@kensio/yulin 0.34.2 → 0.36.0

package/dist/service/iam/credential/session/sim-iam-session-manager.js

@@ -31,7 +31,7 @@ export class SimIamSessionManager {
             role,
             sessionName: input.sessionName,
             sessionToken: credentials.sessionToken,
-            createDate: input.createDate,
+            creationDate: input.creationDate,
             expiration: input.expiration,
         });
         this.credentialRegistry.registerAccessKey(new SimIamAccessKey({
@@ -43,7 +43,7 @@ export class SimIamSessionManager {
                 arn: role.arn,
             },
             session,
-            createDate: input.createDate,
+            creationDate: input.creationDate,
         }));
         return {
             credentials,

package/dist/service/iam/credential/session/sim-iam-session-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-session-manager.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAOrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAsBhG;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,KAAK,CAA0C;IAC/C,kBAAkB,CAA2B;IAC7C,mBAAmB,CAAmC;IACtD,gBAAgB,CAAoC;IAErE,YAAY,UAA0C;QACpD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,iCAAiC,CAC3D,UAAU,CAAC,SAAS,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,KAAmC;QAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,SAAS;YACT,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,IAAI;YACJ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CACvC,IAAI,eAAe,CAAC;YAClB,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,SAAS;YACT,uBAAuB,EAAE;gBACvB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;aACd;YACD,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,WAAW;YACX,OAAO;SACR,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,QAAwB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,kBAAkB;QAClB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,iBAAiB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-iam-session-manager.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAOrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAsBhG;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,KAAK,CAA0C;IAC/C,kBAAkB,CAA2B;IAC7C,mBAAmB,CAAmC;IACtD,gBAAgB,CAAoC;IAErE,YAAY,UAA0C;QACpD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,iCAAiC,CAC3D,UAAU,CAAC,SAAS,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CACf,KAAmC;QAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,SAAS;YACT,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,IAAI;YACJ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CACvC,IAAI,eAAe,CAAC;YAClB,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,SAAS;YACT,uBAAuB,EAAE;gBACvB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;aACd;YACD,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,WAAW;YACX,OAAO;SACR,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,QAAwB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,kBAAkB;QAClB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,iBAAiB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/iam/credential/session/sim-iam-session.d.ts

@@ -6,7 +6,7 @@ interface SimIamSessionProperties {
     readonly role: SimIamRole;
     readonly sessionName: string;
     readonly sessionToken: string;
-    readonly createDate: Date;
+    readonly creationDate: Date;
     readonly expiration: Date;
 }
 /**
@@ -21,7 +21,7 @@ export declare class SimIamSession {
     readonly role: SimIamRole;
     readonly sessionName: string;
     readonly sessionToken: string;
-    readonly createDate: Date;
+    readonly creationDate: Date;
     readonly expiration: Date;
     constructor(properties: SimIamSessionProperties);
     /**

package/dist/service/iam/credential/session/sim-iam-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,eAAe,EAAE,eAAe,CAAC;IACjD,SAAgB,IAAI,EAAE,UAAU,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,UAAU,EAAE,IAAI,CAAC;IACjC,SAAgB,UAAU,EAAE,IAAI,CAAC;IAEjC,YAAY,UAAU,EAAE,uBAAuB,EAoB9C;IAED;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE5B;CACF"}
+{"version":3,"file":"sim-iam-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,eAAe,EAAE,eAAe,CAAC;IACjD,SAAgB,IAAI,EAAE,UAAU,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,YAAY,EAAE,IAAI,CAAC;IACnC,SAAgB,UAAU,EAAE,IAAI,CAAC;IAEjC,YAAY,UAAU,EAAE,uBAAuB,EAoB9C;IAED;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE5B;CACF"}

package/dist/service/iam/credential/session/sim-iam-session.js

@@ -10,7 +10,7 @@ export class SimIamSession {
     role;
     sessionName;
     sessionToken;
-    createDate;
+    creationDate;
     expiration;
     constructor(properties) {
         if (properties.sessionName.length === 0) {
@@ -19,7 +19,7 @@ export class SimIamSession {
         if (properties.sessionToken.length === 0) {
             throw new Error("Sim IAM session token must not be empty");
         }
-        if (properties.expiration.getTime() <= properties.createDate.getTime()) {
+        if (properties.expiration.getTime() <= properties.creationDate.getTime()) {
             throw new Error("Sim IAM session expiration must follow its creation");
         }
         this.principal = properties.principal;
@@ -27,7 +27,7 @@ export class SimIamSession {
         this.role = properties.role;
         this.sessionName = properties.sessionName;
         this.sessionToken = properties.sessionToken;
-        this.createDate = new Date(properties.createDate);
+        this.creationDate = new Date(properties.creationDate);
         this.expiration = new Date(properties.expiration);
     }
     /**

package/dist/service/iam/credential/session/sim-iam-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-session.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACR,SAAS,CAAkB;IAC3B,eAAe,CAAkB;IACjC,IAAI,CAAa;IACjB,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,UAAU,CAAO;IACjB,UAAU,CAAO;IAEjC,YAAY,UAAmC;QAC7C,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAS;QACjB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"sim-iam-session.js","sourceRoot":"","sources":["../../../../../src/service/iam/credential/session/sim-iam-session.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACR,SAAS,CAAkB;IAC3B,eAAe,CAAkB;IACjC,IAAI,CAAa;IACjB,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,YAAY,CAAO;IACnB,UAAU,CAAO;IAEjC,YAAY,UAAmC;QAC7C,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAS;QACjB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-access-key-checks.d.ts

@@ -0,0 +1,30 @@
+import type { SimIamAccessKey } from "./sim-iam-access-key.js";
+/**
+ * The rules deciding whether an access key may be used right now.
+ *
+ * These are separate from the registry that stores keys: the registry answers
+ * which key an id names, and this answers whether that key is usable. Both the
+ * secret-carrying and the signature-carrying paths into IAM apply the same
+ * rules, in the same order, from here.
+ */
+export declare class SimIamAccessKeyChecks {
+    /**
+     * Resolve a looked-up access key, failing when it is unknown or deactivated.
+     */
+    activeAccessKey(accessKey: SimIamAccessKey | undefined, context: {
+        readonly accessKeyId: string;
+    }): SimIamAccessKey;
+    /**
+     * Check a presented session token belongs to the access key.
+     *
+     * A temporary key without its token, and a long-lived key with one, are both
+     * refused: the two kinds of credential are not interchangeable.
+     */
+    checkSessionToken(accessKey: SimIamAccessKey, sessionToken: string | undefined): void;
+    /**
+     * Check a temporary key's session has not expired, in simulated time.
+     */
+    checkNotExpired(accessKey: SimIamAccessKey, now: Date): void;
+    private invalid;
+}
+//# sourceMappingURL=sim-iam-access-key-checks.d.ts.map

package/dist/service/iam/credential/sim-iam-access-key-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key-checks.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key-checks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC;;OAEG;IACH,eAAe,CACb,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,OAAO,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACxC,eAAe,CAiBjB;IAED;;;;;OAKG;IACH,iBAAiB,CACf,SAAS,EAAE,eAAe,EAC1B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,IAAI,CAeN;IAED;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAQ3D;IAED,OAAO,CAAC,OAAO;CAYhB"}

package/dist/service/iam/credential/sim-iam-access-key-checks.js

@@ -0,0 +1,67 @@
+import { SimIamInvalidCredentials } from "./error/sim-iam-credential.error.js";
+/**
+ * The rules deciding whether an access key may be used right now.
+ *
+ * These are separate from the registry that stores keys: the registry answers
+ * which key an id names, and this answers whether that key is usable. Both the
+ * secret-carrying and the signature-carrying paths into IAM apply the same
+ * rules, in the same order, from here.
+ */
+export class SimIamAccessKeyChecks {
+    /**
+     * Resolve a looked-up access key, failing when it is unknown or deactivated.
+     */
+    activeAccessKey(accessKey, context) {
+        if (accessKey === undefined) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: context.accessKeyId,
+                reason: "unknown-access-key",
+            });
+        }
+        if (accessKey.status !== "Active") {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: context.accessKeyId,
+                reason: "inactive-access-key",
+                accessKeyStatus: accessKey.status,
+            });
+        }
+        return accessKey;
+    }
+    /**
+     * Check a presented session token belongs to the access key.
+     *
+     * A temporary key without its token, and a long-lived key with one, are both
+     * refused: the two kinds of credential are not interchangeable.
+     */
+    checkSessionToken(accessKey, sessionToken) {
+        if (accessKey.session !== undefined && sessionToken === undefined) {
+            throw this.invalid(accessKey, "session-token-missing");
+        }
+        if (accessKey.session === undefined && sessionToken !== undefined) {
+            throw this.invalid(accessKey, "session-token-unexpected");
+        }
+        if (accessKey.session !== undefined &&
+            !accessKey.matchesSessionToken(sessionToken)) {
+            throw this.invalid(accessKey, "session-token-mismatch");
+        }
+    }
+    /**
+     * Check a temporary key's session has not expired, in simulated time.
+     */
+    checkNotExpired(accessKey, now) {
+        if (accessKey.session?.isExpired(now) === true) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: accessKey.accessKeyId,
+                reason: "expired-session",
+                expiration: accessKey.session.expiration,
+            });
+        }
+    }
+    invalid(accessKey, reason) {
+        return new SimIamInvalidCredentials({
+            accessKeyId: accessKey.accessKeyId,
+            reason,
+        });
+    }
+}
+//# sourceMappingURL=sim-iam-access-key-checks.js.map

package/dist/service/iam/credential/sim-iam-access-key-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key-checks.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAG/E;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC;;OAEG;IACH,eAAe,CACb,SAAsC,EACtC,OAAyC;QAEzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,qBAAqB;gBAC7B,eAAe,EAAE,SAAS,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CACf,SAA0B,EAC1B,YAAgC;QAEhC,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,CAAC,SAAS,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAC5C,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAA0B,EAAE,GAAS;QACnD,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,MAAM,EAAE,iBAAiB;gBACzB,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,OAAO,CACb,SAA0B,EAC1B,MAG8B;QAE9B,OAAO,IAAI,wBAAwB,CAAC;YAClC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-access-key.d.ts

@@ -8,7 +8,12 @@ interface SimIamAccessKeyProperties {
     readonly principal: SimAwsPrincipal;
     readonly identityPolicyPrincipal?: SimAwsPrincipal | undefined;
     readonly session?: SimIamSession | undefined;
-    readonly createDate?: Date | undefined;
+    /**
+     * When this access key was created, in simulated time. Required so that no
+     * part of IAM invents a timestamp of its own: the caller already knows what
+     * "now" means in its simulation.
+     */
+    readonly creationDate: Date;
     readonly status?: SimIamAccessKeyStatus | undefined;
 }
 /**
@@ -23,7 +28,7 @@ export declare class SimIamAccessKey {
     readonly principal: SimAwsPrincipal;
     readonly identityPolicyPrincipal: SimAwsPrincipal;
     readonly session?: SimIamSession | undefined;
-    readonly createDate: Date;
+    readonly creationDate: Date;
     status: SimIamAccessKeyStatus;
     constructor(properties: SimIamAccessKeyProperties);
     /**

package/dist/service/iam/credential/sim-iam-access-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-access-key.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE1D,UAAU,yBAAyB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,eAAe,EAAE,MAAM,CAAC;IACxC,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,uBAAuB,EAAE,eAAe,CAAC;IACzD,SAAgB,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpD,SAAgB,UAAU,EAAE,IAAI,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAErC,YAAY,UAAU,EAAE,yBAAyB,EAShD;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAEvD;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAM7D;IAED;;OAEG;IACH,QAAQ,IAAI,wBAAwB,CAOnC;IAED,OAAO,CAAC,YAAY;CAMrB"}
+{"version":3,"file":"sim-iam-access-key.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE1D,UAAU,yBAAyB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,eAAe,EAAE,MAAM,CAAC;IACxC,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,uBAAuB,EAAE,eAAe,CAAC;IACzD,SAAgB,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAC5B,MAAM,EAAE,qBAAqB,CAAC;IAErC,YAAY,UAAU,EAAE,yBAAyB,EAShD;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAEvD;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAM7D;IAED;;OAEG;IACH,QAAQ,IAAI,wBAAwB,CAOnC;IAED,OAAO,CAAC,YAAY;CAMrB"}

package/dist/service/iam/credential/sim-iam-access-key.js

@@ -11,7 +11,7 @@ export class SimIamAccessKey {
     principal;
     identityPolicyPrincipal;
     session;
-    createDate;
+    creationDate;
     status;
     constructor(properties) {
         this.accessKeyId = properties.accessKeyId;
@@ -20,7 +20,7 @@ export class SimIamAccessKey {
         this.identityPolicyPrincipal =
             properties.identityPolicyPrincipal ?? properties.principal;
         this.session = properties.session;
-        this.createDate = new Date(properties.createDate ?? Date.now());
+        this.creationDate = new Date(properties.creationDate);
         this.status = properties.status ?? "Active";
     }
     /**

package/dist/service/iam/credential/sim-iam-access-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-access-key.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB1D;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACV,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,SAAS,CAAkB;IAC3B,uBAAuB,CAAkB;IACzC,OAAO,CAA6B;IACpC,UAAU,CAAO;IAC1B,MAAM,CAAwB;IAErC,YAAY,UAAqC;QAC/C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,uBAAuB;YAC1B,UAAU,CAAC,uBAAuB,IAAI,UAAU,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAuB;QAC5C,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI;YACxB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,QAAgB;QACnD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QAEpE,OAAO,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;CACF"}
+{"version":3,"file":"sim-iam-access-key.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-access-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAuB1D;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACV,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,SAAS,CAAkB;IAC3B,uBAAuB,CAAkB;IACzC,OAAO,CAA6B;IACpC,YAAY,CAAO;IAC5B,MAAM,CAAwB;IAErC,YAAY,UAAqC;QAC/C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,uBAAuB;YAC1B,UAAU,CAAC,uBAAuB,IAAI,UAAU,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAuB;QAC5C,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAgC;QAClD,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI;YACxB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,QAAgB;QACnD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChE,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QAEpE,OAAO,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-account-signing-credentials.d.ts

@@ -0,0 +1,21 @@
+import type { SimIamCredentialRegistry } from "./sim-iam-credential-registry.js";
+import type { SimIamSigningCredential, SimIamSigningCredentialInput, SimIamSigningCredentialResolver } from "./sim-iam-signing-credential.js";
+/**
+ * Derives signing keys for one Account's access keys.
+ *
+ * Storing and authenticating access keys belongs to the credential registry.
+ * Turning an authenticated key into something a signature can be checked
+ * against is a separate job, and it is this one.
+ *
+ * What leaves here is a key derived for a single date, Region and service, so
+ * it cannot be used to sign anything outside the scope it was asked for.
+ */
+export declare class SimIamAccountSigningCredentials implements SimIamSigningCredentialResolver {
+    private readonly credentials;
+    constructor(credentials: SimIamCredentialRegistry);
+    /**
+     * Authenticate an access key and derive its signing key for a scope.
+     */
+    signingCredentialFor(input: SimIamSigningCredentialInput): SimIamSigningCredential;
+}
+//# sourceMappingURL=sim-iam-account-signing-credentials.d.ts.map

package/dist/service/iam/credential/sim-iam-account-signing-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-signing-credentials.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-account-signing-credentials.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;GASG;AACH,qBAAa,+BAAgC,YAAW,+BAA+B;IACrF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IAEvD,YAAY,WAAW,EAAE,wBAAwB,EAEhD;IAED;;OAEG;IACH,oBAAoB,CAClB,KAAK,EAAE,4BAA4B,GAClC,uBAAuB,CAWzB;CACF"}

package/dist/service/iam/credential/sim-iam-account-signing-credentials.js

@@ -0,0 +1,28 @@
+import { simIamSigV4SigningKey } from "../sigv4/sim-iam-sigv4-signing-key.js";
+/**
+ * Derives signing keys for one Account's access keys.
+ *
+ * Storing and authenticating access keys belongs to the credential registry.
+ * Turning an authenticated key into something a signature can be checked
+ * against is a separate job, and it is this one.
+ *
+ * What leaves here is a key derived for a single date, Region and service, so
+ * it cannot be used to sign anything outside the scope it was asked for.
+ */
+export class SimIamAccountSigningCredentials {
+    credentials;
+    constructor(credentials) {
+        this.credentials = credentials;
+    }
+    /**
+     * Authenticate an access key and derive its signing key for a scope.
+     */
+    signingCredentialFor(input) {
+        const accessKey = this.credentials.authenticateAccessKey(input.accessKeyId, input.sessionToken, input.now);
+        return {
+            signingKey: simIamSigV4SigningKey(accessKey.secretAccessKey, input.scope),
+            identity: accessKey.identity(),
+        };
+    }
+}
+//# sourceMappingURL=sim-iam-account-signing-credentials.js.map

package/dist/service/iam/credential/sim-iam-account-signing-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-account-signing-credentials.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-account-signing-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAQ9E;;;;;;;;;GASG;AACH,MAAM,OAAO,+BAA+B;IACzB,WAAW,CAA2B;IAEvD,YAAY,WAAqC;QAC/C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,oBAAoB,CAClB,KAAmC;QAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,qBAAqB,CACtD,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,GAAG,CACV,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,qBAAqB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC;YACzE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;SAC/B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-credential-registry.d.ts

@@ -1,5 +1,19 @@
 import type { SimAwsCredentials, SimIamCredentialIdentity } from "./sim-aws-credentials.js";
 import type { SimIamAccessKey } from "./sim-iam-access-key.js";
+import { type SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimIamAccessKeyIndex } from "./sim-iam-signing-credential.js";
+interface SimIamCredentialRegistryProperties {
+    /**
+     * Clock deciding whether a temporary session has expired. Session expiry is
+     * simulated state, so it is judged in simulated time rather than host time.
+     */
+    readonly clock?: SimClock;
+    /**
+     * Simulation-wide index told about every key registered here, so a signed
+     * request naming only an access key id can be traced back to this Account.
+     */
+    readonly accessKeyIndex?: SimIamAccessKeyIndex | undefined;
+}
 /**
  * Stores and authenticates simulated IAM access keys.
  *
@@ -9,6 +23,10 @@ import type { SimIamAccessKey } from "./sim-iam-access-key.js";
  */
 export declare class SimIamCredentialRegistry {
     private readonly accessKeys;
+    private readonly clock;
+    private readonly accessKeyIndex?;
+    private readonly checks;
+    constructor(properties?: SimIamCredentialRegistryProperties);
     /**
      * Register a new simulated access key.
      */
@@ -17,5 +35,15 @@ export declare class SimIamCredentialRegistry {
      * Authenticate credentials and resolve their simulated AWS identity.
      */
     resolveCredentials(credentials: SimAwsCredentials, now?: Date): SimIamCredentialIdentity;
+    /**
+     * Authenticate an access key without a secret to compare.
+     *
+     * A signed request proves possession of the secret by its signature rather
+     * than by presenting it, so everything except the secret is checked here and
+     * the signature settles the rest.
+     */
+    authenticateAccessKey(accessKeyId: string, sessionToken: string | undefined, now?: Date): SimIamAccessKey;
+    private activeAccessKey;
 }
+export {};
 //# sourceMappingURL=sim-iam-credential-registry.d.ts.map

package/dist/service/iam/credential/sim-iam-credential-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-credential-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM/D;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IAEjE;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAMlD;IAED;;OAEG;IACH,kBAAkB,CAChB,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACrB,wBAAwB,CAgE1B;CACF"}
+{"version":3,"file":"sim-iam-credential-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM/D,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,UAAU,kCAAkC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAC5D;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,YAAY,UAAU,GAAE,kCAAuC,EAG9D;IAED;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAOlD;IAED;;OAEG;IACH,kBAAkB,CAChB,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAuB,GAC3B,wBAAwB,CAc1B;IAED;;;;;;OAMG;IACH,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,GAAE,IAAuB,GAC3B,eAAe,CAOjB;IAED,OAAO,CAAC,eAAe;CAKxB"}

package/dist/service/iam/credential/sim-iam-credential-registry.js

@@ -1,4 +1,6 @@
+import { SimIamAccessKeyChecks } from "./sim-iam-access-key-checks.js";
 import { SimIamDuplicateAccessKey, SimIamInvalidCredentials, } from "./error/sim-iam-credential.error.js";
+import { SimRealClock } from "../../../util/clock/sim-clock.js";
 /**
  * Stores and authenticates simulated IAM access keys.
  *
@@ -8,6 +10,13 @@ import { SimIamDuplicateAccessKey, SimIamInvalidCredentials, } from "./error/sim
  */
 export class SimIamCredentialRegistry {
     accessKeys = new Map();
+    clock;
+    accessKeyIndex;
+    checks = new SimIamAccessKeyChecks();
+    constructor(properties = {}) {
+        this.clock = properties.clock ?? new SimRealClock();
+        this.accessKeyIndex = properties.accessKeyIndex;
+    }
     /**
      * Register a new simulated access key.
      */
@@ -16,60 +25,40 @@ export class SimIamCredentialRegistry {
             throw new SimIamDuplicateAccessKey(accessKey.accessKeyId);
         }
         this.accessKeys.set(accessKey.accessKeyId, accessKey);
+        this.accessKeyIndex?.registerAccessKey(accessKey.accessKeyId);
     }
     /**
      * Authenticate credentials and resolve their simulated AWS identity.
      */
-    resolveCredentials(credentials, now = new Date()) {
-        const accessKey = this.accessKeys.get(credentials.accessKeyId);
-        if (accessKey === undefined) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "unknown-access-key",
-            });
-        }
-        if (accessKey.status !== "Active") {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "inactive-access-key",
-                accessKeyStatus: accessKey.status,
-            });
-        }
+    resolveCredentials(credentials, now = this.clock.now()) {
+        const accessKey = this.activeAccessKey(credentials.accessKeyId);
         if (!accessKey.matchesSecretAccessKey(credentials.secretAccessKey)) {
             throw new SimIamInvalidCredentials({
                 accessKeyId: credentials.accessKeyId,
                 reason: "secret-access-key-mismatch",
             });
         }
-        if (accessKey.session !== undefined &&
-            credentials.sessionToken === undefined) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "session-token-missing",
-            });
-        }
-        if (accessKey.session === undefined &&
-            credentials.sessionToken !== undefined) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "session-token-unexpected",
-            });
-        }
-        if (accessKey.session !== undefined &&
-            !accessKey.matchesSessionToken(credentials.sessionToken)) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "session-token-mismatch",
-            });
-        }
-        if (accessKey.session?.isExpired(now) === true) {
-            throw new SimIamInvalidCredentials({
-                accessKeyId: credentials.accessKeyId,
-                reason: "expired-session",
-                expiration: accessKey.session.expiration,
-            });
-        }
+        this.checks.checkSessionToken(accessKey, credentials.sessionToken);
+        this.checks.checkNotExpired(accessKey, now);
         return accessKey.identity();
     }
+    /**
+     * Authenticate an access key without a secret to compare.
+     *
+     * A signed request proves possession of the secret by its signature rather
+     * than by presenting it, so everything except the secret is checked here and
+     * the signature settles the rest.
+     */
+    authenticateAccessKey(accessKeyId, sessionToken, now = this.clock.now()) {
+        const accessKey = this.activeAccessKey(accessKeyId);
+        this.checks.checkSessionToken(accessKey, sessionToken);
+        this.checks.checkNotExpired(accessKey, now);
+        return accessKey;
+    }
+    activeAccessKey(accessKeyId) {
+        return this.checks.activeAccessKey(this.accessKeys.get(accessKeyId), {
+            accessKeyId,
+        });
+    }
 }
 //# sourceMappingURL=sim-iam-credential-registry.js.map

package/dist/service/iam/credential/sim-iam-credential-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-credential-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjE;;OAEG;IACH,iBAAiB,CAAC,SAA0B;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAA8B,EAC9B,GAAG,GAAS,IAAI,IAAI,EAAE;QAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,qBAAqB;gBAC7B,eAAe,EAAE,SAAS,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,4BAA4B;aACrC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,WAAW,CAAC,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,uBAAuB;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,WAAW,CAAC,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,SAAS;YAC/B,CAAC,SAAS,CAAC,mBAAmB,CAAC,WAAW,CAAC,YAAY,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,iBAAiB;gBACzB,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"sim-iam-credential-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-credential-registry.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAiB,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAgB/E;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,KAAK,CAAW;IAChB,cAAc,CAAoC;IAClD,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,YAAY,UAAU,GAAuC,EAAE;QAC7D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,SAA0B;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAA8B,EAC9B,GAAG,GAAS,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,MAAM,EAAE,4BAA4B;aACrC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE5C,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CACnB,WAAmB,EACnB,YAAgC,EAChC,GAAG,GAAS,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,eAAe,CAAC,WAAmB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;YACnE,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/credential/sim-iam-signing-credential.d.ts

@@ -0,0 +1,32 @@
+import type { SimIamSigV4CredentialScope } from "../sigv4/sim-iam-sigv4-credential-scope.js";
+import type { SimIamCredentialIdentity } from "./sim-aws-credentials.js";
+/**
+ * Records access keys somewhere beyond one Account's own registry.
+ */
+export interface SimIamAccessKeyIndex {
+    registerAccessKey(accessKeyId: string): void;
+}
+export interface SimIamSigningCredentialInput {
+    readonly accessKeyId: string;
+    readonly sessionToken?: string | undefined;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly now?: Date | undefined;
+}
+/**
+ * A signing key scoped to one date, Region and service, with the identity it
+ * belongs to.
+ */
+export interface SimIamSigningCredential {
+    readonly signingKey: Buffer;
+    readonly identity: SimIamCredentialIdentity;
+}
+/**
+ * Resolves the signing key an access key would have signed with.
+ *
+ * Implemented by the Account-scoped credential registry, and by the
+ * simulation-wide resolver that finds which Account owns an access key first.
+ */
+export interface SimIamSigningCredentialResolver {
+    signingCredentialFor(input: SimIamSigningCredentialInput): SimIamSigningCredential;
+}
+//# sourceMappingURL=sim-iam-signing-credential.d.ts.map

package/dist/service/iam/credential/sim-iam-signing-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-signing-credential.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-signing-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,oBAAoB,CAClB,KAAK,EAAE,4BAA4B,GAClC,uBAAuB,CAAC;CAC5B"}

package/dist/service/iam/credential/sim-iam-signing-credential.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-signing-credential.js.map

package/dist/service/iam/credential/sim-iam-signing-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-signing-credential.js","sourceRoot":"","sources":["../../../../src/service/iam/credential/sim-iam-signing-credential.ts"],"names":[],"mappings":""}

package/dist/service/iam/index.d.ts

@@ -1,3 +1,9 @@
 export { SimIam } from "./sim-iam.js";
 export type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
+export type { SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
+export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, type SimIamSigV4ErrorCode, } from "./sigv4/error/sim-iam-sigv4.error.js";
+export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-scope.js";
+export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
+export { type SimAwsRequestAuthMethod, SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, type SimAwsRequestAuthFailure, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/index.js

@@ -1,2 +1,6 @@
 export { SimIam } from "./sim-iam.js";
+export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, } from "./sigv4/error/sim-iam-sigv4.error.js";
+export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
+export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/policy/parse/sim-iam-document-parser.d.ts

@@ -0,0 +1,31 @@
+import type { SimIamPolicyDocument, SimIamPolicyDocumentCondition, SimIamPolicyDocumentPrincipal, SimIamPolicyDocumentStatement } from "../sim-iam-policy.js";
+export interface SimIamParsedPolicyDocument {
+    readonly statements: readonly SimIamParsedPolicyStatement[];
+}
+export interface SimIamParsedPolicyStatement {
+    readonly source: SimIamPolicyDocumentStatement;
+    readonly sid?: string | undefined;
+    readonly effect: "Allow" | "Deny";
+    readonly actions?: readonly string[] | undefined;
+    readonly notActions?: readonly string[] | undefined;
+    readonly resources?: readonly string[] | undefined;
+    readonly notResources?: readonly string[] | undefined;
+    readonly principal?: SimIamPolicyDocumentPrincipal | undefined;
+    readonly notPrincipal?: SimIamPolicyDocumentPrincipal | undefined;
+    readonly condition?: SimIamPolicyDocumentCondition | undefined;
+}
+/**
+ * Parse raw IAM policy document shapes into a form convenient for evaluation.
+ *
+ * IAM policy JSON commonly allows either a single value or an array. The decision
+ * engine should not need to care which source shape was used.
+ */
+export declare class SimIamPolicyDocumentParser {
+    /**
+     * Parse a sim IAM Policy Document into a form convenient for evaluation.
+     */
+    parse(policy: SimIamPolicyDocument): SimIamParsedPolicyDocument;
+    private parseStatement;
+    private stringList;
+}
+//# sourceMappingURL=sim-iam-document-parser.d.ts.map

package/dist/service/iam/policy/parse/sim-iam-document-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-document-parser.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/policy/parse/sim-iam-document-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC7D;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAChE;AAED;;;;;GAKG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,oBAAoB,GAAG,0BAA0B,CAM9D;IAED,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,UAAU;CAanB"}

package/dist/service/iam/policy/parse/sim-iam-document-parser.factory.d.ts

@@ -0,0 +1,7 @@
+import { StaticFactory } from "@kensio/part-factory";
+import type { SimIamParsedPolicyStatement } from "./sim-iam-document-parser.js";
+/**
+ * Generates parsed IAM policy statements for tests.
+ */
+export declare const simIamParsedPolicyStatementFactory: StaticFactory<SimIamParsedPolicyStatement>;
+//# sourceMappingURL=sim-iam-document-parser.factory.d.ts.map

package/dist/service/iam/policy/parse/sim-iam-document-parser.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-document-parser.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/policy/parse/sim-iam-document-parser.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,kCAAkC,4CAU3C,CAAC"}