves the caller principal and any policy sources implied by that caller.
- *
- * Authorization requests may omit a caller, provide an anonymous caller,
- * provide a principal ARN, or provide a complete principal object. This builder
- * applies those cases consistently before identity and resource policies are
- * collected.
+ * Resolves the caller and any policy sources implied by that caller.
  *
  * The configured default principal represents the simulated account root. It is
  * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root, allowing services to evaluate unauthenticated
- * requests.
- *
- * Root access is modelled as an inline identity policy because the authorizer
- * evaluates all permissions through policy sources. Keeping that policy here
- * ties it to the rule that identifies the default root principal rather than to
- * general authorization-context assembly.
+ * not fall back to root.
  */
 export declare class SimIamAuthZCallerContextBuilder {
-    private readonly defaultCallerPrincipal?;
-    constructor(defaultCallerPrincipal?: SimAwsPrincipal);
+    private readonly callerResolver;
+    private readonly defaultCallerPrincipal;
+    constructor(defaultCallerPrincipal: SimAwsPrincipal, credentialIdentityResolver: SimAwsCredentialIdentityResolver);
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
-    build(caller: SimAwsCallerContext | undefined): SimIamAuthZCallerContext;
-    /**
-     * Convert the caller representation used by simulated AWS services into the
-     * principal representation consumed by IAM authorization.
-     */
-    private callerPrincipal;
+    build(caller: SimAwsCaller | undefined): SimIamAuthZCallerContext;
     /**
      * Give the configured account-root principal unrestricted identity access.
-     *
-     * Comparing ARNs rather than object identity ensures that an explicitly
-     * supplied principal object for the same root ARN receives the same simulated
-     * root permissions as an omitted caller.
      */
     private rootPolicySources;
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,UAAU,wBAAwB;IAChC,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAA8B;IAEtE,YAAY,sBAAsB,CAAC,EAAE,eAAe,EAEnD;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,SAAS,GAAG,wBAAwB,CAOvE;IAED;;;OAGG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CAyB1B"}
+{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,EAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD,YACE,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAI7D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,wBAAwB,CAUhE;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA2B1B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.js

@@ -1,62 +1,35 @@
+import { SimAwsCallerResolver, } from "../../../aws/caller/sim-aws-caller-resolver.js";
 /**
- * Resolves the caller principal and any policy sources implied by that caller.
- *
- * Authorization requests may omit a caller, provide an anonymous caller,
- * provide a principal ARN, or provide a complete principal object. This builder
- * applies those cases consistently before identity and resource policies are
- * collected.
+ * Resolves the caller and any policy sources implied by that caller.
  *
  * The configured default principal represents the simulated account root. It is
  * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root, allowing services to evaluate unauthenticated
- * requests.
- *
- * Root access is modelled as an inline identity policy because the authorizer
- * evaluates all permissions through policy sources. Keeping that policy here
- * ties it to the rule that identifies the default root principal rather than to
- * general authorization-context assembly.
+ * not fall back to root.
  */
 export class SimIamAuthZCallerContextBuilder {
+    callerResolver;
     defaultCallerPrincipal;
-    constructor(defaultCallerPrincipal) {
+    constructor(defaultCallerPrincipal, credentialIdentityResolver) {
         this.defaultCallerPrincipal = defaultCallerPrincipal;
+        this.callerResolver = new SimAwsCallerResolver(credentialIdentityResolver);
     }
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
     build(caller) {
-        const callerPrincipal = this.callerPrincipal(caller);
+        const resolvedCaller = this.callerResolver.resolve(caller, this.defaultCallerPrincipal);
         return {
-            callerPrincipal,
-            rootPolicySources: this.rootPolicySources(callerPrincipal),
+            caller: resolvedCaller,
+            rootPolicySources: this.rootPolicySources(resolvedCaller),
         };
     }
-    /**
-     * Convert the caller representation used by simulated AWS services into the
-     * principal representation consumed by IAM authorization.
-     */
-    callerPrincipal(caller) {
-        if (caller?.kind === "anonymous") {
-            return undefined;
-        }
-        if (typeof caller?.principal === "string") {
-            return {
-                arn: caller.principal,
-            };
-        }
-        return caller?.principal ?? this.defaultCallerPrincipal;
-    }
     /**
      * Give the configured account-root principal unrestricted identity access.
-     *
-     * Comparing ARNs rather than object identity ensures that an explicitly
-     * supplied principal object for the same root ARN receives the same simulated
-     * root permissions as an omitted caller.
      */
-    rootPolicySources(callerPrincipal) {
-        if (this.defaultCallerPrincipal === undefined ||
-            callerPrincipal?.arn !== this.defaultCallerPrincipal.arn) {
+    rootPolicySources(caller) {
+        const defaultCaller = this.callerResolver.resolve(this.defaultCallerPrincipal, this.defaultCallerPrincipal);
+        if (defaultCaller.arn === undefined || caller.arn !== defaultCaller.arn) {
             return [];
         }
         return [

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-caller-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,+BAA+B;IACzB,sBAAsB,CAA+B;IAEtE,YAAY,sBAAwC;QAClD,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAuC;QAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAErD,OAAO;YACL,eAAe;YACf,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;SAC3D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,eAAe,CACrB,MAAuC;QAEvC,IAAI,MAAM,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,SAAS;aACtB,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CACvB,eAA4C;QAE5C,IACE,IAAI,CAAC,sBAAsB,KAAK,SAAS;YACzC,eAAe,EAAE,GAAG,KAAK,IAAI,CAAC,sBAAsB,CAAC,GAAG,EACxD,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,UAAU,EAAE,iBAAiB;gBAC7B,UAAU,EAAE,yBAAyB;gBACrC,QAAQ,EAAE;oBACR,OAAO,EAAE,YAAY;oBACrB,SAAS,EAAE;wBACT,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,GAAG;wBACX,QAAQ,EAAE,GAAG;qBACd;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-caller-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,gDAAgD,CAAC;AAYxD;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IACzB,cAAc,CAAuB;IACrC,sBAAsB,CAAkB;IAEzD,YACE,sBAAuC,EACvC,0BAA4D;QAE5D,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;QACrD,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAgC;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAChD,MAAM,EACN,IAAI,CAAC,sBAAsB,CAC5B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,MAA4B;QAE5B,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAC/C,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,sBAAsB,CAC5B,CAAC;QAEF,IAAI,aAAa,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,UAAU,EAAE,iBAAiB;gBAC7B,UAAU,EAAE,yBAAyB;gBACrC,QAAQ,EAAE;oBACR,OAAO,EAAE,YAAY;oBACrB,SAAS,EAAE;wBACT,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,GAAG;wBACX,QAAQ,EAAE,GAAG;qBACd;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,10 +1,13 @@
 import type { SimArn } from "../../../aws/arn.js";
-import type { SimAwsCallerContext, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
-import type { SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
-import type { SimIamAuthZContext } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthZContext, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
+import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
 export interface SimIamResourcePolicyInput {
     readonly document: SimIamPolicyDocument;
+    readonly sourceType?: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
     readonly policyName?: string | undefined;
     readonly resourceArn?: string | undefined;
 }
@@ -15,13 +18,22 @@ export interface SimIamAuthorizationInput {
     readonly action: string;
     readonly resource: string;
     /**
-     * Simulated request caller context.
+     * Condition values known by the service handling the simulated request, such
+     * as S3 object tags. Sim IAM automatically supplies global condition values
+     * that it can derive itself, such as AWS:PrincipalArn.
      *
-     * If omitted, authorization defaults to the root principal of the sim Account
-     * owning the sim IAM instance. An explicit anonymous caller suppresses that
-     * fallback and is evaluated without an authenticated principal.
+     * Context-key names are matched case-insensitively by the condition matcher,
+     * while string values remain case-sensitive. IAM-derived values take
+     * precedence over supplied values for equivalent keys.
      */
-    readonly caller?: SimAwsCallerContext | undefined;
+    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+    /**
+     * Simulated request caller.
+     *
+     * If credentials are supplied, they are authenticated before policy
+     * evaluation. If omitted, authorization defaults to the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * Resource policies supplied by the service that owns the target resource.
      *
@@ -54,12 +66,20 @@ export interface SimIamAuthorizationInput {
  */
 export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
-    private readonly identityPolicySourceBuilder;
-    constructor(policies: ReadonlyMap<SimArn, SimIamPolicy>, roles: ReadonlyMap<SimIamRoleName, SimIamRole>, defaultCallerPrincipal?: SimAwsPrincipal);
+    private readonly identityPolicyCoordinator;
+    constructor(policies: ReadonlyMap<SimArn, SimIamPolicy>, roles: ReadonlyMap<SimIamRoleName, SimIamRole>, users: ReadonlyMap<SimIamUsername, SimIamUser>, defaultCallerPrincipal: SimAwsPrincipal, credentialIdentityResolver: SimAwsCredentialIdentityResolver);
     /**
      * Build the context consumed by SimIamAuthorizer.
      */
     build(input: SimIamAuthorizationInput): SimIamAuthZContext;
+    /**
+     * Combine service-provided condition values with global values that IAM can
+     * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
+     * identity whose policies apply; for temporary Role credentials this is the
+     * underlying Role ARN, rather than the STS assumed-role session ARN retained
+     * as the effective caller for diagnostics.
+     */
+    private conditionContext;
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,6BAA6B,CAAC;AAIrC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAElD;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;CAC9E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAyC;IAErF,YACE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3C,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,EAC9C,sBAAsB,CAAC,EAAE,eAAe,EAOzC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAezD;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAElB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;CAC9E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IAEjF,YACE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3C,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,EAC9C,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,EAC9C,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAW7D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAgBzD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -1,4 +1,4 @@
-import { SimIamAuthZIdentityPolicySourceBuilder } from "./identity-policy-source/sim-iam-auth-z-id-pol-src-builder.js";
+import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context-builder.js";
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
@@ -23,11 +23,14 @@ import { SimIamAuthZCallerContextBuilder } from "./sim-iam-auth-z-caller-context
  */
 export class SimIamAuthZContextBuilder {
     callerContextBuilder;
-    identityPolicySourceBuilder;
-    constructor(policies, roles, defaultCallerPrincipal) {
-        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(defaultCallerPrincipal);
-        this.identityPolicySourceBuilder =
-            new SimIamAuthZIdentityPolicySourceBuilder({ policies, roles });
+    identityPolicyCoordinator;
+    constructor(policies, roles, users, defaultCallerPrincipal, credentialIdentityResolver) {
+        this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(defaultCallerPrincipal, credentialIdentityResolver);
+        this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
+            policies,
+            roles,
+            users,
+        });
     }
     /**
      * Build the context consumed by SimIamAuthorizer.
@@ -36,13 +39,31 @@ export class SimIamAuthZContextBuilder {
         const callerContext = this.callerContextBuilder.build(input.caller);
         return {
             identityPolicies: [
-                ...this.identityPolicySourceBuilder.build(callerContext.callerPrincipal?.arn),
+                ...this.identityPolicyCoordinator.build(callerContext.caller.identityPolicyArn),
                 ...callerContext.rootPolicySources,
             ],
             resourcePolicies: this.resourcePolicySources(input),
             action: input.action,
             resource: input.resource,
-            callerPrincipal: callerContext.callerPrincipal,
+            conditionContext: this.conditionContext(input, callerContext.caller),
+            caller: callerContext.caller,
+        };
+    }
+    /**
+     * Combine service-provided condition values with global values that IAM can
+     * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
+     * identity whose policies apply; for temporary Role credentials this is the
+     * underlying Role ARN, rather than the STS assumed-role session ARN retained
+     * as the effective caller for diagnostics.
+     */
+    conditionContext(input, caller) {
+        const principalArn = caller.identityPolicyArn ?? caller.arn;
+        if (principalArn === undefined) {
+            return input.conditionContext ?? {};
+        }
+        return {
+            ...input.conditionContext,
+            "aws:PrincipalArn": principalArn,
         };
     }
     /**
@@ -56,7 +77,7 @@ export class SimIamAuthZContextBuilder {
      */
     resourcePolicySources(input) {
         return (input.resourcePolicies ?? []).map((policy) => ({
-            sourceType: "resource",
+            sourceType: policy.sourceType ?? "resource",
             document: policy.document,
             policyName: policy.policyName,
             resourceArn: policy.resourceArn,

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,sCAAsC,EAAE,MAAM,+DAA+D,CAAC;AACvH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAkC7F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,2BAA2B,CAAyC;IAErF,YACE,QAA2C,EAC3C,KAA8C,EAC9C,sBAAwC;QAExC,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,sBAAsB,CACvB,CAAC;QACF,IAAI,CAAC,2BAA2B;YAC9B,IAAI,sCAAsC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,2BAA2B,CAAC,KAAK,CACvC,aAAa,CAAC,eAAe,EAAE,GAAG,CACnC;gBACD,GAAG,aAAa,CAAC,iBAAiB;aACnC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe,EAAE,aAAa,CAAC,eAAe;SAC/C,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAsD7F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAEjF,YACE,QAA2C,EAC3C,KAA8C,EAC9C,KAA8C,EAC9C,sBAAuC,EACvC,0BAA4D;QAE5D,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,sBAAsB,EACtB,0BAA0B,CAC3B,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ;YACR,KAAK;YACL,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;gBACD,GAAG,aAAa,CAAC,iBAAiB;aACnC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts

@@ -1,6 +1,6 @@
 import type { SimArn } from "../../../aws/arn.js";
-import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
-import type { SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session";
 export interface SimIamAuthZPolicySource {
     readonly sourceType: SimIamAuthZPolicySourceType;
@@ -9,6 +9,12 @@ export interface SimIamAuthZPolicySource {
     readonly policyArn?: SimArn | undefined;
     readonly resourceArn?: string | undefined;
 }
+/**
+ * A policy source that can participate as a resource or trust policy.
+ */
+export type SimIamAuthZResourcePolicySource = Omit<SimIamAuthZPolicySource, "sourceType"> & {
+    readonly sourceType: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
+};
 export interface SimIamAuthZContext {
     /**
      * Identity-based policies that grant permissions to the principal.
@@ -24,9 +30,10 @@ export interface SimIamAuthZContext {
     readonly resourcePolicies: readonly SimIamAuthZPolicySource[];
     readonly action: string;
     readonly resource: string;
+    readonly conditionContext: Readonly<Record<string, SimIamConditionValue>>;
     /**
-     * Resolved caller principal, if the simulated request has one.
+     * Resolved caller and any metadata derived from its principal.
      */
-    readonly callerPrincipal?: SimAwsPrincipal | undefined;
+    readonly caller: SimAwsResolvedCaller;
 }
 //# sourceMappingURL=sim-iam-auth-z-context.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GACnC,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,GACV,OAAO,GACP,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACxD"}
+{"version":3,"file":"sim-iam-auth-z-context.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAE3F,MAAM,MAAM,2BAA2B,GACnC,iBAAiB,GACjB,kBAAkB,GAClB,UAAU,GACV,OAAO,GACP,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,uBAAuB,EACvB,YAAY,CACb,GAAG;IACF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAE1E;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts

@@ -1,5 +1,5 @@
 import { StaticFactory } from "@kensio/part-factory";
-import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthZContext, SimIamAuthZResourcePolicySource } from "./sim-iam-auth-z-context.js";
 /**
  * Generates simulated IAM authorization contexts for tests.
  */
@@ -7,5 +7,5 @@ export declare const simIamAuthZContextFactory: StaticFactory<SimIamAuthZContext
 /**
  * Generates simulated IAM resource-policy sources for tests.
  */
-export declare const simIamAuthZResourcePolicySourceFactory: StaticFactory<SimIamAuthZPolicySource>;
+export declare const simIamAuthZResourcePolicySourceFactory: StaticFactory<SimIamAuthZResourcePolicySource>;
 //# sourceMappingURL=sim-iam-auth-z-context.factory.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAQpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,wCAU/C,CAAC"}
+{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EACV,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAkBpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,gDAW/C,CAAC"}