@kensio/yulin 0.40.0 → 0.42.0

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAEpE;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -87,21 +87,34 @@ export class SimIamAuthZContextBuilder {
     }
     /**
      * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
-     * identity whose policies apply; for temporary Role credentials this is the
-     * underlying Role ARN, rather than the STS assumed-role session ARN retained
-     * as the effective caller for diagnostics.
+     * derive from the resolved caller.
+     *
+     * A service supplies values it knows from the request, and values it can
+     * only work out once the caller is resolved. IAM's own values are applied
+     * last, so nothing a service supplies can overwrite them.
      */
     conditionContext(input, caller) {
-        const principalArn = caller.identityPolicyArn ?? caller.arn;
-        if (principalArn === undefined) {
-            return input.conditionContext ?? {};
-        }
         return {
             ...input.conditionContext,
-            "aws:PrincipalArn": principalArn,
+            ...input.callerConditions?.conditionValuesFor(caller),
+            ...this.callerDerivedConditions(caller),
         };
     }
+    /**
+     * The condition values IAM derives from the caller itself.
+     *
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    callerDerivedConditions(caller) {
+        const principalArn = caller.identityPolicyArn ?? caller.arn;
+        if (principalArn === undefined) {
+            return {};
+        }
+        return { "aws:PrincipalArn": principalArn };
+    }
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAapF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAkFpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IACnD,gBAAgB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEtE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC7C,aAAa,EACb,KAAK,CAAC,2BAA2B,CAClC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAcpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AA2FpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IACnD,gBAAgB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEtE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC7C,aAAa,EACb,KAAK,CAAC,2BAA2B,CAClC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,GAAG,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrD,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,uBAAuB,CAC7B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.d.ts

@@ -0,0 +1,21 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamConditionValue } from "../../policy/sim-iam-policy.js";
+/**
+ * Condition values a service can only work out once IAM has resolved the
+ * caller.
+ *
+ * Most condition values a service supplies are properties of the request, so
+ * it has them before it asks IAM anything. A few are properties of whoever
+ * turns out to be making the request, and only IAM can say who that is: a
+ * caller may arrive as credentials to authenticate or be omitted altogether.
+ * `kms:CallerAccount` is one, naming the Account a KMS request came from.
+ *
+ * The values stay with the service that owns the condition key rather than
+ * being derived by IAM for every request, since a key such as
+ * `kms:CallerAccount` exists only in KMS and matching it elsewhere would be
+ * looser than AWS.
+ */
+export interface SimIamCallerConditionSource {
+    conditionValuesFor(caller: SimAwsResolvedCaller): Readonly<Record<string, SimIamConditionValue>>;
+}
+//# sourceMappingURL=sim-iam-caller-condition-source.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-condition-source.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-caller-condition-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,2BAA2B;IAC1C,kBAAkB,CAChB,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;CACnD"}

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-caller-condition-source.js.map

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-condition-source.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-caller-condition-source.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
 import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
 import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
 import type { SimCreateAliasCommand, SimCreateAliasCommandOutput, SimListAliasesCommand, SimListAliasesCommandOutput } from "./alias.command.js";
@@ -6,9 +6,6 @@ interface SimKmsAliasCommandsProperties {
     readonly keys: SimKmsKeyStore;
     readonly authorizer: SimKmsAuthorizer;
 }
-interface SimKmsAliasCommandOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The alias commands of one simulated KMS scope.
  */
@@ -24,11 +21,11 @@ export declare class SimKmsAliasCommands {
      * Only the key is checked here, because the key is what the alias gives
      * access to and it is the half that carries a policy.
      */
-    create(command: SimCreateAliasCommand, options?: SimKmsAliasCommandOptions): SimCreateAliasCommandOutput;
+    create(command: SimCreateAliasCommand, options?: SimKmsRequestOptions): SimCreateAliasCommandOutput;
     /**
      * List aliases, optionally narrowed to one key's.
      */
-    list(command: SimListAliasesCommand, options?: SimKmsAliasCommandOptions): SimListAliasesCommandOutput;
+    list(command: SimListAliasesCommand, options?: SimKmsRequestOptions): SimListAliasesCommandOutput;
 }
 export {};
 //# sourceMappingURL=sim-kms-alias-commands.d.ts.map

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-alias-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,YAAY,UAAU,EAAE,6BAA6B,EAGpD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAc7B;IAED;;OAEG;IACH,IAAI,CACF,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAyB7B;CACF"}
+{"version":3,"file":"sim-kms-alias-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,YAAY,UAAU,EAAE,6BAA6B,EAGpD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,2BAA2B,CAc7B;IAED;;OAEG;IACH,IAAI,CACF,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,2BAA2B,CAyB7B;CACF"}

package/dist/service/kms/command/alias/sim-kms-alias-commands.js

@@ -25,7 +25,7 @@ export class SimKmsAliasCommands {
         }
         this.aliasName.validateCustomerAlias(aliasName);
         const key = this.keys.require(command.input.TargetKeyId);
-        this.authorizer.authorizeKey("kms:CreateAlias", key, options?.caller);
+        this.authorizer.authorizeKey("kms:CreateAlias", key, options);
         this.keys.addAlias(aliasName, key);
         return { $metadata: {} };
     }
@@ -33,7 +33,7 @@ export class SimKmsAliasCommands {
      * List aliases, optionally narrowed to one key's.
      */
     list(command, options) {
-        this.authorizer.authorizeAccount("kms:ListAliases", options?.caller);
+        this.authorizer.authorizeAccount("kms:ListAliases", options);
         const keyId = command.input?.KeyId;
         const aliases = this.keys
             .aliasesFor(keyId === undefined ? undefined : this.keys.require(keyId).keyId)

package/dist/service/kms/command/alias/sim-kms-alias-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-alias-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAmB7D;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnD,YAAY,UAAyC;QACnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA8B,EAC9B,OAAmC;QAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,CACF,OAA8B,EAC9B,OAAmC;QAEnC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI;aACtB,UAAU,CACT,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACjE;aACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC,CAAC;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAChC,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-kms-alias-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAe7D;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnD,YAAY,UAAyC;QACnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA8B,EAC9B,OAA8B;QAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,CACF,OAA8B,EAC9B,OAA8B;QAE9B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAE7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI;aACtB,UAAU,CACT,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACjE;aACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC,CAAC;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAChC,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts

@@ -1,7 +1,7 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimKmsKey } from "../../key/sim-kms-key.js";
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
 interface SimKmsAuthorizerProperties {
     readonly iam: SimIamInterServiceAuthZ;
     readonly accountRegionScope: SimAwsAccountRegionScope;
@@ -16,10 +16,16 @@ interface SimKmsAuthorizerProperties {
  * - operations with no key to speak of, such as CreateKey and ListKeys, which
  *   real KMS gives no resource-level permissions and so are authorized against
  *   `*` with identity policies alone.
+ *
+ * Both carry the KMS condition values a key policy can be written against:
+ * `kms:CallerAccount` for the Account the request came from, and
+ * `kms:ViaService` where another service made the request on the caller's
+ * behalf.
  */
 export declare class SimKmsAuthorizer {
     private readonly iam;
     private readonly accountRegionScope;
+    private readonly callerAccount;
     constructor(properties: SimKmsAuthorizerProperties);
     /**
      * Ensure the caller may perform an action on a key.
@@ -28,11 +34,18 @@ export declare class SimKmsAuthorizer {
      * allow: this is the rule that makes a KMS key policy the root of trust for
      * its key rather than one more input to the decision.
      */
-    authorizeKey(action: string, key: SimKmsKey, caller?: SimAwsCaller): void;
+    authorizeKey(action: string, key: SimKmsKey, options?: SimKmsRequestOptions): void;
     /**
      * Ensure the caller may perform an action that names no particular key.
      */
-    authorizeAccount(action: string, caller?: SimAwsCaller): void;
+    authorizeAccount(action: string, options?: SimKmsRequestOptions): void;
+    /**
+     * The condition values this request carries.
+     *
+     * A request the caller made itself supplies no `kms:ViaService`, so a policy
+     * conditioned on it fails to match rather than matching anything.
+     */
+    private conditionContext;
 }
 export {};
 //# sourceMappingURL=sim-kms-authorizer.d.ts.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAgBxE;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAY5D;CACF"}
+{"version":3,"file":"sim-kms-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;;OAMG;IACH,YAAY,CACV,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,SAAS,EACd,OAAO,GAAE,oBAAyB,GACjC,IAAI,CAkBN;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,IAAI,CAkBzE;IAED;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAYzB"}

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -1,4 +1,6 @@
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { SimKmsCallerAccountCondition } from "../../key/sim-kms-caller-account.js";
+import { SimKmsViaService } from "../../key/sim-kms-via-service.js";
 /**
  * Applies simulated IAM authorization to KMS requests.
  *
@@ -9,10 +11,16 @@ import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
  * - operations with no key to speak of, such as CreateKey and ListKeys, which
  *   real KMS gives no resource-level permissions and so are authorized against
  *   `*` with identity policies alone.
+ *
+ * Both carry the KMS condition values a key policy can be written against:
+ * `kms:CallerAccount` for the Account the request came from, and
+ * `kms:ViaService` where another service made the request on the caller's
+ * behalf.
  */
 export class SimKmsAuthorizer {
     iam;
     accountRegionScope;
+    callerAccount = new SimKmsCallerAccountCondition();
     constructor(properties) {
         this.iam = properties.iam;
         this.accountRegionScope = properties.accountRegionScope;
@@ -24,11 +32,13 @@ export class SimKmsAuthorizer {
      * allow: this is the rule that makes a KMS key policy the root of trust for
      * its key rather than one more input to the decision.
      */
-    authorizeKey(action, key, caller) {
+    authorizeKey(action, key, options = {}) {
         const decision = this.iam.authorize({
             action,
             resource: key.arn,
-            caller,
+            caller: options.caller,
+            conditionContext: this.conditionContext(options),
+            callerConditions: this.callerAccount,
             resourcePolicies: [key.policy.asResourcePolicy()],
             requiresResourcePolicyAllow: true,
         });
@@ -43,9 +53,15 @@ export class SimKmsAuthorizer {
     /**
      * Ensure the caller may perform an action that names no particular key.
      */
-    authorizeAccount(action, caller) {
+    authorizeAccount(action, options = {}) {
         const resource = `arn:aws:kms:${this.accountRegionScope.regionName}:${this.accountRegionScope.accountId}:key/*`;
-        const decision = this.iam.authorize({ action, resource, caller });
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller: options.caller,
+            conditionContext: this.conditionContext(options),
+            callerConditions: this.callerAccount,
+        });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
@@ -54,5 +70,17 @@ export class SimKmsAuthorizer {
             });
         }
     }
+    /**
+     * The condition values this request carries.
+     *
+     * A request the caller made itself supplies no `kms:ViaService`, so a policy
+     * conditioned on it fails to match rather than matching anything.
+     */
+    conditionContext(options) {
+        if (options.viaService === undefined) {
+            return {};
+        }
+        return new SimKmsViaService(options.viaService, this.accountRegionScope.regionName).asConditionContext();
+    }
 }
 //# sourceMappingURL=sim-kms-authorizer.js.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQzE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAA0B;IAC7B,kBAAkB,CAA2B;IAE9D,YAAY,UAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAc,EAAE,GAAc,EAAE,MAAqB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,MAAM;YACN,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjD,2BAA2B,EAAE,IAAI;SAClC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc,EAAE,MAAqB;QACpD,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,CAAC;QAEhH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-kms-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAQpE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAA0B;IAC7B,kBAAkB,CAA2B;IAC7C,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CACV,MAAc,EACd,GAAc,EACd,OAAO,GAAyB,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAChD,gBAAgB,EAAE,IAAI,CAAC,aAAa;YACpC,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjD,2BAA2B,EAAE,IAAI;SAClC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc,EAAE,OAAO,GAAyB,EAAE;QACjE,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,CAAC;QAEhH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAChD,gBAAgB,EAAE,IAAI,CAAC,aAAa;SACrC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CACtB,OAA6B;QAE7B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,gBAAgB,CACzB,OAAO,CAAC,UAAU,EAClB,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACnC,CAAC,kBAAkB,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
 import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
 import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
 import type { SimDecryptCommand, SimDecryptCommandOutput, SimEncryptCommand, SimEncryptCommandOutput } from "./crypto.command.js";
@@ -6,9 +6,6 @@ interface SimKmsCryptoCommandsProperties {
     readonly keys: SimKmsKeyStore;
     readonly authorizer: SimKmsAuthorizer;
 }
-interface SimKmsCryptoCommandOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The Encrypt and Decrypt commands of one simulated KMS scope.
  *
@@ -24,7 +21,7 @@ export declare class SimKmsCryptoCommands {
     /**
      * Encrypt plaintext under a key.
      */
-    encrypt(command: SimEncryptCommand, options?: SimKmsCryptoCommandOptions): SimEncryptCommandOutput;
+    encrypt(command: SimEncryptCommand, options?: SimKmsRequestOptions): SimEncryptCommandOutput;
     /**
      * Decrypt a ciphertext produced by this simulation.
      *
@@ -32,7 +29,7 @@ export declare class SimKmsCryptoCommands {
      * KeyId is optional for a symmetric key. Authorization therefore happens
      * against the key the blob names, once it is known.
      */
-    decrypt(command: SimDecryptCommand, options?: SimKmsCryptoCommandOptions): SimDecryptCommandOutput;
+    decrypt(command: SimDecryptCommand, options?: SimKmsRequestOptions): SimDecryptCommandOutput;
 }
 export {};
 //# sourceMappingURL=sim-kms-crypto-commands.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-crypto-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-crypto-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAW7B,UAAU,8BAA8B;IACtC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,0BAA0B;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IAEpD,YAAY,UAAU,EAAE,8BAA8B,EAIrD;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,0BAA0B,GACnC,uBAAuB,CA0BzB;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,0BAA0B,GACnC,uBAAuB,CAuBzB;CACF"}
+{"version":3,"file":"sim-kms-crypto-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-crypto-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAW7B,UAAU,8BAA8B;IACtC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IAEpD,YAAY,UAAU,EAAE,8BAA8B,EAIrD;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,uBAAuB,CA0BzB;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,uBAAuB,CAuBzB;CACF"}

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.js

@@ -38,7 +38,7 @@ export class SimKmsCryptoCommands {
             throw new SimKmsValidationException(`Plaintext of ${String(plaintext.length)} bytes exceeds the ${String(maxPlaintextBytes)} byte limit for a symmetric key; encrypt a data key from GenerateDataKey instead`);
         }
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:Encrypt", key, options?.caller);
+        this.authorizer.authorizeKey("kms:Encrypt", key, options);
         return {
             $metadata: {},
             CiphertextBlob: key.encrypt(plaintext, command.input.EncryptionContext),
@@ -61,7 +61,7 @@ export class SimKmsCryptoCommands {
         }
         const parts = this.blob.decode(ciphertextBlob);
         const key = this.ciphertextKey.behind(parts.keyArn);
-        this.authorizer.authorizeKey("kms:Decrypt", key, options?.caller);
+        this.authorizer.authorizeKey("kms:Decrypt", key, options);
         this.ciphertextKey.requireExpected(command.input.KeyId, key);
         return {
             $metadata: {},

package/dist/service/kms/command/crypto/sim-kms-crypto-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-crypto-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-crypto-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AASrC;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAW/B;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAClC,aAAa,CAAsB;IAEpD,YAAY,UAA0C;QACpD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,OAAO,CACL,OAA0B,EAC1B,OAAoC;QAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAC1C,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAClC,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CACjC,gBAAgB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,iBAAiB,CAAC,kFAAkF,CAC1K,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElE,OAAO;YACL,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,mBAAmB,EAAE,wBAAwB;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAA0B,EAC1B,OAAoC;QAEpC,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAC1C,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAClC,CAAC;QAEF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE7D,OAAO;YACL,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC9D,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,mBAAmB,EAAE,wBAAwB;SAC9C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-kms-crypto-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-crypto-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AASrC;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAO/B;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAClC,aAAa,CAAsB;IAEpD,YAAY,UAA0C;QACpD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,OAAO,CACL,OAA0B,EAC1B,OAA8B;QAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAC1C,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAClC,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CACjC,gBAAgB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,iBAAiB,CAAC,kFAAkF,CAC1K,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO;YACL,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACvE,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,mBAAmB,EAAE,wBAAwB;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAA0B,EAC1B,OAA8B;QAE9B,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAC1C,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAClC,CAAC;QAEF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE7D,OAAO;YACL,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC9D,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,mBAAmB,EAAE,wBAAwB;SAC9C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
 import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
 import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
 import type { SimGenerateDataKeyCommand, SimGenerateDataKeyCommandOutput } from "./crypto.command.js";
@@ -6,9 +6,6 @@ interface SimKmsGenerateDataKeyProperties {
     readonly keys: SimKmsKeyStore;
     readonly authorizer: SimKmsAuthorizer;
 }
-interface SimKmsGenerateDataKeyOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The GenerateDataKey command of one simulated KMS scope.
  *
@@ -25,7 +22,7 @@ export declare class SimKmsGenerateDataKey {
     /**
      * Generate a data key, returned both in the clear and encrypted.
      */
-    handle(command: SimGenerateDataKeyCommand, options?: SimKmsGenerateDataKeyOptions): SimGenerateDataKeyCommandOutput;
+    handle(command: SimGenerateDataKeyCommand, options?: SimKmsRequestOptions): SimGenerateDataKeyCommandOutput;
 }
 export {};
 //# sourceMappingURL=sim-kms-generate-data-key.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-generate-data-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-generate-data-key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,qBAAqB,CAAC;AAG7B,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IAEvD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,4BAA4B,GACrC,+BAA+B,CAiBjC;CACF"}
+{"version":3,"file":"sim-kms-generate-data-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-generate-data-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,qBAAqB,CAAC;AAG7B,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IAEvD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,+BAA+B,CAiBjC;CACF"}

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.js

@@ -22,7 +22,7 @@ export class SimKmsGenerateDataKey {
     handle(command, options) {
         const length = this.dataKeySpec.lengthFor(command.input.KeySpec, command.input.NumberOfBytes);
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:GenerateDataKey", key, options?.caller);
+        this.authorizer.authorizeKey("kms:GenerateDataKey", key, options);
         const dataKey = Uint8Array.from(randomBytes(length));
         return {
             $metadata: {},

package/dist/service/kms/command/crypto/sim-kms-generate-data-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-generate-data-key.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-generate-data-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAW/D;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACf,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,WAAW,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAEvD,YAAY,UAA2C;QACrD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAAkC,EAClC,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CACvC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,aAAa,CAC5B,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,OAAO;YACL,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACrE,KAAK,EAAE,GAAG,CAAC,GAAG;SACf,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-kms-generate-data-key.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-generate-data-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAO/D;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACf,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,WAAW,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAEvD,YAAY,UAA2C;QACrD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAAkC,EAClC,OAA8B;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CACvC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,aAAa,CAC5B,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,OAAO;YACL,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACrE,KAAK,EAAE,GAAG,CAAC,GAAG;SACf,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-commands.d.ts

@@ -1,4 +1,4 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
 import type { SimKmsKeyFactory } from "../../key/sim-kms-key-factory.js";
 import type { SimKmsKeyMetadataView } from "../../key/sim-kms-key-metadata.js";
 import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
@@ -10,9 +10,6 @@ interface SimKmsKeyCommandsProperties {
     readonly authorizer: SimKmsAuthorizer;
     readonly metadata: SimKmsKeyMetadataView;
 }
-interface SimKmsKeyCommandOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The key creation and description commands of one simulated KMS scope.
  */
@@ -31,11 +28,11 @@ export declare class SimKmsKeyCommands {
      * Region's keys rather than a key policy. Real KMS gives kms:CreateKey no
      * resource-level permissions for the same reason.
      */
-    create(command: SimCreateKeyCommand, options?: SimKmsKeyCommandOptions): SimCreateKeyCommandOutput;
+    create(command: SimCreateKeyCommand, options?: SimKmsRequestOptions): SimCreateKeyCommandOutput;
     /**
      * Describe a key.
      */
-    describe(command: SimDescribeKeyCommand, options?: SimKmsKeyCommandOptions): SimDescribeKeyCommandOutput;
+    describe(command: SimDescribeKeyCommand, options?: SimKmsRequestOptions): SimDescribeKeyCommandOutput;
 }
 export {};
 //# sourceMappingURL=sim-kms-key-commands.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,UAAU,2BAA2B;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,2BAA2B,EAKlD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,uBAAuB,GAChC,yBAAyB,CAgB3B;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,uBAAuB,GAChC,2BAA2B,CAK7B;CACF"}
+{"version":3,"file":"sim-kms-key-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,UAAU,2BAA2B;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,2BAA2B,EAKlD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,yBAAyB,CAgB3B;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,2BAA2B,CAK7B;CACF"}

package/dist/service/kms/command/key/sim-kms-key-commands.js

@@ -25,7 +25,7 @@ export class SimKmsKeyCommands {
      */
     create(command, options) {
         this.keyType.require(command.input.KeyUsage, command.input.KeySpec, command.input.Origin);
-        this.authorizer.authorizeAccount("kms:CreateKey", options?.caller);
+        this.authorizer.authorizeAccount("kms:CreateKey", options);
         const key = this.keyFactory.make({
             description: command.input.Description,
             policy: this.policyDocument.parseOptional(command.input.Policy),
@@ -38,7 +38,7 @@ export class SimKmsKeyCommands {
      */
     describe(command, options) {
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:DescribeKey", key, options?.caller);
+        this.authorizer.authorizeKey("kms:DescribeKey", key, options);
         return { $metadata: {}, KeyMetadata: this.metadata.describe(key) };
     }
 }

package/dist/service/kms/command/key/sim-kms-key-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAsBtD;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,UAAU,CAAmB;IAC7B,QAAQ,CAAwB;IAChC,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;IAC9B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA4B,EAC5B,OAAiC;QAEjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YACtC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEnB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,OAA8B,EAC9B,OAAiC;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEtE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAkBtD;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,UAAU,CAAmB;IAC7B,QAAQ,CAAwB;IAChC,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;IAC9B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA4B,EAC5B,OAA8B;QAE9B,IAAI,CAAC,OAAO,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YACtC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEnB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,OAA8B,EAC9B,OAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAE9D,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.d.ts

@@ -1,5 +1,5 @@
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
 import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
 import type { SimCancelKeyDeletionCommand, SimCancelKeyDeletionCommandOutput, SimDisableKeyCommand, SimDisableKeyCommandOutput, SimEnableKeyCommand, SimEnableKeyCommandOutput, SimScheduleKeyDeletionCommand, SimScheduleKeyDeletionCommandOutput } from "./key.command.js";
@@ -8,9 +8,6 @@ interface SimKmsKeyLifecycleCommandsProperties {
     readonly authorizer: SimKmsAuthorizer;
     readonly clock: SimClock;
 }
-interface SimKmsKeyLifecycleCommandOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The commands that move a simulated KMS key between lifecycle states.
  *
@@ -26,11 +23,11 @@ export declare class SimKmsKeyLifecycleCommands {
     /**
      * Enable a key.
      */
-    enable(command: SimEnableKeyCommand, options?: SimKmsKeyLifecycleCommandOptions): SimEnableKeyCommandOutput;
+    enable(command: SimEnableKeyCommand, options?: SimKmsRequestOptions): SimEnableKeyCommandOutput;
     /**
      * Disable a key, leaving it present but unusable.
      */
-    disable(command: SimDisableKeyCommand, options?: SimKmsKeyLifecycleCommandOptions): SimDisableKeyCommandOutput;
+    disable(command: SimDisableKeyCommand, options?: SimKmsRequestOptions): SimDisableKeyCommandOutput;
     /**
      * Schedule a key for deletion after a recovery window.
      *
@@ -38,11 +35,11 @@ export declare class SimKmsKeyLifecycleCommands {
      * what recoverable means: the key is still there, refusing to be used, until
      * the window runs out.
      */
-    scheduleDeletion(command: SimScheduleKeyDeletionCommand, options?: SimKmsKeyLifecycleCommandOptions): SimScheduleKeyDeletionCommandOutput;
+    scheduleDeletion(command: SimScheduleKeyDeletionCommand, options?: SimKmsRequestOptions): SimScheduleKeyDeletionCommandOutput;
     /**
      * Cancel a scheduled deletion, leaving the key disabled.
      */
-    cancelDeletion(command: SimCancelKeyDeletionCommand, options?: SimKmsKeyLifecycleCommandOptions): SimCancelKeyDeletionCommandOutput;
+    cancelDeletion(command: SimCancelKeyDeletionCommand, options?: SimKmsRequestOptions): SimCancelKeyDeletionCommandOutput;
 }
 export {};
 //# sourceMappingURL=sim-kms-key-lifecycle-commands.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-lifecycle-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-lifecycle-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,kBAAkB,CAAC;AAE1B,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,gCAAgC,GACzC,yBAAyB,CAM3B;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,gCAAgC,GACzC,0BAA0B,CAM5B;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,OAAO,EAAE,6BAA6B,EACtC,OAAO,CAAC,EAAE,gCAAgC,GACzC,mCAAmC,CAmBrC;IAED;;OAEG;IACH,cAAc,CACZ,OAAO,EAAE,2BAA2B,EACpC,OAAO,CAAC,EAAE,gCAAgC,GACzC,iCAAiC,CAMnC;CACF"}
+{"version":3,"file":"sim-kms-key-lifecycle-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-lifecycle-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,kBAAkB,CAAC;AAE1B,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,yBAAyB,CAM3B;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,0BAA0B,CAM5B;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,OAAO,EAAE,6BAA6B,EACtC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,mCAAmC,CAerC;IAED;;OAEG;IACH,cAAc,CACZ,OAAO,EAAE,2BAA2B,EACpC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,iCAAiC,CAMnC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.js

@@ -20,7 +20,7 @@ export class SimKmsKeyLifecycleCommands {
      */
     enable(command, options) {
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:EnableKey", key, options?.caller);
+        this.authorizer.authorizeKey("kms:EnableKey", key, options);
         key.enable();
         return { $metadata: {} };
     }
@@ -29,7 +29,7 @@ export class SimKmsKeyLifecycleCommands {
      */
     disable(command, options) {
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:DisableKey", key, options?.caller);
+        this.authorizer.authorizeKey("kms:DisableKey", key, options);
         key.disable();
         return { $metadata: {} };
     }
@@ -43,7 +43,7 @@ export class SimKmsKeyLifecycleCommands {
     scheduleDeletion(command, options) {
         const window = new SimKmsPendingWindow(command.input.PendingWindowInDays);
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:ScheduleKeyDeletion", key, options?.caller);
+        this.authorizer.authorizeKey("kms:ScheduleKeyDeletion", key, options);
         const deletionDate = window.deletionDateFrom(this.clock.now());
         key.scheduleDeletion(deletionDate);
         return {
@@ -59,7 +59,7 @@ export class SimKmsKeyLifecycleCommands {
      */
     cancelDeletion(command, options) {
         const key = this.keys.require(command.input.KeyId);
-        this.authorizer.authorizeKey("kms:CancelKeyDeletion", key, options?.caller);
+        this.authorizer.authorizeKey("kms:CancelKeyDeletion", key, options);
         key.cancelDeletion();
         return { $metadata: {}, KeyId: key.arn };
     }