@kensio/yulin 0.35.0 → 0.37.0

package/dist/service/cloudfront/controller/sim-cloudfront-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/controller/sim-cloudfront-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAE7D,OAAO,EAEL,KAAK,wCAAwC,IAAI,wCAAwC,EAC1F,MAAM,8CAA8C,CAAC;AAEtD;;;;;;;GAOG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IAExD,YAAY,UAAU,GAAE,wCAA6C,EAMpE;IAED;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,CAAC,CAEnB;CACF"}
+{"version":3,"file":"sim-cloudfront-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/controller/sim-cloudfront-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAE7D,OAAO,EAEL,KAAK,wCAAwC,IAAI,wCAAwC,EAC1F,MAAM,8CAA8C,CAAC;AAEtD;;;;;;;GAOG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IAExD,YAAY,UAAU,GAAE,wCAA6C,EAMpE;IAED;;;;;;OAMG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE3E;CACF"}

package/dist/service/cloudfront/controller/sim-cloudfront-controller.js

@@ -18,12 +18,12 @@ export class SimCloudFrontServiceController {
     /**
      * Handle one incoming request for the simulated CloudFront service.
      *
-     * The `_target` is part of the shared service-controller interface, but
-     * CloudFront routing is host-based, so the request itself contains the
-     * information needed to find the Distribution.
+     * The service request carries the resolved target and caller, but CloudFront
+     * routing is host-based and a Distribution has no IAM authorization of its
+     * own, so only the request itself is needed to find and serve it.
      */
-    async handleRequest(_target, request) {
-        return this.pipeline.handle(request);
+    async handleRequest(serviceRequest) {
+        return this.pipeline.handle(serviceRequest.request);
     }
 }
 //# sourceMappingURL=sim-cloudfront-controller.js.map

package/dist/service/cloudfront/controller/sim-cloudfront-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-controller.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/controller/sim-cloudfront-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EACL,0CAA0C,GAE3C,MAAM,8CAA8C,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA8B;IACxB,QAAQ,CAA+B;IAExD,YAAY,UAAU,GAA6C,EAAE;QACnE,MAAM,mBAAmB,GACvB,IAAI,0CAA0C,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,4BAA4B,CAAC,YAAY,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,OAA4B,EAC5B,OAAgB;QAEhB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-cloudfront-controller.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/controller/sim-cloudfront-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EACL,0CAA0C,GAE3C,MAAM,8CAA8C,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA8B;IACxB,QAAQ,CAA+B;IAExD,YAAY,UAAU,GAA6C,EAAE;QACnE,MAAM,mBAAmB,GACvB,IAAI,0CAA0C,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,4BAA4B,CAAC,YAAY,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/service/cloudfront/distribution/sim-cloudfront-distribution.d.ts

@@ -3,6 +3,7 @@ import type { SimCloudFrontOrigin } from "../origin/sim-cloudfront-origin.js";
 import type { SimCloudFrontBehavior } from "../behaviour/sim-cloud-front-behavior.js";
 import { type SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimCloudFrontDistributionConfig } from "../command/create-distribution/create-distribution.command.js";
+import { type SimClock } from "../../../util/clock/sim-clock.js";
 export type SimCloudFrontDistributionId = Brand<string, "SimCloudFrontDistributionId">;
 export type SimCloudFrontDistributionStatus = "Deploying" | "Deployed";
 interface SimCloudFrontDistributionProperties {
@@ -10,6 +11,11 @@ interface SimCloudFrontDistributionProperties {
     readonly status?: SimCloudFrontDistributionStatus;
     readonly accountId?: SimAwsAccountId;
     readonly distributionConfig?: SimCloudFrontDistributionConfig;
+    /**
+     * Clock stamping this Distribution's last modified time. A Distribution built
+     * standalone, outside a SimAws instance, falls back to the real clock.
+     */
+    readonly clock?: SimClock;
 }
 /**
  * Simulated CloudFront Distribution.

package/dist/service/cloudfront/distribution/sim-cloudfront-distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-distribution.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cloudfront-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEtF,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+DAA+D,CAAC;AAErH,MAAM,MAAM,2BAA2B,GAAG,KAAK,CAC7C,MAAM,EACN,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,WAAW,GAAG,UAAU,CAAC;AAEvE,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,2BAA2B,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,+BAA+B,CAAC;CAC/D;AAED;;GAEG;AACH,qBAAa,yBAAyB;;IACpC,SAAgB,cAAc,EAAE,2BAA2B,CAAC;IAC5D,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,kBAAkB,EAChC,+BAA+B,GAAG,SAAS,CAAC;IAC9C,SAAgB,SAAS,EAAE,qBAAqB,EAAE,CAAM;IACxD,SAAgB,gBAAgB,EAAE,IAAI,CAAc;IAGpD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAElE,YAAY,UAAU,GAAE,mCAAwC,EAY/D;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,+BAA+B,CAE5C;IAED;;OAEG;IACH,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGlC;IAED;;OAEG;IACH,uBAAuB,IAAI,WAAW,CAAC,MAAM,CAAC,CAE7C;IAED;;OAEG;IACH,UAAU,IAAI,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAErD;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAExD;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAE/D;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAE3D;IAED;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAE7D;CACF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,2BAA2B,CAIhE"}
+{"version":3,"file":"sim-cloudfront-distribution.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cloudfront-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEtF,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,kCAAkC,CAAC;AAE/E,MAAM,MAAM,2BAA2B,GAAG,KAAK,CAC7C,MAAM,EACN,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,WAAW,GAAG,UAAU,CAAC;AAEvE,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,2BAA2B,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,+BAA+B,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,yBAAyB;;IACpC,SAAgB,cAAc,EAAE,2BAA2B,CAAC;IAC5D,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,kBAAkB,EAChC,+BAA+B,GAAG,SAAS,CAAC;IAC9C,SAAgB,SAAS,EAAE,qBAAqB,EAAE,CAAM;IACxD,SAAgB,gBAAgB,EAAE,IAAI,CAAC;IAGvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAElE,YAAY,UAAU,GAAE,mCAAwC,EAc/D;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,+BAA+B,CAE5C;IAED;;OAEG;IACH,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGlC;IAED;;OAEG;IACH,uBAAuB,IAAI,WAAW,CAAC,MAAM,CAAC,CAE7C;IAED;;OAEG;IACH,UAAU,IAAI,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAErD;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAExD;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAE/D;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAE3D;IAED;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAE7D;CACF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,2BAA2B,CAIhE"}

package/dist/service/cloudfront/distribution/sim-cloudfront-distribution.js

@@ -1,5 +1,6 @@
 import { faker } from "@faker-js/faker";
 import { makeSimAwsAccountId, } from "../../aws/sim-aws-account.js";
+import { SimRealClock } from "../../../util/clock/sim-clock.js";
 /**
  * Simulated CloudFront Distribution.
  */
@@ -8,12 +9,13 @@ export class SimCloudFrontDistribution {
     accountId;
     distributionConfig;
     behaviors = [];
-    lastModifiedTime = new Date();
+    lastModifiedTime;
     #status;
     alternateDomainNames = new Set();
     origins = new Map();
     constructor(properties = {}) {
-        const { distributionId = makeDistributionId(), status = "Deployed", accountId = makeSimAwsAccountId(), distributionConfig, } = properties;
+        const { distributionId = makeDistributionId(), status = "Deployed", accountId = makeSimAwsAccountId(), distributionConfig, clock = new SimRealClock(), } = properties;
+        this.lastModifiedTime = clock.now();
         this.distributionId = distributionId;
         this.#status = status;
         this.accountId = accountId;

package/dist/service/cloudfront/distribution/sim-cloudfront-distribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-distribution.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cloudfront-distribution.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAiBtC;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACpB,cAAc,CAA8B;IAC5C,SAAS,CAAkB;IAC3B,kBAAkB,CACY;IAC9B,SAAS,GAA4B,EAAE,CAAC;IACxC,gBAAgB,GAAS,IAAI,IAAI,EAAE,CAAC;IAEpD,OAAO,CAAkC;IACxB,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IAElE,YAAY,UAAU,GAAwC,EAAE;QAC9D,MAAM,EACJ,cAAc,GAAG,kBAAkB,EAAE,EACrC,MAAM,GAAG,UAAU,EACnB,SAAS,GAAG,mBAAmB,EAAE,EACjC,kBAAkB,GACnB,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAA2B;QAChD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA+B;QACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAAkB,EAAE,MAA2B;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAA2B;QAChD,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAC7B,eAAe,CACe,CAAC;AACnC,CAAC"}
+{"version":3,"file":"sim-cloudfront-distribution.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cloudfront-distribution.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAiB,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAqB/E;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACpB,cAAc,CAA8B;IAC5C,SAAS,CAAkB;IAC3B,kBAAkB,CACY;IAC9B,SAAS,GAA4B,EAAE,CAAC;IACxC,gBAAgB,CAAO;IAEvC,OAAO,CAAkC;IACxB,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IAElE,YAAY,UAAU,GAAwC,EAAE;QAC9D,MAAM,EACJ,cAAc,GAAG,kBAAkB,EAAE,EACrC,MAAM,GAAG,UAAU,EACnB,SAAS,GAAG,mBAAmB,EAAE,EACjC,kBAAkB,EAClB,KAAK,GAAG,IAAI,YAAY,EAAE,GAC3B,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAA2B;QAChD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA+B;QACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAAkB,EAAE,MAA2B;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,mBAA2B;QAChD,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAC7B,eAAe,CACe,CAAC;AACnC,CAAC"}

package/dist/service/dynamodb/table/sim-dynamodb-table.js

@@ -18,7 +18,7 @@ export class SimDynamoDbTable {
         this.arn = arn;
         this.background = background;
         this.tableName = tableInput.tableName();
-        this.creationDateTime = new Date();
+        this.creationDateTime = background.now();
         this.#keySchema = tableInput.keySchema();
     }
     /**

package/dist/service/dynamodb/table/sim-dynamodb-table.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-dynamodb-table.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/sim-dynamodb-table.ts"],"names":[],"mappings":"AACA,OAAO,EACL,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAEL,eAAe,GAChB,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EAAE,wBAAwB,IAAI,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAU9G;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACX,gBAAgB,CAAO;IAEvB,SAAS,CAAoB;IAC7B,GAAG,CAAS;IAEX,UAAU,CAAsB;IACxC,UAAU,CAA0B;IAC7C,OAAO,GAAiC,UAAU,CAAC;IAElC,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/D,YAAY,UAA4C;QACtD,MAAM,EACJ,YAAY,EACZ,GAAG,GAAG,uBAAuB,EAAE,EAC/B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;QAEpE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,IAAwB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA0E;IAE1E,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,YAAY,EAAE,OAAO;QACrB,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-dynamodb-table.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/table/sim-dynamodb-table.ts"],"names":[],"mappings":"AACA,OAAO,EACL,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAEL,eAAe,GAChB,MAAM,wCAAwC,CAAC;AAKhD,OAAO,EAAE,wBAAwB,IAAI,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAU9G;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACX,gBAAgB,CAAO;IAEvB,SAAS,CAAoB;IAC7B,GAAG,CAAS;IAEX,UAAU,CAAsB;IACxC,UAAU,CAA0B;IAC7C,OAAO,GAAiC,UAAU,CAAC;IAElC,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/D,YAAY,UAA4C;QACtD,MAAM,EACJ,YAAY,EACZ,GAAG,GAAG,uBAAuB,EAAE,EAC/B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;QAEpE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,IAAwB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA0E;IAE1E,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,UAAU;QACnB,YAAY,EAAE,OAAO;QACrB,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -0,0 +1,60 @@
+interface SimIamAllowSidesProperties {
+    readonly identity: boolean;
+    readonly resource: boolean;
+}
+/**
+ * Which sides of a policy evaluation produced a matching Allow.
+ *
+ * Identity-based policies are the caller's side of a request; resource-based
+ * policies are the resource's side. AWS combines the two differently depending
+ * on whether the caller and the resource belong to the same Account, so the
+ * sides are kept apart rather than counted together.
+ */
+export declare class SimIamAllowSides {
+    private readonly identityAllowed;
+    private readonly resourceAllowed;
+    constructor(properties: SimIamAllowSidesProperties);
+    /**
+     * Whether an identity-based policy allowed the request.
+     */
+    get identity(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request.
+     */
+    get resource(): boolean;
+}
+/**
+ * Which sides of an authorization must allow a request for it to be allowed.
+ */
+export interface SimIamAllowRequirement {
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * The same-Account rule: an Allow from either side is enough.
+ *
+ * Within one Account an identity policy can allow a request with no resource
+ * policy involved, and a resource policy can allow it with no identity policy
+ * involved.
+ */
+export declare class SimIamEitherSideAllowRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether either side of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * The cross-Account rule: both sides must allow.
+ *
+ * AWS decides a cross-Account request in both Accounts. The caller's Account
+ * allows the action through an identity policy, and the resource's Account
+ * allows it through a resource policy. Neither side can grant access to the
+ * other Account's principals or resources on its own.
+ */
+export declare class SimIamBothSidesAllowRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether both sides of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+export {};
+//# sourceMappingURL=sim-iam-allow-requirement.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAE1C,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,gCAAiC,YAAW,sBAAsB;IAC7E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,sBAAsB;IAC5E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -0,0 +1,60 @@
+/**
+ * Which sides of a policy evaluation produced a matching Allow.
+ *
+ * Identity-based policies are the caller's side of a request; resource-based
+ * policies are the resource's side. AWS combines the two differently depending
+ * on whether the caller and the resource belong to the same Account, so the
+ * sides are kept apart rather than counted together.
+ */
+export class SimIamAllowSides {
+    identityAllowed;
+    resourceAllowed;
+    constructor(properties) {
+        this.identityAllowed = properties.identity;
+        this.resourceAllowed = properties.resource;
+    }
+    /**
+     * Whether an identity-based policy allowed the request.
+     */
+    get identity() {
+        return this.identityAllowed;
+    }
+    /**
+     * Whether a resource-based policy allowed the request.
+     */
+    get resource() {
+        return this.resourceAllowed;
+    }
+}
+/**
+ * The same-Account rule: an Allow from either side is enough.
+ *
+ * Within one Account an identity policy can allow a request with no resource
+ * policy involved, and a resource policy can allow it with no identity policy
+ * involved.
+ */
+export class SimIamEitherSideAllowRequirement {
+    /**
+     * Whether either side of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows) {
+        return allows.identity || allows.resource;
+    }
+}
+/**
+ * The cross-Account rule: both sides must allow.
+ *
+ * AWS decides a cross-Account request in both Accounts. The caller's Account
+ * allows the action through an identity policy, and the resource's Account
+ * allows it through a resource policy. Neither side can grant access to the
+ * other Account's principals or resources on its own.
+ */
+export class SimIamBothSidesAllowRequirement {
+    /**
+     * Whether both sides of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows) {
+        return allows.identity && allows.resource;
+    }
+}
+//# sourceMappingURL=sim-iam-allow-requirement.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,eAAe,CAAU;IACzB,eAAe,CAAU;IAE1C,YAAY,UAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -0,0 +1,46 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+/**
+ * The matching Allow statements found for one authorization, kept per side.
+ *
+ * Which side an Allow came from decides whether it counts: a cross-Account
+ * request needs one from each. Trust policies are resource policies on an IAM
+ * Role, so they count as the resource side, and are additionally kept apart for
+ * the AssumeRole rule that an identity policy cannot substitute for a Role's
+ * trust.
+ */
+export declare class SimIamAllowStatements {
+    private readonly identityStatements;
+    private readonly resourceStatements;
+    private readonly trustStatements;
+    /**
+     * Record a matching Allow against the policy side it came from.
+     */
+    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement): void;
+    /**
+     * Every matching Allow statement, identity side first.
+     */
+    get all(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identity(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resource(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trust(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides(): SimIamAllowSides;
+    /**
+     * The list an Allow from this policy source belongs in.
+     */
+    private sideStatements;
+}
+//# sourceMappingURL=sim-iam-allow-statements.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-statements.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,6BAA6B,GACvC,IAAI,CAMN;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,6BAA6B,EAAE,CAElD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,6BAA6B,EAAE,CAEpD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,gBAAgB,CAK5B;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -0,0 +1,67 @@
+import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+/**
+ * The matching Allow statements found for one authorization, kept per side.
+ *
+ * Which side an Allow came from decides whether it counts: a cross-Account
+ * request needs one from each. Trust policies are resource policies on an IAM
+ * Role, so they count as the resource side, and are additionally kept apart for
+ * the AssumeRole rule that an identity policy cannot substitute for a Role's
+ * trust.
+ */
+export class SimIamAllowStatements {
+    identityStatements = [];
+    resourceStatements = [];
+    trustStatements = [];
+    /**
+     * Record a matching Allow against the policy side it came from.
+     */
+    record(policy, statement) {
+        if (policy.sourceType === "trust") {
+            this.trustStatements.push(statement);
+        }
+        this.sideStatements(policy).push(statement);
+    }
+    /**
+     * Every matching Allow statement, identity side first.
+     */
+    get all() {
+        return [...this.identityStatements, ...this.resourceStatements];
+    }
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identity() {
+        return this.identityStatements;
+    }
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resource() {
+        return this.resourceStatements;
+    }
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trust() {
+        return this.trustStatements;
+    }
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides() {
+        return new SimIamAllowSides({
+            identity: this.identityStatements.length > 0,
+            resource: this.resourceStatements.length > 0,
+        });
+    }
+    /**
+     * The list an Allow from this policy source belongs in.
+     */
+    sideStatements(policy) {
+        if (policy.sourceType === "resource" || policy.sourceType === "trust") {
+            return this.resourceStatements;
+        }
+        return this.identityStatements;
+    }
+}
+//# sourceMappingURL=sim-iam-allow-statements.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-statements.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACf,kBAAkB,GAAoC,EAAE,CAAC;IACzD,kBAAkB,GAAoC,EAAE,CAAC;IACzD,eAAe,GAAoC,EAAE,CAAC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAAwC;QAExC,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.d.ts

@@ -0,0 +1,37 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+interface SimIamCallerAccountResolverProperties {
+    /**
+     * The Account evaluating the request, which owns the target resource.
+     */
+    readonly accountId: SimAwsAccountId;
+    /**
+     * Resolves the IAM state of other Accounts in the same simulation.
+     *
+     * A standalone SimIam has no wider simulation to look in, so it has no
+     * resolver and no other Account's identity policies to find.
+     */
+    readonly iamResolver?: SimIamAccountResolver | undefined;
+}
+/**
+ * Works out which Account owns the caller of an authorization request.
+ *
+ * The answer decides how the request is evaluated, so it is made once, here,
+ * from the resolved caller. A caller with no Account in its ARN — a service
+ * principal or an anonymous request — has no identity side and is treated as
+ * belonging to the evaluating Account, which leaves it to be allowed by a
+ * resource policy alone.
+ */
+export declare class SimIamCallerAccountResolver {
+    private readonly accountId;
+    private readonly iamResolver?;
+    constructor(properties: SimIamCallerAccountResolverProperties);
+    /**
+     * Resolve the caller's Account relative to the Account owning the resource.
+     */
+    resolve(caller: SimAwsResolvedCaller): SimIamCallerAccount;
+}
+export {};
+//# sourceMappingURL=sim-iam-caller-account-resolver.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAIvE,UAAU,qCAAqC;IAC7C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAoC;IAEjE,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAazD;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.js

@@ -0,0 +1,33 @@
+import { SimIamCrossAccountCaller } from "./sim-iam-cross-account-caller.js";
+import { SimIamSameAccountCaller } from "./sim-iam-same-account-caller.js";
+/**
+ * Works out which Account owns the caller of an authorization request.
+ *
+ * The answer decides how the request is evaluated, so it is made once, here,
+ * from the resolved caller. A caller with no Account in its ARN — a service
+ * principal or an anonymous request — has no identity side and is treated as
+ * belonging to the evaluating Account, which leaves it to be allowed by a
+ * resource policy alone.
+ */
+export class SimIamCallerAccountResolver {
+    accountId;
+    iamResolver;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.iamResolver = properties.iamResolver;
+    }
+    /**
+     * Resolve the caller's Account relative to the Account owning the resource.
+     */
+    resolve(caller) {
+        const callerAccountId = caller.accountId;
+        if (callerAccountId === undefined || callerAccountId === this.accountId) {
+            return new SimIamSameAccountCaller();
+        }
+        return new SimIamCrossAccountCaller({
+            principal: caller.identityPolicyPrincipal,
+            callerAccountIam: this.iamResolver?.findIamForAccount(callerAccountId),
+        });
+    }
+}
+//# sourceMappingURL=sim-iam-caller-account-resolver.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account-resolver.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAiB3E;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,SAAS,CAAkB;IAC3B,WAAW,CAAqC;IAEjE,YAAY,UAAiD;QAC3D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAA4B;QAClC,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;QAEzC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACxE,OAAO,IAAI,uBAAuB,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,wBAAwB,CAAC;YAClC,SAAS,EAAE,MAAM,CAAC,uBAAuB;YACzC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CACnD,eAAkC,CACnC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.d.ts

@@ -0,0 +1,21 @@
+import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+/**
+ * What the Account owning the caller contributes to an authorization request.
+ *
+ * The Account evaluating a request owns the resource. Whether the caller
+ * belongs to that same Account decides two things at once: which identity
+ * policies are in scope, and how an Allow from each side is combined. Both
+ * answers come from here so they cannot disagree.
+ */
+export interface SimIamCallerAccount {
+    /**
+     * Identity policies contributed by the caller's own Account.
+     */
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * How identity and resource Allows combine for this caller.
+     */
+    readonly allowRequirement: SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-caller-account.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;CACnD"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-caller-account.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account.ts"],"names":[],"mappings":""}

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamAccountIdentityPolicies } from "../identity/sim-iam-account-identity-policies.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+interface SimIamCrossAccountCallerProperties {
+    /**
+     * The identity whose policies apply to the request, in the caller's Account.
+     */
+    readonly principal: SimAwsPrincipal;
+    /**
+     * Simulated IAM of the Account owning the caller, when the simulation has it.
+     */
+    readonly callerAccountIam?: SimIamAccountIdentityPolicies | undefined;
+}
+/**
+ * A caller belonging to a different Account from the resource.
+ *
+ * AWS decides such a request in both Accounts, so the identity policies of the
+ * caller's own Account are pulled in and both sides are then required to allow.
+ * A resource policy naming another Account's principal delegates to that
+ * Account rather than granting on its own behalf.
+ *
+ * An Account the simulation knows nothing about contributes no identity
+ * policies, which denies the request. That matches AWS for the case it
+ * represents: a principal ARN that was never given any permissions.
+ */
+export declare class SimIamCrossAccountCaller implements SimIamCallerAccount {
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    readonly allowRequirement: SimIamAllowRequirement;
+    constructor(properties: SimIamCrossAccountCallerProperties);
+}
+export {};
+//# sourceMappingURL=sim-iam-cross-account-caller.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-cross-account-caller.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-cross-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,UAAU,kCAAkC;IAC1C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CACvE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CACT;IAExC,YAAY,UAAU,EAAE,kCAAkC,EAKzD;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.js

@@ -0,0 +1,22 @@
+import { SimIamBothSidesAllowRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * A caller belonging to a different Account from the resource.
+ *
+ * AWS decides such a request in both Accounts, so the identity policies of the
+ * caller's own Account are pulled in and both sides are then required to allow.
+ * A resource policy naming another Account's principal delegates to that
+ * Account rather than granting on its own behalf.
+ *
+ * An Account the simulation knows nothing about contributes no identity
+ * policies, which denies the request. That matches AWS for the case it
+ * represents: a principal ARN that was never given any permissions.
+ */
+export class SimIamCrossAccountCaller {
+    identityPolicies;
+    allowRequirement = new SimIamBothSidesAllowRequirement();
+    constructor(properties) {
+        this.identityPolicies =
+            properties.callerAccountIam?.identityPolicySourcesFor(properties.principal) ?? [];
+    }
+}
+//# sourceMappingURL=sim-iam-cross-account-caller.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-cross-account-caller.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-cross-account-caller.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAiB/C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAC1B,gBAAgB,CAAqC;IAErD,gBAAgB,GACvB,IAAI,+BAA+B,EAAE,CAAC;IAExC,YAAY,UAA8C;QACxD,IAAI,CAAC,gBAAgB;YACnB,UAAU,CAAC,gBAAgB,EAAE,wBAAwB,CACnD,UAAU,CAAC,SAAS,CACrB,IAAI,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.d.ts

@@ -0,0 +1,18 @@
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+/**
+ * A caller decided entirely within the Account that owns the resource.
+ *
+ * This covers a principal belonging to that Account, and callers with no
+ * identity side at all: a service principal or an anonymous request, which AWS
+ * allows on a resource policy alone.
+ *
+ * The Account's own IAM state already holds every identity policy in scope, so
+ * nothing is contributed here.
+ */
+export declare class SimIamSameAccountCaller implements SimIamCallerAccount {
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    readonly allowRequirement: SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-same-account-caller.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-same-account-caller.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-same-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAM;IAEnE,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CACR;CAC1C"}

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.js

@@ -0,0 +1,16 @@
+import { SimIamEitherSideAllowRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * A caller decided entirely within the Account that owns the resource.
+ *
+ * This covers a principal belonging to that Account, and callers with no
+ * identity side at all: a service principal or an anonymous request, which AWS
+ * allows on a resource policy alone.
+ *
+ * The Account's own IAM state already holds every identity policy in scope, so
+ * nothing is contributed here.
+ */
+export class SimIamSameAccountCaller {
+    identityPolicies = [];
+    allowRequirement = new SimIamEitherSideAllowRequirement();
+}
+//# sourceMappingURL=sim-iam-same-account-caller.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-same-account-caller.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-same-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gCAAgC,GACjC,MAAM,uCAAuC,CAAC;AAI/C;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACzB,gBAAgB,GAAuC,EAAE,CAAC;IAE1D,gBAAgB,GACvB,IAAI,gCAAgC,EAAE,CAAC;CAC1C"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,7 +1,7 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
-interface SimIamAuthZCallerContext {
+export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
     readonly rootPolicySources: readonly SimIamAuthZPolicySource[];
 }
@@ -26,5 +26,4 @@ export declare class SimIamAuthZCallerContextBuilder {
      */
     private rootPolicySources;
 }
-export {};
 //# sourceMappingURL=sim-iam-auth-z-caller-context-builder.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,EAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD,YACE,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAI7D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,wBAAwB,CAUhE;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA2B1B"}
+{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,EAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD,YACE,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAI7D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,wBAAwB,CAUhE;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA2B1B"}