@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.js

@@ -36,6 +36,20 @@ export class SimIamExpiredToken extends SimIamSigV4Error {
         super("ExpiredToken", message);
     }
 }
+/**
+ * Raised when a presigned URL is used after the window it was signed for.
+ *
+ * The window is judged in simulated time, so a test that freezes the clock
+ * keeps a URL usable however long it spends, and one that advances the clock
+ * past `X-Amz-Expires` sees exactly what a real expired link does. The AWS
+ * error code is the one real S3 answers an expired presigned URL with, which
+ * is `AccessDenied` rather than anything naming expiry.
+ */
+export class SimIamPresignedRequestExpired extends SimIamSigV4Error {
+    constructor(message) {
+        super("AccessDenied", message);
+    }
+}
 /**
  * Raised when a signature was made for a different service or Region than the
  * endpoint it arrived at.

package/dist/service/iam/sigv4/error/sim-iam-sigv4.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4.error.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/error/sim-iam-sigv4.error.ts"],"names":[],"mappings":"AAYA;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAuB;IAE3C,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,OAAe;QACzB,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,gBAAgB;IAC/C,gBAAgB,CAAsB;IAEtD,YAAY,OAAe,EAAE,gBAAyB;QACpD,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4.error.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/error/sim-iam-sigv4.error.ts"],"names":[],"mappings":"AAaA;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAuB;IAE3C,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,OAAe;QACzB,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,gBAAgB;IAC/C,gBAAgB,CAAsB;IAEtD,YAAY,OAAe,EAAE,gBAAyB;QACpD,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-credential.d.ts

@@ -0,0 +1,25 @@
+import { SimIamSigV4CredentialScope } from "../sim-iam-sigv4-credential-scope.js";
+/**
+ * The access key and scope a presigned URL's `X-Amz-Credential` names.
+ *
+ * The same `<access-key-id>/<scope>` pair an Authorization header carries,
+ * written into a query parameter instead.
+ */
+export declare class SimIamSigV4PresignedCredential {
+    readonly accessKeyId: string;
+    readonly scope: SimIamSigV4CredentialScope;
+    private constructor();
+    /**
+     * Split a credential value, or fail saying what shape it should have been.
+     */
+    static parse(value: string): SimIamSigV4PresignedCredential;
+}
+/**
+ * Refuse a presigned URL made with a signing algorithm that is not simulated.
+ *
+ * Naming the algorithm is worth doing because the alternative is a signature
+ * mismatch with nothing to act on: SigV4A URLs look identical apart from this
+ * parameter.
+ */
+export declare function simIamSigV4CheckPresignedAlgorithm(algorithm: string): void;
+//# sourceMappingURL=sim-iam-sigv4-presigned-credential.d.ts.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-credential.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-credential.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElF;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,KAAK,EAAE,0BAA0B,CAAC;IAElD,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,8BAA8B,CAc1D;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAQ1E"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-credential.js

@@ -0,0 +1,41 @@
+import { SimIamIncompleteSignature } from "../error/sim-iam-sigv4.error.js";
+import { simIamSigV4Algorithm } from "../sim-iam-sigv4-authorization.js";
+import { SimIamSigV4CredentialScope } from "../sim-iam-sigv4-credential-scope.js";
+/**
+ * The access key and scope a presigned URL's `X-Amz-Credential` names.
+ *
+ * The same `<access-key-id>/<scope>` pair an Authorization header carries,
+ * written into a query parameter instead.
+ */
+export class SimIamSigV4PresignedCredential {
+    accessKeyId;
+    scope;
+    constructor(accessKeyId, scope) {
+        this.accessKeyId = accessKeyId;
+        this.scope = scope;
+    }
+    /**
+     * Split a credential value, or fail saying what shape it should have been.
+     */
+    static parse(value) {
+        const separator = value.indexOf("/");
+        if (separator < 1) {
+            throw new SimIamIncompleteSignature(`Presigned URL X-Amz-Credential ${value} must be ` +
+                `<access-key-id>/<scope>`);
+        }
+        return new SimIamSigV4PresignedCredential(value.slice(0, separator), SimIamSigV4CredentialScope.parse(value.slice(separator + 1)));
+    }
+}
+/**
+ * Refuse a presigned URL made with a signing algorithm that is not simulated.
+ *
+ * Naming the algorithm is worth doing because the alternative is a signature
+ * mismatch with nothing to act on: SigV4A URLs look identical apart from this
+ * parameter.
+ */
+export function simIamSigV4CheckPresignedAlgorithm(algorithm) {
+    if (algorithm !== simIamSigV4Algorithm) {
+        throw new SimIamIncompleteSignature(`Presigned URL X-Amz-Algorithm ${algorithm} is not ${simIamSigV4Algorithm}`);
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-presigned-credential.js.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-credential.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElF;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACzB,WAAW,CAAS;IACpB,KAAK,CAA6B;IAElD,YAAoB,WAAmB,EAAE,KAAiC;QACxE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,KAAa;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAyB,CACjC,kCAAkC,KAAK,WAAW;gBAChD,yBAAyB,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,8BAA8B,CACvC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EACzB,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,SAAiB;IAClE,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,yBAAyB,CACjC,iCAAiC,SAAS,WACxC,oBACF,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-parameters.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The query parameters a presigned URL states its signature in.
+ *
+ * Names are matched without regard to case, as the canonical query builder
+ * already excludes the signature parameter without regard to case. Signers
+ * emit the `X-Amz-` spelling, and nothing is gained by refusing a client that
+ * lower-cases them on the way.
+ */
+export declare const simIamSigV4PresignedParameters: {
+    readonly algorithm: "x-amz-algorithm";
+    readonly credential: "x-amz-credential";
+    readonly date: "x-amz-date";
+    readonly expires: "x-amz-expires";
+    readonly signedHeaders: "x-amz-signedheaders";
+    readonly signature: "x-amz-signature";
+    readonly securityToken: "x-amz-security-token";
+    readonly contentSha256: "x-amz-content-sha256";
+};
+/**
+ * Read a parameter the signature cannot be rebuilt without.
+ */
+export declare function simIamSigV4RequiredPresignedParameter(url: URL, name: string): string;
+/**
+ * Read one presigned parameter from a URL, whatever case it was written in.
+ */
+export declare function simIamSigV4PresignedParameter(url: URL, name: string): string | undefined;
+//# sourceMappingURL=sim-iam-sigv4-presigned-parameters.d.ts.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-parameters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-parameters.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-parameters.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B;aACzC,SAAS,EAAE,iBAAiB;aAC5B,UAAU,EAAE,kBAAkB;aAC9B,IAAI,EAAE,YAAY;aAClB,OAAO,EAAE,eAAe;aACxB,aAAa,EAAE,qBAAqB;aACpC,SAAS,EAAE,iBAAiB;aAC5B,aAAa,EAAE,sBAAsB;aACrC,aAAa,EAAE,sBAAsB;CAC7B,CAAC;AAEX;;GAEG;AACH,wBAAgB,qCAAqC,CACnD,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,MAAM,GACX,MAAM,CAUR;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAQpB"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-parameters.js

@@ -0,0 +1,41 @@
+import { SimIamIncompleteSignature } from "../error/sim-iam-sigv4.error.js";
+/**
+ * The query parameters a presigned URL states its signature in.
+ *
+ * Names are matched without regard to case, as the canonical query builder
+ * already excludes the signature parameter without regard to case. Signers
+ * emit the `X-Amz-` spelling, and nothing is gained by refusing a client that
+ * lower-cases them on the way.
+ */
+export const simIamSigV4PresignedParameters = {
+    algorithm: "x-amz-algorithm",
+    credential: "x-amz-credential",
+    date: "x-amz-date",
+    expires: "x-amz-expires",
+    signedHeaders: "x-amz-signedheaders",
+    signature: "x-amz-signature",
+    securityToken: "x-amz-security-token",
+    contentSha256: "x-amz-content-sha256",
+};
+/**
+ * Read a parameter the signature cannot be rebuilt without.
+ */
+export function simIamSigV4RequiredPresignedParameter(url, name) {
+    const value = simIamSigV4PresignedParameter(url, name);
+    if (value === undefined || value.length === 0) {
+        throw new SimIamIncompleteSignature(`Presigned URL is missing its ${name} parameter`);
+    }
+    return value;
+}
+/**
+ * Read one presigned parameter from a URL, whatever case it was written in.
+ */
+export function simIamSigV4PresignedParameter(url, name) {
+    for (const [key, value] of url.searchParams) {
+        if (key.toLowerCase() === name) {
+            return value;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=sim-iam-sigv4-presigned-parameters.js.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-parameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-parameters.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-parameters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,SAAS,EAAE,iBAAiB;IAC5B,UAAU,EAAE,kBAAkB;IAC9B,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,eAAe;IACxB,aAAa,EAAE,qBAAqB;IACpC,SAAS,EAAE,iBAAiB;IAC5B,aAAa,EAAE,sBAAsB;IACrC,aAAa,EAAE,sBAAsB;CAC7B,CAAC;AAEX;;GAEG;AACH,MAAM,UAAU,qCAAqC,CACnD,GAAQ,EACR,IAAY;IAEZ,MAAM,KAAK,GAAG,6BAA6B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,yBAAyB,CACjC,gCAAgC,IAAI,YAAY,CACjD,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAQ,EACR,IAAY;IAEZ,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-query.d.ts

@@ -0,0 +1,39 @@
+import type { SimIamSigV4CredentialScope } from "../sim-iam-sigv4-credential-scope.js";
+import type { SimIamSigV4SignatureStatement } from "../sim-iam-sigv4-signature-statement.js";
+/**
+ * The signature a presigned URL carries in its query string.
+ *
+ * A presigned URL states in query parameters exactly what an `Authorization`
+ * header states, plus the lifetime it was signed for. That is the whole of the
+ * difference: the canonical request, the signing key and the comparison are
+ * the same work, which is why this is a second way of reading a signature
+ * rather than a second way of verifying one.
+ */
+export declare class SimIamSigV4PresignedQuery implements SimIamSigV4SignatureStatement {
+    readonly accessKeyId: string;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly signedHeaderNames: readonly string[];
+    readonly signature: string;
+    readonly amzDate: string;
+    readonly sessionToken: string | undefined;
+    private readonly window;
+    private constructor();
+    /**
+     * Whether a URL offers a presigned signature to verify.
+     *
+     * Presence of `X-Amz-Algorithm` is the test, not its value. A request
+     * carrying that parameter is unambiguously an attempt at a presigned URL, so
+     * an unsupported algorithm belongs in a refusal that says so rather than in
+     * a silent fall through to anonymous.
+     */
+    static carriedBy(url: URL): boolean;
+    /**
+     * Read a presigned URL's signature, or fail describing what was missing.
+     */
+    static parse(url: URL): SimIamSigV4PresignedQuery;
+    /**
+     * Refuse this URL if simulated time has passed the window it was signed for.
+     */
+    checkNotExpired(now: Date): void;
+}
+//# sourceMappingURL=sim-iam-sigv4-presigned-query.d.ts.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-query.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-query.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAY7F;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,YAAW,6BAA6B;IAC7E,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,KAAK,EAAE,0BAA0B,CAAC;IAClD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,OAAO,eA4BN;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAIlC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,yBAAyB,CAEhD;IAED;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAE/B;CACF"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-query.js

@@ -0,0 +1,59 @@
+import { simIamSigV4CheckedAmzDate } from "../sim-iam-sigv4-request-date.js";
+import { simIamSigV4CheckPresignedAlgorithm, SimIamSigV4PresignedCredential, } from "./sim-iam-sigv4-presigned-credential.js";
+import { simIamSigV4PresignedParameter, simIamSigV4PresignedParameters as parameters, simIamSigV4RequiredPresignedParameter as required, } from "./sim-iam-sigv4-presigned-parameters.js";
+import { SimIamSigV4PresignedWindow } from "./sim-iam-sigv4-presigned-window.js";
+/**
+ * The signature a presigned URL carries in its query string.
+ *
+ * A presigned URL states in query parameters exactly what an `Authorization`
+ * header states, plus the lifetime it was signed for. That is the whole of the
+ * difference: the canonical request, the signing key and the comparison are
+ * the same work, which is why this is a second way of reading a signature
+ * rather than a second way of verifying one.
+ */
+export class SimIamSigV4PresignedQuery {
+    accessKeyId;
+    scope;
+    signedHeaderNames;
+    signature;
+    amzDate;
+    sessionToken;
+    window;
+    constructor(url) {
+        simIamSigV4CheckPresignedAlgorithm(required(url, parameters.algorithm));
+        const credential = SimIamSigV4PresignedCredential.parse(required(url, parameters.credential));
+        this.accessKeyId = credential.accessKeyId;
+        this.scope = credential.scope;
+        this.amzDate = simIamSigV4CheckedAmzDate(simIamSigV4PresignedParameter(url, parameters.date) ?? null, this.scope, "X-Amz-Date parameter");
+        this.signedHeaderNames = required(url, parameters.signedHeaders)
+            .split(";")
+            .map((name) => name.toLowerCase());
+        this.signature = required(url, parameters.signature);
+        this.sessionToken = simIamSigV4PresignedParameter(url, parameters.securityToken);
+        this.window = new SimIamSigV4PresignedWindow(this.amzDate, SimIamSigV4PresignedWindow.expirySeconds(simIamSigV4PresignedParameter(url, parameters.expires)));
+    }
+    /**
+     * Whether a URL offers a presigned signature to verify.
+     *
+     * Presence of `X-Amz-Algorithm` is the test, not its value. A request
+     * carrying that parameter is unambiguously an attempt at a presigned URL, so
+     * an unsupported algorithm belongs in a refusal that says so rather than in
+     * a silent fall through to anonymous.
+     */
+    static carriedBy(url) {
+        return (simIamSigV4PresignedParameter(url, parameters.algorithm) !== undefined);
+    }
+    /**
+     * Read a presigned URL's signature, or fail describing what was missing.
+     */
+    static parse(url) {
+        return new SimIamSigV4PresignedQuery(url);
+    }
+    /**
+     * Refuse this URL if simulated time has passed the window it was signed for.
+     */
+    checkNotExpired(now) {
+        this.window.checkNotExpired(now);
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-presigned-query.js.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-query.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-query.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAE7E,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,IAAI,UAAU,EAC5C,qCAAqC,IAAI,QAAQ,GAClD,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAAyB;IACpB,WAAW,CAAS;IACpB,KAAK,CAA6B;IAClC,iBAAiB,CAAoB;IACrC,SAAS,CAAS;IAClB,OAAO,CAAS;IAChB,YAAY,CAAqB;IAEhC,MAAM,CAA6B;IAEpD,YAAoB,GAAQ;QAC1B,kCAAkC,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAExE,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CACrD,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CACrC,CAAC;QAEF,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,yBAAyB,CACtC,6BAA6B,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,EAC3D,IAAI,CAAC,KAAK,EACV,sBAAsB,CACvB,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,aAAa,CAAC;aAC7D,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,6BAA6B,CAC/C,GAAG,EACH,UAAU,CAAC,aAAa,CACzB,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,0BAA0B,CAC1C,IAAI,CAAC,OAAO,EACZ,0BAA0B,CAAC,aAAa,CACtC,6BAA6B,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CACvD,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,CAAC,GAAQ;QACvB,OAAO,CACL,6BAA6B,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,CACvE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,GAAQ;QACnB,OAAO,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAS;QACvB,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-window.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The window of time a presigned URL is usable in.
+ *
+ * A presigned URL is the one signed request that carries its own lifetime:
+ * `X-Amz-Expires` says how many seconds after `X-Amz-Date` it stops working.
+ * Both are signed, so neither can be stretched by whoever holds the URL.
+ */
+export declare class SimIamSigV4PresignedWindow {
+    private readonly signedAt;
+    private readonly expiresSeconds;
+    constructor(amzDate: string, expiresSeconds: number);
+    /**
+     * Read the stated lifetime, refusing one AWS would not have signed.
+     *
+     * AWS caps a presigned lifetime at seven days, so a longer one cannot have
+     * come from a signer this simulation should accept. Refusing it here is the
+     * fail-closed answer: honouring it would let a test prove a URL works that
+     * real S3 would never have issued.
+     */
+    static expirySeconds(value: string | undefined): number;
+    /**
+     * The instant this URL stops working.
+     */
+    expiresAt(): Date;
+    /**
+     * Refuse a URL used after its window, in simulated time.
+     */
+    checkNotExpired(now: Date): void;
+}
+//# sourceMappingURL=sim-iam-sigv4-presigned-window.d.ts.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-window.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-window.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAO;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,YAAY,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAGlD;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAuBtD;IAED;;OAEG;IACH,SAAS,IAAI,IAAI,CAEhB;IAED;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAa/B;CACF"}

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-window.js

@@ -0,0 +1,64 @@
+import { SimIamIncompleteSignature, SimIamPresignedRequestExpired, } from "../error/sim-iam-sigv4.error.js";
+import { simIamSigV4SignedAt } from "../sim-iam-sigv4-request-date.js";
+/**
+ * The longest window AWS will presign for, seven days in seconds.
+ */
+const maximumExpirySeconds = 604_800;
+const secondsPattern = /^\d+$/;
+/**
+ * The window of time a presigned URL is usable in.
+ *
+ * A presigned URL is the one signed request that carries its own lifetime:
+ * `X-Amz-Expires` says how many seconds after `X-Amz-Date` it stops working.
+ * Both are signed, so neither can be stretched by whoever holds the URL.
+ */
+export class SimIamSigV4PresignedWindow {
+    signedAt;
+    expiresSeconds;
+    constructor(amzDate, expiresSeconds) {
+        this.signedAt = simIamSigV4SignedAt(amzDate);
+        this.expiresSeconds = expiresSeconds;
+    }
+    /**
+     * Read the stated lifetime, refusing one AWS would not have signed.
+     *
+     * AWS caps a presigned lifetime at seven days, so a longer one cannot have
+     * come from a signer this simulation should accept. Refusing it here is the
+     * fail-closed answer: honouring it would let a test prove a URL works that
+     * real S3 would never have issued.
+     */
+    static expirySeconds(value) {
+        if (value === undefined || value.length === 0) {
+            throw new SimIamIncompleteSignature("Presigned URL carries no X-Amz-Expires parameter");
+        }
+        if (!secondsPattern.test(value)) {
+            throw new SimIamIncompleteSignature(`Presigned URL X-Amz-Expires ${value} must be a whole number of seconds`);
+        }
+        const seconds = Number(value);
+        if (seconds < 1 || seconds > maximumExpirySeconds) {
+            throw new SimIamIncompleteSignature(`Presigned URL X-Amz-Expires ${value} is outside the 1 to ` +
+                `${String(maximumExpirySeconds)} seconds AWS signs for`);
+        }
+        return seconds;
+    }
+    /**
+     * The instant this URL stops working.
+     */
+    expiresAt() {
+        return new Date(this.signedAt.getTime() + this.expiresSeconds * 1000);
+    }
+    /**
+     * Refuse a URL used after its window, in simulated time.
+     */
+    checkNotExpired(now) {
+        const expiresAt = this.expiresAt();
+        if (now.getTime() <= expiresAt.getTime()) {
+            return;
+        }
+        throw new SimIamPresignedRequestExpired(`Request has expired. The presigned URL was signed at ` +
+            `${this.signedAt.toISOString()} for ${String(this.expiresSeconds)} ` +
+            `seconds, so it expired at ${expiresAt.toISOString()}, and simulated ` +
+            `time is now ${now.toISOString()}.`);
+    }
+}
+//# sourceMappingURL=sim-iam-sigv4-presigned-window.js.map

package/dist/service/iam/sigv4/presign/sim-iam-sigv4-presigned-window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-presigned-window.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/presign/sim-iam-sigv4-presigned-window.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE;;GAEG;AACH,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAErC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,QAAQ,CAAO;IACf,cAAc,CAAS;IAExC,YAAY,OAAe,EAAE,cAAsB;QACjD,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,aAAa,CAAC,KAAyB;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,yBAAyB,CACjC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,yBAAyB,CACjC,+BAA+B,KAAK,oCAAoC,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,oBAAoB,EAAE,CAAC;YAClD,MAAM,IAAI,yBAAyB,CACjC,+BAA+B,KAAK,uBAAuB;gBACzD,GAAG,MAAM,CAAC,oBAAoB,CAAC,wBAAwB,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAS;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEnC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,6BAA6B,CACrC,uDAAuD;YACrD,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG;YACpE,6BAA6B,SAAS,CAAC,WAAW,EAAE,kBAAkB;YACtE,eAAe,GAAG,CAAC,WAAW,EAAE,GAAG,CACtC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-authorization.d.ts

@@ -1,4 +1,5 @@
 import { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+import type { SimIamSigV4SignatureStatement } from "./sim-iam-sigv4-signature-statement.js";
 export declare const simIamSigV4Algorithm = "AWS4-HMAC-SHA256";
 interface SimIamSigV4AuthorizationProperties {
     readonly accessKeyId: string;
@@ -13,7 +14,7 @@ interface SimIamSigV4AuthorizationProperties {
  * canonicalize exactly the headers the signer chose, not whichever headers the
  * request happens to carry now.
  */
-export declare class SimIamSigV4Authorization {
+export declare class SimIamSigV4Authorization implements SimIamSigV4SignatureStatement {
     readonly accessKeyId: string;
     readonly scope: SimIamSigV4CredentialScope;
     readonly signedHeaderNames: readonly string[];

package/dist/service/iam/sigv4/sim-iam-sigv4-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-authorization.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,KAAK,EAAE,0BAA0B,CAAC;IAClD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,wBAAwB,CAoCjE;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IAiBrB,OAAO,CAAC,MAAM,CAAC,KAAK;CAcrB"}
+{"version":3,"file":"sim-iam-sigv4-authorization.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,6BAA6B;IAC5E,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,KAAK,EAAE,0BAA0B,CAAC;IAClD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,wBAAwB,CAoCjE;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IAiBrB,OAAO,CAAC,MAAM,CAAC,KAAK;CAcrB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-authorization.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AASvD;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnB,WAAW,CAAS;IACpB,KAAK,CAA6B;IAClC,iBAAiB,CAAoB;IACrC,SAAS,CAAS;IAElC,YAAY,UAA8C;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAA0B;QACrC,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,yBAAyB,CACjC,kCAAkC,MAAM,CAAC,SAAS,CAAC,WACjD,oBACF,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAyB,CACjC,mCAAmC,UAAU,WAAW;gBACtD,yBAAyB,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,wBAAwB,CAAC;YAClC,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YAC3C,KAAK,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC;iBACnD,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,MAAM,CAAC,KAAa;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAErC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CACR,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAChC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAClC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,KAAK,CAClB,MAAmC,EACnC,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,yBAAyB,CACjC,uCAAuC,IAAI,QAAQ,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4-authorization.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAGjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AASvD;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnB,WAAW,CAAS;IACpB,KAAK,CAA6B;IAClC,iBAAiB,CAAoB;IACrC,SAAS,CAAS;IAElC,YAAY,UAA8C;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAA0B;QACrC,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,yBAAyB,CACjC,kCAAkC,MAAM,CAAC,SAAS,CAAC,WACjD,oBACF,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAyB,CACjC,mCAAmC,UAAU,WAAW;gBACtD,yBAAyB,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,wBAAwB,CAAC;YAClC,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YAC3C,KAAK,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC;iBACnD,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,MAAM,CAAC,KAAa;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAErC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CACR,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAChC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAClC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,KAAK,CAClB,MAAmC,EACnC,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,yBAAyB,CACjC,uCAAuC,IAAI,QAAQ,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.d.ts

@@ -10,7 +10,28 @@ import type { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scop
  * would buy nothing a caller could assert on, and would break every client that
  * stamps real time and has no way to know what time this simulation is keeping.
  * This is a documented divergence from real AWS, which enforces a five minute
- * window.
+ * window. A presigned URL is the exception: it states its own lifetime in
+ * `X-Amz-Expires`, and that lifetime is enforced, in simulated time.
  */
 export declare function simIamSigV4RequestDate(headers: Headers, scope: SimIamSigV4CredentialScope): string;
+/**
+ * Check a signing stamp from wherever the request carried it.
+ *
+ * A presigned URL states the same value in its query string rather than in a
+ * header, so the source is named by the caller and appears in any complaint
+ * about the stamp.
+ */
+export declare function simIamSigV4CheckedAmzDate(amzDate: string | null, scope: SimIamSigV4CredentialScope, source: string): string;
+/**
+ * The instant an `X-Amz-Date` stamp names.
+ *
+ * The stamp is ISO 8601 basic form, which `Date` does not parse, so the
+ * separators of the extended form are put back before it is read.
+ *
+ * The result is checked to name the day and time it was built from. Digits
+ * alone do not make a date: `Date` reads 24:60:00 as no instant at all, and
+ * quietly rolls February 30th forward into March, which would give a presigned
+ * URL a window nothing signed. Both are refused rather than honoured.
+ */
+export declare function simIamSigV4SignedAt(amzDate: string): Date;
 //# sourceMappingURL=sim-iam-sigv4-request-date.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-request-date.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAItF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,GAChC,MAAM,CA2BR"}
+{"version":3,"file":"sim-iam-sigv4-request-date.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAItF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,GAChC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,KAAK,EAAE,0BAA0B,EACjC,MAAM,EAAE,MAAM,GACb,MAAM,CAsBR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAiCzD"}

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.js

@@ -1,5 +1,5 @@
 import { SimIamIncompleteSignature } from "./error/sim-iam-sigv4.error.js";
-const amzDatePattern = /^(?<dateStamp>\d{8})T\d{6}Z$/;
+const amzDatePattern = /^(?<dateStamp>\d{8})T(?<time>\d{6})Z$/;
 /**
  * Read the `X-Amz-Date` a request was signed at.
  *
@@ -11,21 +11,63 @@ const amzDatePattern = /^(?<dateStamp>\d{8})T\d{6}Z$/;
  * would buy nothing a caller could assert on, and would break every client that
  * stamps real time and has no way to know what time this simulation is keeping.
  * This is a documented divergence from real AWS, which enforces a five minute
- * window.
+ * window. A presigned URL is the exception: it states its own lifetime in
+ * `X-Amz-Expires`, and that lifetime is enforced, in simulated time.
  */
 export function simIamSigV4RequestDate(headers, scope) {
-    const amzDate = headers.get("x-amz-date");
+    return simIamSigV4CheckedAmzDate(headers.get("x-amz-date"), scope, "X-Amz-Date header");
+}
+/**
+ * Check a signing stamp from wherever the request carried it.
+ *
+ * A presigned URL states the same value in its query string rather than in a
+ * header, so the source is named by the caller and appears in any complaint
+ * about the stamp.
+ */
+export function simIamSigV4CheckedAmzDate(amzDate, scope, source) {
     if (amzDate === null || amzDate.length === 0) {
-        throw new SimIamIncompleteSignature("Signed request carries no X-Amz-Date header");
+        throw new SimIamIncompleteSignature(`Signed request carries no ${source}`);
     }
     const dateStamp = amzDatePattern.exec(amzDate)?.groups?.["dateStamp"];
     if (dateStamp === undefined) {
-        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} must be an ISO 8601 basic stamp, ` +
-            `YYYYMMDDTHHMMSSZ`);
+        throw new SimIamIncompleteSignature(`${source} ${amzDate} must be an ISO 8601 basic stamp, YYYYMMDDTHHMMSSZ`);
     }
     if (dateStamp !== scope.dateStamp) {
-        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} is not on the day its credential scope names, ${scope.dateStamp}`);
+        throw new SimIamIncompleteSignature(`${source} ${amzDate} is not on the day its credential scope names, ${scope.dateStamp}`);
     }
     return amzDate;
 }
+/**
+ * The instant an `X-Amz-Date` stamp names.
+ *
+ * The stamp is ISO 8601 basic form, which `Date` does not parse, so the
+ * separators of the extended form are put back before it is read.
+ *
+ * The result is checked to name the day and time it was built from. Digits
+ * alone do not make a date: `Date` reads 24:60:00 as no instant at all, and
+ * quietly rolls February 30th forward into March, which would give a presigned
+ * URL a window nothing signed. Both are refused rather than honoured.
+ */
+export function simIamSigV4SignedAt(amzDate) {
+    const parts = amzDatePattern.exec(amzDate)?.groups;
+    /* v8 ignore if -- a stamp is always checked before it is read */
+    if (parts === undefined) {
+        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} is not an ISO 8601 basic stamp`);
+    }
+    const dateStamp = String(parts["dateStamp"]);
+    const time = String(parts["time"]);
+    const date = [
+        dateStamp.slice(0, 4),
+        dateStamp.slice(4, 6),
+        dateStamp.slice(6, 8),
+    ].join("-");
+    const clockTime = [time.slice(0, 2), time.slice(2, 4), time.slice(4, 6)].join(":");
+    const signedAt = new Date(`${date}T${clockTime}Z`);
+    if (Number.isNaN(signedAt.getTime()) ||
+        signedAt.toISOString() !== `${date}T${clockTime}.000Z`) {
+        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} is not a real instant: there is no ` +
+            `${clockTime} on ${date}`);
+    }
+    return signedAt;
+}
 //# sourceMappingURL=sim-iam-sigv4-request-date.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-request-date.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,KAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE1C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CACjC,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;IAEtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,oCAAoC;YACvD,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,kDACnB,KAAK,CAAC,SACR,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-request-date.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,KAAiC;IAEjC,OAAO,yBAAyB,CAC9B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EACzB,KAAK,EACL,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAsB,EACtB,KAAiC,EACjC,MAAc;IAEd,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;IAEtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CACjC,GAAG,MAAM,IAAI,OAAO,oDAAoD,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,yBAAyB,CACjC,GAAG,MAAM,IAAI,OAAO,kDAClB,KAAK,CAAC,SACR,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEnD,iEAAiE;IACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,iCAAiC,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3E,GAAG,CACJ,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;IAEnD,IACE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,IAAI,SAAS,OAAO,EACtD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,sCAAsC;YACzD,GAAG,SAAS,OAAO,IAAI,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.d.ts

@@ -1,10 +1,17 @@
-import type { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
+import type { SimIamSigV4PayloadDeclaration } from "./canonical/sim-iam-sigv4-payload-hash.js";
+import type { SimIamSigV4SignatureStatement } from "./sim-iam-sigv4-signature-statement.js";
 import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js";
 interface SimIamSigV4SignatureCheckInput {
     readonly signedRequest: SimIamSigV4SignedRequest;
-    readonly authorization: SimIamSigV4Authorization;
+    readonly statement: SimIamSigV4SignatureStatement;
     readonly signingKey: Buffer;
     readonly amzDate: string;
+    /**
+     * How the request declared its payload hash. Omitted for a header-signed
+     * request, which declares it in a header the canonical request can read for
+     * itself.
+     */
+    readonly payload?: SimIamSigV4PayloadDeclaration | undefined;
 }
 /**
  * Rebuild the signature the request should carry, and refuse it otherwise.

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signature-check.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAMlF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,8BAA8B,GACpC,IAAI,CAwBN"}
+{"version":3,"file":"sim-iam-sigv4-signature-check.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAG/F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAC5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAMlF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,8BAA8B,GACpC,IAAI,CAyBN"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js

@@ -10,16 +10,16 @@ import { simIamSigV4Signature, simIamSigV4StringToSign, } from "./sim-iam-sigv4-
  * the bytes the simulator signed over.
  */
 export function simIamSigV4CheckSignature(input) {
-    const { signedRequest, authorization, signingKey, amzDate } = input;
-    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, authorization.signedHeaderNames).toString();
+    const { signedRequest, statement, signingKey, amzDate, payload } = input;
+    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, statement.signedHeaderNames, payload).toString();
     const expected = simIamSigV4Signature(signingKey, simIamSigV4StringToSign({
         amzDate,
-        scope: authorization.scope,
+        scope: statement.scope,
         canonicalRequest,
     }));
-    if (!simIamSigV4SignaturesMatch(expected, authorization.signature)) {
+    if (!simIamSigV4SignaturesMatch(expected, statement.signature)) {
         throw new SimIamSignatureDoesNotMatch(`Request signature does not match the signature the simulator ` +
-            `calculated for access key ${authorization.accessKeyId}`, canonicalRequest);
+            `calculated for access key ${statement.accessKeyId}`, canonicalRequest);
     }
 }
 //# sourceMappingURL=sim-iam-sigv4-signature-check.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AASxC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEpE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,aAAa,CAAC,iBAAiB,CAChC,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,aAAa,CAAC,WAAW,EAAE,EAC1D,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAE7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAexC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEzE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,SAAS,CAAC,iBAAiB,EAC3B,OAAO,CACR,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,SAAS,CAAC,WAAW,EAAE,EACtD,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}