@kensio/yulin 0.34.0 → 0.35.0

package/dist/dist-hidden/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts

@@ -1,11 +0,0 @@
-import { StaticFactory } from "@kensio/part-factory";
-import type { SimIamAuthZContext, SimIamAuthZResourcePolicySource } from "./sim-iam-auth-z-context.js";
-/**
- * Generates simulated IAM authorization contexts for tests.
- */
-export declare const simIamAuthZContextFactory: StaticFactory<SimIamAuthZContext>;
-/**
- * Generates simulated IAM resource-policy sources for tests.
- */
-export declare const simIamAuthZResourcePolicySourceFactory: StaticFactory<SimIamAuthZResourcePolicySource>;
-//# sourceMappingURL=sim-iam-auth-z-context.factory.d.ts.map

package/dist/dist-hidden/service/iam/authorize/context/sim-iam-auth-z-context.factory.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-auth-z-context.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EACV,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,yBAAyB,mCAkBpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sCAAsC,gDAW/C,CAAC"}

package/dist/dist-hidden/service/iam/authorize/context/sim-iam-auth-z-context.factory.js

@@ -1,38 +0,0 @@
-import { StaticFactory } from "@kensio/part-factory";
-/**
- * Generates simulated IAM authorization contexts for tests.
- */
-export const simIamAuthZContextFactory = new StaticFactory({
-    identityPolicies: [],
-    resourcePolicies: [],
-    action: "s3:GetObject",
-    resource: "arn:aws:s3:::test-bucket/test-key",
-    conditionContext: {},
-    caller: {
-        identityPolicyPrincipal: {
-            kind: "arn",
-            arn: "arn:aws:iam::123456789012:role/TestRole",
-        },
-        principal: {
-            kind: "arn",
-            arn: "arn:aws:iam::123456789012:role/TestRole",
-        },
-        arn: "arn:aws:iam::123456789012:role/TestRole",
-        accountId: "123456789012",
-    },
-});
-/**
- * Generates simulated IAM resource-policy sources for tests.
- */
-export const simIamAuthZResourcePolicySourceFactory = new StaticFactory({
-    sourceType: "resource",
-    document: {
-        Version: "2012-10-17",
-        Statement: {
-            Effect: "Allow",
-            Action: "s3:GetObject",
-            Resource: "arn:aws:s3:::test-bucket/test-key",
-        },
-    },
-});
-//# sourceMappingURL=sim-iam-auth-z-context.factory.js.map

package/dist/dist-hidden/service/iam/authorize/context/sim-iam-auth-z-context.factory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-auth-z-context.factory.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAMrD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,aAAa,CAAqB;IAC7E,gBAAgB,EAAE,EAAE;IACpB,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,mCAAmC;IAC7C,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE;QACN,uBAAuB,EAAE;YACvB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,SAAS,EAAE;YACT,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,yCAAyC;SAC/C;QACD,GAAG,EAAE,yCAAyC;QAC9C,SAAS,EAAE,cAAc;KAC1B;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,IAAI,aAAa,CAAkC;IACjD,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE;QACR,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,mCAAmC;SAC9C;KACF;CACF,CAAC,CAAC"}

package/dist/dist-hidden/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-num-lte.d.ts

@@ -1,34 +0,0 @@
-import type { SimIamConditionValue } from "../../../../../policy/sim-iam-policy.js";
-import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.js";
-/**
- * IAM `NumericLessThanEquals` condition operator.
- *
- * IAM policy documents and service request contexts may represent numeric
- * values as either JSON numbers or numeric strings. Both representations are
- * accepted here and compared numerically.
- *
- * The request value must be scalar. Multiple policy values use OR semantics:
- * the condition matches when the request value is less than or equal to at
- * least one valid policy value.
- *
- * Empty strings, booleans, arrays in the request context, and non-finite values
- * are rejected rather than being converted through JavaScript coercion rules.
- */
-export declare class SimIamNumericLessThanEquals implements SimIamConditionOperator {
-    /**
-     * Compare one request value with one or more policy limits.
-     */
-    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
-    /**
-     * Normalize the scalar or array representation used by a policy document.
-     *
-     * The current policy value type permits arrays of strings, while scalar
-     * values may also be numbers. Invalid entries do not participate in matching.
-     */
-    private expectedValues;
-    /**
-     * Parse a supported IAM numeric representation without broad coercion.
-     */
-    private numericValue;
-}
-//# sourceMappingURL=sim-iam-num-lte.d.ts.map

package/dist/dist-hidden/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-num-lte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-num-lte.d.ts","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-num-lte.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,qBAAa,2BAA4B,YAAW,uBAAuB;IACzE;;OAEG;IACH,OAAO,CACL,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAST;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;IACH,OAAO,CAAC,YAAY;CAYrB"}

package/dist/dist-hidden/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-num-lte.js

@@ -1,52 +0,0 @@
-/**
- * IAM `NumericLessThanEquals` condition operator.
- *
- * IAM policy documents and service request contexts may represent numeric
- * values as either JSON numbers or numeric strings. Both representations are
- * accepted here and compared numerically.
- *
- * The request value must be scalar. Multiple policy values use OR semantics:
- * the condition matches when the request value is less than or equal to at
- * least one valid policy value.
- *
- * Empty strings, booleans, arrays in the request context, and non-finite values
- * are rejected rather than being converted through JavaScript coercion rules.
- */
-export class SimIamNumericLessThanEquals {
-    /**
-     * Compare one request value with one or more policy limits.
-     */
-    matches(actual, expected) {
-        const actualNumber = this.numericValue(actual);
-        if (actualNumber === undefined) {
-            return false;
-        }
-        return this.expectedValues(expected).some((expectedNumber) => actualNumber <= expectedNumber);
-    }
-    /**
-     * Normalize the scalar or array representation used by a policy document.
-     *
-     * The current policy value type permits arrays of strings, while scalar
-     * values may also be numbers. Invalid entries do not participate in matching.
-     */
-    expectedValues(value) {
-        const values = Array.isArray(value) ? value : [value];
-        return values
-            .map((item) => this.numericValue(item))
-            .filter((item) => item !== undefined);
-    }
-    /**
-     * Parse a supported IAM numeric representation without broad coercion.
-     */
-    numericValue(value) {
-        if (typeof value === "number") {
-            return Number.isFinite(value) ? value : undefined;
-        }
-        if (typeof value !== "string" || value.trim() === "") {
-            return undefined;
-        }
-        const parsed = Number(value);
-        return Number.isFinite(parsed) ? parsed : undefined;
-    }
-}
-//# sourceMappingURL=sim-iam-num-lte.js.map

package/dist/dist-hidden/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-num-lte.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-num-lte.js","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-num-lte.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,MAA4B,EAC5B,QAA8B;QAE9B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CACvC,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,IAAI,cAAc,CACnD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,KAA2B;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEtD,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,IAA0B,EAAsB,EAAE,CACtD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CACxB;aACA,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAA2B;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;CACF"}

package/dist/dist-hidden/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js

@@ -1,46 +0,0 @@
-import { SimIamForAllValuesStringEquals } from "./string/all-values/sim-iam-for-all-values-string-equals.js";
-import { SimIamForAllValuesStringLike } from "./string/all-values/sim-iam-for-all-values-string-like.js";
-import { SimIamForAnyValueStringEquals } from "./string/any-value/sim-iam-for-any-value-string-equals.js";
-import { SimIamForAnyValueStringLike } from "./string/any-value/sim-iam-for-any-value-string-like.js";
-import { SimIamStringEquals } from "./string/equals/sim-iam-string-equals.js";
-import { SimIamStringLike } from "./string/like/sim-iam-string-like.js";
-import { SimIamNumericLessThanEquals } from "./numeric/less-than-equals/sim-iam-num-lte.js";
-const operatorFactories = new Map([
-    [
-        "NumericLessThanEquals",
-        () => new SimIamNumericLessThanEquals(),
-    ],
-    ["StringEquals", () => new SimIamStringEquals()],
-    ["StringLike", () => new SimIamStringLike()],
-    [
-        "ForAnyValue:StringEquals",
-        () => new SimIamForAnyValueStringEquals(),
-    ],
-    [
-        "ForAnyValue:StringLike",
-        () => new SimIamForAnyValueStringLike(),
-    ],
-    [
-        "ForAllValues:StringEquals",
-        () => new SimIamForAllValuesStringEquals(),
-    ],
-    [
-        "ForAllValues:StringLike",
-        () => new SimIamForAllValuesStringLike(),
-    ],
-]);
-/**
- * Parses IAM condition operator keywords into their behavior objects.
- *
- * Unsupported operators return undefined so condition evaluation fails closed
- * without throwing.
- */
-export class SimIamConditionOperatorParser {
-    /**
-     * Parse a keyword into a condition operator, if supported.
-     */
-    parse(keyword) {
-        return operatorFactories.get(keyword)?.();
-    }
-}
-//# sourceMappingURL=sim-iam-condition-operator-parser.js.map

package/dist/dist-hidden/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-condition-operator-parser.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,6DAA6D,CAAC;AAC7G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAI5F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAyC;IACxE;QACE,uBAAuB;QACvB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD,CAAC,cAAc,EAAE,GAA4B,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACzE,CAAC,YAAY,EAAE,GAA4B,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;IACrE;QACE,0BAA0B;QAC1B,GAA4B,EAAE,CAAC,IAAI,6BAA6B,EAAE;KACnE;IACD;QACE,wBAAwB;QACxB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD;QACE,2BAA2B;QAC3B,GAA4B,EAAE,CAAC,IAAI,8BAA8B,EAAE;KACpE;IACD;QACE,yBAAyB;QACzB,GAA4B,EAAE,CAAC,IAAI,4BAA4B,EAAE;KAClE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,KAAK,CAAC,OAAe;QACnB,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/dist-hidden/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -1,59 +0,0 @@
-import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-doc-parser.js";
-import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
-/**
- * Matches the principal portion of an IAM policy statement.
- *
- * Principal matching has different rules depending on the policy source:
- *
- * - identity policies must not contain Principal or NotPrincipal;
- * - resource and trust policies must identify the caller through Principal, or
- *   exclude the caller through NotPrincipal;
- * - Principal may be a string, an array, or an object grouped by principal type;
- * - AWS account IDs and account-root ARNs grant access to authenticated
- *   principals belonging to the referenced account.
- *
- * Keeping these rules in one collaborator prevents statement matching from
- * mixing principal parsing concerns with Action, Resource, and Condition logic.
- */
-export declare class SimIamPolicyPrincipalMatcher {
-    private readonly context;
-    constructor(context: SimIamAuthZContext);
-    /**
-     * Check whether the statement's principal constraint applies to the caller.
-     *
-     * Identity policies are associated with their identity by the surrounding
-     * authorization flow, so Principal and NotPrincipal are rejected.
-     *
-     * Resource and trust policies require Principal or NotPrincipal because the
-     * policy must state which callers it applies to.
-     */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
-    /**
-     * Check each Principal representation supported by the parsed policy model.
-     *
-     * Arrays use logical OR semantics. Principal objects are evaluated according
-     * to their principal category so AWS values match caller ARNs and account
-     * delegation, while Service values match service principals.
-     */
-    private valueMatches;
-    /**
-     * Compare an AWS principal pattern with the resolved caller.
-     *
-     * The wildcard matches both authenticated and anonymous requests. Other AWS
-     * forms require an ARN-based caller. Account delegation forms compare against
-     * the account ID derived by the caller resolver.
-     */
-    private awsPatternMatches;
-    /**
-     * Compare a service principal pattern with the resolved caller.
-     */
-    private servicePatternMatches;
-    /**
-     * Return the account ID represented by an account delegation principal.
-     *
-     * IAM supports both a bare 12-digit account ID and the corresponding account
-     * root ARN.
-     */
-    private delegatedAccountId;
-}
-//# sourceMappingURL=sim-iam-policy-principal-matcher.d.ts.map

package/dist/dist-hidden/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAiBT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA2BpB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/dist-hidden/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts

@@ -1,51 +0,0 @@
-import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
-import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-doc-parser.js";
-/**
- * Matches one parsed IAM policy statement against one authorization request.
- *
- * This class owns the statement-level matching rules so
- * `SimIamPolicyDecision` can stay focused on policy iteration and final
- * Deny/Allow/ImplicitDeny aggregation.
- *
- * Principal and NotPrincipal evaluation is delegated to
- * `SimIamPolicyPrincipalMatcher`, which owns the policy-source rules, supported
- * Principal shapes, and AWS account delegation forms.
- *
- * The matcher coordinates:
- *
- * - Principal and NotPrincipal;
- * - Action and NotAction;
- * - Resource and NotResource;
- * - supported IAM string conditions.
- */
-export declare class SimIamPolicyStatementMatcher {
-    private readonly context;
-    private readonly conditionMatcher;
-    private readonly principalMatcher;
-    constructor(context: SimIamAuthZContext);
-    /**
-     * Check whether a parsed statement applies to the current request.
-     *
-     * Each statement section must match. The short-circuit evaluation also avoids
-     * evaluating later sections after an earlier constraint has rejected the
-     * statement.
-     */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
-    /**
-     * Check Action or NotAction against the requested IAM action.
-     *
-     * AWS action names are case-insensitive, so wildcard matching follows that
-     * behavior. The parser guarantees one of Action or NotAction exists; the final
-     * throw protects future parser changes from producing invalid statements.
-     */
-    private actionMatches;
-    /**
-     * Check Resource or NotResource against the requested resource ARN.
-     *
-     * Resource ARNs are matched case-sensitively. This mirrors IAM's ARN matching
-     * behavior and prevents policies from matching resources that differ only by
-     * case.
-     */
-    private resourceMatches;
-}
-//# sourceMappingURL=sim-iam-policy-statement-matcher.d.ts.map

package/dist/dist-hidden/service/iam/authorize/match/sim-iam-policy-statement-matcher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-policy-statement-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-statement-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAK5F;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,4BAA4B;IAI3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAEhE,YAA6B,OAAO,EAAE,kBAAkB,EAKvD;IAED;;;;;;OAMG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAOT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAwBrB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAuBxB"}

package/dist/dist-hidden/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -1,33 +0,0 @@
-import type { SimArn } from "../../aws/arn.js";
-import type { SimIamPolicy } from "../policy/sim-iam-policy.js";
-import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
-import { type SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-builder.js";
-import { SimIamPolicyDecision } from "./sim-iam-decision.js";
-import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
-import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
-import type { SimAwsCredentialIdentityResolver } from "../../aws/caller/sim-aws-caller-resolver.js";
-interface SimIamAuthorizerProps {
-    readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
-    readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
-    readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
-    readonly defaultCallerPrincipal: SimAwsPrincipal;
-    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
-}
-/**
- * Facade for simulated IAM authorization decisions.
- *
- * This class represents the service-facing entry point for IAM authorization.
- * It assembles the authorization context from IAM state and request input, while
- * each SimIamPolicyDecision instance keeps the state and diagnostics for one
- * evaluated authorization attempt.
- */
-export declare class SimIamAuthorizer {
-    private readonly contextBuilder;
-    constructor(props: SimIamAuthorizerProps);
-    /**
-     * Evaluate an IAM authorization request.
-     */
-    authorize(input: SimIamAuthorizationInput): SimIamPolicyDecision;
-}
-export {};
-//# sourceMappingURL=sim-iam-authorizer.d.ts.map

package/dist/dist-hidden/service/iam/authorize/sim-iam-authorizer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6CAA6C,CAAC;AAEpG,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,eAAe,CAAC;IACjD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAE3D,YAAY,KAAK,EAAE,qBAAqB,EAQvC;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,wBAAwB,GAAG,oBAAoB,CAE/D;CACF"}

package/dist/dist-hidden/service/iam/authorize/sim-iam-authorizer.js

@@ -1,23 +0,0 @@
-import { SimIamAuthZContextBuilder, } from "./context/sim-iam-auth-z-context-builder.js";
-import { SimIamPolicyDecision } from "./sim-iam-decision.js";
-/**
- * Facade for simulated IAM authorization decisions.
- *
- * This class represents the service-facing entry point for IAM authorization.
- * It assembles the authorization context from IAM state and request input, while
- * each SimIamPolicyDecision instance keeps the state and diagnostics for one
- * evaluated authorization attempt.
- */
-export class SimIamAuthorizer {
-    contextBuilder;
-    constructor(props) {
-        this.contextBuilder = new SimIamAuthZContextBuilder(props.policies, props.roles, props.users, props.defaultCallerPrincipal, props.credentialIdentityResolver);
-    }
-    /**
-     * Evaluate an IAM authorization request.
-     */
-    authorize(input) {
-        return new SimIamPolicyDecision(this.contextBuilder.build(input));
-    }
-}
-//# sourceMappingURL=sim-iam-authorizer.js.map

package/dist/dist-hidden/service/iam/authorize/sim-iam-authorizer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-authorizer.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,yBAAyB,GAE1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAa7D;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,cAAc,CAA4B;IAE3D,YAAY,KAA4B;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAyB,CACjD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,0BAA0B,CACjC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/dist-hidden/service/iam/authorize/sim-iam-decision.d.ts

@@ -1,84 +0,0 @@
-import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js";
-import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
-import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-doc-parser.js";
-import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
-export declare const SimIamPolicyDecisionValue: {
-    readonly ExplicitDeny: "ExplicitDeny";
-    readonly Allow: "Allow";
-    readonly ImplicitDeny: "ImplicitDeny";
-};
-export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];
-/**
- * Decision for one simulated IAM policy authorization attempt.
- *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
- *
- * The simulator currently models the common IAM authorization union:
- *
- * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
- * - otherwise the request is implicitly denied.
- *
- * Resource policies are expected to be supplied by the service that owns the
- * target resource.
- */
-export declare class SimIamPolicyDecision {
-    private readonly request;
-    private readonly policyDocumentParser;
-    private readonly statementMatcher;
-    private readonly explicitDenyStatementRecords;
-    private readonly allowStatementRecords;
-    private readonly trustAllowStatementRecords;
-    constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
-    /**
-     * Resolved caller against which this authorization decision was evaluated.
-     *
-     * This includes IAM's default account-root caller when the authorization input
-     * omitted a caller.
-     */
-    get caller(): SimAwsResolvedCaller;
-    /**
-     * Final IAM decision value.
-     */
-    get value(): SimIamPolicyDecisionValue;
-    /**
-     * Whether the request is allowed.
-     */
-    get isAllowed(): boolean;
-    /**
-     * Whether the request is denied either explicitly or implicitly.
-     */
-    get isDenied(): boolean;
-    /**
-     * Whether the request is denied by a matching Deny statement.
-     */
-    get isExplicitDeny(): boolean;
-    /**
-     * Whether the request is denied because no Allow statement matched.
-     */
-    get isImplicitDeny(): boolean;
-    /**
-     * Whether a matching trust-policy statement explicitly allows the request.
-     *
-     * An identity-policy Allow cannot substitute for the target role's trust.
-     */
-    get isAllowedByTrustPolicy(): boolean;
-    /**
-     * Matching explicit Deny statements.
-     */
-    get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
-    /**
-     * Matching Allow statements.
-     */
-    get allowStatements(): readonly SimIamPolicyDocumentStatement[];
-    /**
-     * Matching Allow statements originating from trust policies.
-     */
-    get trustAllowStatements(): readonly SimIamPolicyDocumentStatement[];
-    private evaluate;
-    private evaluatePolicy;
-}
-//# sourceMappingURL=sim-iam-decision.d.ts.map

package/dist/dist-hidden/service/iam/authorize/sim-iam-decision.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-decision.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAExF,eAAO,MAAM,yBAAyB;aACpC,YAAY,EAAE,cAAc;aAC5B,KAAK,EAAE,OAAO;aACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CACxC;IACL,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuC;IAC7E,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CACtC;IAEL,YACE,OAAO,EAAE,kBAAkB,EAC3B,oBAAoB,GAAE,0BAA6D,EAOpF;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,yBAAyB,CAUrC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;OAIG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,SAAS,6BAA6B,EAAE,CAErE;IAED;;OAEG;IACH,IAAI,eAAe,IAAI,SAAS,6BAA6B,EAAE,CAE9D;IAED;;OAEG;IACH,IAAI,oBAAoB,IAAI,SAAS,6BAA6B,EAAE,CAEnE;IAED,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,cAAc;CAoBvB"}

package/dist/dist-hidden/service/iam/authorize/sim-iam-decision.js

@@ -1,134 +0,0 @@
-import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-doc-parser.js";
-import { SimIamPolicyStatementMatcher } from "./match/sim-iam-policy-statement-matcher.js";
-export const SimIamPolicyDecisionValue = {
-    ExplicitDeny: "ExplicitDeny",
-    Allow: "Allow",
-    ImplicitDeny: "ImplicitDeny",
-};
-/**
- * Decision for one simulated IAM policy authorization attempt.
- *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
- *
- * The simulator currently models the common IAM authorization union:
- *
- * - an explicit Deny in any evaluated policy wins;
- * - an Allow in an identity policy or resource policy allows the request;
- * - otherwise the request is implicitly denied.
- *
- * Resource policies are expected to be supplied by the service that owns the
- * target resource.
- */
-export class SimIamPolicyDecision {
-    request;
-    policyDocumentParser;
-    statementMatcher;
-    explicitDenyStatementRecords = [];
-    allowStatementRecords = [];
-    trustAllowStatementRecords = [];
-    constructor(request, policyDocumentParser = new SimIamPolicyDocumentParser()) {
-        this.request = request;
-        this.policyDocumentParser = policyDocumentParser;
-        this.statementMatcher = new SimIamPolicyStatementMatcher(request);
-        this.evaluate();
-    }
-    /**
-     * Resolved caller against which this authorization decision was evaluated.
-     *
-     * This includes IAM's default account-root caller when the authorization input
-     * omitted a caller.
-     */
-    get caller() {
-        return this.request.caller;
-    }
-    /**
-     * Final IAM decision value.
-     */
-    get value() {
-        if (this.explicitDenyStatementRecords.length > 0) {
-            return SimIamPolicyDecisionValue.ExplicitDeny;
-        }
-        if (this.allowStatementRecords.length > 0) {
-            return SimIamPolicyDecisionValue.Allow;
-        }
-        return SimIamPolicyDecisionValue.ImplicitDeny;
-    }
-    /**
-     * Whether the request is allowed.
-     */
-    get isAllowed() {
-        return this.value === SimIamPolicyDecisionValue.Allow;
-    }
-    /**
-     * Whether the request is denied either explicitly or implicitly.
-     */
-    get isDenied() {
-        return this.value !== SimIamPolicyDecisionValue.Allow;
-    }
-    /**
-     * Whether the request is denied by a matching Deny statement.
-     */
-    get isExplicitDeny() {
-        return this.value === SimIamPolicyDecisionValue.ExplicitDeny;
-    }
-    /**
-     * Whether the request is denied because no Allow statement matched.
-     */
-    get isImplicitDeny() {
-        return this.value === SimIamPolicyDecisionValue.ImplicitDeny;
-    }
-    /**
-     * Whether a matching trust-policy statement explicitly allows the request.
-     *
-     * An identity-policy Allow cannot substitute for the target role's trust.
-     */
-    get isAllowedByTrustPolicy() {
-        return this.trustAllowStatementRecords.length > 0;
-    }
-    /**
-     * Matching explicit Deny statements.
-     */
-    get explicitDenyStatements() {
-        return this.explicitDenyStatementRecords;
-    }
-    /**
-     * Matching Allow statements.
-     */
-    get allowStatements() {
-        return this.allowStatementRecords;
-    }
-    /**
-     * Matching Allow statements originating from trust policies.
-     */
-    get trustAllowStatements() {
-        return this.trustAllowStatementRecords;
-    }
-    evaluate() {
-        for (const policy of [
-            ...this.request.identityPolicies,
-            ...this.request.resourcePolicies,
-        ]) {
-            this.evaluatePolicy(policy);
-        }
-    }
-    evaluatePolicy(policy) {
-        const parsedPolicy = this.policyDocumentParser.parse(policy.document);
-        for (const statement of parsedPolicy.statements) {
-            if (!this.statementMatcher.matches(policy, statement)) {
-                continue;
-            }
-            if (statement.effect === "Deny") {
-                this.explicitDenyStatementRecords.push(statement.source);
-                continue;
-            }
-            this.allowStatementRecords.push(statement.source);
-            if (policy.sourceType === "trust") {
-                this.trustAllowStatementRecords.push(statement.source);
-            }
-        }
-    }
-}
-//# sourceMappingURL=sim-iam-decision.js.map

package/dist/dist-hidden/service/iam/authorize/sim-iam-decision.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAG3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,qBAAqB,GAAoC,EAAE,CAAC;IAC5D,0BAA0B,GACzC,EAAE,CAAC;IAEL,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAElD,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}