@kensio/yulin 0.34.2 → 0.36.0

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The AWS error codes a SigV4 request can be rejected with.
+ *
+ * These are the codes real AWS returns, so a caller handling a rejection can
+ * treat a simulated one exactly as it treats the real thing.
+ */
+export type SimIamSigV4ErrorCode = "ExpiredToken" | "IncompleteSignature" | "InvalidClientTokenId" | "SignatureDoesNotMatch";
+/**
+ * Base error for a rejected SigV4 signed request.
+ */
+export declare class SimIamSigV4Error extends Error {
+    readonly code: SimIamSigV4ErrorCode;
+    constructor(code: SimIamSigV4ErrorCode, message: string);
+}
+/**
+ * Raised when the Authorization header is absent or does not carry the parts a
+ * SigV4 signature is made of.
+ */
+export declare class SimIamIncompleteSignature extends SimIamSigV4Error {
+    constructor(message: string);
+}
+/**
+ * Raised when the signing access key is unknown, inactive, or presented with a
+ * session token that does not belong to it.
+ */
+export declare class SimIamInvalidClientTokenId extends SimIamSigV4Error {
+    constructor(message: string);
+}
+/**
+ * Raised when the signing credentials belong to a session that has expired in
+ * simulated time.
+ */
+export declare class SimIamExpiredToken extends SimIamSigV4Error {
+    constructor(message: string);
+}
+/**
+ * Raised when a signature was made for a different service or Region than the
+ * endpoint it arrived at.
+ *
+ * The scope is an input to the signing key, so this would otherwise surface as
+ * a bare signature mismatch with nothing to act on. Checking it first turns the
+ * least diagnosable SigV4 failure into the most obvious one, which matters
+ * because rewritten local hostnames make it an easy mistake to make. The AWS
+ * error code stays the one real AWS answers with, so client handling is
+ * unchanged; the detail is what the simulator adds.
+ */
+export declare class SimIamCredentialScopeMismatch extends SimIamSigV4Error {
+    constructor(message: string);
+}
+/**
+ * Raised when the request does not reproduce the signature it carries.
+ *
+ * The message says which part of the canonical request the simulator built, so
+ * a mismatch can be diagnosed without re-deriving it by hand.
+ */
+export declare class SimIamSignatureDoesNotMatch extends SimIamSigV4Error {
+    readonly canonicalRequest?: string | undefined;
+    constructor(message: string, canonicalRequest?: string);
+}
+//# sourceMappingURL=sim-iam-sigv4.error.d.ts.map

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4.error.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/error/sim-iam-sigv4.error.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,qBAAqB,GACrB,sBAAsB,GACtB,uBAAuB,CAAC;AAE5B;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,IAAI,EAAE,oBAAoB,CAAC;IAE3C,YAAY,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAItD;CACF;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;;;GAUG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,SAAgB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtD,YAAY,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAGrD;CACF"}

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.js

@@ -0,0 +1,68 @@
+/**
+ * Base error for a rejected SigV4 signed request.
+ */
+export class SimIamSigV4Error extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+    }
+}
+/**
+ * Raised when the Authorization header is absent or does not carry the parts a
+ * SigV4 signature is made of.
+ */
+export class SimIamIncompleteSignature extends SimIamSigV4Error {
+    constructor(message) {
+        super("IncompleteSignature", message);
+    }
+}
+/**
+ * Raised when the signing access key is unknown, inactive, or presented with a
+ * session token that does not belong to it.
+ */
+export class SimIamInvalidClientTokenId extends SimIamSigV4Error {
+    constructor(message) {
+        super("InvalidClientTokenId", message);
+    }
+}
+/**
+ * Raised when the signing credentials belong to a session that has expired in
+ * simulated time.
+ */
+export class SimIamExpiredToken extends SimIamSigV4Error {
+    constructor(message) {
+        super("ExpiredToken", message);
+    }
+}
+/**
+ * Raised when a signature was made for a different service or Region than the
+ * endpoint it arrived at.
+ *
+ * The scope is an input to the signing key, so this would otherwise surface as
+ * a bare signature mismatch with nothing to act on. Checking it first turns the
+ * least diagnosable SigV4 failure into the most obvious one, which matters
+ * because rewritten local hostnames make it an easy mistake to make. The AWS
+ * error code stays the one real AWS answers with, so client handling is
+ * unchanged; the detail is what the simulator adds.
+ */
+export class SimIamCredentialScopeMismatch extends SimIamSigV4Error {
+    constructor(message) {
+        super("SignatureDoesNotMatch", message);
+    }
+}
+/**
+ * Raised when the request does not reproduce the signature it carries.
+ *
+ * The message says which part of the canonical request the simulator built, so
+ * a mismatch can be diagnosed without re-deriving it by hand.
+ */
+export class SimIamSignatureDoesNotMatch extends SimIamSigV4Error {
+    canonicalRequest;
+    constructor(message, canonicalRequest) {
+        super("SignatureDoesNotMatch", message);
+        this.canonicalRequest = canonicalRequest;
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4.error.js.map

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4.error.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/error/sim-iam-sigv4.error.ts"],"names":[],"mappings":"AAYA;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAuB;IAE3C,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,OAAe;QACzB,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,gBAAgB;IAC/C,gBAAgB,CAAsB;IAEtD,YAAY,OAAe,EAAE,gBAAyB;QACpD,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/iam/sigv4/sigv4-uri-escape.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Percent-encode a value the way SigV4 canonicalization requires.
+ *
+ * Everything outside the unreserved set `A-Za-z0-9-_.~` is encoded, which is
+ * `encodeURIComponent` plus the few characters it leaves alone.
+ */
+export declare function escapeSigV4Uri(value: string): string;
+//# sourceMappingURL=sigv4-uri-escape.d.ts.map

package/dist/service/iam/sigv4/sigv4-uri-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-uri-escape.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sigv4-uri-escape.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMpD"}

package/dist/service/iam/sigv4/sigv4-uri-escape.js

@@ -0,0 +1,10 @@
+/**
+ * Percent-encode a value the way SigV4 canonicalization requires.
+ *
+ * Everything outside the unreserved set `A-Za-z0-9-_.~` is encoded, which is
+ * `encodeURIComponent` plus the few characters it leaves alone.
+ */
+export function escapeSigV4Uri(value) {
+    return encodeURIComponent(value).replaceAll(/[!'()*]/g, (character) => `%${(character.codePointAt(0) ?? 0).toString(16).toUpperCase()}`);
+}
+//# sourceMappingURL=sigv4-uri-escape.js.map

package/dist/service/iam/sigv4/sigv4-uri-escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4-uri-escape.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sigv4-uri-escape.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,UAAU,CACzC,UAAU,EACV,CAAC,SAAS,EAAE,EAAE,CACZ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,CAAC;AACJ,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-authorization.d.ts

@@ -0,0 +1,33 @@
+import { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+export declare const simIamSigV4Algorithm = "AWS4-HMAC-SHA256";
+interface SimIamSigV4AuthorizationProperties {
+    readonly accessKeyId: string;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly signedHeaderNames: readonly string[];
+    readonly signature: string;
+}
+/**
+ * The parts of an `Authorization: AWS4-HMAC-SHA256 ...` header.
+ *
+ * The signed header list matters as much as the signature: verification has to
+ * canonicalize exactly the headers the signer chose, not whichever headers the
+ * request happens to carry now.
+ */
+export declare class SimIamSigV4Authorization {
+    readonly accessKeyId: string;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly signedHeaderNames: readonly string[];
+    readonly signature: string;
+    constructor(properties: SimIamSigV4AuthorizationProperties);
+    /**
+     * Parse an Authorization header value, or fail describing what was missing.
+     */
+    static parse(headerValue: string | null): SimIamSigV4Authorization;
+    /**
+     * Split the comma-separated `Name=value` fields that follow the algorithm.
+     */
+    private static fields;
+    private static field;
+}
+export {};
+//# sourceMappingURL=sim-iam-sigv4-authorization.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-authorization.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,KAAK,EAAE,0BAA0B,CAAC;IAClD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,wBAAwB,CAoCjE;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IAiBrB,OAAO,CAAC,MAAM,CAAC,KAAK;CAcrB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-authorization.js

@@ -0,0 +1,70 @@
+import { SimIamIncompleteSignature } from "./error/sim-iam-sigv4.error.js";
+import { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+export const simIamSigV4Algorithm = "AWS4-HMAC-SHA256";
+/**
+ * The parts of an `Authorization: AWS4-HMAC-SHA256 ...` header.
+ *
+ * The signed header list matters as much as the signature: verification has to
+ * canonicalize exactly the headers the signer chose, not whichever headers the
+ * request happens to carry now.
+ */
+export class SimIamSigV4Authorization {
+    accessKeyId;
+    scope;
+    signedHeaderNames;
+    signature;
+    constructor(properties) {
+        this.accessKeyId = properties.accessKeyId;
+        this.scope = properties.scope;
+        this.signedHeaderNames = properties.signedHeaderNames;
+        this.signature = properties.signature;
+    }
+    /**
+     * Parse an Authorization header value, or fail describing what was missing.
+     */
+    static parse(headerValue) {
+        if (headerValue === null || headerValue.length === 0) {
+            throw new SimIamIncompleteSignature("Request carries no Authorization header to verify");
+        }
+        const [algorithm, ...rest] = headerValue.split(" ");
+        if (algorithm !== simIamSigV4Algorithm) {
+            throw new SimIamIncompleteSignature(`Authorization header algorithm ${String(algorithm)} is not ${simIamSigV4Algorithm}`);
+        }
+        const fields = this.fields(rest.join(" "));
+        const credential = this.field(fields, "Credential");
+        const separator = credential.indexOf("/");
+        if (separator < 1) {
+            throw new SimIamIncompleteSignature(`Authorization header Credential ${credential} must be ` +
+                `<access-key-id>/<scope>`);
+        }
+        return new SimIamSigV4Authorization({
+            accessKeyId: credential.slice(0, separator),
+            scope: SimIamSigV4CredentialScope.parse(credential.slice(separator + 1)),
+            signedHeaderNames: this.field(fields, "SignedHeaders")
+                .split(";")
+                .map((name) => name.toLowerCase()),
+            signature: this.field(fields, "Signature"),
+        });
+    }
+    /**
+     * Split the comma-separated `Name=value` fields that follow the algorithm.
+     */
+    static fields(value) {
+        const fields = new Map();
+        for (const field of value.split(",")) {
+            const separator = field.indexOf("=");
+            if (separator > 0) {
+                fields.set(field.slice(0, separator).trim(), field.slice(separator + 1).trim());
+            }
+        }
+        return fields;
+    }
+    static field(fields, name) {
+        const value = fields.get(name);
+        if (value === undefined || value.length === 0) {
+            throw new SimIamIncompleteSignature(`Authorization header is missing its ${name} field`);
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-authorization.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-authorization.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AASvD;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnB,WAAW,CAAS;IACpB,KAAK,CAA6B;IAClC,iBAAiB,CAAoB;IACrC,SAAS,CAAS;IAElC,YAAY,UAA8C;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAA0B;QACrC,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,yBAAyB,CACjC,kCAAkC,MAAM,CAAC,SAAS,CAAC,WACjD,oBACF,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAyB,CACjC,mCAAmC,UAAU,WAAW;gBACtD,yBAAyB,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,wBAAwB,CAAC;YAClC,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YAC3C,KAAK,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC;iBACnD,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,MAAM,CAAC,KAAa;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAErC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CACR,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAChC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAClC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,KAAK,CAClB,MAAmC,EACnC,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,yBAAyB,CACjC,uCAAuC,IAAI,QAAQ,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-failure.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Run a credential lookup, restating any rejection as the AWS error code a
+ * signed request would be answered with.
+ *
+ * The registry reports why a credential failed in its own terms, which is the
+ * useful vocabulary in process. Over the wire AWS has a smaller vocabulary, and
+ * a client handling a real rejection expects those codes, so the translation
+ * happens here rather than in the registry.
+ */
+export declare function simIamSigV4CredentialFailure<T>(accessKeyId: string, resolve: () => T): T;
+//# sourceMappingURL=sim-iam-sigv4-credential-failure.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-credential-failure.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-credential-failure.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,EAC5C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,GACf,CAAC,CAUH"}

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-failure.js

@@ -0,0 +1,45 @@
+import { SimIamInvalidCredentials } from "../credential/error/sim-iam-credential.error.js";
+import { SimIamExpiredToken, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, } from "./error/sim-iam-sigv4.error.js";
+/**
+ * Run a credential lookup, restating any rejection as the AWS error code a
+ * signed request would be answered with.
+ *
+ * The registry reports why a credential failed in its own terms, which is the
+ * useful vocabulary in process. Over the wire AWS has a smaller vocabulary, and
+ * a client handling a real rejection expects those codes, so the translation
+ * happens here rather than in the registry.
+ */
+export function simIamSigV4CredentialFailure(accessKeyId, resolve) {
+    try {
+        return resolve();
+    }
+    catch (error) {
+        if (error instanceof SimIamInvalidCredentials) {
+            throw sigV4Error(accessKeyId, error);
+        }
+        throw error;
+    }
+}
+function sigV4Error(accessKeyId, error) {
+    const reason = error.reason;
+    switch (reason) {
+        case "expired-session": {
+            return new SimIamExpiredToken(`The security token included in the request for access key ` +
+                `${accessKeyId} has expired: ${error.message}`);
+        }
+        case "secret-access-key-mismatch": {
+            // A signed request never presents a secret, so reaching this means the
+            // signature is what failed rather than the credential.
+            return new SimIamSignatureDoesNotMatch(error.message);
+        }
+        case "inactive-access-key":
+        case "session-token-mismatch":
+        case "session-token-missing":
+        case "session-token-unexpected":
+        case "unknown-access-key": {
+            return new SimIamInvalidClientTokenId(`The security token included in the request for access key ` +
+                `${accessKeyId} is invalid: ${error.message}`);
+        }
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-credential-failure.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-credential-failure.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-credential-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAE3F,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,GAE5B,MAAM,gCAAgC,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;YAC9C,MAAM,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,WAAmB,EACnB,KAA+B;IAE/B,MAAM,MAAM,GAAmC,KAAK,CAAC,MAAM,CAAC;IAE5D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,iBAAiB,EAAE,CAAC;YACvB,OAAO,IAAI,kBAAkB,CAC3B,4DAA4D;gBAC1D,GAAG,WAAW,iBAAiB,KAAK,CAAC,OAAO,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,KAAK,4BAA4B,EAAE,CAAC;YAClC,uEAAuE;YACvE,uDAAuD;YACvD,OAAO,IAAI,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,qBAAqB,CAAC;QAC3B,KAAK,wBAAwB,CAAC;QAC9B,KAAK,uBAAuB,CAAC;QAC7B,KAAK,0BAA0B,CAAC;QAChC,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,IAAI,0BAA0B,CACnC,4DAA4D;gBAC1D,GAAG,WAAW,gBAAgB,KAAK,CAAC,OAAO,EAAE,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-scope.d.ts

@@ -0,0 +1,30 @@
+interface SimIamSigV4CredentialScopeProperties {
+    readonly dateStamp: string;
+    readonly regionName: string;
+    readonly serviceName: string;
+}
+/**
+ * The scope a SigV4 signature was made in: a date, a Region, and a service.
+ *
+ * The scope is not only checked, it is an input to the signing key, so a
+ * request signed for one Region or service cannot be replayed against another
+ * even before anything compares the two.
+ */
+export declare class SimIamSigV4CredentialScope {
+    readonly dateStamp: string;
+    readonly regionName: string;
+    readonly serviceName: string;
+    constructor(properties: SimIamSigV4CredentialScopeProperties);
+    /**
+     * Parse the scope part of a Credential value, such as
+     * `20260726/eu-west-2/lambda/aws4_request`.
+     */
+    static parse(value: string): SimIamSigV4CredentialScope;
+    /**
+     * The scope in the form it appears in a Credential value and a string to
+     * sign.
+     */
+    toString(): string;
+}
+export {};
+//# sourceMappingURL=sim-iam-sigv4-credential-scope.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-credential-scope.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-credential-scope.ts"],"names":[],"mappings":"AAKA,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,0BAA0B,CAmCtD;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAIjB;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-scope.js

@@ -0,0 +1,52 @@
+import { SimIamIncompleteSignature } from "./error/sim-iam-sigv4.error.js";
+const terminator = "aws4_request";
+const dateStampPattern = /^\d{8}$/;
+/**
+ * The scope a SigV4 signature was made in: a date, a Region, and a service.
+ *
+ * The scope is not only checked, it is an input to the signing key, so a
+ * request signed for one Region or service cannot be replayed against another
+ * even before anything compares the two.
+ */
+export class SimIamSigV4CredentialScope {
+    dateStamp;
+    regionName;
+    serviceName;
+    constructor(properties) {
+        this.dateStamp = properties.dateStamp;
+        this.regionName = properties.regionName;
+        this.serviceName = properties.serviceName;
+    }
+    /**
+     * Parse the scope part of a Credential value, such as
+     * `20260726/eu-west-2/lambda/aws4_request`.
+     */
+    static parse(value) {
+        const parts = value.split("/");
+        if (parts.length !== 4) {
+            throw new SimIamIncompleteSignature(`SigV4 credential scope ${value} must be ` +
+                `<date>/<region>/<service>/${terminator}`);
+        }
+        const [dateStamp, regionName, serviceName, scopeTerminator] = parts;
+        if (!dateStampPattern.test(dateStamp)) {
+            throw new SimIamIncompleteSignature(`SigV4 credential scope date ${dateStamp} must be 8 digits, YYYYMMDD`);
+        }
+        if (scopeTerminator !== terminator) {
+            throw new SimIamIncompleteSignature(`SigV4 credential scope must end with ${terminator}, ` +
+                `not ${scopeTerminator}`);
+        }
+        return new SimIamSigV4CredentialScope({
+            dateStamp,
+            regionName,
+            serviceName,
+        });
+    }
+    /**
+     * The scope in the form it appears in a Credential value and a string to
+     * sign.
+     */
+    toString() {
+        return [this.dateStamp, this.regionName, this.serviceName, terminator].join("/");
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-credential-scope.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-credential-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-credential-scope.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-credential-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAQnC;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACrB,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,WAAW,CAAS;IAEpC,YAAY,UAAgD;QAC1D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,CACjC,0BAA0B,KAAK,WAAW;gBACxC,6BAA6B,UAAU,EAAE,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,CAAC,GAAG,KAK7D,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,yBAAyB,CACjC,+BAA+B,SAAS,6BAA6B,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,yBAAyB,CACjC,wCAAwC,UAAU,IAAI;gBACpD,OAAO,eAAe,EAAE,CAC3B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,SAAS;YACT,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,IAAI,CACzE,GAAG,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-expected-scope.d.ts

@@ -0,0 +1,39 @@
+import type { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+/**
+ * The service and Region a signature is expected to have been scoped to.
+ *
+ * The Region is optional because not every simulated endpoint is
+ * Region-specific: a CloudFront hostname names no Region, so there is nothing
+ * to disagree with.
+ */
+export interface SimIamSigV4ExpectedScope {
+    readonly serviceName: string;
+    readonly regionName?: string | undefined;
+}
+/**
+ * Check a signature's scope against the endpoint it reached, when that
+ * endpoint is known.
+ *
+ * Verification is also done standalone, by a test asking only whether a
+ * signature is sound, and then there is no endpoint to compare against.
+ */
+export declare function simIamSigV4CheckExpectedScope(expected: SimIamSigV4ExpectedScope | undefined, scope: SimIamSigV4CredentialScope): void;
+/**
+ * Checks that a signature was made for the endpoint it arrived at.
+ *
+ * Real AWS makes this check too, and the reason it is worth making here is
+ * diagnostic. A wrong service or Region changes the signing key, so without
+ * this the only symptom is a signature that does not match, with no hint that
+ * the credentials and the request body were fine all along.
+ */
+export declare class SimIamSigV4ScopeExpectation {
+    private readonly expected;
+    constructor(expected: SimIamSigV4ExpectedScope);
+    /**
+     * Refuse a scope naming a service or Region other than the expected one.
+     */
+    check(scope: SimIamSigV4CredentialScope): void;
+    private checkServiceName;
+    private checkRegionName;
+}
+//# sourceMappingURL=sim-iam-sigv4-expected-scope.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-expected-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-expected-scope.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-expected-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,wBAAwB,GAAG,SAAS,EAC9C,KAAK,EAAE,0BAA0B,GAChC,IAAI,CAIN;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IAEpD,YAAY,QAAQ,EAAE,wBAAwB,EAE7C;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,0BAA0B,GAAG,IAAI,CAG7C;IAED,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,eAAe;CAaxB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-expected-scope.js

@@ -0,0 +1,52 @@
+import { SimIamCredentialScopeMismatch } from "./error/sim-iam-sigv4.error.js";
+/**
+ * Check a signature's scope against the endpoint it reached, when that
+ * endpoint is known.
+ *
+ * Verification is also done standalone, by a test asking only whether a
+ * signature is sound, and then there is no endpoint to compare against.
+ */
+export function simIamSigV4CheckExpectedScope(expected, scope) {
+    if (expected !== undefined) {
+        new SimIamSigV4ScopeExpectation(expected).check(scope);
+    }
+}
+/**
+ * Checks that a signature was made for the endpoint it arrived at.
+ *
+ * Real AWS makes this check too, and the reason it is worth making here is
+ * diagnostic. A wrong service or Region changes the signing key, so without
+ * this the only symptom is a signature that does not match, with no hint that
+ * the credentials and the request body were fine all along.
+ */
+export class SimIamSigV4ScopeExpectation {
+    expected;
+    constructor(expected) {
+        this.expected = expected;
+    }
+    /**
+     * Refuse a scope naming a service or Region other than the expected one.
+     */
+    check(scope) {
+        this.checkServiceName(scope.serviceName);
+        this.checkRegionName(scope.regionName);
+    }
+    checkServiceName(signed) {
+        if (signed === this.expected.serviceName) {
+            return;
+        }
+        throw new SimIamCredentialScopeMismatch(`Request is signed for service ${signed}, but reached simulated ` +
+            `${this.expected.serviceName}. Its credential scope should name ` +
+            `service ${this.expected.serviceName}.`);
+    }
+    checkRegionName(signed) {
+        const expected = this.expected.regionName;
+        if (expected === undefined || signed === expected) {
+            return;
+        }
+        throw new SimIamCredentialScopeMismatch(`Request is signed for Region ${signed}, but reached simulated ` +
+            `${this.expected.serviceName} in ${expected}. Its credential scope ` +
+            `should name Region ${expected}.`);
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-expected-scope.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-expected-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-expected-scope.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-expected-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAe/E;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA8C,EAC9C,KAAiC;IAEjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,2BAA2B,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACrB,QAAQ,CAA2B;IAEpD,YAAY,QAAkC;QAC5C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAiC;QACrC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,IAAI,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,6BAA6B,CACrC,iCAAiC,MAAM,0BAA0B;YAC/D,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,qCAAqC;YACjE,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,CAC1C,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,MAAc;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAE1C,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,6BAA6B,CACrC,gCAAgC,MAAM,0BAA0B;YAC9D,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,QAAQ,yBAAyB;YACpE,sBAAsB,QAAQ,GAAG,CACpC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.d.ts

@@ -0,0 +1,16 @@
+import type { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+/**
+ * Read the `X-Amz-Date` a request was signed at.
+ *
+ * The stamp is required, has to be well formed, and has to agree with the date
+ * in the credential scope, because both feed the signature and a signer that
+ * disagrees with itself cannot have produced one.
+ *
+ * It is deliberately never compared to a clock. Rejecting an old signature
+ * would buy nothing a caller could assert on, and would break every client that
+ * stamps real time and has no way to know what time this simulation is keeping.
+ * This is a documented divergence from real AWS, which enforces a five minute
+ * window.
+ */
+export declare function simIamSigV4RequestDate(headers: Headers, scope: SimIamSigV4CredentialScope): string;
+//# sourceMappingURL=sim-iam-sigv4-request-date.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-request-date.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAItF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,GAChC,MAAM,CA2BR"}

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.js

@@ -0,0 +1,31 @@
+import { SimIamIncompleteSignature } from "./error/sim-iam-sigv4.error.js";
+const amzDatePattern = /^(?<dateStamp>\d{8})T\d{6}Z$/;
+/**
+ * Read the `X-Amz-Date` a request was signed at.
+ *
+ * The stamp is required, has to be well formed, and has to agree with the date
+ * in the credential scope, because both feed the signature and a signer that
+ * disagrees with itself cannot have produced one.
+ *
+ * It is deliberately never compared to a clock. Rejecting an old signature
+ * would buy nothing a caller could assert on, and would break every client that
+ * stamps real time and has no way to know what time this simulation is keeping.
+ * This is a documented divergence from real AWS, which enforces a five minute
+ * window.
+ */
+export function simIamSigV4RequestDate(headers, scope) {
+    const amzDate = headers.get("x-amz-date");
+    if (amzDate === null || amzDate.length === 0) {
+        throw new SimIamIncompleteSignature("Signed request carries no X-Amz-Date header");
+    }
+    const dateStamp = amzDatePattern.exec(amzDate)?.groups?.["dateStamp"];
+    if (dateStamp === undefined) {
+        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} must be an ISO 8601 basic stamp, ` +
+            `YYYYMMDDTHHMMSSZ`);
+    }
+    if (dateStamp !== scope.dateStamp) {
+        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} is not on the day its credential scope names, ${scope.dateStamp}`);
+    }
+    return amzDate;
+}
+//# sourceMappingURL=sim-iam-sigv4-request-date.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-request-date.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,KAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE1C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CACjC,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;IAEtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,oCAAoC;YACvD,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,kDACnB,KAAK,CAAC,SACR,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.d.ts

@@ -0,0 +1,18 @@
+import type { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
+import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js";
+interface SimIamSigV4SignatureCheckInput {
+    readonly signedRequest: SimIamSigV4SignedRequest;
+    readonly authorization: SimIamSigV4Authorization;
+    readonly signingKey: Buffer;
+    readonly amzDate: string;
+}
+/**
+ * Rebuild the signature the request should carry, and refuse it otherwise.
+ *
+ * The canonical request travels with the failure, because a mismatch is
+ * otherwise undiagnosable: the only way to see which byte differed is to have
+ * the bytes the simulator signed over.
+ */
+export declare function simIamSigV4CheckSignature(input: SimIamSigV4SignatureCheckInput): void;
+export {};
+//# sourceMappingURL=sim-iam-sigv4-signature-check.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-check.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAMlF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,8BAA8B,GACpC,IAAI,CAwBN"}