@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-request-date.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAItF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,GAChC,MAAM,CA2BR"}
+{"version":3,"file":"sim-iam-sigv4-request-date.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAItF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,GAChC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,KAAK,EAAE,0BAA0B,EACjC,MAAM,EAAE,MAAM,GACb,MAAM,CAsBR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAiCzD"}

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.js

@@ -1,5 +1,5 @@
 import { SimIamIncompleteSignature } from "./error/sim-iam-sigv4.error.js";
-const amzDatePattern = /^(?<dateStamp>\d{8})T\d{6}Z$/;
+const amzDatePattern = /^(?<dateStamp>\d{8})T(?<time>\d{6})Z$/;
 /**
  * Read the `X-Amz-Date` a request was signed at.
  *
@@ -11,21 +11,63 @@ const amzDatePattern = /^(?<dateStamp>\d{8})T\d{6}Z$/;
  * would buy nothing a caller could assert on, and would break every client that
  * stamps real time and has no way to know what time this simulation is keeping.
  * This is a documented divergence from real AWS, which enforces a five minute
- * window.
+ * window. A presigned URL is the exception: it states its own lifetime in
+ * `X-Amz-Expires`, and that lifetime is enforced, in simulated time.
  */
 export function simIamSigV4RequestDate(headers, scope) {
-    const amzDate = headers.get("x-amz-date");
+    return simIamSigV4CheckedAmzDate(headers.get("x-amz-date"), scope, "X-Amz-Date header");
+}
+/**
+ * Check a signing stamp from wherever the request carried it.
+ *
+ * A presigned URL states the same value in its query string rather than in a
+ * header, so the source is named by the caller and appears in any complaint
+ * about the stamp.
+ */
+export function simIamSigV4CheckedAmzDate(amzDate, scope, source) {
     if (amzDate === null || amzDate.length === 0) {
-        throw new SimIamIncompleteSignature("Signed request carries no X-Amz-Date header");
+        throw new SimIamIncompleteSignature(`Signed request carries no ${source}`);
     }
     const dateStamp = amzDatePattern.exec(amzDate)?.groups?.["dateStamp"];
     if (dateStamp === undefined) {
-        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} must be an ISO 8601 basic stamp, ` +
-            `YYYYMMDDTHHMMSSZ`);
+        throw new SimIamIncompleteSignature(`${source} ${amzDate} must be an ISO 8601 basic stamp, YYYYMMDDTHHMMSSZ`);
     }
     if (dateStamp !== scope.dateStamp) {
-        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} is not on the day its credential scope names, ${scope.dateStamp}`);
+        throw new SimIamIncompleteSignature(`${source} ${amzDate} is not on the day its credential scope names, ${scope.dateStamp}`);
     }
     return amzDate;
 }
+/**
+ * The instant an `X-Amz-Date` stamp names.
+ *
+ * The stamp is ISO 8601 basic form, which `Date` does not parse, so the
+ * separators of the extended form are put back before it is read.
+ *
+ * The result is checked to name the day and time it was built from. Digits
+ * alone do not make a date: `Date` reads 24:60:00 as no instant at all, and
+ * quietly rolls February 30th forward into March, which would give a presigned
+ * URL a window nothing signed. Both are refused rather than honoured.
+ */
+export function simIamSigV4SignedAt(amzDate) {
+    const parts = amzDatePattern.exec(amzDate)?.groups;
+    /* v8 ignore if -- a stamp is always checked before it is read */
+    if (parts === undefined) {
+        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} is not an ISO 8601 basic stamp`);
+    }
+    const dateStamp = String(parts["dateStamp"]);
+    const time = String(parts["time"]);
+    const date = [
+        dateStamp.slice(0, 4),
+        dateStamp.slice(4, 6),
+        dateStamp.slice(6, 8),
+    ].join("-");
+    const clockTime = [time.slice(0, 2), time.slice(2, 4), time.slice(4, 6)].join(":");
+    const signedAt = new Date(`${date}T${clockTime}Z`);
+    if (Number.isNaN(signedAt.getTime()) ||
+        signedAt.toISOString() !== `${date}T${clockTime}.000Z`) {
+        throw new SimIamIncompleteSignature(`X-Amz-Date ${amzDate} is not a real instant: there is no ` +
+            `${clockTime} on ${date}`);
+    }
+    return signedAt;
+}
 //# sourceMappingURL=sim-iam-sigv4-request-date.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-request-date.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-request-date.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,KAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE1C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CACjC,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;IAEtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,oCAAoC;YACvD,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,kDACnB,KAAK,CAAC,SACR,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-request-date.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-request-date.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,KAAiC;IAEjC,OAAO,yBAAyB,CAC9B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EACzB,KAAK,EACL,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAsB,EACtB,KAAiC,EACjC,MAAc;IAEd,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;IAEtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CACjC,GAAG,MAAM,IAAI,OAAO,oDAAoD,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,yBAAyB,CACjC,GAAG,MAAM,IAAI,OAAO,kDAClB,KAAK,CAAC,SACR,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEnD,iEAAiE;IACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,iCAAiC,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3E,GAAG,CACJ,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;IAEnD,IACE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,IAAI,SAAS,OAAO,EACtD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,cAAc,OAAO,sCAAsC;YACzD,GAAG,SAAS,OAAO,IAAI,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.d.ts

@@ -1,10 +1,17 @@
-import type { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
+import type { SimIamSigV4PayloadDeclaration } from "./canonical/sim-iam-sigv4-payload-hash.js";
+import type { SimIamSigV4SignatureStatement } from "./sim-iam-sigv4-signature-statement.js";
 import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js";
 interface SimIamSigV4SignatureCheckInput {
     readonly signedRequest: SimIamSigV4SignedRequest;
-    readonly authorization: SimIamSigV4Authorization;
+    readonly statement: SimIamSigV4SignatureStatement;
     readonly signingKey: Buffer;
     readonly amzDate: string;
+    /**
+     * How the request declared its payload hash. Omitted for a header-signed
+     * request, which declares it in a header the canonical request can read for
+     * itself.
+     */
+    readonly payload?: SimIamSigV4PayloadDeclaration | undefined;
 }
 /**
  * Rebuild the signature the request should carry, and refuse it otherwise.

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signature-check.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAMlF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,8BAA8B,GACpC,IAAI,CAwBN"}
+{"version":3,"file":"sim-iam-sigv4-signature-check.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAG/F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAC5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAMlF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,8BAA8B,GACpC,IAAI,CAyBN"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js

@@ -10,16 +10,16 @@ import { simIamSigV4Signature, simIamSigV4StringToSign, } from "./sim-iam-sigv4-
  * the bytes the simulator signed over.
  */
 export function simIamSigV4CheckSignature(input) {
-    const { signedRequest, authorization, signingKey, amzDate } = input;
-    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, authorization.signedHeaderNames).toString();
+    const { signedRequest, statement, signingKey, amzDate, payload } = input;
+    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, statement.signedHeaderNames, payload).toString();
     const expected = simIamSigV4Signature(signingKey, simIamSigV4StringToSign({
         amzDate,
-        scope: authorization.scope,
+        scope: statement.scope,
         canonicalRequest,
     }));
-    if (!simIamSigV4SignaturesMatch(expected, authorization.signature)) {
+    if (!simIamSigV4SignaturesMatch(expected, statement.signature)) {
         throw new SimIamSignatureDoesNotMatch(`Request signature does not match the signature the simulator ` +
-            `calculated for access key ${authorization.accessKeyId}`, canonicalRequest);
+            `calculated for access key ${statement.accessKeyId}`, canonicalRequest);
     }
 }
 //# sourceMappingURL=sim-iam-sigv4-signature-check.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AASxC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEpE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,aAAa,CAAC,iBAAiB,CAChC,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,aAAa,CAAC,WAAW,EAAE,EAC1D,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAE7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAexC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEzE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,SAAS,CAAC,iBAAiB,EAC3B,OAAO,CACR,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,SAAS,CAAC,WAAW,EAAE,EACtD,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.d.ts

@@ -0,0 +1,16 @@
+import type { SimIamSigV4CredentialScope } from "./sim-iam-sigv4-credential-scope.js";
+/**
+ * What a request states about the signature it carries.
+ *
+ * SigV4 offers the same facts in two places: an `Authorization` header, or the
+ * query string of a presigned URL. Everything downstream of parsing needs only
+ * these four, so verification is written against this rather than against
+ * either form, and the two differ only in how they are read off the request.
+ */
+export interface SimIamSigV4SignatureStatement {
+    readonly accessKeyId: string;
+    readonly scope: SimIamSigV4CredentialScope;
+    readonly signedHeaderNames: readonly string[];
+    readonly signature: string;
+}
+//# sourceMappingURL=sim-iam-sigv4-signature-statement.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-statement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-sigv4-signature-statement.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-sigv4-signature-statement.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-statement.ts"],"names":[],"mappings":""}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.d.ts

@@ -1,6 +1,11 @@
 import type { SimIamSigningCredential, SimIamSigningCredentialResolver } from "../credential/sim-iam-signing-credential.js";
-import type { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
-import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js";
+import type { SimIamSigV4SignatureStatement } from "./sim-iam-sigv4-signature-statement.js";
+interface SimIamSigV4SigningCredentialInput {
+    readonly credentials: SimIamSigningCredentialResolver;
+    readonly statement: SimIamSigV4SignatureStatement;
+    readonly sessionToken: string | undefined;
+    readonly now: Date | undefined;
+}
 /**
  * Find the signing key the request claims to have been signed with.
  *
@@ -8,6 +13,10 @@ import type { SimIamSigV4SignedRequest } from "./sim-iam-sigv4-signed-request.js
  * named access key would have derived rather than for the secret itself, and
  * the signature comparison settles whether the signer really held it. Any
  * rejection is restated in the vocabulary a signed request is answered in.
+ *
+ * The session token comes from wherever the request carried it: a header on a
+ * header-signed request, a query parameter on a presigned URL.
  */
-export declare function simIamSigV4SigningCredential(credentials: SimIamSigningCredentialResolver, signedRequest: SimIamSigV4SignedRequest, authorization: SimIamSigV4Authorization, now: Date | undefined): SimIamSigningCredential;
+export declare function simIamSigV4SigningCredential(input: SimIamSigV4SigningCredentialInput): SimIamSigningCredential;
+export {};
 //# sourceMappingURL=sim-iam-sigv4-signing-credentials.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signing-credentials.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,+BAA+B,EAC5C,aAAa,EAAE,wBAAwB,EACvC,aAAa,EAAE,wBAAwB,EACvC,GAAG,EAAE,IAAI,GAAG,SAAS,GACpB,uBAAuB,CAUzB"}
+{"version":3,"file":"sim-iam-sigv4-signing-credentials.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,+BAA+B,EAChC,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,iCAAiC;IACzC,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,IAAI,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,uBAAuB,CAWzB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.js

@@ -6,12 +6,16 @@ import { simIamSigV4CredentialFailure } from "./sim-iam-sigv4-credential-failure
  * named access key would have derived rather than for the secret itself, and
  * the signature comparison settles whether the signer really held it. Any
  * rejection is restated in the vocabulary a signed request is answered in.
+ *
+ * The session token comes from wherever the request carried it: a header on a
+ * header-signed request, a query parameter on a presigned URL.
  */
-export function simIamSigV4SigningCredential(credentials, signedRequest, authorization, now) {
-    return simIamSigV4CredentialFailure(authorization.accessKeyId, () => credentials.signingCredentialFor({
-        accessKeyId: authorization.accessKeyId,
-        sessionToken: signedRequest.headers.get("x-amz-security-token") ?? undefined,
-        scope: authorization.scope,
+export function simIamSigV4SigningCredential(input) {
+    const { credentials, statement, sessionToken, now } = input;
+    return simIamSigV4CredentialFailure(statement.accessKeyId, () => credentials.signingCredentialFor({
+        accessKeyId: statement.accessKeyId,
+        sessionToken,
+        scope: statement.scope,
         now,
     }));
 }

package/dist/service/iam/sigv4/sim-iam-sigv4-signing-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signing-credentials.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAGrF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAA4C,EAC5C,aAAuC,EACvC,aAAuC,EACvC,GAAqB;IAErB,OAAO,4BAA4B,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,CAClE,WAAW,CAAC,oBAAoB,CAAC;QAC/B,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY,EACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS;QAChE,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,GAAG;KACJ,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-signing-credentials.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signing-credentials.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAUrF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAwC;IAExC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAE5D,OAAO,4BAA4B,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAC9D,WAAW,CAAC,oBAAoB,CAAC;QAC/B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,YAAY;QACZ,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,GAAG;KACJ,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.d.ts

@@ -12,10 +12,16 @@ interface SimIamSigV4VerifierProperties {
  * principal made the request, which is exactly the question the IAM
  * authorization already built has no way to ask of an HTTP request.
  *
- * Verification needs no clock. The signing date is an input to the signing key
- * and comes from the request, so a correctly signed request verifies whenever
- * it arrives. Only the credentials behind it can go stale, and that is judged in
- * simulated time by the registry.
+ * A signature arrives in one of two forms, an `Authorization` header or the
+ * query string of a presigned URL, and both are verified here. The work either
+ * way is the same canonical request against the same signing key; only where
+ * the claims are read from, and whether a lifetime is stated, differ.
+ *
+ * Verifying a header-signed request needs no clock. The signing date is an
+ * input to the signing key and comes from the request, so a correctly signed
+ * request verifies whenever it arrives. Only the credentials behind it can go
+ * stale, and that is judged in simulated time by the registry. A presigned URL
+ * is the exception, because it states its own expiry.
  */
 export declare class SimIamSigV4Verifier {
     private readonly credentials;
@@ -27,6 +33,16 @@ export declare class SimIamSigV4Verifier {
      * with when the request cannot be attributed to a registered access key.
      */
     verify(signedRequest: SimIamSigV4SignedRequest, options?: SimIamSigV4VerifyOptions): SimIamCredentialIdentity;
+    private verifyHeaderSigned;
+    /**
+     * Verify a presigned URL.
+     *
+     * Expiry is checked before the signature, because an expired URL is the
+     * likeliest reason a presigned request fails and "this expired" is a far
+     * more useful thing to be told than "this signature does not match". The
+     * expiry is signed, so a URL cannot claim a longer life than it was given.
+     */
+    private verifyPresigned;
 }
 export {};
 //# sourceMappingURL=sim-iam-sigv4-verifier.d.ts.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-verifier.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAKnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;CACvD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAE9D,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAa,EAAE,wBAAwB,EACvC,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CA4B1B;CACF"}
+{"version":3,"file":"sim-iam-sigv4-verifier.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAOnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,+BAA+B,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAE9D,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAa,EAAE,wBAAwB,EACvC,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CAM1B;IAED,OAAO,CAAC,kBAAkB;IAkC1B;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;CA4BxB"}

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js

@@ -1,3 +1,5 @@
+import { SimIamSigV4PayloadDeclaration } from "./canonical/sim-iam-sigv4-payload-hash.js";
+import { SimIamSigV4PresignedQuery } from "./presign/sim-iam-sigv4-presigned-query.js";
 import { SimIamSigV4Authorization } from "./sim-iam-sigv4-authorization.js";
 import { simIamSigV4CheckExpectedScope } from "./sim-iam-sigv4-expected-scope.js";
 import { simIamSigV4CheckSignature } from "./sim-iam-sigv4-signature-check.js";
@@ -10,10 +12,16 @@ import { simIamSigV4SigningCredential } from "./sim-iam-sigv4-signing-credential
  * principal made the request, which is exactly the question the IAM
  * authorization already built has no way to ask of an HTTP request.
  *
- * Verification needs no clock. The signing date is an input to the signing key
- * and comes from the request, so a correctly signed request verifies whenever
- * it arrives. Only the credentials behind it can go stale, and that is judged in
- * simulated time by the registry.
+ * A signature arrives in one of two forms, an `Authorization` header or the
+ * query string of a presigned URL, and both are verified here. The work either
+ * way is the same canonical request against the same signing key; only where
+ * the claims are read from, and whether a lifetime is stated, differ.
+ *
+ * Verifying a header-signed request needs no clock. The signing date is an
+ * input to the signing key and comes from the request, so a correctly signed
+ * request verifies whenever it arrives. Only the credentials behind it can go
+ * stale, and that is judged in simulated time by the registry. A presigned URL
+ * is the exception, because it states its own expiry.
  */
 export class SimIamSigV4Verifier {
     credentials;
@@ -27,19 +35,57 @@ export class SimIamSigV4Verifier {
      * with when the request cannot be attributed to a registered access key.
      */
     verify(signedRequest, options = {}) {
+        if (SimIamSigV4PresignedQuery.carriedBy(signedRequest.url)) {
+            return this.verifyPresigned(signedRequest, options);
+        }
+        return this.verifyHeaderSigned(signedRequest, options);
+    }
+    verifyHeaderSigned(signedRequest, options) {
         const authorization = SimIamSigV4Authorization.parse(signedRequest.headers.get("authorization"));
         // Checked before anything else can fail on it, so a signature made for the
         // wrong endpoint says so rather than looking like a bad secret.
         simIamSigV4CheckExpectedScope(options.expectedScope, authorization.scope);
         const amzDate = simIamSigV4RequestDate(signedRequest.headers, authorization.scope);
-        const { signingKey, identity } = simIamSigV4SigningCredential(this.credentials, signedRequest, authorization, options.now);
+        const { signingKey, identity } = simIamSigV4SigningCredential({
+            credentials: this.credentials,
+            statement: authorization,
+            sessionToken: signedRequest.headers.get("x-amz-security-token") ?? undefined,
+            now: options.now,
+        });
         simIamSigV4CheckSignature({
             signedRequest,
-            authorization,
+            statement: authorization,
             signingKey,
             amzDate,
         });
         return identity;
     }
+    /**
+     * Verify a presigned URL.
+     *
+     * Expiry is checked before the signature, because an expired URL is the
+     * likeliest reason a presigned request fails and "this expired" is a far
+     * more useful thing to be told than "this signature does not match". The
+     * expiry is signed, so a URL cannot claim a longer life than it was given.
+     */
+    verifyPresigned(signedRequest, options) {
+        const presigned = SimIamSigV4PresignedQuery.parse(signedRequest.url);
+        simIamSigV4CheckExpectedScope(options.expectedScope, presigned.scope);
+        presigned.checkNotExpired(options.now ?? new Date());
+        const { signingKey, identity } = simIamSigV4SigningCredential({
+            credentials: this.credentials,
+            statement: presigned,
+            sessionToken: presigned.sessionToken,
+            now: options.now,
+        });
+        simIamSigV4CheckSignature({
+            signedRequest,
+            statement: presigned,
+            signingKey,
+            amzDate: presigned.amzDate,
+            payload: SimIamSigV4PayloadDeclaration.fromPresignedQuery(signedRequest.url),
+        });
+        return identity;
+    }
 }
 //# sourceMappingURL=sim-iam-sigv4-verifier.js.map

package/dist/service/iam/sigv4/sim-iam-sigv4-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-verifier.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOtF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAkC;IAE9D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAuC,EACvC,OAAO,GAA6B,EAAE;QAEtC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAClD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAC;QAEF,2EAA2E;QAC3E,gEAAgE;QAChE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,sBAAsB,CACpC,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAC3D,IAAI,CAAC,WAAW,EAChB,aAAa,EACb,aAAa,EACb,OAAO,CAAC,GAAG,CACZ,CAAC;QAEF,yBAAyB,CAAC;YACxB,aAAa;YACb,aAAa;YACb,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4-verifier.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAOtF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAkC;IAE9D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,aAAuC,EACvC,OAAO,GAA6B,EAAE;QAEtC,IAAI,yBAAyB,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAEO,kBAAkB,CACxB,aAAuC,EACvC,OAAiC;QAEjC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAClD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAC;QAEF,2EAA2E;QAC3E,gEAAgE;QAChE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,sBAAsB,CACpC,aAAa,CAAC,OAAO,EACrB,aAAa,CAAC,KAAK,CACpB,CAAC;QACF,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC;YAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,aAAa;YACxB,YAAY,EACV,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS;YAChE,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,yBAAyB,CAAC;YACxB,aAAa;YACb,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CACrB,aAAuC,EACvC,OAAiC;QAEjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAErE,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACtE,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC;YAC5D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,yBAAyB,CAAC;YACxB,aAAa;YACb,SAAS,EAAE,SAAS;YACpB,UAAU;YACV,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,OAAO,EAAE,6BAA6B,CAAC,kBAAkB,CACvD,aAAa,CAAC,GAAG,CAClB;SACF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/service/kms/command/alias/alias.command.d.ts

@@ -0,0 +1,43 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim KMS CreateAlias command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/CreateAliasCommand/
+ */
+export interface SimCreateAliasCommand {
+    readonly input: SimCreateAliasCommandInput;
+}
+export interface SimCreateAliasCommandInput {
+    readonly AliasName?: string | undefined;
+    readonly TargetKeyId?: string | undefined;
+}
+export interface SimCreateAliasCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS ListAliases command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/ListAliasesCommand/
+ */
+export interface SimListAliasesCommand {
+    readonly input?: SimListAliasesCommandInput | undefined;
+}
+export interface SimListAliasesCommandInput {
+    /**
+     * Narrows the result to the aliases of one key. Real KMS returns every alias
+     * in the Region when this is omitted.
+     */
+    readonly KeyId?: string | undefined;
+    readonly Limit?: number | undefined;
+}
+export interface SimListAliasesCommandEntry {
+    readonly AliasName: string;
+    readonly AliasArn: string;
+    readonly TargetKeyId: string;
+}
+export interface SimListAliasesCommandOutput {
+    readonly Aliases?: readonly SimListAliasesCommandEntry[] | undefined;
+    readonly Truncated?: boolean | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=alias.command.d.ts.map

package/dist/service/kms/command/alias/alias.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/alias.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/alias/alias.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=alias.command.js.map

package/dist/service/kms/command/alias/alias.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/alias.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimCreateAliasCommand, SimCreateAliasCommandOutput, SimListAliasesCommand, SimListAliasesCommandOutput } from "./alias.command.js";
+interface SimKmsAliasCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsAliasCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The alias commands of one simulated KMS scope.
+ */
+export declare class SimKmsAliasCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly aliasName;
+    constructor(properties: SimKmsAliasCommandsProperties);
+    /**
+     * Point a new alias at a key.
+     *
+     * Real KMS checks kms:CreateAlias against both the alias and the target key.
+     * Only the key is checked here, because the key is what the alias gives
+     * access to and it is the half that carries a policy.
+     */
+    create(command: SimCreateAliasCommand, options?: SimKmsAliasCommandOptions): SimCreateAliasCommandOutput;
+    /**
+     * List aliases, optionally narrowed to one key's.
+     */
+    list(command: SimListAliasesCommand, options?: SimKmsAliasCommandOptions): SimListAliasesCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-alias-commands.d.ts.map

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,YAAY,UAAU,EAAE,6BAA6B,EAGpD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAc7B;IAED;;OAEG;IACH,IAAI,CACF,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAyB7B;CACF"}

package/dist/service/kms/command/alias/sim-kms-alias-commands.js

@@ -0,0 +1,56 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+import { SimKmsAliasName } from "../../key/sim-kms-alias.js";
+/**
+ * The alias commands of one simulated KMS scope.
+ */
+export class SimKmsAliasCommands {
+    keys;
+    authorizer;
+    aliasName = new SimKmsAliasName();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * Point a new alias at a key.
+     *
+     * Real KMS checks kms:CreateAlias against both the alias and the target key.
+     * Only the key is checked here, because the key is what the alias gives
+     * access to and it is the half that carries a policy.
+     */
+    create(command, options) {
+        const aliasName = command.input.AliasName;
+        if (aliasName === undefined) {
+            throw new SimKmsValidationException("AliasName is required");
+        }
+        this.aliasName.validateCustomerAlias(aliasName);
+        const key = this.keys.require(command.input.TargetKeyId);
+        this.authorizer.authorizeKey("kms:CreateAlias", key, options?.caller);
+        this.keys.addAlias(aliasName, key);
+        return { $metadata: {} };
+    }
+    /**
+     * List aliases, optionally narrowed to one key's.
+     */
+    list(command, options) {
+        this.authorizer.authorizeAccount("kms:ListAliases", options?.caller);
+        const keyId = command.input?.KeyId;
+        const aliases = this.keys
+            .aliasesFor(keyId === undefined ? undefined : this.keys.require(keyId).keyId)
+            .map((alias) => ({
+            AliasName: alias.aliasName,
+            AliasArn: alias.arn,
+            TargetKeyId: alias.targetKeyId,
+        }));
+        const limit = command.input?.Limit;
+        if (limit === undefined || aliases.length <= limit) {
+            return { $metadata: {}, Aliases: aliases, Truncated: false };
+        }
+        return {
+            $metadata: {},
+            Aliases: aliases.slice(0, limit),
+            Truncated: true,
+        };
+    }
+}
+//# sourceMappingURL=sim-kms-alias-commands.js.map

package/dist/service/kms/command/alias/sim-kms-alias-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAmB7D;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnD,YAAY,UAAyC;QACnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA8B,EAC9B,OAAmC;QAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,CACF,OAA8B,EAC9B,OAAmC;QAEnC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI;aACtB,UAAU,CACT,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACjE;aACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC,CAAC;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAChC,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts

@@ -0,0 +1,38 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimKmsKey } from "../../key/sim-kms-key.js";
+interface SimKmsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * Applies simulated IAM authorization to KMS requests.
+ *
+ * KMS splits into two kinds of request, and they authorize differently:
+ *
+ * - operations on an existing key, where the key policy is mandatory and must
+ *   allow the request, so an identity policy alone never reaches the key;
+ * - operations with no key to speak of, such as CreateKey and ListKeys, which
+ *   real KMS gives no resource-level permissions and so are authorized against
+ *   `*` with identity policies alone.
+ */
+export declare class SimKmsAuthorizer {
+    private readonly iam;
+    private readonly accountRegionScope;
+    constructor(properties: SimKmsAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a key.
+     *
+     * The key's policy is supplied as the resource side and is required to
+     * allow: this is the rule that makes a KMS key policy the root of trust for
+     * its key rather than one more input to the decision.
+     */
+    authorizeKey(action: string, key: SimKmsKey, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may perform an action that names no particular key.
+     */
+    authorizeAccount(action: string, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=sim-kms-authorizer.d.ts.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAgBxE;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAY5D;CACF"}