@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/aws/sim-aws.js

@@ -4,7 +4,7 @@ import { SimAwsServiceFactory } from "./factory/sim-aws-service-factory.js";
 import { SimAwsScopeRegistry } from "./scope/sim-aws-scope-registry.js";
 import { simAwsRunAsContext } from "./caller/sim-aws-run-as-context.js";
 import { SimAwsTimekeeping } from "./sim-aws-timekeeping.js";
-import { simIamSigV4SignedRequest } from "../iam/sigv4/sim-iam-sigv4-signed-request.js";
+import { SimAwsRequestAuthentication } from "./sim-aws-request-authentication.js";
 /**
  * Top-level container for simulated AWS.
  * Contains Account scopes, Region scopes, Account/Region scopes, and built-in
@@ -25,6 +25,7 @@ export class SimAws {
     background;
     scopes;
     timekeeping;
+    requestAuthentication;
     constructor(properties = {}) {
         const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, background: suppliedBackground, } = properties;
         const timekeeping = new SimAwsTimekeeping({
@@ -42,6 +43,10 @@ export class SimAws {
         });
         this.iamRegistry = this.serviceFactory.iamRegistry;
         this.scopes = new SimAwsScopeRegistry({ simAws: this });
+        this.requestAuthentication = new SimAwsRequestAuthentication({
+            serviceFactory: this.serviceFactory,
+            clock: background,
+        });
     }
     /**
      * Get the current time in this simulated AWS environment.
@@ -86,7 +91,7 @@ export class SimAws {
      * Throws a SimIamSigV4Error carrying the AWS error code real AWS would use.
      */
     verifySignedRequest(request, body) {
-        return this.serviceFactory.signedRequests.verify(simIamSigV4SignedRequest(request, body));
+        return this.requestAuthentication.verifySignature(request, body);
     }
     /**
      * Work out which simulated principal an HTTP request is made by.
@@ -97,11 +102,10 @@ export class SimAws {
      * a request offering neither is anonymous rather than the Account root.
      *
      * The body is passed separately for the same reason it is on
-     * `verifySignedRequest`: a request body can only be read once, and whoever
-     * serves the request needs the same bytes.
+     * `verifySignedRequest`: a request body can only be read once.
      */
     resolveRequestCaller(request, options = {}) {
-        return this.serviceFactory.requestCallers.resolve(simIamSigV4SignedRequest(request, options.body), options.expectedScope);
+        return this.requestAuthentication.resolveCaller(request, options);
     }
     /**
      * Get a simulated AWS Account.
@@ -151,6 +155,12 @@ export class SimAws {
     iam() {
         return this.accountRegionScope().iam();
     }
+    /**
+     * Get simulated KMS in the default Account Region scope.
+     */
+    kms() {
+        return this.accountRegionScope().kms();
+    }
     /**
      * Get simulated Lambda in the default Account Region scope.
      */
@@ -175,27 +185,6 @@ export class SimAws {
     sts() {
         return this.accountRegionScope().sts();
     }
-    /**
-     * Get the shared simulated CloudFront registry.
-     *
-     * This is intended for CloudFront service/controller wiring so request routing
-     * uses the same registry as CloudFront SDK command handling.
-     * @internal
-     */
-    cloudFrontRegistry() {
-        return this.serviceFactory.cloudFrontRegistry;
-    }
-    /**
-     * Get the shared simulated Lambda Function URL registry.
-     *
-     * This is intended for Lambda controller wiring, so serving a Function URL
-     * request resolves the owning Account from the same registry the Function
-     * URL commands register ids in.
-     * @internal
-     */
-    lambdaUrlRegistry() {
-        return this.serviceFactory.lambdaUrlRegistry;
-    }
     /**
      * Run a function with an ambient simulated caller for this SimAws instance.
      *

package/dist/service/aws/sim-aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws.js","sourceRoot":"","sources":["../../../src/service/aws/sim-aws.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAEL,2BAA2B,GAE5B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAOxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAM7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAGxF;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACD,gBAAgB,CAAkB;IAClC,iBAAiB,CAAgB;IACjD;;;OAGG;IACa,cAAc,CAAuB;IAErD;;OAEG;IACa,WAAW,CAAiB;IAE3B,UAAU,CAA4C;IACtD,MAAM,CAAsB;IAC5B,WAAW,CAAoB;IAEhD,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,gBAAgB,GAAG,0BAA0B,EAC7C,iBAAiB,GAAG,2BAA2B,EAC/C,KAAK,EACL,UAAU,EAAE,kBAAkB,GAC/B,GAAG,UAAU,CAAC;QAEf,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;QAE1C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,MAAM,EAAE,IAAI;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAgB,EAChB,IAAiB;QAEjB,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,CAC9C,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CACxC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,oBAAoB,CAClB,OAAgB,EAChB,OAAO,GAA+B,EAAE;QAExC,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,OAAO,CAC/C,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAC/C,OAAO,CAAC,aAAa,CACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAS,GAA6B,IAAI,CAAC,gBAAgB;QAE3D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAA4B,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,SAAS,GAAoB,IAAI,CAAC,gBAAgB,EAClD,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QAElD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,cAAc,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,EAAE;QACA,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAI,MAAuB,EAAE,GAAqB;QAC3D,OAAO,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-aws.js","sourceRoot":"","sources":["../../../src/service/aws/sim-aws.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAEL,2BAA2B,GAE5B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAQxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAQlF;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACD,gBAAgB,CAAkB;IAClC,iBAAiB,CAAgB;IACjD;;;OAGG;IACa,cAAc,CAAuB;IAErD;;OAEG;IACa,WAAW,CAAiB;IAE3B,UAAU,CAA4C;IACtD,MAAM,CAAsB;IAC5B,WAAW,CAAoB;IAC/B,qBAAqB,CAA8B;IAEpE,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,gBAAgB,GAAG,0BAA0B,EAC7C,iBAAiB,GAAG,2BAA2B,EAC/C,KAAK,EACL,UAAU,EAAE,kBAAkB,GAC/B,GAAG,UAAU,CAAC;QAEf,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;QAE1C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,MAAM,EAAE,IAAI;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CACjB,OAAgB,EAChB,IAAiB;QAEjB,OAAO,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;;OAUG;IACH,oBAAoB,CAClB,OAAgB,EAChB,OAAO,GAA+B,EAAE;QAExC,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAS,GAA6B,IAAI,CAAC,gBAAgB;QAE3D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAA4B,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,SAAS,GAAoB,IAAI,CAAC,gBAAgB,EAClD,UAAU,GAAkB,IAAI,CAAC,iBAAiB;QAElD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,cAAc,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,EAAE;QACA,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAI,MAAuB,EAAE,GAAqB;QAC3D,OAAO,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAGhG;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,yBAAyB,EACnC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAMV"}
+{"version":3,"file":"sim-cfn-resource-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAGhG;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,yBAAyB,EACnC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAIV"}

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.js

@@ -22,6 +22,6 @@ export function parseSimCfnResourceDependencies(dependsOn) {
  */
 export function parseSimCfnResourceRefDependencies(template, resourceLogicalIds) {
     const referencedNames = parseSimCfnNode(template).referencedNames();
-    return [...new Set(referencedNames)].filter((name) => resourceLogicalIds.has(name));
+    return [...new Set(referencedNames).intersection(resourceLogicalIds)];
 }
 //# sourceMappingURL=sim-cfn-resource-dependencies.js.map

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-dependencies.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE;YAC3D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAmC,EACnC,kBAAuC;IAEvC,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAC7B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-cfn-resource-dependencies.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE;YAC3D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAmC,EACnC,kBAAuC;IAEvC,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js

@@ -12,7 +12,7 @@ export class SimCloudFrontControllerDependenciesFactory {
      */
     make(properties = {}) {
         const simAws = properties.simAws ?? new SimAws();
-        const cloudFrontRegistry = properties.cloudFrontRegistry ?? simAws.cloudFrontRegistry();
+        const cloudFrontRegistry = properties.cloudFrontRegistry ?? simAws.serviceFactory.cloudFrontRegistry;
         return {
             distroRouter: properties.distroRouter ??
                 new DefaultSimCloudFrontDistroRouter({

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-controller-dependency.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/controller/dependency/sim-cf-controller-dependency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAE9H,OAAO,EAAE,6BAA6B,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC5I,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAkBxF;;GAEG;AACH,MAAM,OAAO,0CAA0C;IACrD;;OAEG;IACH,IAAI,CACF,UAAU,GAA6C,EAAE;QAEzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QACjD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAE/D,OAAO;YACL,YAAY,EACV,UAAU,CAAC,YAAY;gBACvB,IAAI,gCAAgC,CAAC;oBACnC,MAAM;oBACN,kBAAkB;iBACnB,CAAC;YACJ,iBAAiB,EACf,UAAU,CAAC,iBAAiB;gBAC5B,IAAI,oCAAoC,EAAE;YAC5C,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,IAAI,gBAAgB,EAAE;YACjE,aAAa,EACX,UAAU,CAAC,aAAa,IAAI,IAAI,0BAA0B,EAAE;SAC/D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cf-controller-dependency.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/controller/dependency/sim-cf-controller-dependency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAE9H,OAAO,EAAE,6BAA6B,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC5I,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAkBxF;;GAEG;AACH,MAAM,OAAO,0CAA0C;IACrD;;OAEG;IACH,IAAI,CACF,UAAU,GAA6C,EAAE;QAEzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QACjD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC;QAE5E,OAAO;YACL,YAAY,EACV,UAAU,CAAC,YAAY;gBACvB,IAAI,gCAAgC,CAAC;oBACnC,MAAM;oBACN,kBAAkB;iBACnB,CAAC;YACJ,iBAAiB,EACf,UAAU,CAAC,iBAAiB;gBAC5B,IAAI,oCAAoC,EAAE;YAC5C,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,IAAI,gBAAgB,EAAE;YACjE,aAAa,EACX,UAAU,CAAC,aAAa,IAAI,IAAI,0BAA0B,EAAE;SAC/D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-distro-router.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,gDAAgD,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAClC,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqC;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAE,mCAAwC,EAkB/D;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,yBAAyB,EAAE,GACzC,yBAAyB,CAM3B;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,wBAAwB,GAAG,SAAS,CAatE;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAExE;CACF"}
+{"version":3,"file":"sim-cloud-front-distro-router.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,gDAAgD,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAClC,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqC;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAE,mCAAwC,EAmB/D;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,yBAAyB,EAAE,GACzC,yBAAyB,CAM3B;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,wBAAwB,GAAG,SAAS,CAatE;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAExE;CACF"}

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.js

@@ -18,7 +18,8 @@ export class SimCloudFrontDistroRouter {
     distroIdRouter;
     constructor(properties = {}) {
         this.simAws = properties.simAws ?? new SimAws();
-        const cloudFrontRegistry = properties.cloudFrontRegistry ?? this.simAws.cloudFrontRegistry();
+        const cloudFrontRegistry = properties.cloudFrontRegistry ??
+            this.simAws.serviceFactory.cloudFrontRegistry;
         const distributions = properties.distributions ?? new Map();
         // Both sub-routers share the same SimAws, Registry and Distributions
         // snapshot so their lookups stay consistent within a single request.

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-distro-router.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAG9E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAgBrF;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,qBAAqB,CAAqC;IAC1D,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAwC,EAAE;QAC9D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACpE,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,GAAG,EAAE,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,qBAAqB,GAAG,IAAI,kCAAkC,CAAC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAA0C;QAE1C,OAAO,IAAI,yBAAyB,CAAC;YACnC,aAAa,EAAE,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC7D,aAAa,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC;QAE9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF"}
+{"version":3,"file":"sim-cloud-front-distro-router.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAG9E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAgBrF;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,qBAAqB,CAAqC;IAC1D,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAwC,EAAE;QAC9D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB;YAC7B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC;QAChD,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,GAAG,EAAE,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,qBAAqB,GAAG,IAAI,kCAAkC,CAAC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAA0C;QAE1C,OAAO,IAAI,yBAAyB,CAAC;YACnC,aAAa,EAAE,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC7D,aAAa,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC;QAE9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -1,6 +1,11 @@
 interface SimIamAllowSidesProperties {
     readonly identity: boolean;
     readonly resource: boolean;
+    /**
+     * Whether a resource-policy Allow named the caller rather than its Account.
+     * Defaults to the resource side, for callers with no reason to distinguish.
+     */
+    readonly resourceDirect?: boolean | undefined;
 }
 /**
  * Which sides of a policy evaluation produced a matching Allow.
@@ -13,6 +18,7 @@ interface SimIamAllowSidesProperties {
 export declare class SimIamAllowSides {
     private readonly identityAllowed;
     private readonly resourceAllowed;
+    private readonly resourceDirectAllowed;
     constructor(properties: SimIamAllowSidesProperties);
     /**
      * Whether an identity-based policy allowed the request.
@@ -22,6 +28,16 @@ export declare class SimIamAllowSides {
      * Whether a resource-based policy allowed the request.
      */
     get resource(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by delegating to the caller's Account.
+     */
+    get resourceDirect(): boolean;
+    /**
+     * Whether the resource's policy admitted the caller only by delegating to
+     * its Account, which grants nothing on its own.
+     */
+    get resourceDelegated(): boolean;
 }
 /**
  * Which sides of an authorization must allow a request for it to be allowed.
@@ -56,5 +72,45 @@ export declare class SimIamBothSidesAllowRequirement implements SimIamAllowRequi
      */
     isSatisfiedBy(allows: SimIamAllowSides): boolean;
 }
+/**
+ * The rule for a resource whose policy is mandatory: it must admit the caller.
+ *
+ * Most AWS resources have no resource policy until someone writes one, and its
+ * absence simply leaves the decision to IAM. A KMS key is not like that: it
+ * always has a key policy, and an identity policy cannot reach the key unless
+ * that policy admits the caller. Services holding such a resource ask for this
+ * rule rather than IAM inferring it, because only the service knows its
+ * resource works that way.
+ *
+ * How the policy admits the caller decides what else is needed. A statement
+ * naming the caller grants access outright, which is why a KMS key policy can
+ * make a key usable by a Role with no permissions of its own. A statement
+ * naming the Account only delegates to that Account's IAM, so an identity
+ * policy still has to allow the action. That second case is the one the
+ * default key policy creates, and getting it wrong would make every key in the
+ * simulation usable by every principal in its Account.
+ */
+export declare class SimIamMandatoryResourcePolicyRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether the resource's own policy admitted the caller, and whether
+     * anything further is needed for the way it did so.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * Every applicable rule at once.
+ *
+ * A request can be subject to more than one: a cross-Account call against a
+ * KMS key has to satisfy both the cross-Account rule and the key's own
+ * mandatory-policy rule, and the stricter answer is the right one.
+ */
+export declare class SimIamEveryAllowRequirement implements SimIamAllowRequirement {
+    private readonly requirements;
+    constructor(requirements: readonly SimIamAllowRequirement[]);
+    /**
+     * Whether every rule is satisfied.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
 export {};
 //# sourceMappingURL=sim-iam-allow-requirement.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAE1C,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,gCAAiC,YAAW,sBAAsB;IAC7E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,sBAAsB;IAC5E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF"}
+{"version":3,"file":"sim-iam-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAEhD,YAAY,UAAU,EAAE,0BAA0B,EAKjD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;OAGG;IACH,IAAI,iBAAiB,IAAI,OAAO,CAE/B;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,gCAAiC,YAAW,sBAAsB;IAC7E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,sBAAsB;IAC5E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,wCAAyC,YAAW,sBAAsB;IACrF;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAM/C;CACF;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,sBAAsB;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IAEjE,YAAY,YAAY,EAAE,SAAS,sBAAsB,EAAE,EAE1D;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAI/C;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -9,9 +9,12 @@
 export class SimIamAllowSides {
     identityAllowed;
     resourceAllowed;
+    resourceDirectAllowed;
     constructor(properties) {
         this.identityAllowed = properties.identity;
         this.resourceAllowed = properties.resource;
+        this.resourceDirectAllowed =
+            properties.resourceDirect ?? properties.resource;
     }
     /**
      * Whether an identity-based policy allowed the request.
@@ -25,6 +28,20 @@ export class SimIamAllowSides {
     get resource() {
         return this.resourceAllowed;
     }
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by delegating to the caller's Account.
+     */
+    get resourceDirect() {
+        return this.resourceDirectAllowed;
+    }
+    /**
+     * Whether the resource's policy admitted the caller only by delegating to
+     * its Account, which grants nothing on its own.
+     */
+    get resourceDelegated() {
+        return this.resourceAllowed && !this.resourceDirectAllowed;
+    }
 }
 /**
  * The same-Account rule: an Allow from either side is enough.
@@ -57,4 +74,53 @@ export class SimIamBothSidesAllowRequirement {
         return allows.identity && allows.resource;
     }
 }
+/**
+ * The rule for a resource whose policy is mandatory: it must admit the caller.
+ *
+ * Most AWS resources have no resource policy until someone writes one, and its
+ * absence simply leaves the decision to IAM. A KMS key is not like that: it
+ * always has a key policy, and an identity policy cannot reach the key unless
+ * that policy admits the caller. Services holding such a resource ask for this
+ * rule rather than IAM inferring it, because only the service knows its
+ * resource works that way.
+ *
+ * How the policy admits the caller decides what else is needed. A statement
+ * naming the caller grants access outright, which is why a KMS key policy can
+ * make a key usable by a Role with no permissions of its own. A statement
+ * naming the Account only delegates to that Account's IAM, so an identity
+ * policy still has to allow the action. That second case is the one the
+ * default key policy creates, and getting it wrong would make every key in the
+ * simulation usable by every principal in its Account.
+ */
+export class SimIamMandatoryResourcePolicyRequirement {
+    /**
+     * Whether the resource's own policy admitted the caller, and whether
+     * anything further is needed for the way it did so.
+     */
+    isSatisfiedBy(allows) {
+        if (allows.resourceDirect) {
+            return true;
+        }
+        return allows.resourceDelegated && allows.identity;
+    }
+}
+/**
+ * Every applicable rule at once.
+ *
+ * A request can be subject to more than one: a cross-Account call against a
+ * KMS key has to satisfy both the cross-Account rule and the key's own
+ * mandatory-policy rule, and the stricter answer is the right one.
+ */
+export class SimIamEveryAllowRequirement {
+    requirements;
+    constructor(requirements) {
+        this.requirements = requirements;
+    }
+    /**
+     * Whether every rule is satisfied.
+     */
+    isSatisfiedBy(allows) {
+        return this.requirements.every((requirement) => requirement.isSatisfiedBy(allows));
+    }
+}
 //# sourceMappingURL=sim-iam-allow-requirement.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,eAAe,CAAU;IACzB,eAAe,CAAU;IAE1C,YAAY,UAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"sim-iam-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,eAAe,CAAU;IACzB,eAAe,CAAU;IACzB,qBAAqB,CAAU;IAEhD,YAAY,UAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,qBAAqB;YACxB,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC7D,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,wCAAwC;IACnD;;;OAGG;IACH,aAAa,CAAC,MAAwB;QACpC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAAoC;IAEjE,YAAY,YAA+C;QACzD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAC7C,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAClC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts

@@ -1,6 +1,7 @@
 import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
 import type { SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
 import { SimIamAllowSides } from "./sim-iam-allow-requirement.js";
+import type { SimIamPrincipalMatch } from "../match/sim-iam-principal-match.js";
 /**
  * The matching Allow statements found for one authorization, kept per side.
  *
@@ -14,10 +15,15 @@ export declare class SimIamAllowStatements {
     private readonly identityStatements;
     private readonly resourceStatements;
     private readonly trustStatements;
+    private readonly delegatedStatements;
     /**
      * Record a matching Allow against the policy side it came from.
+     *
+     * A resource-policy Allow that matched by way of the caller's Account rather
+     * than the caller itself is kept apart as well, so a rule that cares about
+     * the difference can ask for it.
      */
-    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement): void;
+    record(policy: SimIamAuthZPolicySource, statement: SimIamPolicyDocumentStatement, principal: SimIamPrincipalMatch): void;
     /**
      * Every matching Allow statement, identity side first.
      */

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-statements.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,6BAA6B,GACvC,IAAI,CAMN;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,6BAA6B,EAAE,CAElD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,6BAA6B,EAAE,CAEpD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,gBAAgB,CAK5B;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;CASvB"}
+{"version":3,"file":"sim-iam-allow-statements.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAEhF;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IACvE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAuC;IAE3E;;;;;;OAMG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,6BAA6B,EACxC,SAAS,EAAE,oBAAoB,GAC9B,IAAI,CAUN;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,6BAA6B,EAAE,CAElD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,SAAS,6BAA6B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,6BAA6B,EAAE,CAEpD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,gBAAgB,CAU5B;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js

@@ -12,13 +12,21 @@ export class SimIamAllowStatements {
     identityStatements = [];
     resourceStatements = [];
     trustStatements = [];
+    delegatedStatements = [];
     /**
      * Record a matching Allow against the policy side it came from.
+     *
+     * A resource-policy Allow that matched by way of the caller's Account rather
+     * than the caller itself is kept apart as well, so a rule that cares about
+     * the difference can ask for it.
      */
-    record(policy, statement) {
+    record(policy, statement, principal) {
         if (policy.sourceType === "trust") {
             this.trustStatements.push(statement);
         }
+        if (principal.isAccountDelegation) {
+            this.delegatedStatements.push(statement);
+        }
         this.sideStatements(policy).push(statement);
     }
     /**
@@ -49,9 +57,11 @@ export class SimIamAllowStatements {
      * Which sides produced a matching Allow.
      */
     get sides() {
+        const delegated = new Set(this.delegatedStatements);
         return new SimIamAllowSides({
             identity: this.identityStatements.length > 0,
             resource: this.resourceStatements.length > 0,
+            resourceDirect: this.resourceStatements.some((statement) => !delegated.has(statement)),
         });
     }
     /**

package/dist/service/iam/authorize/allow/sim-iam-allow-statements.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-statements.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACf,kBAAkB,GAAoC,EAAE,CAAC;IACzD,kBAAkB,GAAoC,EAAE,CAAC;IACzD,eAAe,GAAoC,EAAE,CAAC;IAEvE;;OAEG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAAwC;QAExC,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"sim-iam-allow-statements.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-statements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACf,kBAAkB,GAAoC,EAAE,CAAC;IACzD,kBAAkB,GAAoC,EAAE,CAAC;IACzD,eAAe,GAAoC,EAAE,CAAC;IACtD,mBAAmB,GAAoC,EAAE,CAAC;IAE3E;;;;;;OAMG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAAwC,EACxC,SAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAC;YAClC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC5C,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CACzC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,MAA+B;QAE/B,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts

@@ -0,0 +1,17 @@
+import { type SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
+import type { SimIamCallerAccount } from "../caller-account/sim-iam-caller-account.js";
+/**
+ * Works out which allow rules apply to one authorization request.
+ *
+ * Two things decide it, and both have to hold. The caller's Account says whose
+ * Allow counts: either side within one Account, both sides across Accounts.
+ * The resource-owning service says whether its resource insists on allowing,
+ * which is true of a KMS key and of nothing else so far.
+ */
+export declare class SimIamAuthZAllowRequirement {
+    /**
+     * The rule a request is subject to.
+     */
+    resolve(callerAccount: SimIamCallerAccount, requiresResourcePolicyAllow: boolean | undefined): SimIamAllowRequirement;
+}
+//# sourceMappingURL=sim-iam-auth-z-allow-requirement.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAG5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAEvF;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,aAAa,EAAE,mBAAmB,EAClC,2BAA2B,EAAE,OAAO,GAAG,SAAS,GAC/C,sBAAsB,CASxB;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js

@@ -0,0 +1,24 @@
+import { SimIamEveryAllowRequirement, SimIamMandatoryResourcePolicyRequirement, } from "../allow/sim-iam-allow-requirement.js";
+/**
+ * Works out which allow rules apply to one authorization request.
+ *
+ * Two things decide it, and both have to hold. The caller's Account says whose
+ * Allow counts: either side within one Account, both sides across Accounts.
+ * The resource-owning service says whether its resource insists on allowing,
+ * which is true of a KMS key and of nothing else so far.
+ */
+export class SimIamAuthZAllowRequirement {
+    /**
+     * The rule a request is subject to.
+     */
+    resolve(callerAccount, requiresResourcePolicyAllow) {
+        if (requiresResourcePolicyAllow !== true) {
+            return callerAccount.allowRequirement;
+        }
+        return new SimIamEveryAllowRequirement([
+            callerAccount.allowRequirement,
+            new SimIamMandatoryResourcePolicyRequirement(),
+        ]);
+    }
+}
+//# sourceMappingURL=sim-iam-auth-z-allow-requirement.js.map

package/dist/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-auth-z-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-allow-requirement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAC3B,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAG/C;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,OAAO,CACL,aAAkC,EAClC,2BAAgD;QAEhD,IAAI,2BAA2B,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,aAAa,CAAC,gBAAgB,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC;YACrC,aAAa,CAAC,gBAAgB;YAC9B,IAAI,wCAAwC,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -44,6 +44,15 @@ export interface SimIamAuthorizationInput {
      * service-level resource policy.
      */
     readonly resourcePolicies?: readonly SimIamResourcePolicyInput[] | undefined;
+    /**
+     * Whether the resource's own policy must allow the request.
+     *
+     * Off by default, which is the ordinary AWS rule: a resource with no policy
+     * leaves the decision to the caller's identity policies. A service sets it
+     * for a resource whose policy is mandatory and is the root of trust for
+     * reaching it, which in AWS means a KMS key policy.
+     */
+    readonly requiresResourcePolicyAllow?: boolean | undefined;
 }
 interface SimIamAuthZContextBuilderProperties {
     /**
@@ -90,6 +99,7 @@ export declare class SimIamAuthZContextBuilder {
     private readonly callerContextBuilder;
     private readonly identityPolicyCoordinator;
     private readonly callerAccountResolver;
+    private readonly allowRequirement;
     constructor(properties: SimIamAuthZContextBuilderProperties);
     /**
      * Build the context consumed by SimIamAuthorizer.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;CAC9E;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IAEpE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAkBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -1,5 +1,6 @@
 import { makeSimAwsAccountRootPrincipal } from "../../../aws/caller/sim-aws-account-root-principal.js";
 import { SimIamCallerAccountResolver } from "../caller-account/sim-iam-caller-account-resolver.js";
+import { SimIamAuthZAllowRequirement } from "./sim-iam-auth-z-allow-requirement.js";
 import { SimIamAuthZIdentityPolicyCoordinator } from "./identity-policy-source/sim-iam-auth-z-id-pol-coordinator.js";
 import { SimIamAuthZCallerContextBuilder, } from "./sim-iam-auth-z-caller-context-builder.js";
 /**
@@ -32,6 +33,7 @@ export class SimIamAuthZContextBuilder {
     callerContextBuilder;
     identityPolicyCoordinator;
     callerAccountResolver;
+    allowRequirement = new SimIamAuthZAllowRequirement();
     constructor(properties) {
         this.callerContextBuilder = new SimIamAuthZCallerContextBuilder(makeSimAwsAccountRootPrincipal(properties.accountId), properties.credentialIdentityResolver);
         this.identityPolicyCoordinator = new SimIamAuthZIdentityPolicyCoordinator({
@@ -56,7 +58,7 @@ export class SimIamAuthZContextBuilder {
                 ...callerAccount.identityPolicies,
             ],
             resourcePolicies: this.resourcePolicySources(input),
-            allowRequirement: callerAccount.allowRequirement,
+            allowRequirement: this.allowRequirement.resolve(callerAccount, input.requiresResourcePolicyAllow),
             action: input.action,
             resource: input.resource,
             conditionContext: this.conditionContext(input, callerContext.caller),

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAanG,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAwEpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IAEpE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAapF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAkFpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IACnD,gBAAgB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEtE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC7C,aAAa,EACb,KAAK,CAAC,2BAA2B,CAClC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -1,5 +1,6 @@
 import type { SimIamParsedPolicyStatement } from "../../policy/parse/sim-iam-document-parser.js";
 import type { SimIamAuthZContext, SimIamAuthZPolicySource } from "../context/sim-iam-auth-z-context.js";
+import { SimIamPrincipalMatch } from "./sim-iam-principal-match.js";
 /**
  * Matches the principal portion of an IAM policy statement.
  *
@@ -27,7 +28,7 @@ export declare class SimIamPolicyPrincipalMatcher {
      * Resource and trust policies require Principal or NotPrincipal because the
      * policy must state which callers it applies to.
      */
-    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): boolean;
+    matches(policy: SimIamAuthZPolicySource, statement: SimIamParsedPolicyStatement): SimIamPrincipalMatch;
     /**
      * Check each Principal representation supported by the parsed policy model.
      *
@@ -36,6 +37,10 @@ export declare class SimIamPolicyPrincipalMatcher {
      * delegation, while Service values match service principals.
      */
     private valueMatches;
+    /**
+     * The winning match among alternatives, since Principal lists are an OR.
+     */
+    private firstMatch;
     /**
      * Compare an AWS principal pattern with the resolved caller.
      *

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,OAAO,CAiBT;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA2BpB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAqBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}
+{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,oBAAoB,CAqBtB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAiCpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAyBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}