@kensio/yulin 0.36.0 → 0.37.0

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-service-cache.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAEnG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mDAAmD,CAAC;AAK3D,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAE5E,YAAY,UAAU,EAAE,mCAAmC,EAQ1D;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAenE;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAuBrD;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,4BAA4B,GAAG,UAAU,CAY7D;CACF"}
+{"version":3,"file":"sim-aws-account-service-cache.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAEnG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mDAAmD,CAAC;AAK3D,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAE5E,YAAY,UAAU,EAAE,mCAAmC,EAQ1D;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAenE;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CA0BrD;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,4BAA4B,GAAG,UAAU,CAY7D;CACF"}

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -73,6 +73,9 @@ export class SimAwsAccountServiceCache {
             const iam = new SimIam({
                 accountRegionScope: scope.accountRegionScope,
                 background: this.background,
+                // A cross-Account request is decided in both Accounts, so this IAM
+                // needs to be able to reach the IAM of the caller's own Account.
+                iamResolver: this.iamRegistry,
                 // Access keys are indexed simulation-wide as they are issued, so a
                 // signed request naming only a key id can be traced to this Account.
                 credentialRegistry: new SimIamCredentialRegistry({

package/dist/service/aws/factory/sim-aws-account-service-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-service-cache.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AAC5G,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,WAAW,CAAiB;IAC5B,kBAAkB,CAAwB;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAA0B;IAC3C,eAAe,CAAqB;IAErD;;;;;;OAMG;IACc,QAAQ,GAAG,IAAI,IAAI,EAAuC,CAAC;IAE5E,YAAY,UAA+C;QACzD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAmC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACxE,GAAG,EAAE,CACH,IAAI,aAAa,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YAC/D,GAAG;YACH,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACjE,GAAG,EAAE;YACH,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC;gBACrB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,mEAAmE;gBACnE,qEAAqE;gBACrE,kBAAkB,EAAE,IAAI,wBAAwB,CAAC;oBAC/C,KAAK,EAAE,IAAI,CAAC,UAAU;oBACtB,cAAc,EAAE,IAAI,2BAA2B,CAC7C,IAAI,CAAC,iBAAiB,EACtB,KAAK,CAAC,kBAAkB,CAAC,SAAS,CACnC;iBACF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAEnE,OAAO,GAAG,CAAC;QACb,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAmC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACrE,GAAG,EAAE,CACH,IAAI,UAAU,CAAC;YACb,GAAG;YACH,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CACL,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-aws-account-service-cache.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AAC5G,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,WAAW,CAAiB;IAC5B,kBAAkB,CAAwB;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAA0B;IAC3C,eAAe,CAAqB;IAErD;;;;;;OAMG;IACc,QAAQ,GAAG,IAAI,IAAI,EAAuC,CAAC;IAE5E,YAAY,UAA+C;QACzD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAmC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACxE,GAAG,EAAE,CACH,IAAI,aAAa,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YAC/D,GAAG;YACH,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACjE,GAAG,EAAE;YACH,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC;gBACrB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,mEAAmE;gBACnE,iEAAiE;gBACjE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,mEAAmE;gBACnE,qEAAqE;gBACrE,kBAAkB,EAAE,IAAI,wBAAwB,CAAC;oBAC/C,KAAK,EAAE,IAAI,CAAC,UAAU;oBACtB,cAAc,EAAE,IAAI,2BAA2B,CAC7C,IAAI,CAAC,iBAAiB,EACtB,KAAK,CAAC,kBAAkB,CAAC,SAAS,CACnC;iBACF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAEnE,OAAO,GAAG,CAAC;QACb,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAmC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACrE,GAAG,EAAE,CACH,IAAI,UAAU,CAAC;YACb,GAAG;YACH,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CACL,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -0,0 +1,60 @@
+interface SimIamAllowSidesProperties {
+    readonly identity: boolean;
+    readonly resource: boolean;
+}
+/**
+ * Which sides of a policy evaluation produced a matching Allow.
+ *
+ * Identity-based policies are the caller's side of a request; resource-based
+ * policies are the resource's side. AWS combines the two differently depending
+ * on whether the caller and the resource belong to the same Account, so the
+ * sides are kept apart rather than counted together.
+ */
+export declare class SimIamAllowSides {
+    private readonly identityAllowed;
+    private readonly resourceAllowed;
+    constructor(properties: SimIamAllowSidesProperties);
+    /**
+     * Whether an identity-based policy allowed the request.
+     */
+    get identity(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request.
+     */
+    get resource(): boolean;
+}
+/**
+ * Which sides of an authorization must allow a request for it to be allowed.
+ */
+export interface SimIamAllowRequirement {
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * The same-Account rule: an Allow from either side is enough.
+ *
+ * Within one Account an identity policy can allow a request with no resource
+ * policy involved, and a resource policy can allow it with no identity policy
+ * involved.
+ */
+export declare class SimIamEitherSideAllowRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether either side of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * The cross-Account rule: both sides must allow.
+ *
+ * AWS decides a cross-Account request in both Accounts. The caller's Account
+ * allows the action through an identity policy, and the resource's Account
+ * allows it through a resource policy. Neither side can grant access to the
+ * other Account's principals or resources on its own.
+ */
+export declare class SimIamBothSidesAllowRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether both sides of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+export {};
+//# sourceMappingURL=sim-iam-allow-requirement.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAE1C,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,gCAAiC,YAAW,sBAAsB;IAC7E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,sBAAsB;IAC5E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -0,0 +1,60 @@
+/**
+ * Which sides of a policy evaluation produced a matching Allow.
+ *
+ * Identity-based policies are the caller's side of a request; resource-based
+ * policies are the resource's side. AWS combines the two differently depending
+ * on whether the caller and the resource belong to the same Account, so the
+ * sides are kept apart rather than counted together.
+ */
+export class SimIamAllowSides {
+    identityAllowed;
+    resourceAllowed;
+    constructor(properties) {
+        this.identityAllowed = properties.identity;
+        this.resourceAllowed = properties.resource;
+    }
+    /**
+     * Whether an identity-based policy allowed the request.
+     */
+    get identity() {
+        return this.identityAllowed;
+    }
+    /**
+     * Whether a resource-based policy allowed the request.
+     */
+    get resource() {
+        return this.resourceAllowed;
+    }
+}
+/**
+ * The same-Account rule: an Allow from either side is enough.
+ *
+ * Within one Account an identity policy can allow a request with no resource
+ * policy involved, and a resource policy can allow it with no identity policy
+ * involved.
+ */
+export class SimIamEitherSideAllowRequirement {
+    /**
+     * Whether either side of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows) {
+        return allows.identity || allows.resource;
+    }
+}
+/**
+ * The cross-Account rule: both sides must allow.
+ *
+ * AWS decides a cross-Account request in both Accounts. The caller's Account
+ * allows the action through an identity policy, and the resource's Account
+ * allows it through a resource policy. Neither side can grant access to the
+ * other Account's principals or resources on its own.
+ */
+export class SimIamBothSidesAllowRequirement {
+    /**
+     * Whether both sides of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows) {
+        return allows.identity && allows.resource;
+    }
+}
+//# sourceMappingURL=sim-iam-allow-requirement.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,eAAe,CAAU;IACzB,eAAe,CAAU;IAE1C,YAAY,UAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -0,0 +1,46 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+/**
+ * The matching Allow statements found for one authorization, kept per side.
+ *
+ * Which side an Allow came from decides whether it counts: a cross-Account
+ * request needs one from each. Trust policies are resource policies on an IAM
+ * Role, so they count as the resource side, and are additionally kept apart for
+ * the AssumeRole rule that an identity policy cannot substitute for a Role's
+ * trust.
+ */
+export declare class SimIamAllowStatements {
+    private readonly identityStatements;
+    private readonly resourceStatements;
+    private readonly trustStatements;
+    /**
+     * Record a matching Allow against the policy side it came from.
+     */
+    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement): void;
+    /**
+     * Every matching Allow statement, identity side first.
+     */
+    get all(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identity(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resource(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trust(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides(): SimIamAllowSides;
+    /**
+     * The list an Allow from this policy source belongs in.
+     */
+    private sideStatements;
+}
+//# sourceMappingURL=sim-iam-allow-statements.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-statements.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,6BAA6B,GACvC,IAAI,CAMN;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,6BAA6B,EAAE,CAElD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,6BAA6B,EAAE,CAEpD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,gBAAgB,CAK5B;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -0,0 +1,67 @@
+import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+/**
+ * The matching Allow statements found for one authorization, kept per side.
+ *
+ * Which side an Allow came from decides whether it counts: a cross-Account
+ * request needs one from each. Trust policies are resource policies on an IAM
+ * Role, so they count as the resource side, and are additionally kept apart for
+ * the AssumeRole rule that an identity policy cannot substitute for a Role's
+ * trust.
+ */
+export class SimIamAllowStatements {
+    identityStatements = [];
+    resourceStatements = [];
+    trustStatements = [];
+    /**
+     * Record a matching Allow against the policy side it came from.
+     */
+    record(policy, statement) {
+        if (policy.sourceType === "trust") {
+            this.trustStatements.push(statement);
+        }
+        this.sideStatements(policy).push(statement);
+    }
+    /**
+     * Every matching Allow statement, identity side first.
+     */
+    get all() {
+        return [...this.identityStatements, ...this.resourceStatements];
+    }
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identity() {
+        return this.identityStatements;
+    }
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resource() {
+        return this.resourceStatements;
+    }
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trust() {
+        return this.trustStatements;
+    }
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides() {
+        return new SimIamAllowSides({
+            identity: this.identityStatements.length > 0,
+            resource: this.resourceStatements.length > 0,
+        });
+    }
+    /**
+     * The list an Allow from this policy source belongs in.
+     */
+    sideStatements(policy) {
+        if (policy.sourceType === "resource" || policy.sourceType === "trust") {
+            return this.resourceStatements;
+        }
+        return this.identityStatements;
+    }
+}
+//# sourceMappingURL=sim-iam-allow-statements.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-statements.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACf,kBAAkB,GAAoC,EAAE,CAAC;IACzD,kBAAkB,GAAoC,EAAE,CAAC;IACzD,eAAe,GAAoC,EAAE,CAAC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAAwC;QAExC,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.d.ts

@@ -0,0 +1,37 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+interface SimIamCallerAccountResolverProperties {
+    /**
+     * The Account evaluating the request, which owns the target resource.
+     */
+    readonly accountId: SimAwsAccountId;
+    /**
+     * Resolves the IAM state of other Accounts in the same simulation.
+     *
+     * A standalone SimIam has no wider simulation to look in, so it has no
+     * resolver and no other Account's identity policies to find.
+     */
+    readonly iamResolver?: SimIamAccountResolver | undefined;
+}
+/**
+ * Works out which Account owns the caller of an authorization request.
+ *
+ * The answer decides how the request is evaluated, so it is made once, here,
+ * from the resolved caller. A caller with no Account in its ARN — a service
+ * principal or an anonymous request — has no identity side and is treated as
+ * belonging to the evaluating Account, which leaves it to be allowed by a
+ * resource policy alone.
+ */
+export declare class SimIamCallerAccountResolver {
+    private readonly accountId;
+    private readonly iamResolver?;
+    constructor(properties: SimIamCallerAccountResolverProperties);
+    /**
+     * Resolve the caller's Account relative to the Account owning the resource.
+     */
+    resolve(caller: SimAwsResolvedCaller): SimIamCallerAccount;
+}
+export {};
+//# sourceMappingURL=sim-iam-caller-account-resolver.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAIvE,UAAU,qCAAqC;IAC7C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAoC;IAEjE,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAazD;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.js

@@ -0,0 +1,33 @@
+import { SimIamCrossAccountCaller } from "./sim-iam-cross-account-caller.js";
+import { SimIamSameAccountCaller } from "./sim-iam-same-account-caller.js";
+/**
+ * Works out which Account owns the caller of an authorization request.
+ *
+ * The answer decides how the request is evaluated, so it is made once, here,
+ * from the resolved caller. A caller with no Account in its ARN — a service
+ * principal or an anonymous request — has no identity side and is treated as
+ * belonging to the evaluating Account, which leaves it to be allowed by a
+ * resource policy alone.
+ */
+export class SimIamCallerAccountResolver {
+    accountId;
+    iamResolver;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.iamResolver = properties.iamResolver;
+    }
+    /**
+     * Resolve the caller's Account relative to the Account owning the resource.
+     */
+    resolve(caller) {
+        const callerAccountId = caller.accountId;
+        if (callerAccountId === undefined || callerAccountId === this.accountId) {
+            return new SimIamSameAccountCaller();
+        }
+        return new SimIamCrossAccountCaller({
+            principal: caller.identityPolicyPrincipal,
+            callerAccountIam: this.iamResolver?.findIamForAccount(callerAccountId),
+        });
+    }
+}
+//# sourceMappingURL=sim-iam-caller-account-resolver.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account-resolver.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAiB3E;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,SAAS,CAAkB;IAC3B,WAAW,CAAqC;IAEjE,YAAY,UAAiD;QAC3D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAA4B;QAClC,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;QAEzC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACxE,OAAO,IAAI,uBAAuB,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,wBAAwB,CAAC;YAClC,SAAS,EAAE,MAAM,CAAC,uBAAuB;YACzC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CACnD,eAAkC,CACnC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.d.ts

@@ -0,0 +1,21 @@
+import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+/**
+ * What the Account owning the caller contributes to an authorization request.
+ *
+ * The Account evaluating a request owns the resource. Whether the caller
+ * belongs to that same Account decides two things at once: which identity
+ * policies are in scope, and how an Allow from each side is combined. Both
+ * answers come from here so they cannot disagree.
+ */
+export interface SimIamCallerAccount {
+    /**
+     * Identity policies contributed by the caller's own Account.
+     */
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * How identity and resource Allows combine for this caller.
+     */
+    readonly allowRequirement: SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-caller-account.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;CACnD"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-caller-account.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account.ts"],"names":[],"mappings":""}

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamAccountIdentityPolicies } from "../identity/sim-iam-account-identity-policies.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+interface SimIamCrossAccountCallerProperties {
+    /**
+     * The identity whose policies apply to the request, in the caller's Account.
+     */
+    readonly principal: SimAwsPrincipal;
+    /**
+     * Simulated IAM of the Account owning the caller, when the simulation has it.
+     */
+    readonly callerAccountIam?: SimIamAccountIdentityPolicies | undefined;
+}
+/**
+ * A caller belonging to a different Account from the resource.
+ *
+ * AWS decides such a request in both Accounts, so the identity policies of the
+ * caller's own Account are pulled in and both sides are then required to allow.
+ * A resource policy naming another Account's principal delegates to that
+ * Account rather than granting on its own behalf.
+ *
+ * An Account the simulation knows nothing about contributes no identity
+ * policies, which denies the request. That matches AWS for the case it
+ * represents: a principal ARN that was never given any permissions.
+ */
+export declare class SimIamCrossAccountCaller implements SimIamCallerAccount {
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    readonly allowRequirement: SimIamAllowRequirement;
+    constructor(properties: SimIamCrossAccountCallerProperties);
+}
+export {};
+//# sourceMappingURL=sim-iam-cross-account-caller.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-cross-account-caller.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-cross-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,UAAU,kCAAkC;IAC1C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CACvE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAClE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAE9D,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CACT;IAExC,YAAY,UAAU,EAAE,kCAAkC,EAKzD;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.js

@@ -0,0 +1,22 @@
+import { SimIamBothSidesAllowRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * A caller belonging to a different Account from the resource.
+ *
+ * AWS decides such a request in both Accounts, so the identity policies of the
+ * caller's own Account are pulled in and both sides are then required to allow.
+ * A resource policy naming another Account's principal delegates to that
+ * Account rather than granting on its own behalf.
+ *
+ * An Account the simulation knows nothing about contributes no identity
+ * policies, which denies the request. That matches AWS for the case it
+ * represents: a principal ARN that was never given any permissions.
+ */
+export class SimIamCrossAccountCaller {
+    identityPolicies;
+    allowRequirement = new SimIamBothSidesAllowRequirement();
+    constructor(properties) {
+        this.identityPolicies =
+            properties.callerAccountIam?.identityPolicySourcesFor(properties.principal) ?? [];
+    }
+}
+//# sourceMappingURL=sim-iam-cross-account-caller.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-cross-account-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-cross-account-caller.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-cross-account-caller.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAiB/C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAC1B,gBAAgB,CAAqC;IAErD,gBAAgB,GACvB,IAAI,+BAA+B,EAAE,CAAC;IAExC,YAAY,UAA8C;QACxD,IAAI,CAAC,gBAAgB;YACnB,UAAU,CAAC,gBAAgB,EAAE,wBAAwB,CACnD,UAAU,CAAC,SAAS,CACrB,IAAI,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.d.ts

@@ -0,0 +1,18 @@
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+/**
+ * A caller decided entirely within the Account that owns the resource.
+ *
+ * This covers a principal belonging to that Account, and callers with no
+ * identity side at all: a service principal or an anonymous request, which AWS
+ * allows on a resource policy alone.
+ *
+ * The Account's own IAM state already holds every identity policy in scope, so
+ * nothing is contributed here.
+ */
+export declare class SimIamSameAccountCaller implements SimIamCallerAccount {
+    readonly identityPolicies: readonly SimIamAuthZPolicySource[];
+    readonly allowRequirement: SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-same-account-caller.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-same-account-caller.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-same-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAM;IAEnE,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CACR;CAC1C"}

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.js

@@ -0,0 +1,16 @@
+import { SimIamEitherSideAllowRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * A caller decided entirely within the Account that owns the resource.
+ *
+ * This covers a principal belonging to that Account, and callers with no
+ * identity side at all: a service principal or an anonymous request, which AWS
+ * allows on a resource policy alone.
+ *
+ * The Account's own IAM state already holds every identity policy in scope, so
+ * nothing is contributed here.
+ */
+export class SimIamSameAccountCaller {
+    identityPolicies = [];
+    allowRequirement = new SimIamEitherSideAllowRequirement();
+}
+//# sourceMappingURL=sim-iam-same-account-caller.js.map

package/dist/service/iam/authorize/caller-account/sim-iam-same-account-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-same-account-caller.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-same-account-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gCAAgC,GACjC,MAAM,uCAAuC,CAAC;AAI/C;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACzB,gBAAgB,GAAuC,EAAE,CAAC;IAE1D,gBAAgB,GACvB,IAAI,gCAAgC,EAAE,CAAC;CAC1C"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,7 +1,7 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
-interface SimIamAuthZCallerContext {
+export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
     readonly rootPolicySources: readonly SimIamAuthZPolicySource[];
 }
@@ -26,5 +26,4 @@ export declare class SimIamAuthZCallerContextBuilder {
      */
     private rootPolicySources;
 }
-export {};
 //# sourceMappingURL=sim-iam-auth-z-caller-context-builder.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,EAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD,YACE,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAI7D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,wBAAwB,CAUhE;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA2B1B"}
+{"version":3,"file":"sim-iam-auth-z-caller-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,EAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAChE;AAED;;;;;;GAMG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD,YACE,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAI7D;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,wBAAwB,CAUhE;IAED;;OAEG;IACH,OAAO,CAAC,iBAAiB;CA2B1B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -1,8 +1,10 @@
 import type { SimArn } from "../../../aws/arn.js";
 import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
 import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
-import type { SimIamAuthZContext, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
+import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
 export interface SimIamResourcePolicyInput {
@@ -43,6 +45,21 @@ export interface SimIamAuthorizationInput {
      */
     readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
 }
+interface SimIamAuthZContextBuilderProperties {
+    /**
+     * The Account whose IAM is evaluating the request.
+     */
+    readonly accountId: SimAwsAccountId;
+    readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
+    readonly roles: ReadonlyMap<SimIamRoleName, SimIamRole>;
+    readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * Resolves other Accounts' IAM in the same simulation, for the identity side
+     * of a cross-Account request.
+     */
+    readonly iamResolver?: SimIamAccountResolver | undefined;
+}
 /**
  * Builds the authorization context consumed by SimIamAuthorizer.
  *
@@ -55,6 +72,11 @@ export interface SimIamAuthorizationInput {
  * finding a principal role, reading inline policies from the role, resolving
  * attached managed policy ARNs, and parsing stored policy documents.
  *
+ * Whose identity policies are in scope depends on which Account owns the
+ * caller, which SimIamCallerAccountResolver decides. A caller from another
+ * Account brings that Account's identity policies with it, along with the rule
+ * that both sides must then allow the request.
+ *
  * Resource policies are supplied by the service that owns the target resource.
  * They are passed through the authorization input rather than loaded from the
  * IAM role or managed-policy stores.
@@ -67,11 +89,25 @@ export interface SimIamAuthorizationInput {
 export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
     private readonly identityPolicyCoordinator;
-    constructor(policies: ReadonlyMap<SimArn, SimIamPolicy>, roles: ReadonlyMap<SimIamRoleName, SimIamRole>, users: ReadonlyMap<SimIamUsername, SimIamUser>, defaultCallerPrincipal: SimAwsPrincipal, credentialIdentityResolver: SimAwsCredentialIdentityResolver);
+    private readonly callerAccountResolver;
+    constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
      * Build the context consumed by SimIamAuthorizer.
      */
     build(input: SimIamAuthorizationInput): SimIamAuthZContext;
+    /**
+     * Identity policy sources this Account applies to one of its own principals.
+     *
+     * This is the identity side of a request within one Account, and is also what
+     * another Account's IAM asks for when it is deciding a cross-Account request
+     * against a principal belonging to this one.
+     */
+    identityPolicySourcesFor(principal: SimAwsPrincipal): readonly SimIamAuthZPolicySource[];
+    /**
+     * Combine stored identity policies with any implied by the caller itself,
+     * such as the unrestricted access held by this Account's root principal.
+     */
+    private ownIdentityPolicySources;
     /**
      * Combine service-provided condition values with global values that IAM can
      * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
@@ -91,4 +127,5 @@ export declare class SimIamAuthZContextBuilder {
      */
     private resourcePolicySources;
 }
+export {};
 //# sourceMappingURL=sim-iam-auth-z-context-builder.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAElB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;CAC9E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IAEjF,YACE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3C,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,EAC9C,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,EAC9C,sBAAsB,EAAE,eAAe,EACvC,0BAA0B,EAAE,gCAAgC,EAW7D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAgBzD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;CAC9E;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IAEpE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAkBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}