@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/aws/sim-aws.js

@@ -4,7 +4,7 @@ import { SimAwsServiceFactory } from "./factory/sim-aws-service-factory.js";
 import { SimAwsScopeRegistry } from "./scope/sim-aws-scope-registry.js";
 import { simAwsRunAsContext } from "./caller/sim-aws-run-as-context.js";
 import { SimAwsTimekeeping } from "./sim-aws-timekeeping.js";
-import { simIamSigV4SignedRequest } from "../iam/sigv4/sim-iam-sigv4-signed-request.js";
+import { SimAwsRequestAuthentication } from "./sim-aws-request-authentication.js";
 /**
  * Top-level container for simulated AWS.
  * Contains Account scopes, Region scopes, Account/Region scopes, and built-in
@@ -25,6 +25,7 @@ export class SimAws {
     background;
     scopes;
     timekeeping;
+    requestAuthentication;
     constructor(properties = {}) {
         const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, background: suppliedBackground, } = properties;
         const timekeeping = new SimAwsTimekeeping({
@@ -42,6 +43,10 @@ export class SimAws {
         });
         this.iamRegistry = this.serviceFactory.iamRegistry;
         this.scopes = new SimAwsScopeRegistry({ simAws: this });
+        this.requestAuthentication = new SimAwsRequestAuthentication({
+            serviceFactory: this.serviceFactory,
+            clock: background,
+        });
     }
     /**
      * Get the current time in this simulated AWS environment.
@@ -86,7 +91,7 @@ export class SimAws {
      * Throws a SimIamSigV4Error carrying the AWS error code real AWS would use.
      */
     verifySignedRequest(request, body) {
-        return this.serviceFactory.signedRequests.verify(simIamSigV4SignedRequest(request, body));
+        return this.requestAuthentication.verifySignature(request, body);
     }
     /**
      * Work out which simulated principal an HTTP request is made by.
@@ -97,11 +102,10 @@ export class SimAws {
      * a request offering neither is anonymous rather than the Account root.
      *
      * The body is passed separately for the same reason it is on
-     * `verifySignedRequest`: a request body can only be read once, and whoever
-     * serves the request needs the same bytes.
+     * `verifySignedRequest`: a request body can only be read once.
      */
     resolveRequestCaller(request, options = {}) {
-        return this.serviceFactory.requestCallers.resolve(simIamSigV4SignedRequest(request, options.body), options.expectedScope);
+        return this.requestAuthentication.resolveCaller(request, options);
     }
     /**
      * Get a simulated AWS Account.
@@ -151,6 +155,12 @@ export class SimAws {
     iam() {
         return this.accountRegionScope().iam();
     }
+    /**
+     * Get simulated KMS in the default Account Region scope.
+     */
+    kms() {
+        return this.accountRegionScope().kms();
+    }
     /**
      * Get simulated Lambda in the default Account Region scope.
      */
@@ -175,27 +185,6 @@ export class SimAws {
     sts() {
         return this.accountRegionScope().sts();
     }
-    /**
-     * Get the shared simulated CloudFront registry.
-     *
-     * This is intended for CloudFront service/controller wiring so request routing
-     * uses the same registry as CloudFront SDK command handling.
-     * @internal
-     */
-    cloudFrontRegistry() {
-        return this.serviceFactory.cloudFrontRegistry;
-    }
-    /**
-     * Get the shared simulated Lambda Function URL registry.
-     *
-     * This is intended for Lambda controller wiring, so serving a Function URL
-     * request resolves the owning Account from the same registry the Function
-     * URL commands register ids in.
-     * @internal
-     */
-    lambdaUrlRegistry() {
-        return this.serviceFactory.lambdaUrlRegistry;
-    }
     /**
      * Run a function with an ambient simulated caller for this SimAws instance.
      *

package/dist/service/aws/sim-aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws.js","sourceRoot":"","sources":["../../../src/service/aws/sim-aws.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAEL,2BAA2B,GAE5B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAOxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAM7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAGxF;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACD,gBAAgB,CAAkB;IAClC,iBAAiB,CAAgB;IACjD;;;OAGG;IACa,cAAc,CAAuB;IAErD;;OAEG;IACa,WAAW,CAAiB;IAE3B,UAAU,CAA4C;IACtD,MAAM,CAAsB;IAC5B,WAAW,CAAoB;IAEhD,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,gBAAgB,GAAG,0BAA0B,EAC7C,iBAAiB,GAAG,2BAA2B,EAC/C,KAAK,EACL,UAAU,EAAE,kBAAkB,GAC/B,GAAG,UAAU,CAAC;QAEf,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;QAE1C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,MAAM,EAAE,IAAI;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAgB,EAChB,IAAiB;QAEjB,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,CAC9C,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CACxC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,oBAAoB,CAClB,OAAgB,EAChB,OAAO,GAA+B,EAAE;QAExC,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,OAAO,CAC/C,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAC/C,OAAO,CAAC,aAAa,CACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAS,GAA6B,IAAI,CAAC,gBAAgB;QAE3D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAA4B,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,SAAS,GAAoB,IAAI,CAAC,gBAAgB,EAClD,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QAElD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,cAAc,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,EAAE;QACA,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAI,MAAuB,EAAE,GAAqB;QAC3D,OAAO,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-aws.js","sourceRoot":"","sources":["../../../src/service/aws/sim-aws.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAEL,2BAA2B,GAE5B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAQxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAQlF;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACD,gBAAgB,CAAkB;IAClC,iBAAiB,CAAgB;IACjD;;;OAGG;IACa,cAAc,CAAuB;IAErD;;OAEG;IACa,WAAW,CAAiB;IAE3B,UAAU,CAA4C;IACtD,MAAM,CAAsB;IAC5B,WAAW,CAAoB;IAC/B,qBAAqB,CAA8B;IAEpE,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,gBAAgB,GAAG,0BAA0B,EAC7C,iBAAiB,GAAG,2BAA2B,EAC/C,KAAK,EACL,UAAU,EAAE,kBAAkB,GAC/B,GAAG,UAAU,CAAC;QAEf,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;QAE1C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,MAAM,EAAE,IAAI;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAgB,EAChB,IAAiB;QAEjB,OAAO,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;;OAUG;IACH,oBAAoB,CAClB,OAAgB,EAChB,OAAO,GAA+B,EAAE;QAExC,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAS,GAA6B,IAAI,CAAC,gBAAgB;QAE3D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAA4B,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,SAAS,GAAoB,IAAI,CAAC,gBAAgB,EAClD,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QAElD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,cAAc,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,EAAE;QACA,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAI,MAAuB,EAAE,GAAqB;QAC3D,OAAO,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAGhG;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,yBAAyB,EACnC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAMV"}
+{"version":3,"file":"sim-cfn-resource-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAGhG;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,yBAAyB,EACnC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAIV"}

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.js

@@ -22,6 +22,6 @@ export function parseSimCfnResourceDependencies(dependsOn) {
  */
 export function parseSimCfnResourceRefDependencies(template, resourceLogicalIds) {
     const referencedNames = parseSimCfnNode(template).referencedNames();
-    return [...new Set(referencedNames)].filter((name) => resourceLogicalIds.has(name));
+    return [...new Set(referencedNames).intersection(resourceLogicalIds)];
 }
 //# sourceMappingURL=sim-cfn-resource-dependencies.js.map

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-dependencies.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE;YAC3D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAmC,EACnC,kBAAuC;IAEvC,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAC7B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-cfn-resource-dependencies.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE;YAC3D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAmC,EACnC,kBAAuC;IAEvC,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js

@@ -12,7 +12,7 @@ export class SimCloudFrontControllerDependenciesFactory {
      */
     make(properties = {}) {
         const simAws = properties.simAws ?? new SimAws();
-        const cloudFrontRegistry = properties.cloudFrontRegistry ?? simAws.cloudFrontRegistry();
+        const cloudFrontRegistry = properties.cloudFrontRegistry ?? simAws.serviceFactory.cloudFrontRegistry;
         return {
             distroRouter: properties.distroRouter ??
                 new DefaultSimCloudFrontDistroRouter({

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-controller-dependency.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/controller/dependency/sim-cf-controller-dependency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAE9H,OAAO,EAAE,6BAA6B,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC5I,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAkBxF;;GAEG;AACH,MAAM,OAAO,0CAA0C;IACrD;;OAEG;IACH,IAAI,CACF,UAAU,GAA6C,EAAE;QAEzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QACjD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAE/D,OAAO;YACL,YAAY,EACV,UAAU,CAAC,YAAY;gBACvB,IAAI,gCAAgC,CAAC;oBACnC,MAAM;oBACN,kBAAkB;iBACnB,CAAC;YACJ,iBAAiB,EACf,UAAU,CAAC,iBAAiB;gBAC5B,IAAI,oCAAoC,EAAE;YAC5C,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,IAAI,gBAAgB,EAAE;YACjE,aAAa,EACX,UAAU,CAAC,aAAa,IAAI,IAAI,0BAA0B,EAAE;SAC/D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cf-controller-dependency.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/controller/dependency/sim-cf-controller-dependency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAE9H,OAAO,EAAE,6BAA6B,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC5I,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAkBxF;;GAEG;AACH,MAAM,OAAO,0CAA0C;IACrD;;OAEG;IACH,IAAI,CACF,UAAU,GAA6C,EAAE;QAEzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QACjD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC;QAE5E,OAAO;YACL,YAAY,EACV,UAAU,CAAC,YAAY;gBACvB,IAAI,gCAAgC,CAAC;oBACnC,MAAM;oBACN,kBAAkB;iBACnB,CAAC;YACJ,iBAAiB,EACf,UAAU,CAAC,iBAAiB;gBAC5B,IAAI,oCAAoC,EAAE;YAC5C,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,IAAI,gBAAgB,EAAE;YACjE,aAAa,EACX,UAAU,CAAC,aAAa,IAAI,IAAI,0BAA0B,EAAE;SAC/D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-distro-router.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,gDAAgD,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAClC,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqC;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAE,mCAAwC,EAkB/D;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,yBAAyB,EAAE,GACzC,yBAAyB,CAM3B;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,wBAAwB,GAAG,SAAS,CAatE;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAExE;CACF"}
+{"version":3,"file":"sim-cloud-front-distro-router.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,gDAAgD,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAClC,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqC;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAE,mCAAwC,EAmB/D;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,yBAAyB,EAAE,GACzC,yBAAyB,CAM3B;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,wBAAwB,GAAG,SAAS,CAatE;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAExE;CACF"}

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.js

@@ -18,7 +18,8 @@ export class SimCloudFrontDistroRouter {
     distroIdRouter;
     constructor(properties = {}) {
         this.simAws = properties.simAws ?? new SimAws();
-        const cloudFrontRegistry = properties.cloudFrontRegistry ?? this.simAws.cloudFrontRegistry();
+        const cloudFrontRegistry = properties.cloudFrontRegistry ??
+            this.simAws.serviceFactory.cloudFrontRegistry;
         const distributions = properties.distributions ?? new Map();
         // Both sub-routers share the same SimAws, Registry and Distributions
         // snapshot so their lookups stay consistent within a single request.

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-distro-router.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAG9E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAgBrF;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,qBAAqB,CAAqC;IAC1D,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAwC,EAAE;QAC9D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACpE,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,GAAG,EAAE,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,qBAAqB,GAAG,IAAI,kCAAkC,CAAC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAA0C;QAE1C,OAAO,IAAI,yBAAyB,CAAC;YACnC,aAAa,EAAE,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC7D,aAAa,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC;QAE9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF"}
+{"version":3,"file":"sim-cloud-front-distro-router.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAG9E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAgBrF;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,qBAAqB,CAAqC;IAC1D,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAwC,EAAE;QAC9D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB;YAC7B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC;QAChD,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,GAAG,EAAE,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,qBAAqB,GAAG,IAAI,kCAAkC,CAAC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAA0C;QAE1C,OAAO,IAAI,yBAAyB,CAAC;YACnC,aAAa,EAAE,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC7D,aAAa,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC;QAE9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -0,0 +1,116 @@
+interface SimIamAllowSidesProperties {
+    readonly identity: boolean;
+    readonly resource: boolean;
+    /**
+     * Whether a resource-policy Allow named the caller rather than its Account.
+     * Defaults to the resource side, for callers with no reason to distinguish.
+     */
+    readonly resourceDirect?: boolean | undefined;
+}
+/**
+ * Which sides of a policy evaluation produced a matching Allow.
+ *
+ * Identity-based policies are the caller's side of a request; resource-based
+ * policies are the resource's side. AWS combines the two differently depending
+ * on whether the caller and the resource belong to the same Account, so the
+ * sides are kept apart rather than counted together.
+ */
+export declare class SimIamAllowSides {
+    private readonly identityAllowed;
+    private readonly resourceAllowed;
+    private readonly resourceDirectAllowed;
+    constructor(properties: SimIamAllowSidesProperties);
+    /**
+     * Whether an identity-based policy allowed the request.
+     */
+    get identity(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request.
+     */
+    get resource(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by delegating to the caller's Account.
+     */
+    get resourceDirect(): boolean;
+    /**
+     * Whether the resource's policy admitted the caller only by delegating to
+     * its Account, which grants nothing on its own.
+     */
+    get resourceDelegated(): boolean;
+}
+/**
+ * Which sides of an authorization must allow a request for it to be allowed.
+ */
+export interface SimIamAllowRequirement {
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * The same-Account rule: an Allow from either side is enough.
+ *
+ * Within one Account an identity policy can allow a request with no resource
+ * policy involved, and a resource policy can allow it with no identity policy
+ * involved.
+ */
+export declare class SimIamEitherSideAllowRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether either side of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * The cross-Account rule: both sides must allow.
+ *
+ * AWS decides a cross-Account request in both Accounts. The caller's Account
+ * allows the action through an identity policy, and the resource's Account
+ * allows it through a resource policy. Neither side can grant access to the
+ * other Account's principals or resources on its own.
+ */
+export declare class SimIamBothSidesAllowRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether both sides of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * The rule for a resource whose policy is mandatory: it must admit the caller.
+ *
+ * Most AWS resources have no resource policy until someone writes one, and its
+ * absence simply leaves the decision to IAM. A KMS key is not like that: it
+ * always has a key policy, and an identity policy cannot reach the key unless
+ * that policy admits the caller. Services holding such a resource ask for this
+ * rule rather than IAM inferring it, because only the service knows its
+ * resource works that way.
+ *
+ * How the policy admits the caller decides what else is needed. A statement
+ * naming the caller grants access outright, which is why a KMS key policy can
+ * make a key usable by a Role with no permissions of its own. A statement
+ * naming the Account only delegates to that Account's IAM, so an identity
+ * policy still has to allow the action. That second case is the one the
+ * default key policy creates, and getting it wrong would make every key in the
+ * simulation usable by every principal in its Account.
+ */
+export declare class SimIamMandatoryResourcePolicyRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether the resource's own policy admitted the caller, and whether
+     * anything further is needed for the way it did so.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * Every applicable rule at once.
+ *
+ * A request can be subject to more than one: a cross-Account call against a
+ * KMS key has to satisfy both the cross-Account rule and the key's own
+ * mandatory-policy rule, and the stricter answer is the right one.
+ */
+export declare class SimIamEveryAllowRequirement implements SimIamAllowRequirement {
+    private readonly requirements;
+    constructor(requirements: readonly SimIamAllowRequirement[]);
+    /**
+     * Whether every rule is satisfied.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+export {};
+//# sourceMappingURL=sim-iam-allow-requirement.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAEhD,YAAY,UAAU,EAAE,0BAA0B,EAKjD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;OAGG;IACH,IAAI,iBAAiB,IAAI,OAAO,CAE/B;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,gCAAiC,YAAW,sBAAsB;IAC7E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,sBAAsB;IAC5E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,wCAAyC,YAAW,sBAAsB;IACrF;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAM/C;CACF;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,sBAAsB;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IAEjE,YAAY,YAAY,EAAE,SAAS,sBAAsB,EAAE,EAE1D;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAI/C;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -0,0 +1,126 @@
+/**
+ * Which sides of a policy evaluation produced a matching Allow.
+ *
+ * Identity-based policies are the caller's side of a request; resource-based
+ * policies are the resource's side. AWS combines the two differently depending
+ * on whether the caller and the resource belong to the same Account, so the
+ * sides are kept apart rather than counted together.
+ */
+export class SimIamAllowSides {
+    identityAllowed;
+    resourceAllowed;
+    resourceDirectAllowed;
+    constructor(properties) {
+        this.identityAllowed = properties.identity;
+        this.resourceAllowed = properties.resource;
+        this.resourceDirectAllowed =
+            properties.resourceDirect ?? properties.resource;
+    }
+    /**
+     * Whether an identity-based policy allowed the request.
+     */
+    get identity() {
+        return this.identityAllowed;
+    }
+    /**
+     * Whether a resource-based policy allowed the request.
+     */
+    get resource() {
+        return this.resourceAllowed;
+    }
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by delegating to the caller's Account.
+     */
+    get resourceDirect() {
+        return this.resourceDirectAllowed;
+    }
+    /**
+     * Whether the resource's policy admitted the caller only by delegating to
+     * its Account, which grants nothing on its own.
+     */
+    get resourceDelegated() {
+        return this.resourceAllowed && !this.resourceDirectAllowed;
+    }
+}
+/**
+ * The same-Account rule: an Allow from either side is enough.
+ *
+ * Within one Account an identity policy can allow a request with no resource
+ * policy involved, and a resource policy can allow it with no identity policy
+ * involved.
+ */
+export class SimIamEitherSideAllowRequirement {
+    /**
+     * Whether either side of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows) {
+        return allows.identity || allows.resource;
+    }
+}
+/**
+ * The cross-Account rule: both sides must allow.
+ *
+ * AWS decides a cross-Account request in both Accounts. The caller's Account
+ * allows the action through an identity policy, and the resource's Account
+ * allows it through a resource policy. Neither side can grant access to the
+ * other Account's principals or resources on its own.
+ */
+export class SimIamBothSidesAllowRequirement {
+    /**
+     * Whether both sides of the evaluation allowed the request.
+     */
+    isSatisfiedBy(allows) {
+        return allows.identity && allows.resource;
+    }
+}
+/**
+ * The rule for a resource whose policy is mandatory: it must admit the caller.
+ *
+ * Most AWS resources have no resource policy until someone writes one, and its
+ * absence simply leaves the decision to IAM. A KMS key is not like that: it
+ * always has a key policy, and an identity policy cannot reach the key unless
+ * that policy admits the caller. Services holding such a resource ask for this
+ * rule rather than IAM inferring it, because only the service knows its
+ * resource works that way.
+ *
+ * How the policy admits the caller decides what else is needed. A statement
+ * naming the caller grants access outright, which is why a KMS key policy can
+ * make a key usable by a Role with no permissions of its own. A statement
+ * naming the Account only delegates to that Account's IAM, so an identity
+ * policy still has to allow the action. That second case is the one the
+ * default key policy creates, and getting it wrong would make every key in the
+ * simulation usable by every principal in its Account.
+ */
+export class SimIamMandatoryResourcePolicyRequirement {
+    /**
+     * Whether the resource's own policy admitted the caller, and whether
+     * anything further is needed for the way it did so.
+     */
+    isSatisfiedBy(allows) {
+        if (allows.resourceDirect) {
+            return true;
+        }
+        return allows.resourceDelegated && allows.identity;
+    }
+}
+/**
+ * Every applicable rule at once.
+ *
+ * A request can be subject to more than one: a cross-Account call against a
+ * KMS key has to satisfy both the cross-Account rule and the key's own
+ * mandatory-policy rule, and the stricter answer is the right one.
+ */
+export class SimIamEveryAllowRequirement {
+    requirements;
+    constructor(requirements) {
+        this.requirements = requirements;
+    }
+    /**
+     * Whether every rule is satisfied.
+     */
+    isSatisfiedBy(allows) {
+        return this.requirements.every((requirement) => requirement.isSatisfiedBy(allows));
+    }
+}
+//# sourceMappingURL=sim-iam-allow-requirement.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,eAAe,CAAU;IACzB,eAAe,CAAU;IACzB,qBAAqB,CAAU;IAEhD,YAAY,UAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,qBAAqB;YACxB,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC7D,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,wCAAwC;IACnD;;;OAGG;IACH,aAAa,CAAC,MAAwB;QACpC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAAoC;IAEjE,YAAY,YAA+C;QACzD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAC7C,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAClC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -0,0 +1,52 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+import type { SimIamPrincipalMatch } from "../match/sim-iam-principal-match.js";
+/**
+ * The matching Allow statements found for one authorization, kept per side.
+ *
+ * Which side an Allow came from decides whether it counts: a cross-Account
+ * request needs one from each. Trust policies are resource policies on an IAM
+ * Role, so they count as the resource side, and are additionally kept apart for
+ * the AssumeRole rule that an identity policy cannot substitute for a Role's
+ * trust.
+ */
+export declare class SimIamAllowStatements {
+    private readonly identityStatements;
+    private readonly resourceStatements;
+    private readonly trustStatements;
+    private readonly delegatedStatements;
+    /**
+     * Record a matching Allow against the policy side it came from.
+     *
+     * A resource-policy Allow that matched by way of the caller's Account rather
+     * than the caller itself is kept apart as well, so a rule that cares about
+     * the difference can ask for it.
+     */
+    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, principal: SimIamPrincipalMatch): void;
+    /**
+     * Every matching Allow statement, identity side first.
+     */
+    get all(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identity(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resource(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trust(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides(): SimIamAllowSides;
+    /**
+     * The list an Allow from this policy source belongs in.
+     */
+    private sideStatements;
+}
+//# sourceMappingURL=sim-iam-allow-statements.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-statements.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAEhF;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IACvE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAuC;IAE3E;;;;;;OAMG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,6BAA6B,EACxC,SAAS,EAAE,oBAAoB,GAC9B,IAAI,CAUN;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,6BAA6B,EAAE,CAElD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,6BAA6B,EAAE,CAEpD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,gBAAgB,CAU5B;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -0,0 +1,77 @@
+import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+/**
+ * The matching Allow statements found for one authorization, kept per side.
+ *
+ * Which side an Allow came from decides whether it counts: a cross-Account
+ * request needs one from each. Trust policies are resource policies on an IAM
+ * Role, so they count as the resource side, and are additionally kept apart for
+ * the AssumeRole rule that an identity policy cannot substitute for a Role's
+ * trust.
+ */
+export class SimIamAllowStatements {
+    identityStatements = [];
+    resourceStatements = [];
+    trustStatements = [];
+    delegatedStatements = [];
+    /**
+     * Record a matching Allow against the policy side it came from.
+     *
+     * A resource-policy Allow that matched by way of the caller's Account rather
+     * than the caller itself is kept apart as well, so a rule that cares about
+     * the difference can ask for it.
+     */
+    record(policy, statement, principal) {
+        if (policy.sourceType === "trust") {
+            this.trustStatements.push(statement);
+        }
+        if (principal.isAccountDelegation) {
+            this.delegatedStatements.push(statement);
+        }
+        this.sideStatements(policy).push(statement);
+    }
+    /**
+     * Every matching Allow statement, identity side first.
+     */
+    get all() {
+        return [...this.identityStatements, ...this.resourceStatements];
+    }
+    /**
+     * Matching Allow statements from identity-based policies.
+     */
+    get identity() {
+        return this.identityStatements;
+    }
+    /**
+     * Matching Allow statements from resource-based policies.
+     */
+    get resource() {
+        return this.resourceStatements;
+    }
+    /**
+     * Matching Allow statements originating from trust policies.
+     */
+    get trust() {
+        return this.trustStatements;
+    }
+    /**
+     * Which sides produced a matching Allow.
+     */
+    get sides() {
+        const delegated = new Set(this.delegatedStatements);
+        return new SimIamAllowSides({
+            identity: this.identityStatements.length > 0,
+            resource: this.resourceStatements.length > 0,
+            resourceDirect: this.resourceStatements.some((statement) => !delegated.has(statement)),
+        });
+    }
+    /**
+     * The list an Allow from this policy source belongs in.
+     */
+    sideStatements(policy) {
+        if (policy.sourceType === "resource" || policy.sourceType === "trust") {
+            return this.resourceStatements;
+        }
+        return this.identityStatements;
+    }
+}
+//# sourceMappingURL=sim-iam-allow-statements.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-allow-statements.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACf,kBAAkB,GAAoC,EAAE,CAAC;IACzD,kBAAkB,GAAoC,EAAE,CAAC;IACzD,eAAe,GAAoC,EAAE,CAAC;IACtD,mBAAmB,GAAoC,EAAE,CAAC;IAE3E;;;;;;OAMG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAAwC,EACxC,SAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAC;YAClC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CACzC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.d.ts

@@ -0,0 +1,37 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
+import type { SimIamCallerAccount } from "./sim-iam-caller-account.js";
+interface SimIamCallerAccountResolverProperties {
+    /**
+     * The Account evaluating the request, which owns the target resource.
+     */
+    readonly accountId: SimAwsAccountId;
+    /**
+     * Resolves the IAM state of other Accounts in the same simulation.
+     *
+     * A standalone SimIam has no wider simulation to look in, so it has no
+     * resolver and no other Account's identity policies to find.
+     */
+    readonly iamResolver?: SimIamAccountResolver | undefined;
+}
+/**
+ * Works out which Account owns the caller of an authorization request.
+ *
+ * The answer decides how the request is evaluated, so it is made once, here,
+ * from the resolved caller. A caller with no Account in its ARN — a service
+ * principal or an anonymous request — has no identity side and is treated as
+ * belonging to the evaluating Account, which leaves it to be allowed by a
+ * resource policy alone.
+ */
+export declare class SimIamCallerAccountResolver {
+    private readonly accountId;
+    private readonly iamResolver?;
+    constructor(properties: SimIamCallerAccountResolverProperties);
+    /**
+     * Resolve the caller's Account relative to the Account owning the resource.
+     */
+    resolve(caller: SimAwsResolvedCaller): SimIamCallerAccount;
+}
+export {};
+//# sourceMappingURL=sim-iam-caller-account-resolver.d.ts.map

package/dist/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-account-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/caller-account/sim-iam-caller-account-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAIvE,UAAU,qCAAqC;IAC7C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAoC;IAEjE,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAazD;CACF"}