@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/iam/authorize/sim-iam-decision.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAG3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,qBAAqB,GAAoC,EAAE,CAAC;IAC5D,0BAA0B,GACzC,EAAE,CAAC;IAEL,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,0BAA0B,CAAC;IACzC,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAElD,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-iam-decision.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-decision.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAqB;IAC5B,oBAAoB,CAA6B;IACjD,gBAAgB,CAA+B;IAC/C,4BAA4B,GAC3C,EAAE,CAAC;IACY,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,YACE,OAA2B,EAC3B,oBAAoB,GAA+B,IAAI,0BAA0B,EAAE;QAEnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,yBAAyB,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACzC,CAAC;QAED,OAAO,yBAAyB,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,4BAA4B,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,KAAK,MAAM,MAAM,IAAI;YACnB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAChC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB;SACjC,EAAE,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEnE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;CACF"}

package/dist/service/iam/command/sim-iam-command-handlers.d.ts

@@ -0,0 +1,41 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimArn } from "../../aws/arn.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamInterServiceAuthZ } from "../authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamCredentialRegistry } from "../credential/sim-iam-credential-registry.js";
+import type { SimIamUserCredentialGenerator } from "../credential/user/sim-iam-user-credential-generator.js";
+import type { SimIamManagedPolicy } from "../policy/sim-iam-policy.js";
+import type { SimIamRole, SimIamRoleName } from "../role/sim-iam-role.js";
+import type { SimIamUser, SimIamUsername } from "../user/sim-iam-user.js";
+import { SimIamPolicyCommandHandlers } from "./policy/sim-iam-policy-command-handlers.js";
+import { SimIamRoleCommandHandlers } from "./role/sim-iam-role-command-handlers.js";
+import { SimIamUserCommandHandlers } from "./user/sim-iam-user-command-handlers.js";
+interface SimIamCommandHandlersProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly policies: Map<SimArn, SimIamManagedPolicy>;
+    readonly roles: Map<SimIamRoleName, SimIamRole>;
+    readonly users: Map<SimIamUsername, SimIamUser>;
+    readonly credentialRegistry: SimIamCredentialRegistry;
+    readonly userCredentialGenerator: SimIamUserCredentialGenerator;
+    readonly background: BackgroundScheduler;
+    /**
+     * IAM itself, which authorizes its own control-plane commands.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * The command handlers of one simulated IAM Account, grouped by resource.
+ *
+ * Every group authorizes against the same IAM and mutates the same Account
+ * state, so they are wired together here rather than one at a time in the
+ * service facade. That keeps SimIam what it should be: state maps plus
+ * delegation.
+ */
+export declare class SimIamCommandHandlers {
+    readonly roles: SimIamRoleCommandHandlers;
+    readonly users: SimIamUserCommandHandlers;
+    readonly policies: SimIamPolicyCommandHandlers;
+    constructor(properties: SimIamCommandHandlersProperties);
+}
+export {};
+//# sourceMappingURL=sim-iam-command-handlers.d.ts.map

package/dist/service/iam/command/sim-iam-command-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-command-handlers.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/command/sim-iam-command-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,UAAU,+BAA+B;IACvC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;IAChE,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAEzC;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAE/C,YAAY,UAAU,EAAE,+BAA+B,EAwBtD;CACF"}

package/dist/service/iam/command/sim-iam-command-handlers.js

@@ -0,0 +1,42 @@
+import { SimIamActionAuthorizer } from "../authorize/sim-iam-action-authorizer.js";
+import { SimIamPolicyCommandHandlers } from "./policy/sim-iam-policy-command-handlers.js";
+import { SimIamRoleCommandHandlers } from "./role/sim-iam-role-command-handlers.js";
+import { SimIamUserCommandHandlers } from "./user/sim-iam-user-command-handlers.js";
+/**
+ * The command handlers of one simulated IAM Account, grouped by resource.
+ *
+ * Every group authorizes against the same IAM and mutates the same Account
+ * state, so they are wired together here rather than one at a time in the
+ * service facade. That keeps SimIam what it should be: state maps plus
+ * delegation.
+ */
+export class SimIamCommandHandlers {
+    roles;
+    users;
+    policies;
+    constructor(properties) {
+        const authorizer = new SimIamActionAuthorizer({ iam: properties.iam });
+        this.roles = new SimIamRoleCommandHandlers({
+            accountId: properties.accountId,
+            roles: properties.roles,
+            background: properties.background,
+            authorizer,
+        });
+        this.users = new SimIamUserCommandHandlers({
+            accountId: properties.accountId,
+            users: properties.users,
+            credentialRegistry: properties.credentialRegistry,
+            credentialGenerator: properties.userCredentialGenerator,
+            background: properties.background,
+            authorizer,
+        });
+        this.policies = new SimIamPolicyCommandHandlers({
+            accountId: properties.accountId,
+            policies: properties.policies,
+            users: properties.users,
+            background: properties.background,
+            authorizer,
+        });
+    }
+}
+//# sourceMappingURL=sim-iam-command-handlers.js.map

package/dist/service/iam/command/sim-iam-command-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-command-handlers.js","sourceRoot":"","sources":["../../../../src/service/iam/command/sim-iam-command-handlers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAOnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAiBpF;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACvB,KAAK,CAA4B;IACjC,KAAK,CAA4B;IACjC,QAAQ,CAA8B;IAE/C,YAAY,UAA2C;QACrD,MAAM,UAAU,GAAG,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,KAAK,GAAG,IAAI,yBAAyB,CAAC;YACzC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,yBAAyB,CAAC;YACzC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;YACjD,mBAAmB,EAAE,UAAU,CAAC,uBAAuB;YACvD,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,2BAA2B,CAAC;YAC9C,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/index.d.ts

@@ -1,4 +1,5 @@
 export { SimIam } from "./sim-iam.js";
+export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export type { SimIamRequestOptions } from "./command/sim-iam-request-options.js";
 export type { SimIamCredentialIdentity } from "./credential/sim-aws-credentials.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, type SimIamSigV4ErrorCode, } from "./sigv4/error/sim-iam-sigv4.error.js";

package/dist/service/iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/index.js

@@ -1,4 +1,5 @@
 export { SimIam } from "./sim-iam.js";
+export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, } from "./sigv4/error/sim-iam-sigv4.error.js";
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";

package/dist/service/iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/registry/sim-iam-account-resolver.d.ts

@@ -12,5 +12,13 @@ export interface SimIamAccountResolver {
      * registered for the requested Account.
      */
     iamForAccount(accountId: SimAwsAccountId): SimIam;
+    /**
+     * Find simulated IAM for an Account, without requiring it to exist.
+     *
+     * An Account with no IAM registered is a legitimate answer rather than a
+     * fault: a request can name a principal in an Account the simulation was
+     * never told about, and that Account grants it nothing.
+     */
+    findIamForAccount(accountId: SimAwsAccountId): SimIam | undefined;
 }
 //# sourceMappingURL=sim-iam-account-resolver.d.ts.map

package/dist/service/iam/registry/sim-iam-account-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-account-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-account-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAAC;CACnD"}
+{"version":3,"file":"sim-iam-account-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-account-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAAC;IAElD;;;;;;OAMG;IACH,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAAC;CACnE"}

package/dist/service/iam/registry/sim-iam-registry.d.ts

@@ -26,5 +26,9 @@ export declare class SimIamRegistry implements SimIamAccountResolver {
      * rely on receiving a usable account-scoped service.
      */
     iamForAccount(accountId: SimAwsAccountId): SimIam;
+    /**
+     * Find the registered IAM facade belonging to an Account, if there is one.
+     */
+    findIamForAccount(accountId: SimAwsAccountId): SimIam | undefined;
 }
 //# sourceMappingURL=sim-iam-registry.d.ts.map

package/dist/service/iam/registry/sim-iam-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;GAOG;AACH,qBAAa,cAAe,YAAW,qBAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CActD;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAQhD;CACF"}
+{"version":3,"file":"sim-iam-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;GAOG;AACH,qBAAa,cAAe,YAAW,qBAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CActD;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAQhD;IAED;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAEhE;CACF"}

package/dist/service/iam/registry/sim-iam-registry.js

@@ -32,11 +32,17 @@ export class SimIamRegistry {
      * rely on receiving a usable account-scoped service.
      */
     iamForAccount(accountId) {
-        const iam = this.iamByAccountId.get(accountId);
+        const iam = this.findIamForAccount(accountId);
         if (iam === undefined) {
             throw new Error(`Sim IAM is not registered for Account ${accountId}`);
         }
         return iam;
     }
+    /**
+     * Find the registered IAM facade belonging to an Account, if there is one.
+     */
+    findIamForAccount(accountId) {
+        return this.iamByAccountId.get(accountId);
+    }
 }
 //# sourceMappingURL=sim-iam-registry.js.map

package/dist/service/iam/registry/sim-iam-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACR,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,SAA0B,EAAE,GAAW;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,wDAAwD,SAAS,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAA0B;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"sim-iam-registry.js","sourceRoot":"","sources":["../../../../src/service/iam/registry/sim-iam-registry.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACR,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,SAA0B,EAAE,GAAW;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,wDAAwD,SAAS,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAA0B;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,SAA0B;QAC1C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts

@@ -5,6 +5,20 @@ import { SimAwsRequestCaller } from "./sim-aws-request-caller.js";
 interface SimAwsRequestCallerResolverProperties {
     readonly signedRequests: SimIamSigV4Verifier;
 }
+/**
+ * What resolving a caller needs beyond the request itself.
+ */
+export interface SimAwsCallerResolveOptions {
+    /**
+     * The service and Region the signature should have been scoped to.
+     */
+    readonly expectedScope?: SimIamSigV4ExpectedScope | undefined;
+    /**
+     * Simulated time, which credential expiry and a presigned URL's own expiry
+     * are both judged against.
+     */
+    readonly now?: Date | undefined;
+}
 /**
  * The one place an HTTP request into simulated AWS becomes a principal.
  *
@@ -33,14 +47,16 @@ export declare class SimAwsRequestCallerResolver {
      * Throws a SimAwsRequestAuthFailure when the request states an identity that
      * cannot be accepted. Stating none is not a failure; it is anonymous.
      */
-    resolve(request: SimIamSigV4SignedRequest, expectedScope?: SimIamSigV4ExpectedScope): SimAwsRequestCaller;
+    resolve(request: SimIamSigV4SignedRequest, options?: SimAwsCallerResolveOptions): SimAwsRequestCaller;
     /**
      * Whether the request offers a SigV4 signature to verify.
      *
-     * Only an AWS4-HMAC-SHA256 header counts. An Authorization header of any
-     * other scheme belongs to the application: a bearer token sent to a Function
-     * URL with NONE auth is the handler's business, and treating it as a broken
-     * signature would refuse a request real AWS delivers.
+     * Two things count: an AWS4-HMAC-SHA256 Authorization header, and the
+     * `X-Amz-Algorithm` parameter a presigned URL states its signature with. An
+     * Authorization header of any other scheme belongs to the application: a
+     * bearer token sent to a Function URL with NONE auth is the handler's
+     * business, and treating it as a broken signature would refuse a request real
+     * AWS delivers.
      */
     private carriesSignature;
     private signedCaller;

package/dist/service/iam/request/sim-aws-request-caller-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-request-caller-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAK9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAO,EAAE,wBAAwB,EACjC,aAAa,CAAC,EAAE,wBAAwB,GACvC,mBAAmB,CAerB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,YAAY;CAYrB"}
+{"version":3,"file":"sim-aws-request-caller-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAK9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,0BAA+B,GACvC,mBAAmB,CAerB;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,YAAY;CAerB"}

package/dist/service/iam/request/sim-aws-request-caller-resolver.js

@@ -1,3 +1,4 @@
+import { SimIamSigV4PresignedQuery } from "../sigv4/presign/sim-iam-sigv4-presigned-query.js";
 import { simIamSigV4Algorithm } from "../sigv4/sim-iam-sigv4-authorization.js";
 import { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, } from "./sim-aws-caller-header.js";
 import { SimAwsRequestCaller } from "./sim-aws-request-caller.js";
@@ -31,7 +32,7 @@ export class SimAwsRequestCallerResolver {
      * Throws a SimAwsRequestAuthFailure when the request states an identity that
      * cannot be accepted. Stating none is not a failure; it is anonymous.
      */
-    resolve(request, expectedScope) {
+    resolve(request, options = {}) {
         const named = request.headers.get(simAwsCallerHeaderName);
         if (named !== null) {
             return new SimAwsRequestCaller({
@@ -42,22 +43,27 @@ export class SimAwsRequestCallerResolver {
         if (!this.carriesSignature(request)) {
             return SimAwsRequestCaller.anonymous();
         }
-        return this.signedCaller(request, expectedScope);
+        return this.signedCaller(request, options);
     }
     /**
      * Whether the request offers a SigV4 signature to verify.
      *
-     * Only an AWS4-HMAC-SHA256 header counts. An Authorization header of any
-     * other scheme belongs to the application: a bearer token sent to a Function
-     * URL with NONE auth is the handler's business, and treating it as a broken
-     * signature would refuse a request real AWS delivers.
+     * Two things count: an AWS4-HMAC-SHA256 Authorization header, and the
+     * `X-Amz-Algorithm` parameter a presigned URL states its signature with. An
+     * Authorization header of any other scheme belongs to the application: a
+     * bearer token sent to a Function URL with NONE auth is the handler's
+     * business, and treating it as a broken signature would refuse a request real
+     * AWS delivers.
      */
     carriesSignature(request) {
         return (request.headers.get("authorization")?.startsWith(simIamSigV4Algorithm) ===
-            true);
+            true || SimIamSigV4PresignedQuery.carriedBy(request.url));
     }
-    signedCaller(request, expectedScope) {
-        const identity = this.signedRequests.verify(request, { expectedScope });
+    signedCaller(request, options) {
+        const identity = this.signedRequests.verify(request, {
+            expectedScope: options.expectedScope,
+            now: options.now,
+        });
         return new SimAwsRequestCaller({
             principal: identity.principal,
             identityPolicyPrincipal: identity.identityPolicyPrincipal,

package/dist/service/iam/request/sim-aws-request-caller-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-request-caller-resolver.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAI/E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,2BAA2B;IACrB,cAAc,CAAsB;IAErD,YAAY,UAAiD;QAC3D,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAiC,EACjC,aAAwC;QAExC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAE1D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,mBAAmB,CAAC;gBAC7B,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC;gBAC7C,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,OAAiC;QACxD,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC;YACtE,IAAI,CACL,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,OAAiC,EACjC,aAAmD;QAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAExE,OAAO,IAAI,mBAAmB,CAAC;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-aws-request-caller-resolver.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-caller-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAI/E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAqBlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,2BAA2B;IACrB,cAAc,CAAsB;IAErD,YAAY,UAAiD;QAC3D,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,OAAiC,EACjC,OAAO,GAA+B,EAAE;QAExC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAE1D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,mBAAmB,CAAC;gBAC7B,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC;gBAC7C,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;OASG;IACK,gBAAgB,CAAC,OAAiC;QACxD,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC;YACpE,IAAI,IAAI,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAC3D,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,OAAiC,EACjC,OAAmC;QAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE;YACnD,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,OAAO,IAAI,mBAAmB,CAAC;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts

@@ -1,4 +1,5 @@
 import type { SimIamSigV4SignedRequest } from "../sim-iam-sigv4-signed-request.js";
+import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
 /**
  * The canonical form of a signed request: the exact bytes a signature is made
  * over.
@@ -11,7 +12,8 @@ import type { SimIamSigV4SignedRequest } from "../sim-iam-sigv4-signed-request.j
 export declare class SimIamSigV4CanonicalRequest {
     private readonly canonicalHeaders;
     private readonly signedRequest;
-    constructor(signedRequest: SimIamSigV4SignedRequest, signedHeaderNames: readonly string[]);
+    private readonly payload;
+    constructor(signedRequest: SimIamSigV4SignedRequest, signedHeaderNames: readonly string[], payload?: SimIamSigV4PayloadDeclaration);
     /**
      * The canonical request string, ready to be hashed into a string to sign.
      */

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAMnF;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IAEzD,YACE,aAAa,EAAE,wBAAwB,EACvC,iBAAiB,EAAE,SAAS,MAAM,EAAE,EAQrC;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}
+{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAInF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IAExD,YACE,aAAa,EAAE,wBAAwB,EACvC,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,OAAO,GAAE,6BAER,EASF;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js

@@ -1,7 +1,7 @@
 import { SimIamSigV4CanonicalHeaders } from "./sim-iam-sigv4-canonical-headers.js";
 import { simIamSigV4CanonicalPath } from "./sim-iam-sigv4-canonical-path.js";
 import { simIamSigV4CanonicalQuery } from "./sim-iam-sigv4-canonical-query.js";
-import { simIamSigV4PayloadHash } from "./sim-iam-sigv4-payload-hash.js";
+import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
 /**
  * The canonical form of a signed request: the exact bytes a signature is made
  * over.
@@ -14,22 +14,24 @@ import { simIamSigV4PayloadHash } from "./sim-iam-sigv4-payload-hash.js";
 export class SimIamSigV4CanonicalRequest {
     canonicalHeaders;
     signedRequest;
-    constructor(signedRequest, signedHeaderNames) {
+    payload;
+    constructor(signedRequest, signedHeaderNames, payload = SimIamSigV4PayloadDeclaration.fromHeaders(signedRequest.headers)) {
         this.signedRequest = signedRequest;
+        this.payload = payload;
         this.canonicalHeaders = new SimIamSigV4CanonicalHeaders(signedRequest.headers, signedHeaderNames, signedRequest.url);
     }
     /**
      * The canonical request string, ready to be hashed into a string to sign.
      */
     toString() {
-        const { method, url, headers, body } = this.signedRequest;
+        const { method, url, body } = this.signedRequest;
         return [
             method.toUpperCase(),
             simIamSigV4CanonicalPath(url.pathname),
             simIamSigV4CanonicalQuery(url.search),
             `${this.canonicalHeaders.toString()}\n`,
             this.canonicalHeaders.signedHeaderList(),
-            simIamSigV4PayloadHash(headers, body),
+            this.payload.hashFor(body),
         ].join("\n");
     }
 }

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IAEzD,YACE,aAAuC,EACvC,iBAAoC;QAEpC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,iBAAiB,EACjB,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAE1D,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IACxC,OAAO,CAAgC;IAExD,YACE,aAAuC,EACvC,iBAAoC,EACpC,OAAO,GAAkC,6BAA6B,CAAC,WAAW,CAChF,aAAa,CAAC,OAAO,CACtB;QAED,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,iBAAiB,EACjB,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAEjD,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts

@@ -1,19 +1,39 @@
 export declare const simIamSigV4UnsignedPayload = "UNSIGNED-PAYLOAD";
 /**
- * Work out the payload hash a signed request was signed with, and check the
- * body it arrived with is the body it claims.
+ * What a signed request declares its body hashes to.
  *
- * A signer states the payload hash in `x-amz-content-sha256`, and that header
- * is itself signed, so the claim cannot be altered without breaking the
- * signature. The claim still has to be checked against the bytes received:
- * without that, a signature would cover only the client's assertion about the
- * body, and the body could be replaced freely.
- *
- * `UNSIGNED-PAYLOAD` is the one declaration that deliberately leaves the body
- * uncovered, and is honoured. Any other non-digest value, including the
- * streaming markers that chunked uploads use, is refused rather than passed
- * through: accepting one would mean serving a request whose body nothing had
- * checked, which is worse than saying the simulator does not support it.
+ * A header-signed request states this in `x-amz-content-sha256`. A presigned
+ * URL states it in the query parameter of the same name, and a presigned URL
+ * that states nothing has an unsigned payload, because a URL is signed before
+ * there is a body to hash. Reading the declaration is the one part of building
+ * a canonical request that differs between the two.
  */
-export declare function simIamSigV4PayloadHash(headers: Headers, body: Uint8Array | undefined): string;
+export declare class SimIamSigV4PayloadDeclaration {
+    private readonly declared;
+    private constructor();
+    /**
+     * The declaration a header-signed request makes.
+     */
+    static fromHeaders(headers: Headers): SimIamSigV4PayloadDeclaration;
+    /**
+     * The declaration a presigned URL makes, defaulting to an unsigned payload.
+     */
+    static fromPresignedQuery(url: URL): SimIamSigV4PayloadDeclaration;
+    /**
+     * Work out the payload hash the request was signed with, and check that the
+     * body it arrived with is the body it claims.
+     *
+     * The declaration is itself signed, so the claim cannot be altered without
+     * breaking the signature. The claim still has to be checked against the bytes
+     * received: without that, a signature would cover only the client's assertion
+     * about the body, and the body could be replaced freely.
+     *
+     * `UNSIGNED-PAYLOAD` is the one declaration that deliberately leaves the body
+     * uncovered, and is honoured. Any other non-digest value, including the
+     * streaming markers that chunked uploads use, is refused rather than passed
+     * through: accepting one would mean serving a request whose body nothing had
+     * checked, which is worse than saying the simulator does not support it.
+     */
+    hashFor(body: Uint8Array | undefined): string;
+}
 //# sourceMappingURL=sim-iam-sigv4-payload-hash.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-payload-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAW7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,UAAU,GAAG,SAAS,GAC3B,MAAM,CA6BR"}
+{"version":3,"file":"sim-iam-sigv4-payload-hash.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAW7D;;;;;;;;GAQG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IAEzC,OAAO,eAEN;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,6BAA6B,CAElE;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,6BAA6B,CAOjE;IAED;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CA6B5C;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js

@@ -1,47 +1,74 @@
 import { createHash } from "node:crypto";
 import { SimIamSignatureDoesNotMatch } from "../error/sim-iam-sigv4.error.js";
+import { simIamSigV4PresignedParameter, simIamSigV4PresignedParameters, } from "../presign/sim-iam-sigv4-presigned-parameters.js";
 export const simIamSigV4UnsignedPayload = "UNSIGNED-PAYLOAD";
-const sha256HeaderName = "x-amz-content-sha256";
+const sha256Name = "x-amz-content-sha256";
 const sha256DigestPattern = /^[\da-f]{64}$/i;
 /**
  * The SHA-256 of an empty body, which SigV4 uses when a request has no body.
  */
 const emptyBodyHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
 /**
- * Work out the payload hash a signed request was signed with, and check the
- * body it arrived with is the body it claims.
+ * What a signed request declares its body hashes to.
  *
- * A signer states the payload hash in `x-amz-content-sha256`, and that header
- * is itself signed, so the claim cannot be altered without breaking the
- * signature. The claim still has to be checked against the bytes received:
- * without that, a signature would cover only the client's assertion about the
- * body, and the body could be replaced freely.
- *
- * `UNSIGNED-PAYLOAD` is the one declaration that deliberately leaves the body
- * uncovered, and is honoured. Any other non-digest value, including the
- * streaming markers that chunked uploads use, is refused rather than passed
- * through: accepting one would mean serving a request whose body nothing had
- * checked, which is worse than saying the simulator does not support it.
+ * A header-signed request states this in `x-amz-content-sha256`. A presigned
+ * URL states it in the query parameter of the same name, and a presigned URL
+ * that states nothing has an unsigned payload, because a URL is signed before
+ * there is a body to hash. Reading the declaration is the one part of building
+ * a canonical request that differs between the two.
  */
-export function simIamSigV4PayloadHash(headers, body) {
-    const declared = headers.get(sha256HeaderName);
-    if (declared === null || declared.length === 0) {
-        return hashOfBody(body);
+export class SimIamSigV4PayloadDeclaration {
+    declared;
+    constructor(declared) {
+        this.declared = declared;
     }
-    if (declared === simIamSigV4UnsignedPayload) {
-        return declared;
+    /**
+     * The declaration a header-signed request makes.
+     */
+    static fromHeaders(headers) {
+        return new SimIamSigV4PayloadDeclaration(headers.get(sha256Name));
     }
-    if (!sha256DigestPattern.test(declared)) {
-        throw new SimIamSignatureDoesNotMatch(`Signed ${sha256HeaderName} header declares ${declared}, which is ` +
-            `neither a SHA-256 digest nor ${simIamSigV4UnsignedPayload}. ` +
-            `Chunked and streaming payload signing is not simulated.`);
+    /**
+     * The declaration a presigned URL makes, defaulting to an unsigned payload.
+     */
+    static fromPresignedQuery(url) {
+        return new SimIamSigV4PayloadDeclaration(simIamSigV4PresignedParameter(url, simIamSigV4PresignedParameters.contentSha256) ?? simIamSigV4UnsignedPayload);
     }
-    const received = hashOfBody(body);
-    if (received !== declared.toLowerCase()) {
-        throw new SimIamSignatureDoesNotMatch(`Request body hashes to ${received}, not the ${declared} its signed ` +
-            `${sha256HeaderName} header declares`);
+    /**
+     * Work out the payload hash the request was signed with, and check that the
+     * body it arrived with is the body it claims.
+     *
+     * The declaration is itself signed, so the claim cannot be altered without
+     * breaking the signature. The claim still has to be checked against the bytes
+     * received: without that, a signature would cover only the client's assertion
+     * about the body, and the body could be replaced freely.
+     *
+     * `UNSIGNED-PAYLOAD` is the one declaration that deliberately leaves the body
+     * uncovered, and is honoured. Any other non-digest value, including the
+     * streaming markers that chunked uploads use, is refused rather than passed
+     * through: accepting one would mean serving a request whose body nothing had
+     * checked, which is worse than saying the simulator does not support it.
+     */
+    hashFor(body) {
+        const declared = this.declared;
+        if (declared === null || declared.length === 0) {
+            return hashOfBody(body);
+        }
+        if (declared === simIamSigV4UnsignedPayload) {
+            return declared;
+        }
+        if (!sha256DigestPattern.test(declared)) {
+            throw new SimIamSignatureDoesNotMatch(`Signed ${sha256Name} declares ${declared}, which is neither a ` +
+                `SHA-256 digest nor ${simIamSigV4UnsignedPayload}. Chunked and ` +
+                `streaming payload signing is not simulated.`);
+        }
+        const received = hashOfBody(body);
+        if (received !== declared.toLowerCase()) {
+            throw new SimIamSignatureDoesNotMatch(`Request body hashes to ${received}, not the ${declared} its signed ` +
+                `${sha256Name} declares`);
+        }
+        return declared;
     }
-    return declared;
 }
 function hashOfBody(body) {
     if (body === undefined || body.byteLength === 0) {

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-payload-hash.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAE9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;GAEG;AACH,MAAM,aAAa,GACjB,kEAAkE,CAAC;AAErE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,IAA4B;IAE5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE/C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,UAAU,gBAAgB,oBAAoB,QAAQ,aAAa;YACjE,gCAAgC,0BAA0B,IAAI;YAC9D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CACnC,0BAA0B,QAAQ,aAAa,QAAQ,cAAc;YACnE,GAAG,gBAAgB,kBAAkB,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,IAA4B;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-payload-hash.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-payload-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,kDAAkD,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAC1C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;GAEG;AACH,MAAM,aAAa,GACjB,kEAAkE,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,QAAQ,CAAgB;IAEzC,YAAoB,QAAuB;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAgB;QACjC,OAAO,IAAI,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAQ;QAChC,OAAO,IAAI,6BAA6B,CACtC,6BAA6B,CAC3B,GAAG,EACH,8BAA8B,CAAC,aAAa,CAC7C,IAAI,0BAA0B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAA4B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,QAAQ,KAAK,0BAA0B,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,2BAA2B,CACnC,UAAU,UAAU,aAAa,QAAQ,uBAAuB;gBAC9D,sBAAsB,0BAA0B,gBAAgB;gBAChE,6CAA6C,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,2BAA2B,CACnC,0BAA0B,QAAQ,aAAa,QAAQ,cAAc;gBACnE,GAAG,UAAU,WAAW,CAC3B,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAA4B;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.d.ts

@@ -4,7 +4,7 @@
  * These are the codes real AWS returns, so a caller handling a rejection can
  * treat a simulated one exactly as it treats the real thing.
  */
-export type SimIamSigV4ErrorCode = "ExpiredToken" | "IncompleteSignature" | "InvalidClientTokenId" | "SignatureDoesNotMatch";
+export type SimIamSigV4ErrorCode = "AccessDenied" | "ExpiredToken" | "IncompleteSignature" | "InvalidClientTokenId" | "SignatureDoesNotMatch";
 /**
  * Base error for a rejected SigV4 signed request.
  */
@@ -33,6 +33,18 @@ export declare class SimIamInvalidClientTokenId extends SimIamSigV4Error {
 export declare class SimIamExpiredToken extends SimIamSigV4Error {
     constructor(message: string);
 }
+/**
+ * Raised when a presigned URL is used after the window it was signed for.
+ *
+ * The window is judged in simulated time, so a test that freezes the clock
+ * keeps a URL usable however long it spends, and one that advances the clock
+ * past `X-Amz-Expires` sees exactly what a real expired link does. The AWS
+ * error code is the one real S3 answers an expired presigned URL with, which
+ * is `AccessDenied` rather than anything naming expiry.
+ */
+export declare class SimIamPresignedRequestExpired extends SimIamSigV4Error {
+    constructor(message: string);
+}
 /**
  * Raised when a signature was made for a different service or Region than the
  * endpoint it arrived at.

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4.error.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/error/sim-iam-sigv4.error.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,qBAAqB,GACrB,sBAAsB,GACtB,uBAAuB,CAAC;AAE5B;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,IAAI,EAAE,oBAAoB,CAAC;IAE3C,YAAY,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAItD;CACF;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;;;GAUG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,SAAgB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtD,YAAY,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAGrD;CACF"}
+{"version":3,"file":"sim-iam-sigv4.error.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/error/sim-iam-sigv4.error.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,sBAAsB,GACtB,uBAAuB,CAAC;AAE5B;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,IAAI,EAAE,oBAAoB,CAAC;IAE3C,YAAY,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAItD;CACF;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;;;GAUG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,SAAgB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtD,YAAY,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAGrD;CACF"}