@kensio/yulin 0.34.0 → 0.35.0

package/dist/service/dynamodb/table/dynamodb-table-create-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamodb-table-create-input.d.ts","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/dynamodb-table-create-input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,EAAE,iBAAiB,IAAI,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,IAAI,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAE5F;;GAEG;AACH,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAA1C,YAA6B,aAAa,EAAE,qBAAqB,EAEhE;IAED;;OAEG;IACH,SAAS,IAAI,uBAAuB,CAOnC;IAED;;OAEG;IACH,SAAS,IAAI,uBAAuB,CASnC;CACF"}
+{"version":3,"file":"dynamodb-table-create-input.d.ts","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/dynamodb-table-create-input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,iBAAiB,IAAI,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,IAAI,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAE5F;;GAEG;AACH,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAAzC,YAA6B,YAAY,EAAE,qBAAqB,EAE/D;IAED;;OAEG;IACH,SAAS,IAAI,uBAAuB,CAOnC;IAED;;OAEG;IACH,SAAS,IAAI,uBAAuB,CASnC;CACF"}

package/dist/service/dynamodb/table/dynamodb-table-create-input.js

@@ -4,27 +4,27 @@ import { DynamoDbKeySchema as DynamoDatabaseKeySchema } from "./dynamodb-key-sch
  * Extract and validate DynamoDB table creation input.
  */
 export class DynamoDbTableCreateInput {
-    createCommand;
-    constructor(createCommand) {
-        this.createCommand = createCommand;
+    tableCommand;
+    constructor(tableCommand) {
+        this.tableCommand = tableCommand;
         //
     }
     /**
      * Extract the table name.
      */
     tableName() {
-        assertDefined(this.createCommand.input.TableName, "createCommand.input.TableName");
-        return this.createCommand.input.TableName;
+        assertDefined(this.tableCommand.input.TableName, "tableCommand.input.TableName");
+        return this.tableCommand.input.TableName;
     }
     /**
      * Build the key schema.
      */
     keySchema() {
-        if (this.createCommand.input.KeySchema === undefined ||
-            this.createCommand.input.KeySchema.length === 0) {
+        if (this.tableCommand.input.KeySchema === undefined ||
+            this.tableCommand.input.KeySchema.length === 0) {
             throw new Error("Table KeySchema is not defined");
         }
-        return new DynamoDatabaseKeySchema(this.createCommand.input);
+        return new DynamoDatabaseKeySchema(this.tableCommand.input);
     }
 }
 //# sourceMappingURL=dynamodb-table-create-input.js.map

package/dist/service/dynamodb/table/dynamodb-table-create-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"dynamodb-table-create-input.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/dynamodb-table-create-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,iBAAiB,IAAI,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGxF;;GAEG;AACH,MAAM,OAAO,wBAAwB;IACN,aAAa;IAA1C,YAA6B,aAAoC;6BAApC,aAAa;QACxC,EAAE;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,aAAa,CACX,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAClC,+BAA+B,CAChC,CAAC;QAEF,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAoC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IACE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;YAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"dynamodb-table-create-input.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/dynamodb-table-create-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,iBAAiB,IAAI,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGxF;;GAEG;AACH,MAAM,OAAO,wBAAwB;IACN,YAAY;IAAzC,YAA6B,YAAmC;4BAAnC,YAAY;QACvC,EAAE;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,aAAa,CACX,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EACjC,8BAA8B,CAC/B,CAAC;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAoC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IACE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;YAC/C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/service/dynamodb/table/sim-dynamodb-table.d.ts

@@ -2,10 +2,10 @@ import type { Brand } from "../../../util/brand.type.js";
 import { type SimArn, type SimArnComponents } from "../../aws/arn.js";
 import type { DynamoDbItem as DynamoDatabaseItem } from "../item/dynamodb-item.js";
 import { type BackgroundScheduler } from "../../../util/background/background.js";
-import type { SimCreateTableCommand, SimDynamoDbTableStatus as SimDynamoDatabaseTableStatus } from "../command/create-table/create-table.cmd.js";
+import type { SimCreateTableCommand, SimDynamoDbTableStatus as SimDynamoDatabaseTableStatus } from "../command/create-table/create-table.command.js";
 export type DynamoDbTableName = Brand<string, "DynamoDbTableName">;
 interface SimDynamoDatabaseTableProperties {
-    readonly createCommand: SimCreateTableCommand;
+    readonly tableCommand: SimCreateTableCommand;
     readonly arn?: SimArn;
     readonly background?: BackgroundScheduler;
 }

package/dist/service/dynamodb/table/sim-dynamodb-table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-dynamodb-table.d.ts","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/sim-dynamodb-table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,IAAI,4BAA4B,EACvD,MAAM,6CAA6C,CAAC;AAGrD,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAEnE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;GAEG;AACH,qBAAa,gBAAgB;;IAC3B,SAAgB,gBAAgB,EAAE,IAAI,CAAC;IAEvC,SAAgB,SAAS,EAAE,iBAAiB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAIjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,YAAY,UAAU,EAAE,gCAAgC,EAcvD;IAED;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxB;IAED;;OAEG;IACH,IAAW,MAAM,IAAI,4BAA4B,CAEhD;IAED;;OAEG;IACI,OAAO,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtD;CACF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,cAAc,CAAC,GACzE,MAAM,CAMR"}
+{"version":3,"file":"sim-dynamodb-table.d.ts","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/sim-dynamodb-table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,IAAI,4BAA4B,EACvD,MAAM,iDAAiD,CAAC;AAGzD,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAEnE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;GAEG;AACH,qBAAa,gBAAgB;;IAC3B,SAAgB,gBAAgB,EAAE,IAAI,CAAC;IAEvC,SAAgB,SAAS,EAAE,iBAAiB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAIjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D,YAAY,UAAU,EAAE,gCAAgC,EAcvD;IAED;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxB;IAED;;OAEG;IACH,IAAW,MAAM,IAAI,4BAA4B,CAEhD;IAED;;OAEG;IACI,OAAO,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtD;CACF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,cAAc,CAAC,GACzE,MAAM,CAMR"}

package/dist/service/dynamodb/table/sim-dynamodb-table.js

@@ -13,13 +13,13 @@ export class SimDynamoDbTable {
     #status = "CREATING";
     items = new Map();
     constructor(properties) {
-        const { createCommand, arn = makeSimDynamoDbTableArn(), background = new BackgroundTasks(), } = properties;
-        const createInput = new DynamoDatabaseTableCreateInput(createCommand);
+        const { tableCommand, arn = makeSimDynamoDbTableArn(), background = new BackgroundTasks(), } = properties;
+        const tableInput = new DynamoDatabaseTableCreateInput(tableCommand);
         this.arn = arn;
         this.background = background;
-        this.tableName = createInput.tableName();
+        this.tableName = tableInput.tableName();
         this.creationDateTime = new Date();
-        this.#keySchema = createInput.keySchema();
+        this.#keySchema = tableInput.keySchema();
     }
     /**
      * Simulate the table entering ACTIVE status.

package/dist/service/dynamodb/table/sim-dynamodb-table.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-dynamodb-table.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/sim-dynamodb-table.ts"],"names":[],"mappings":"AACA,OAAO,EACL,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAEL,eAAe,GAChB,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EAAE,wBAAwB,IAAI,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAU9G;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACX,gBAAgB,CAAO;IAEvB,SAAS,CAAoB;IAC7B,GAAG,CAAS;IAEX,UAAU,CAAsB;IACxC,UAAU,CAA0B;IAC7C,OAAO,GAAiC,UAAU,CAAC;IAElC,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/D,YAAY,UAA4C;QACtD,MAAM,EACJ,aAAa,EACb,GAAG,GAAG,uBAAuB,EAAE,EAC/B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QACf,MAAM,WAAW,GAAG,IAAI,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAEtE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,IAAwB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA0E;IAE1E,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,YAAY,EAAE,OAAO;QACrB,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-dynamodb-table.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/sim-dynamodb-table.ts"],"names":[],"mappings":"AACA,OAAO,EACL,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAEL,eAAe,GAChB,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EAAE,wBAAwB,IAAI,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAU9G;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACX,gBAAgB,CAAO;IAEvB,SAAS,CAAoB;IAC7B,GAAG,CAAS;IAEX,UAAU,CAAsB;IACxC,UAAU,CAA0B;IAC7C,OAAO,GAAiC,UAAU,CAAC;IAElC,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/D,YAAY,UAA4C;QACtD,MAAM,EACJ,YAAY,EACZ,GAAG,GAAG,uBAAuB,EAAE,EAC/B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;QAEpE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,IAAwB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA0E;IAE1E,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,YAAY,EAAE,OAAO;QACrB,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js

@@ -1,5 +1,5 @@
 import { SimIamIdentityPolicyOwnerResolver } from "./sim-iam-id-pol-owner-resolver.js";
-import { SimIamIdentityPolicyOwnerSourceBuilder } from "./sim-iam-id-pol-owner-src-builder.js";
+import { SimIamIdentityPolicyOwnerSourceBuilder } from "./sim-iam-id-pol-owner-source-builder.js";
 /**
  * Coordinates identity-policy discovery for an authorization request.
  *

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-id-pol-coordinator.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-auth-z-id-pol-coordinator.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,uCAAuC,CAAC;AAQ/F;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oCAAoC;IAC9B,aAAa,CAAoC;IACjD,kBAAkB,CAAyC;IAE5E,YAAY,UAA4D;QACtE,MAAM,EACJ,QAAQ,GAAG,IAAI,GAAG,EAAE,EACpB,KAAK,GAAG,IAAI,GAAG,EAAE,EACjB,KAAK,GAAG,IAAI,GAAG,EAAE,GAClB,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAiC,CAAC;YACzD,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,sCAAsC,CAAC;YACnE,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAgC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEvD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-id-pol-coordinator.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-auth-z-id-pol-coordinator.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAQlG;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oCAAoC;IAC9B,aAAa,CAAoC;IACjD,kBAAkB,CAAyC;IAE5E,YAAY,UAA4D;QACtE,MAAM,EACJ,QAAQ,GAAG,IAAI,GAAG,EAAE,EACpB,KAAK,GAAG,IAAI,GAAG,EAAE,EACjB,KAAK,GAAG,IAAI,GAAG,EAAE,GAClB,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAiC,CAAC;YACzD,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,sCAAsC,CAAC;YACnE,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAgC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEvD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-source-builder.d.ts

@@ -0,0 +1,51 @@
+import type { SimArn } from "../../../../aws/arn.js";
+import type { SimIamPolicy } from "../../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySource } from "../sim-iam-auth-z-context.js";
+import type { SimIamIdentityPolicyOwner } from "./sim-iam-id-pol-owner-resolver.js";
+interface SimIamIdentityPolicyOwnerSourceBuilderProperties {
+    readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
+}
+/**
+ * Converts policies stored on an IAM role or user into authorization sources.
+ *
+ * IAM owners store inline policy documents directly and refer to managed
+ * policies by ARN. Authorization evaluation uses one common policy-source
+ * representation for both forms. This class owns the translation from those
+ * storage models to that representation.
+ *
+ * Owner resolution remains outside this class. Callers must first identify the
+ * role or user whose policies apply to the authenticated principal.
+ */
+export declare class SimIamIdentityPolicyOwnerSourceBuilder {
+    private readonly policies;
+    constructor(properties: SimIamIdentityPolicyOwnerSourceBuilderProperties);
+    /**
+     * Build all available inline and managed policy sources for an IAM owner.
+     */
+    build(owner: SimIamIdentityPolicyOwner): readonly SimIamAuthZPolicySource[];
+    /**
+     * Parse policy documents stored directly on the role or user.
+     *
+     * Inline policy names come from the owning entity, so each generated source
+     * retains the name needed for authorization diagnostics.
+     */
+    private inlinePolicySources;
+    /**
+     * Resolve attached policy ARNs through the account-scoped policy store.
+     *
+     * Attachment state and policy storage can exist independently in the
+     * simulator. An ARN with no corresponding stored policy contributes no
+     * authorization statements.
+     */
+    private attachedPolicySources;
+    /**
+     * Convert a managed policy when it has a document available for evaluation.
+     *
+     * A managed policy record without a document contributes no source. This
+     * matches missing attached policies: neither case supplies statements to the
+     * authorization decision.
+     */
+    private managedPolicySource;
+}
+export {};
+//# sourceMappingURL=sim-iam-id-pol-owner-source-builder.d.ts.map

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-source-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-id-pol-owner-source-builder.d.ts","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-source-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,UAAU,gDAAgD;IACxD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sCAAsC;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAE7D,YAAY,UAAU,EAAE,gDAAgD,EAEvE;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,yBAAyB,GAAG,SAAS,uBAAuB,EAAE,CAK1E;IAED;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;CAgB5B"}

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-source-builder.js

@@ -0,0 +1,74 @@
+import { jsonParse } from "../../../../../util/type-guard/json.js";
+/**
+ * Converts policies stored on an IAM role or user into authorization sources.
+ *
+ * IAM owners store inline policy documents directly and refer to managed
+ * policies by ARN. Authorization evaluation uses one common policy-source
+ * representation for both forms. This class owns the translation from those
+ * storage models to that representation.
+ *
+ * Owner resolution remains outside this class. Callers must first identify the
+ * role or user whose policies apply to the authenticated principal.
+ */
+export class SimIamIdentityPolicyOwnerSourceBuilder {
+    policies;
+    constructor(properties) {
+        this.policies = properties.policies;
+    }
+    /**
+     * Build all available inline and managed policy sources for an IAM owner.
+     */
+    build(owner) {
+        return [
+            ...this.inlinePolicySources(owner),
+            ...this.attachedPolicySources(owner),
+        ];
+    }
+    /**
+     * Parse policy documents stored directly on the role or user.
+     *
+     * Inline policy names come from the owning entity, so each generated source
+     * retains the name needed for authorization diagnostics.
+     */
+    inlinePolicySources(owner) {
+        return [...owner.inlinePolicies].map(([policyName, policyDocument]) => ({
+            sourceType: "identity-inline",
+            policyName,
+            document: jsonParse(policyDocument),
+        }));
+    }
+    /**
+     * Resolve attached policy ARNs through the account-scoped policy store.
+     *
+     * Attachment state and policy storage can exist independently in the
+     * simulator. An ARN with no corresponding stored policy contributes no
+     * authorization statements.
+     */
+    attachedPolicySources(owner) {
+        return [...owner.attachedPolicyArns]
+            .map((policyArn) => this.policies.get(policyArn))
+            .filter((policy) => policy !== undefined)
+            .flatMap((policy) => this.managedPolicySource(policy));
+    }
+    /**
+     * Convert a managed policy when it has a document available for evaluation.
+     *
+     * A managed policy record without a document contributes no source. This
+     * matches missing attached policies: neither case supplies statements to the
+     * authorization decision.
+     */
+    managedPolicySource(policy) {
+        if (policy.policyDocument === undefined) {
+            return [];
+        }
+        return [
+            {
+                sourceType: "identity-managed",
+                policyArn: policy.arn,
+                policyName: policy.policyName,
+                document: jsonParse(policy.policyDocument),
+            },
+        ];
+    }
+}
+//# sourceMappingURL=sim-iam-id-pol-owner-source-builder.js.map

package/dist/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-source-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-id-pol-owner-source-builder.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/context/identity-policy-source/sim-iam-id-pol-owner-source-builder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAQnE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sCAAsC;IAChC,QAAQ,CAAoC;IAE7D,YAAY,UAA4D;QACtE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAgC;QACpC,OAAO;YACL,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAClC,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CACzB,KAAgC;QAEhC,OAAO,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,UAAU,EAAE,iBAAiB;YAC7B,UAAU;YACV,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC;SACpC,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAC3B,KAAgC;QAEhC,OAAO,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;aACjC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,MAAM,EAA0B,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;aAChE,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CACzB,MAAoB;QAEpB,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL;gBACE,UAAU,EAAE,kBAAkB;gBAC9B,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;aAC3C;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.d.ts

@@ -0,0 +1,34 @@
+import type { SimIamConditionValue } from "../../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.js";
+/**
+ * IAM `NumericLessThanEquals` condition operator.
+ *
+ * IAM policy documents and service request contexts may represent numeric
+ * values as either JSON numbers or numeric strings. Both representations are
+ * accepted here and compared numerically.
+ *
+ * The request value must be scalar. Multiple policy values use OR semantics:
+ * the condition matches when the request value is less than or equal to at
+ * least one valid policy value.
+ *
+ * Empty strings, booleans, arrays in the request context, and non-finite values
+ * are rejected rather than being converted through JavaScript coercion rules.
+ */
+export declare class SimIamNumericLessThanEquals implements SimIamConditionOperator {
+    /**
+     * Compare one request value with one or more policy limits.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+    /**
+     * Normalize the scalar or array representation used by a policy document.
+     *
+     * The current policy value type permits arrays of strings, while scalar
+     * values may also be numbers. Invalid entries do not participate in matching.
+     */
+    private expectedValues;
+    /**
+     * Parse a supported IAM numeric representation without broad coercion.
+     */
+    private numericValue;
+}
+//# sourceMappingURL=sim-iam-number-lte.d.ts.map

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-number-lte.d.ts","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IACzE;;OAEG;IACH,OAAO,CACL,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAST;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;IACH,OAAO,CAAC,YAAY;CAYrB"}

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.js

@@ -0,0 +1,52 @@
+/**
+ * IAM `NumericLessThanEquals` condition operator.
+ *
+ * IAM policy documents and service request contexts may represent numeric
+ * values as either JSON numbers or numeric strings. Both representations are
+ * accepted here and compared numerically.
+ *
+ * The request value must be scalar. Multiple policy values use OR semantics:
+ * the condition matches when the request value is less than or equal to at
+ * least one valid policy value.
+ *
+ * Empty strings, booleans, arrays in the request context, and non-finite values
+ * are rejected rather than being converted through JavaScript coercion rules.
+ */
+export class SimIamNumericLessThanEquals {
+    /**
+     * Compare one request value with one or more policy limits.
+     */
+    matches(actual, expected) {
+        const actualNumber = this.numericValue(actual);
+        if (actualNumber === undefined) {
+            return false;
+        }
+        return this.expectedValues(expected).some((expectedNumber) => actualNumber <= expectedNumber);
+    }
+    /**
+     * Normalize the scalar or array representation used by a policy document.
+     *
+     * The current policy value type permits arrays of strings, while scalar
+     * values may also be numbers. Invalid entries do not participate in matching.
+     */
+    expectedValues(value) {
+        const values = Array.isArray(value) ? value : [value];
+        return values
+            .map((item) => this.numericValue(item))
+            .filter((item) => item !== undefined);
+    }
+    /**
+     * Parse a supported IAM numeric representation without broad coercion.
+     */
+    numericValue(value) {
+        if (typeof value === "number") {
+            return Number.isFinite(value) ? value : undefined;
+        }
+        if (typeof value !== "string" || value.trim() === "") {
+            return undefined;
+        }
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+}
+//# sourceMappingURL=sim-iam-number-lte.js.map

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-number-lte.js","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,MAA4B,EAC5B,QAA8B;QAE9B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CACvC,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,IAAI,cAAc,CACnD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,KAA2B;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEtD,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,IAA0B,EAAsB,EAAE,CACtD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CACxB;aACA,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAA2B;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;CACF"}

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js

@@ -0,0 +1,46 @@
+import { SimIamForAllValuesStringEquals } from "./string/all-values/sim-iam-for-all-values-string-equals.js";
+import { SimIamForAllValuesStringLike } from "./string/all-values/sim-iam-for-all-values-string-like.js";
+import { SimIamForAnyValueStringEquals } from "./string/any-value/sim-iam-for-any-value-string-equals.js";
+import { SimIamForAnyValueStringLike } from "./string/any-value/sim-iam-for-any-value-string-like.js";
+import { SimIamStringEquals } from "./string/equals/sim-iam-string-equals.js";
+import { SimIamStringLike } from "./string/like/sim-iam-string-like.js";
+import { SimIamNumericLessThanEquals } from "./numeric/less-than-equals/sim-iam-number-lte.js";
+const operatorFactories = new Map([
+    [
+        "NumericLessThanEquals",
+        () => new SimIamNumericLessThanEquals(),
+    ],
+    ["StringEquals", () => new SimIamStringEquals()],
+    ["StringLike", () => new SimIamStringLike()],
+    [
+        "ForAnyValue:StringEquals",
+        () => new SimIamForAnyValueStringEquals(),
+    ],
+    [
+        "ForAnyValue:StringLike",
+        () => new SimIamForAnyValueStringLike(),
+    ],
+    [
+        "ForAllValues:StringEquals",
+        () => new SimIamForAllValuesStringEquals(),
+    ],
+    [
+        "ForAllValues:StringLike",
+        () => new SimIamForAllValuesStringLike(),
+    ],
+]);
+/**
+ * Parses IAM condition operator keywords into their behavior objects.
+ *
+ * Unsupported operators return undefined so condition evaluation fails closed
+ * without throwing.
+ */
+export class SimIamConditionOperatorParser {
+    /**
+     * Parse a keyword into a condition operator, if supported.
+     */
+    parse(keyword) {
+        return operatorFactories.get(keyword)?.();
+    }
+}
+//# sourceMappingURL=sim-iam-condition-operator-parser.js.map

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-condition-operator-parser.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,6DAA6D,CAAC;AAC7G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAI/F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAyC;IACxE;QACE,uBAAuB;QACvB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD,CAAC,cAAc,EAAE,GAA4B,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACzE,CAAC,YAAY,EAAE,GAA4B,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;IACrE;QACE,0BAA0B;QAC1B,GAA4B,EAAE,CAAC,IAAI,6BAA6B,EAAE;KACnE;IACD;QACE,wBAAwB;QACxB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD;QACE,2BAA2B;QAC3B,GAA4B,EAAE,CAAC,IAAI,8BAA8B,EAAE;KACpE;IACD;QACE,yBAAyB;QACzB,GAA4B,EAAE,CAAC,IAAI,4BAA4B,EAAE;KAClE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,KAAK,CAAC,OAAe;QACnB,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -0,0 +1,59 @@
+import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+/**
+ * Matches the principal portion of an IAM policy statement.
+ *
+ * Principal matching has different rules depending on the policy source:
+ *
+ * - identity policies must not contain Principal or NotPrincipal;
+ * - resource and trust policies must identify the caller through Principal, or
+ *   exclude the caller through NotPrincipal;
+ * - Principal may be a string, an array, or an object grouped by principal type;
+ * - AWS account IDs and account-root ARNs grant access to authenticated
+ *   principals belonging to the referenced account.
+ *
+ * Keeping these rules in one collaborator prevents statement matching from
+ * mixing principal parsing concerns with Action, Resource, and Condition logic.
+ */
+export declare class SimIamPolicyPrincipalMatcher {
+    private readonly context;
+    constructor(context: SimIamAuthZContext);
+    /**
+     * Check whether the statement's principal constraint applies to the caller.
+     *
+     * Identity policies are associated with their identity by the surrounding
+     * authorization flow, so Principal and NotPrincipal are rejected.
+     *
+     * Resource and trust policies require Principal or NotPrincipal because the
+     * policy must state which callers it applies to.
+     */
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    /**
+     * Check each Principal representation supported by the parsed policy model.
+     *
+     * Arrays use logical OR semantics. Principal objects are evaluated according
+     * to their principal category so AWS values match caller ARNs and account
+     * delegation, while Service values match service principals.
+     */
+    private valueMatches;
+    /**
+     * Compare an AWS principal pattern with the resolved caller.
+     *
+     * The wildcard matches both authenticated and anonymous requests. Other AWS
+     * forms require an ARN-based caller. Account delegation forms compare against
+     * the account ID derived by the caller resolver.
+     */
+    private awsPatternMatches;
+    /**
+     * Compare a service principal pattern with the resolved caller.
+     */
+    private servicePatternMatches;
+    /**
+     * Return the account ID represented by an account delegation principal.
+     *
+     * IAM supports both a bare 12-digit account ID and the corresponding account
+     * root ARN.
+     */
+    private delegatedAccountId;
+}
+//# sourceMappingURL=sim-iam-policy-principal-matcher.d.ts.map

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAiBT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA2BpB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -0,0 +1,51 @@
+import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
+/**
+ * Matches one parsed IAM policy statement against one authorization request.
+ *
+ * This class owns the statement-level matching rules so
+ * `SimIamPolicyDecision` can stay focused on policy iteration and final
+ * Deny/Allow/ImplicitDeny aggregation.
+ *
+ * Principal and NotPrincipal evaluation is delegated to
+ * `SimIamPolicyPrincipalMatcher`, which owns the policy-source rules, supported
+ * Principal shapes, and AWS account delegation forms.
+ *
+ * The matcher coordinates:
+ *
+ * - Principal and NotPrincipal;
+ * - Action and NotAction;
+ * - Resource and NotResource;
+ * - supported IAM string conditions.
+ */
+export declare class SimIamPolicyStatementMatcher {
+    private readonly context;
+    private readonly conditionMatcher;
+    private readonly principalMatcher;
+    constructor(context: SimIamAuthZContext);
+    /**
+     * Check whether a parsed statement applies to the current request.
+     *
+     * Each statement section must match. The short-circuit evaluation also avoids
+     * evaluating later sections after an earlier constraint has rejected the
+     * statement.
+     */
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    /**
+     * Check Action or NotAction against the requested IAM action.
+     *
+     * AWS action names are case-insensitive, so wildcard matching follows that
+     * behavior. The parser guarantees one of Action or NotAction exists; the final
+     * throw protects future parser changes from producing invalid statements.
+     */
+    private actionMatches;
+    /**
+     * Check Resource or NotResource against the requested resource ARN.
+     *
+     * Resource ARNs are matched case-sensitively. This mirrors IAM's ARN matching
+     * behavior and prevents policies from matching resources that differ only by
+     * case.
+     */
+    private resourceMatches;
+}
+//# sourceMappingURL=sim-iam-policy-statement-matcher.d.ts.map

package/dist/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAKjG;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA4B;IAI3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAEhE,YAA6B,OAAO,EAAE,kBAAkB,EAKvD;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAOT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAwBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAuBxB"}

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -0,0 +1,84 @@
+import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js";
+import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
+import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
+import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
+export declare const SimIamPolicyDecisionValue: {
+    readonly ExplicitDeny: "ExplicitDeny";
+    readonly Allow: "Allow";
+    readonly ImplicitDeny: "ImplicitDeny";
+};
+export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];
+/**
+ * Decision for one simulated IAM policy authorization attempt.
+ *
+ * This evaluates already-discovered identity and resource policy documents. It
+ * does not fetch attached policies itself, apply trust policy semantics,
+ * evaluate permissions boundaries, evaluate SCPs, or enforce service command
+ * access.
+ *
+ * The simulator currently models the common IAM authorization union:
+ *
+ * - an explicit Deny in any evaluated policy wins;
+ * - an Allow in an identity policy or resource policy allows the request;
+ * - otherwise the request is implicitly denied.
+ *
+ * Resource policies are expected to be supplied by the service that owns the
+ * target resource.
+ */
+export declare class SimIamPolicyDecision {
+    private readonly request;
+    private readonly policyDocumentParser;
+    private readonly statementMatcher;
+    private readonly explicitDenyStatementRecords;
+    private readonly allowStatementRecords;
+    private readonly trustAllowStatementRecords;
+    constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
+    /**
+     * Resolved caller against which this authorization decision was evaluated.
+     *
+     * This includes IAM's default account-root caller when the authorization input
+     * omitted a caller.
+     */
+    get caller(): SimAwsResolvedCaller;
+    /**
+     * Final IAM decision value.
+     */
+    get value(): SimIamPolicyDecisionValue;
+    /**
+     * Whether the request is allowed.
+     */
+    get isAllowed(): boolean;
+    /**
+     * Whether the request is denied either explicitly or implicitly.
+     */
+    get isDenied(): boolean;
+    /**
+     * Whether the request is denied by a matching Deny statement.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Whether the request is denied because no Allow statement matched.
+     */
+    get isImplicitDeny(): boolean;
+    /**
+     * Whether a matching trust-policy statement explicitly allows the request.
+     *
+     * An identity-policy Allow cannot substitute for the target role's trust.
+     */
+    get isAllowedByTrustPolicy(): boolean;
+    /**
+     * Matching explicit Deny statements.
+     */
+    get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements.
+     */
+    get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trustAllowStatements(): readonly SimIamPolicyDocumentStatement[];
+    private evaluate;
+    private evaluatePolicy;
+}
+//# sourceMappingURL=sim-iam-decision.d.ts.map

package/dist/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAExF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CACtC;IAEL,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAoBvB"}