@kensio/yulin 0.34.2 → 0.36.0

package/dist/service/iam/policy/parse/sim-iam-document-parser.factory.js

@@ -0,0 +1,15 @@
+import { StaticFactory } from "@kensio/part-factory";
+/**
+ * Generates parsed IAM policy statements for tests.
+ */
+export const simIamParsedPolicyStatementFactory = new StaticFactory({
+    source: {
+        Effect: "Allow",
+        Action: "s3:GetObject",
+        Resource: "arn:aws:s3:::test-bucket/test-key",
+    },
+    effect: "Allow",
+    actions: ["s3:GetObject"],
+    resources: ["arn:aws:s3:::test-bucket/test-key"],
+});
+//# sourceMappingURL=sim-iam-document-parser.factory.js.map

package/dist/service/iam/policy/parse/sim-iam-document-parser.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-document-parser.factory.js","sourceRoot":"","sources":["../../../../../src/service/iam/policy/parse/sim-iam-document-parser.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD;;GAEG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,IAAI,aAAa,CAA8B;IAC7C,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,mCAAmC;KAC9C;IACD,MAAM,EAAE,OAAO;IACf,OAAO,EAAE,CAAC,cAAc,CAAC;IACzB,SAAS,EAAE,CAAC,mCAAmC,CAAC;CACjD,CAAC,CAAC"}

package/dist/service/iam/policy/parse/sim-iam-document-parser.js

@@ -0,0 +1,41 @@
+import { simIamPolicyDocumentStatements } from "../sim-iam-pol-document-statements.js";
+/**
+ * Parse raw IAM policy document shapes into a form convenient for evaluation.
+ *
+ * IAM policy JSON commonly allows either a single value or an array. The decision
+ * engine should not need to care which source shape was used.
+ */
+export class SimIamPolicyDocumentParser {
+    /**
+     * Parse a sim IAM Policy Document into a form convenient for evaluation.
+     */
+    parse(policy) {
+        return {
+            statements: simIamPolicyDocumentStatements(policy).map((statement) => this.parseStatement(statement)),
+        };
+    }
+    parseStatement(statement) {
+        return {
+            source: statement,
+            sid: statement.Sid,
+            effect: statement.Effect,
+            actions: this.stringList(statement.Action),
+            notActions: this.stringList(statement.NotAction),
+            resources: this.stringList(statement.Resource),
+            notResources: this.stringList(statement.NotResource),
+            principal: statement.Principal,
+            notPrincipal: statement.NotPrincipal,
+            condition: statement.Condition,
+        };
+    }
+    stringList(value) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (typeof value === "string") {
+            return [value];
+        }
+        return [...value];
+    }
+}
+//# sourceMappingURL=sim-iam-document-parser.js.map

package/dist/service/iam/policy/parse/sim-iam-document-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-document-parser.js","sourceRoot":"","sources":["../../../../../src/service/iam/policy/parse/sim-iam-document-parser.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAmBvF;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,KAAK,CAAC,MAA4B;QAChC,OAAO;YACL,UAAU,EAAE,8BAA8B,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACnE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAC/B;SACF,CAAC;IACJ,CAAC;IAEO,cAAc,CACpB,SAAwC;QAExC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9C,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC;YACpD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC;IACJ,CAAC;IAEO,UAAU,CAChB,KAA6C;QAE7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/service/iam/policy/sim-iam-pol-document-statements.d.ts

@@ -0,0 +1,7 @@
+import type { SimIamPolicyDocument, SimIamPolicyDocumentStatement } from "./sim-iam-policy.js";
+/**
+ * Return the policy document statements as an array, regardless of whether the
+ * source document used the single-statement or statement-array shape.
+ */
+export declare function simIamPolicyDocumentStatements(policyDocument: SimIamPolicyDocument): readonly SimIamPolicyDocumentStatement[];
+//# sourceMappingURL=sim-iam-pol-document-statements.d.ts.map

package/dist/service/iam/policy/sim-iam-pol-document-statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-pol-document-statements.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-pol-document-statements.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EACpB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAC;AAI7B;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,oBAAoB,GACnC,SAAS,6BAA6B,EAAE,CAgB1C"}

package/dist/service/iam/policy/sim-iam-pol-document-statements.js

@@ -0,0 +1,21 @@
+import { SimIamMalformedPolicyDocument } from "../error/sim-iam.error.js";
+/**
+ * Return the policy document statements as an array, regardless of whether the
+ * source document used the single-statement or statement-array shape.
+ */
+export function simIamPolicyDocumentStatements(policyDocument) {
+    const policyStatement = policyDocument.Statement;
+    // JSON parse can still produce null at runtime
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+    if (policyStatement === undefined || policyStatement === null) {
+        throw new SimIamMalformedPolicyDocument("IAM policy document must define Statement");
+    }
+    if (isSimIamPolicyStatementArray(policyStatement)) {
+        return policyStatement;
+    }
+    return [policyStatement];
+}
+function isSimIamPolicyStatementArray(policyStatement) {
+    return Array.isArray(policyStatement);
+}
+//# sourceMappingURL=sim-iam-pol-document-statements.js.map

package/dist/service/iam/policy/sim-iam-pol-document-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-pol-document-statements.js","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-pol-document-statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAQ1E;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,cAAoC;IAEpC,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC;IAEjD,+CAA+C;IAC/C,uEAAuE;IACvE,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,6BAA6B,CACrC,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,4BAA4B,CAAC,eAAe,CAAC,EAAE,CAAC;QAClD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,eAAe,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,4BAA4B,CACnC,eAA2C;IAE3C,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AACxC,CAAC"}

package/dist/service/iam/policy/sim-iam-policy.d.ts

@@ -41,7 +41,7 @@ export interface SimIamManagedPolicy {
     readonly permissionsBoundaryUsageCount: number;
     readonly isAttachable: boolean;
     readonly description?: string | undefined;
-    readonly createDate: Date;
+    readonly creationDate: Date;
     readonly updateDate: Date;
     readonly policyDocument?: JSONString<SimIamPolicyDocument> | undefined;
 }

package/dist/service/iam/policy/sim-iam-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EACjB,6BAA6B,GAAG,SAAS,6BAA6B,EAAE,CAAC;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAChE;AAED,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CACxD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAC3C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACvC,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,mCAAmC,CAAC;AAEnE,MAAM,MAAM,oBAAoB,GAC9B,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;AAEhD,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAClD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAC/D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC"}
+{"version":3,"file":"sim-iam-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EACjB,6BAA6B,GAAG,SAAS,6BAA6B,EAAE,CAAC;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAChE;AAED,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CACxD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAC3C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACvC,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,mCAAmC,CAAC;AAEnE,MAAM,MAAM,oBAAoB,GAC9B,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;AAEhD,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAClD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAC/D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC"}

package/dist/service/iam/policy/sim-iam-policy.factory.js

@@ -21,7 +21,7 @@ export const simIamPolicyFactory = new DynamicFactory(() => {
         attachmentCount: 0,
         permissionsBoundaryUsageCount: 0,
         isAttachable: true,
-        createDate: now,
+        creationDate: now,
         updateDate: now,
     };
 });

package/dist/service/iam/policy/sim-iam-policy.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,cAAc,CAAe,GAAG,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,YAAgC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC;IAEjB,OAAO;QACL,GAAG,EAAE,gBAAgB,CAAC;YACpB,SAAS,EAAE,mBAAmB,EAAE;YAChC,IAAI;YACJ,UAAU;SACX,CAAC;QACF,QAAQ,EAAE,eAAe,EAAE;QAC3B,UAAU;QACV,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,CAAC;QAClB,6BAA6B,EAAE,CAAC;QAChC,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sim-iam-policy.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,cAAc,CAAe,GAAG,EAAE;IACvE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,YAAgC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC;IAEjB,OAAO;QACL,GAAG,EAAE,gBAAgB,CAAC;YACpB,SAAS,EAAE,mBAAmB,EAAE;YAChC,IAAI;YACJ,UAAU;SACX,CAAC;QACF,QAAQ,EAAE,eAAe,EAAE;QAC3B,UAAU;QACV,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,CAAC;QAClB,6BAA6B,EAAE,CAAC;QAChC,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/service/iam/registry/sim-iam-access-key-registry.d.ts

@@ -0,0 +1,39 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+/**
+ * Simulation-wide index of which Account owns an access key.
+ *
+ * IAM state is Account-scoped, but a signed request names only an access key
+ * id: nothing in a signature says which Account to ask. This index supplies
+ * that missing hop, as the Function URL registry does for URL ids.
+ *
+ * It indexes access keys but does not own them. The owning Account's credential
+ * registry remains the only thing that can authenticate one.
+ */
+export declare class SimIamAccessKeyRegistry {
+    private readonly accountIdByAccessKeyId;
+    /**
+     * Record which Account an access key belongs to.
+     */
+    registerAccessKey(accessKeyId: string, accountId: SimAwsAccountId): void;
+    /**
+     * Find the Account that owns an access key, if any Account does.
+     */
+    accountIdForAccessKey(accessKeyId: string): SimAwsAccountId | undefined;
+}
+/**
+ * Records access keys registered by one Account's credential registry.
+ *
+ * The credential registry knows nothing about Accounts, so the Account it
+ * belongs to is bound here instead of being threaded through every caller that
+ * registers a key.
+ */
+export declare class SimIamAccountAccessKeyIndex {
+    private readonly registry;
+    private readonly accountId;
+    constructor(registry: SimIamAccessKeyRegistry, accountId: SimAwsAccountId);
+    /**
+     * Record an access key as belonging to this index's Account.
+     */
+    registerAccessKey(accessKeyId: string): void;
+}
+//# sourceMappingURL=sim-iam-access-key-registry.d.ts.map

package/dist/service/iam/registry/sim-iam-access-key-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-access-key-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAsC;IAE7E;;OAEG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,IAAI,CAEvE;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEtE;CACF;AAED;;;;;;GAMG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAE5C,YAAY,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,eAAe,EAGxE;IAED;;OAEG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAE3C;CACF"}

package/dist/service/iam/registry/sim-iam-access-key-registry.js

@@ -0,0 +1,47 @@
+/**
+ * Simulation-wide index of which Account owns an access key.
+ *
+ * IAM state is Account-scoped, but a signed request names only an access key
+ * id: nothing in a signature says which Account to ask. This index supplies
+ * that missing hop, as the Function URL registry does for URL ids.
+ *
+ * It indexes access keys but does not own them. The owning Account's credential
+ * registry remains the only thing that can authenticate one.
+ */
+export class SimIamAccessKeyRegistry {
+    accountIdByAccessKeyId = new Map();
+    /**
+     * Record which Account an access key belongs to.
+     */
+    registerAccessKey(accessKeyId, accountId) {
+        this.accountIdByAccessKeyId.set(accessKeyId, accountId);
+    }
+    /**
+     * Find the Account that owns an access key, if any Account does.
+     */
+    accountIdForAccessKey(accessKeyId) {
+        return this.accountIdByAccessKeyId.get(accessKeyId);
+    }
+}
+/**
+ * Records access keys registered by one Account's credential registry.
+ *
+ * The credential registry knows nothing about Accounts, so the Account it
+ * belongs to is bound here instead of being threaded through every caller that
+ * registers a key.
+ */
+export class SimIamAccountAccessKeyIndex {
+    registry;
+    accountId;
+    constructor(registry, accountId) {
+        this.registry = registry;
+        this.accountId = accountId;
+    }
+    /**
+     * Record an access key as belonging to this index's Account.
+     */
+    registerAccessKey(accessKeyId) {
+        this.registry.registerAccessKey(accessKeyId, this.accountId);
+    }
+}
+//# sourceMappingURL=sim-iam-access-key-registry.js.map

package/dist/service/iam/registry/sim-iam-access-key-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-access-key-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-access-key-registry.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7E;;OAEG;IACH,iBAAiB,CAAC,WAAmB,EAAE,SAA0B;QAC/D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAmB;QACvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACrB,QAAQ,CAA0B;IAClC,SAAS,CAAkB;IAE5C,YAAY,QAAiC,EAAE,SAA0B;QACvE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,WAAmB;QACnC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/service/iam/registry/sim-iam-global-credential-resolver.d.ts

@@ -0,0 +1,25 @@
+import type { SimIamSigningCredential, SimIamSigningCredentialInput, SimIamSigningCredentialResolver } from "../credential/sim-iam-signing-credential.js";
+import type { SimIamAccessKeyRegistry } from "./sim-iam-access-key-registry.js";
+import type { SimIamAccountResolver } from "./sim-iam-account-resolver.js";
+interface SimIamGlobalCredentialResolverProperties {
+    readonly accessKeys: SimIamAccessKeyRegistry;
+    readonly iam: SimIamAccountResolver;
+}
+/**
+ * Resolves signing credentials across every Account in one simulation.
+ *
+ * A signed request identifies an access key but not an Account, so the owning
+ * Account is looked up first and its own credential registry does the
+ * authenticating. Authority stays with the Account that issued the key.
+ */
+export declare class SimIamGlobalCredentialResolver implements SimIamSigningCredentialResolver {
+    private readonly accessKeys;
+    private readonly iam;
+    constructor(properties: SimIamGlobalCredentialResolverProperties);
+    /**
+     * Authenticate an access key belonging to any Account in this simulation.
+     */
+    signingCredentialFor(input: SimIamSigningCredentialInput): SimIamSigningCredential;
+}
+export {};
+//# sourceMappingURL=sim-iam-global-credential-resolver.d.ts.map

package/dist/service/iam/registry/sim-iam-global-credential-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-global-credential-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-global-credential-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,UAAU,wCAAwC;IAChD,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,8BAA+B,YAAW,+BAA+B;IACpF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAE5C,YAAY,UAAU,EAAE,wCAAwC,EAG/D;IAED;;OAEG;IACH,oBAAoB,CAClB,KAAK,EAAE,4BAA4B,GAClC,uBAAuB,CAazB;CACF"}

package/dist/service/iam/registry/sim-iam-global-credential-resolver.js

@@ -0,0 +1,31 @@
+import { SimIamInvalidCredentials } from "../credential/error/sim-iam-credential.error.js";
+import { SimIamAccountSigningCredentials } from "../credential/sim-iam-account-signing-credentials.js";
+/**
+ * Resolves signing credentials across every Account in one simulation.
+ *
+ * A signed request identifies an access key but not an Account, so the owning
+ * Account is looked up first and its own credential registry does the
+ * authenticating. Authority stays with the Account that issued the key.
+ */
+export class SimIamGlobalCredentialResolver {
+    accessKeys;
+    iam;
+    constructor(properties) {
+        this.accessKeys = properties.accessKeys;
+        this.iam = properties.iam;
+    }
+    /**
+     * Authenticate an access key belonging to any Account in this simulation.
+     */
+    signingCredentialFor(input) {
+        const accountId = this.accessKeys.accountIdForAccessKey(input.accessKeyId);
+        if (accountId === undefined) {
+            throw new SimIamInvalidCredentials({
+                accessKeyId: input.accessKeyId,
+                reason: "unknown-access-key",
+            });
+        }
+        return new SimIamAccountSigningCredentials(this.iam.iamForAccount(accountId).credentials).signingCredentialFor(input);
+    }
+}
+//# sourceMappingURL=sim-iam-global-credential-resolver.js.map

package/dist/service/iam/registry/sim-iam-global-credential-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-global-credential-resolver.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-global-credential-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,MAAM,sDAAsD,CAAC;AAcvG;;;;;;GAMG;AACH,MAAM,OAAO,8BAA8B;IACxB,UAAU,CAA0B;IACpC,GAAG,CAAwB;IAE5C,YAAY,UAAoD;QAC9D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAClB,KAAmC;QAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAE3E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC;gBACjC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,+BAA+B,CACxC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,WAAW,CAC9C,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/service/iam/request/error/sim-aws-request-auth.error.d.ts

@@ -0,0 +1,27 @@
+import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
+/**
+ * Raised when the `x-sim-aws-caller` header does not name a principal the
+ * simulator understands.
+ *
+ * This is a simulator control header rather than anything real AWS defines, so
+ * a bad value is the caller's mistake in using Yulin, not a failed AWS
+ * authentication. Saying exactly what the grammar is beats silently falling
+ * back to anonymous and leaving a test wondering why its principal vanished.
+ */
+export declare class SimAwsInvalidCallerHeader extends Error {
+    readonly code = "InvalidRequestCaller";
+    constructor(message: string);
+}
+/**
+ * Every way a request can fail to be attributed to a principal.
+ *
+ * A rejected signature and an unusable caller header are both authentication
+ * failures at the same boundary, so whoever turns one into an HTTP response
+ * handles them together.
+ */
+export type SimAwsRequestAuthFailure = SimIamSigV4Error | SimAwsInvalidCallerHeader;
+/**
+ * Whether an error is a request authentication failure.
+ */
+export declare function isSimAwsRequestAuthFailure(error: unknown): error is SimAwsRequestAuthFailure;
+//# sourceMappingURL=sim-aws-request-auth.error.d.ts.map

package/dist/service/iam/request/error/sim-aws-request-auth.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-auth.error.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/request/error/sim-aws-request-auth.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAgB,IAAI,0BAA0B;IAE9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAClC,gBAAgB,GAAG,yBAAyB,CAAC;AAE/C;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,wBAAwB,CAKnC"}

package/dist/service/iam/request/error/sim-aws-request-auth.error.js

@@ -0,0 +1,25 @@
+import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
+/**
+ * Raised when the `x-sim-aws-caller` header does not name a principal the
+ * simulator understands.
+ *
+ * This is a simulator control header rather than anything real AWS defines, so
+ * a bad value is the caller's mistake in using Yulin, not a failed AWS
+ * authentication. Saying exactly what the grammar is beats silently falling
+ * back to anonymous and leaving a test wondering why its principal vanished.
+ */
+export class SimAwsInvalidCallerHeader extends Error {
+    code = "InvalidRequestCaller";
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+/**
+ * Whether an error is a request authentication failure.
+ */
+export function isSimAwsRequestAuthFailure(error) {
+    return (error instanceof SimIamSigV4Error ||
+        error instanceof SimAwsInvalidCallerHeader);
+}
+//# sourceMappingURL=sim-aws-request-auth.error.js.map

package/dist/service/iam/request/error/sim-aws-request-auth.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-auth.error.js","sourceRoot":"","sources":["../../../../../src/service/iam/request/error/sim-aws-request-auth.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClC,IAAI,GAAG,sBAAsB,CAAC;IAE9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAYD;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,gBAAgB;QACjC,KAAK,YAAY,yBAAyB,CAC3C,CAAC;AACJ,CAAC"}

package/dist/service/iam/request/sim-aws-caller-header.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The header naming the principal a request into simulated AWS is made by.
+ *
+ * The same name is used on the way back out, as the simulator's own statement
+ * of who it decided the caller was.
+ *
+ * This is the convenience path for local development and for tooling that will
+ * not sign requests: a curl one-liner can be a Role without holding any
+ * credentials. It is deliberately always enabled and not configurable, because
+ * a simulator whose auth boundary can be half-configured is a simulator whose
+ * tests do not mean what they look like.
+ */
+export declare const simAwsCallerHeaderName = "x-sim-aws-caller";
+/**
+ * Read a caller header value as the principal it names.
+ *
+ * No existence check is made on an ARN, matching how `runAs` already behaves:
+ * naming a principal is not the same as proving it exists, and IAM
+ * authorization will simply find no policies for a principal nothing created.
+ */
+export declare function simAwsCallerHeaderPrincipal(value: string): SimAwsPrincipal;
+/**
+ * Write a principal in the form this header accepts, so what the simulator
+ * reports back can be sent straight back in.
+ */
+export declare function simAwsCallerHeaderValue(principal: SimAwsPrincipal): string;
+//# sourceMappingURL=sim-aws-caller-header.d.ts.map

package/dist/service/iam/request/sim-aws-caller-header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller-header.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-caller-header.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAG1E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAMzD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAmB1E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAY1E"}

package/dist/service/iam/request/sim-aws-caller-header.js

@@ -0,0 +1,62 @@
+import { SimAwsInvalidCallerHeader } from "./error/sim-aws-request-auth.error.js";
+/**
+ * The header naming the principal a request into simulated AWS is made by.
+ *
+ * The same name is used on the way back out, as the simulator's own statement
+ * of who it decided the caller was.
+ *
+ * This is the convenience path for local development and for tooling that will
+ * not sign requests: a curl one-liner can be a Role without holding any
+ * credentials. It is deliberately always enabled and not configurable, because
+ * a simulator whose auth boundary can be half-configured is a simulator whose
+ * tests do not mean what they look like.
+ */
+export const simAwsCallerHeaderName = "x-sim-aws-caller";
+const anonymousValue = "anonymous";
+const servicePrefix = "service:";
+const arnPrefix = "arn:";
+/**
+ * Read a caller header value as the principal it names.
+ *
+ * No existence check is made on an ARN, matching how `runAs` already behaves:
+ * naming a principal is not the same as proving it exists, and IAM
+ * authorization will simply find no policies for a principal nothing created.
+ */
+export function simAwsCallerHeaderPrincipal(value) {
+    const trimmed = value.trim();
+    if (trimmed === anonymousValue) {
+        return { kind: "anonymous" };
+    }
+    if (trimmed.startsWith(servicePrefix)) {
+        return servicePrincipal(trimmed.slice(servicePrefix.length));
+    }
+    if (trimmed.startsWith(arnPrefix)) {
+        return { kind: "arn", arn: trimmed };
+    }
+    throw new SimAwsInvalidCallerHeader(`${simAwsCallerHeaderName} value ${value} must be an ARN, ` +
+        `${anonymousValue}, or ${servicePrefix}<name>`);
+}
+/**
+ * Write a principal in the form this header accepts, so what the simulator
+ * reports back can be sent straight back in.
+ */
+export function simAwsCallerHeaderValue(principal) {
+    switch (principal.kind) {
+        case "arn": {
+            return principal.arn;
+        }
+        case "service": {
+            return `${servicePrefix}${principal.service}`;
+        }
+        case "anonymous": {
+            return anonymousValue;
+        }
+    }
+}
+function servicePrincipal(service) {
+    if (service.length === 0) {
+        throw new SimAwsInvalidCallerHeader(`${simAwsCallerHeaderName} value ${servicePrefix} names no service`);
+    }
+    return { kind: "service", service };
+}
+//# sourceMappingURL=sim-aws-caller-header.js.map

package/dist/service/iam/request/sim-aws-caller-header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller-header.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-caller-header.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACtC,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,yBAAyB,CACjC,GAAG,sBAAsB,UAAU,KAAK,mBAAmB;QACzD,GAAG,cAAc,QAAQ,aAAa,QAAQ,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QAChD,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,GAAG,sBAAsB,UAAU,aAAa,mBAAmB,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts

@@ -0,0 +1,49 @@
+import type { SimIamSigV4ExpectedScope } from "../sigv4/sim-iam-sigv4-expected-scope.js";
+import type { SimIamSigV4SignedRequest } from "../sigv4/sim-iam-sigv4-signed-request.js";
+import type { SimIamSigV4Verifier } from "../sigv4/sim-iam-sigv4-verifier.js";
+import { SimAwsRequestCaller } from "./sim-aws-request-caller.js";
+interface SimAwsRequestCallerResolverProperties {
+    readonly signedRequests: SimIamSigV4Verifier;
+}
+/**
+ * The one place an HTTP request into simulated AWS becomes a principal.
+ *
+ * Resolution runs in a fixed order:
+ *
+ * 1. an `x-sim-aws-caller` header naming the principal directly;
+ * 2. an `Authorization: AWS4-HMAC-SHA256` header, verified as a signature;
+ * 3. neither, giving anonymous.
+ *
+ * The header wins over a signature so that a developer can override the
+ * identity of a request their tooling already signs, without having to stop it
+ * signing. Nothing else is worth resolving after an explicit statement of who
+ * the caller is.
+ *
+ * Anonymous is the floor, and deliberately not the Account root. Simulated IAM
+ * treats an omitted in-process caller as the root principal with unrestricted
+ * access, which is convenient inside a test and would be a serious mistake over
+ * HTTP: every unauthenticated request would arrive as an administrator.
+ */
+export declare class SimAwsRequestCallerResolver {
+    private readonly signedRequests;
+    constructor(properties: SimAwsRequestCallerResolverProperties);
+    /**
+     * Resolve the principal behind a request as received.
+     *
+     * Throws a SimAwsRequestAuthFailure when the request states an identity that
+     * cannot be accepted. Stating none is not a failure; it is anonymous.
+     */
+    resolve(request: SimIamSigV4SignedRequest, expectedScope?: SimIamSigV4ExpectedScope): SimAwsRequestCaller;
+    /**
+     * Whether the request offers a SigV4 signature to verify.
+     *
+     * Only an AWS4-HMAC-SHA256 header counts. An Authorization header of any
+     * other scheme belongs to the application: a bearer token sent to a Function
+     * URL with NONE auth is the handler's business, and treating it as a broken
+     * signature would refuse a request real AWS delivers.
+     */
+    private carriesSignature;
+    private signedCaller;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-caller-resolver.d.ts.map

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAK9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAO,EAAE,wBAAwB,EACjC,aAAa,CAAC,EAAE,wBAAwB,GACvC,mBAAmB,CAerB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,YAAY;CAYrB"}

package/dist/service/iam/request/sim-aws-request-caller-resolver.js

@@ -0,0 +1,68 @@
+import { simIamSigV4Algorithm } from "../sigv4/sim-iam-sigv4-authorization.js";
+import { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, } from "./sim-aws-caller-header.js";
+import { SimAwsRequestCaller } from "./sim-aws-request-caller.js";
+/**
+ * The one place an HTTP request into simulated AWS becomes a principal.
+ *
+ * Resolution runs in a fixed order:
+ *
+ * 1. an `x-sim-aws-caller` header naming the principal directly;
+ * 2. an `Authorization: AWS4-HMAC-SHA256` header, verified as a signature;
+ * 3. neither, giving anonymous.
+ *
+ * The header wins over a signature so that a developer can override the
+ * identity of a request their tooling already signs, without having to stop it
+ * signing. Nothing else is worth resolving after an explicit statement of who
+ * the caller is.
+ *
+ * Anonymous is the floor, and deliberately not the Account root. Simulated IAM
+ * treats an omitted in-process caller as the root principal with unrestricted
+ * access, which is convenient inside a test and would be a serious mistake over
+ * HTTP: every unauthenticated request would arrive as an administrator.
+ */
+export class SimAwsRequestCallerResolver {
+    signedRequests;
+    constructor(properties) {
+        this.signedRequests = properties.signedRequests;
+    }
+    /**
+     * Resolve the principal behind a request as received.
+     *
+     * Throws a SimAwsRequestAuthFailure when the request states an identity that
+     * cannot be accepted. Stating none is not a failure; it is anonymous.
+     */
+    resolve(request, expectedScope) {
+        const named = request.headers.get(simAwsCallerHeaderName);
+        if (named !== null) {
+            return new SimAwsRequestCaller({
+                principal: simAwsCallerHeaderPrincipal(named),
+                authMethod: "caller-header",
+            });
+        }
+        if (!this.carriesSignature(request)) {
+            return SimAwsRequestCaller.anonymous();
+        }
+        return this.signedCaller(request, expectedScope);
+    }
+    /**
+     * Whether the request offers a SigV4 signature to verify.
+     *
+     * Only an AWS4-HMAC-SHA256 header counts. An Authorization header of any
+     * other scheme belongs to the application: a bearer token sent to a Function
+     * URL with NONE auth is the handler's business, and treating it as a broken
+     * signature would refuse a request real AWS delivers.
+     */
+    carriesSignature(request) {
+        return (request.headers.get("authorization")?.startsWith(simIamSigV4Algorithm) ===
+            true);
+    }
+    signedCaller(request, expectedScope) {
+        const identity = this.signedRequests.verify(request, { expectedScope });
+        return new SimAwsRequestCaller({
+            principal: identity.principal,
+            identityPolicyPrincipal: identity.identityPolicyPrincipal,
+            authMethod: "sigv4",
+        });
+    }
+}
+//# sourceMappingURL=sim-aws-request-caller-resolver.js.map

package/dist/service/iam/request/sim-aws-request-caller-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-caller-resolver.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAI/E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,2BAA2B;IACrB,cAAc,CAAsB;IAErD,YAAY,UAAiD;QAC3D,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAiC,EACjC,aAAwC;QAExC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAE1D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,mBAAmB,CAAC;gBAC7B,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC;gBAC7C,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,OAAiC;QACxD,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC;YACtE,IAAI,CACL,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,OAAiC,EACjC,aAAmD;QAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAExE,OAAO,IAAI,mBAAmB,CAAC;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;CACF"}