@kensio/yulin 0.41.0 → 0.42.0

package/dist/service/cognito/user-pool/sim-cognito-password-policy.js

@@ -0,0 +1,51 @@
+import { SimCognitoInvalidParameterException } from "../error/sim-cognito.error.js";
+const minimumLengthRange = { least: 6, most: 99 };
+const temporaryPasswordValidityDaysRange = { least: 0, most: 365 };
+/**
+ * The password policy of one simulated user pool.
+ *
+ * The defaults are the ones real Cognito applies when a `CreateUserPool`
+ * request says nothing about passwords: eight characters, with an uppercase
+ * letter, a lowercase letter, a number and a symbol each required. A pool
+ * created here therefore rejects the same passwords a pool created with the
+ * SDK and no arguments would.
+ */
+export class SimCognitoPasswordPolicy {
+    minimumLength;
+    requiresUppercase;
+    requiresLowercase;
+    requiresNumbers;
+    requiresSymbols;
+    temporaryPasswordValidityDays;
+    constructor(policy = {}) {
+        this.minimumLength = SimCognitoPasswordPolicy.wholeNumberIn("MinimumLength", policy.MinimumLength ?? 8, minimumLengthRange);
+        this.requiresUppercase = policy.RequireUppercase ?? true;
+        this.requiresLowercase = policy.RequireLowercase ?? true;
+        this.requiresNumbers = policy.RequireNumbers ?? true;
+        this.requiresSymbols = policy.RequireSymbols ?? true;
+        this.temporaryPasswordValidityDays = SimCognitoPasswordPolicy.wholeNumberIn("TemporaryPasswordValidityDays", policy.TemporaryPasswordValidityDays ?? 7, temporaryPasswordValidityDaysRange);
+    }
+    static wholeNumberIn(field, value, range) {
+        if (!Number.isSafeInteger(value) ||
+            value < range.least ||
+            value > range.most) {
+            throw new SimCognitoInvalidParameterException(`PasswordPolicy ${field} must be a whole number between ` +
+                `${String(range.least)} and ${String(range.most)}`);
+        }
+        return value;
+    }
+    /**
+     * The policy as Cognito reports it on the pool.
+     */
+    toOutput() {
+        return {
+            MinimumLength: this.minimumLength,
+            RequireUppercase: this.requiresUppercase,
+            RequireLowercase: this.requiresLowercase,
+            RequireNumbers: this.requiresNumbers,
+            RequireSymbols: this.requiresSymbols,
+            TemporaryPasswordValidityDays: this.temporaryPasswordValidityDays,
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-password-policy.js.map

package/dist/service/cognito/user-pool/sim-cognito-password-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-policy.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-password-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAqCpF,MAAM,kBAAkB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAClD,MAAM,kCAAkC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,aAAa,CAAS;IACtB,iBAAiB,CAAU;IAC3B,iBAAiB,CAAU;IAC3B,eAAe,CAAU;IACzB,eAAe,CAAU;IACzB,6BAA6B,CAAS;IAEtD,YAAY,MAAM,GAAiC,EAAE;QACnD,IAAI,CAAC,aAAa,GAAG,wBAAwB,CAAC,aAAa,CACzD,eAAe,EACf,MAAM,CAAC,aAAa,IAAI,CAAC,EACzB,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,6BAA6B,GAAG,wBAAwB,CAAC,aAAa,CACzE,+BAA+B,EAC/B,MAAM,CAAC,6BAA6B,IAAI,CAAC,EACzC,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,KAAa,EACb,KAAa,EACb,KAAwD;QAExD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAC5B,KAAK,GAAG,KAAK,CAAC,KAAK;YACnB,KAAK,GAAG,KAAK,CAAC,IAAI,EAClB,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,KAAK,kCAAkC;gBACvD,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;YACxC,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;SAClE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-arn.d.ts

@@ -0,0 +1,26 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+/**
+ * The part of a user pool ARN that comes before the pool's own id.
+ */
+export declare function cognitoUserPoolArnPrefix(accountRegionScope: SimAwsAccountRegionScope): string;
+interface SimCognitoUserPoolArnProperties {
+    readonly userPoolId: SimCognitoUserPoolId;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The ARN of one simulated user pool.
+ *
+ * A pool ARN is the pool id after `userpool/`, and the id already names its
+ * region, so the region appears twice:
+ * `arn:aws:cognito-idp:eu-west-2:111111111111:userpool/eu-west-2_aBcDeFgHi`.
+ * This is the resource every user pool IAM policy is written against,
+ * including the policies for app client operations, which have no ARN of
+ * their own.
+ */
+export declare class SimCognitoUserPoolArn {
+    readonly value: string;
+    constructor(properties: SimCognitoUserPoolArnProperties);
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-arn.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,kBAAkB,EAAE,wBAAwB,GAC3C,MAAM,CAIR;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,UAAU,EAAE,+BAA+B,EAItD;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-arn.js

@@ -0,0 +1,26 @@
+/**
+ * The part of a user pool ARN that comes before the pool's own id.
+ */
+export function cognitoUserPoolArnPrefix(accountRegionScope) {
+    const { regionName, accountId } = accountRegionScope;
+    return `arn:aws:cognito-idp:${regionName}:${accountId}:userpool/`;
+}
+/**
+ * The ARN of one simulated user pool.
+ *
+ * A pool ARN is the pool id after `userpool/`, and the id already names its
+ * region, so the region appears twice:
+ * `arn:aws:cognito-idp:eu-west-2:111111111111:userpool/eu-west-2_aBcDeFgHi`.
+ * This is the resource every user pool IAM policy is written against,
+ * including the policies for app client operations, which have no ARN of
+ * their own.
+ */
+export class SimCognitoUserPoolArn {
+    value;
+    constructor(properties) {
+        this.value =
+            cognitoUserPoolArnPrefix(properties.accountRegionScope) +
+                properties.userPoolId;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-arn.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-arn.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-arn.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,kBAA4C;IAE5C,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;IAErD,OAAO,uBAAuB,UAAU,IAAI,SAAS,YAAY,CAAC;AACpE,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IAE9B,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK;YACR,wBAAwB,CAAC,UAAU,CAAC,kBAAkB,CAAC;gBACvD,UAAU,CAAC,UAAU,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.d.ts

@@ -0,0 +1,34 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimCognitoUserPoolPoliciesType } from "./sim-cognito-password-policy.js";
+import { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolStore } from "./sim-cognito-user-pool-store.js";
+interface SimCognitoUserPoolFactoryProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly pools: SimCognitoUserPoolStore;
+    readonly clock: SimClock;
+}
+interface SimCognitoMakeUserPoolProperties {
+    readonly name: string | undefined;
+    readonly policies?: SimCognitoUserPoolPoliciesType | undefined;
+    readonly deletionProtection?: string | undefined;
+}
+/**
+ * Builds simulated user pools, including their id, ARN and defaults.
+ *
+ * Creation has to produce an id carrying the region, an ARN built from that
+ * id, a validated name and the password policy defaults, so it happens in one
+ * place rather than at each call site that needs a pool.
+ */
+export declare class SimCognitoUserPoolFactory {
+    private readonly accountRegionScope;
+    private readonly pools;
+    private readonly clock;
+    constructor(properties: SimCognitoUserPoolFactoryProperties);
+    /**
+     * Make a new pool with no app clients yet.
+     */
+    make(properties: SimCognitoMakeUserPoolProperties): SimCognitoUserPool;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-factory.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAG1F,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,gCAAgC,GAAG,kBAAkB,CAwBrE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.js

@@ -0,0 +1,44 @@
+import { SimCognitoDeletionProtection } from "./sim-cognito-deletion-protection.js";
+import { SimCognitoName } from "./sim-cognito-name.js";
+import { SimCognitoPasswordPolicy, } from "./sim-cognito-password-policy.js";
+import { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import { SimCognitoUserPoolArn } from "./sim-cognito-user-pool-arn.js";
+import { makeSimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+/**
+ * Builds simulated user pools, including their id, ARN and defaults.
+ *
+ * Creation has to produce an id carrying the region, an ARN built from that
+ * id, a validated name and the password policy defaults, so it happens in one
+ * place rather than at each call site that needs a pool.
+ */
+export class SimCognitoUserPoolFactory {
+    accountRegionScope;
+    pools;
+    clock;
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
+        this.pools = properties.pools;
+        this.clock = properties.clock;
+    }
+    /**
+     * Make a new pool with no app clients yet.
+     */
+    make(properties) {
+        const userPoolId = makeSimCognitoUserPoolId(this.accountRegionScope.regionName, this.pools.ids);
+        return new SimCognitoUserPool({
+            id: userPoolId,
+            arn: new SimCognitoUserPoolArn({
+                userPoolId,
+                accountRegionScope: this.accountRegionScope,
+            }),
+            name: new SimCognitoName({
+                field: "PoolName",
+                value: properties.name,
+            }),
+            passwordPolicy: new SimCognitoPasswordPolicy(properties.policies?.PasswordPolicy),
+            deletionProtection: new SimCognitoDeletionProtection(properties.deletionProtection),
+            createdDate: this.clock.now(),
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-factory.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-factory.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,wBAAwB,GAEzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAezE;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAC7C,KAAK,CAA0B;IAC/B,KAAK,CAAW;IAEjC,YAAY,UAA+C;QACzD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAA4C;QAC/C,MAAM,UAAU,GAAG,wBAAwB,CACzC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAC;QAEF,OAAO,IAAI,kBAAkB,CAAC;YAC5B,EAAE,EAAE,UAAU;YACd,GAAG,EAAE,IAAI,qBAAqB,CAAC;gBAC7B,UAAU;gBACV,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC;YACF,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,UAAU,CAAC,IAAI;aACvB,CAAC;YACF,cAAc,EAAE,IAAI,wBAAwB,CAC1C,UAAU,CAAC,QAAQ,EAAE,cAAc,CACpC;YACD,kBAAkB,EAAE,IAAI,4BAA4B,CAClD,UAAU,CAAC,kBAAkB,CAC9B;YACD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.d.ts

@@ -0,0 +1,20 @@
+import type { Brand } from "../../../util/brand.type.js";
+import type { AwsRegionName } from "../../aws/sim-aws-region.js";
+export type SimCognitoUserPoolId = Brand<string, "SimCognitoUserPoolId">;
+/**
+ * Allocate a user pool id for a region.
+ *
+ * The region is part of the id rather than decoration: SDK code routinely
+ * splits a pool id on the underscore to work out which region to talk to, and
+ * the hosted issuer URL is built from it the same way.
+ */
+export declare function makeSimCognitoUserPoolId(regionName: AwsRegionName, existing?: Set<string>): SimCognitoUserPoolId;
+/**
+ * Read a requested user pool id, or refuse a malformed one.
+ *
+ * Real Cognito validates the id's shape before it looks anything up, so a
+ * value that is not a pool id at all fails as a validation error rather than
+ * as a missing pool.
+ */
+export declare function requireSimCognitoUserPoolId(value: string | undefined): SimCognitoUserPoolId;
+//# sourceMappingURL=sim-cognito-user-pool-id.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-id.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAczE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,aAAa,EACzB,QAAQ,cAAoB,GAC3B,oBAAoB,CAatB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAetB"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.js

@@ -0,0 +1,48 @@
+import { faker } from "@faker-js/faker";
+import { SimCognitoInvalidParameterException } from "../error/sim-cognito.error.js";
+/**
+ * The number of random characters a user pool id carries after its region.
+ *
+ * Real Cognito ids look like `eu-west-2_aBcDeFgHi`: the region the pool lives
+ * in, an underscore, then nine mixed-case alphanumerics.
+ */
+const userPoolIdSuffixLength = 9;
+const userPoolIdPattern = /^[\w-]+_[0-9a-zA-Z]+$/u;
+const maxUserPoolIdLength = 55;
+/**
+ * Allocate a user pool id for a region.
+ *
+ * The region is part of the id rather than decoration: SDK code routinely
+ * splits a pool id on the underscore to work out which region to talk to, and
+ * the hosted issuer URL is built from it the same way.
+ */
+export function makeSimCognitoUserPoolId(regionName, existing = new Set()) {
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+        const userPoolId = `${regionName}_${faker.string.alphanumeric({
+            length: userPoolIdSuffixLength,
+        })}`;
+        if (!existing.has(userPoolId)) {
+            return userPoolId;
+        }
+    }
+    /* v8 ignore next -- unlikely to happen in practice */
+    throw new Error("Could not allocate unique Cognito user pool id");
+}
+/**
+ * Read a requested user pool id, or refuse a malformed one.
+ *
+ * Real Cognito validates the id's shape before it looks anything up, so a
+ * value that is not a pool id at all fails as a validation error rather than
+ * as a missing pool.
+ */
+export function requireSimCognitoUserPoolId(value) {
+    if (value === undefined || value === "") {
+        throw new SimCognitoInvalidParameterException("UserPoolId is required: name the pool the request is for");
+    }
+    if (value.length > maxUserPoolIdLength || !userPoolIdPattern.test(value)) {
+        throw new SimCognitoInvalidParameterException(`UserPoolId '${value}' is not a user pool id: ids take the ` +
+            `'<region>_<characters>' form, such as 'eu-west-2_aBcDeFgHi'`);
+    }
+    return value;
+}
+//# sourceMappingURL=sim-cognito-user-pool-id.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-id.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAGxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAyB,EACzB,QAAQ,GAAG,IAAI,GAAG,EAAU;IAE5B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5D,MAAM,EAAE,sBAAsB;SAC/B,CAAC,EAA0B,CAAC;QAE7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAmC,CAC3C,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,mCAAmC,CAC3C,eAAe,KAAK,wCAAwC;YAC1D,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,KAA6B,CAAC;AACvC,CAAC"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts

@@ -0,0 +1,36 @@
+import type { SimCognitoUserPool } from "./sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+/**
+ * The user pools of one simulated Cognito scope.
+ *
+ * Pools are keyed by id rather than by name, as real Cognito keys them: two
+ * pools may share a name, and only the id ever identifies one.
+ */
+export declare class SimCognitoUserPoolStore {
+    private readonly pools;
+    /**
+     * Every pool in this scope, in creation order.
+     */
+    get all(): readonly SimCognitoUserPool[];
+    /**
+     * The pool ids already in use, so a new one can avoid them.
+     */
+    get ids(): Set<string>;
+    /**
+     * Store a newly created pool.
+     */
+    add(pool: SimCognitoUserPool): void;
+    /**
+     * Forget a deleted pool.
+     */
+    remove(pool: SimCognitoUserPool): void;
+    /**
+     * Find a pool by id.
+     */
+    find(userPoolId: SimCognitoUserPoolId): SimCognitoUserPool | undefined;
+    /**
+     * Resolve a pool by id, or refuse.
+     */
+    require(userPoolId: SimCognitoUserPoolId): SimCognitoUserPool;
+}
+//# sourceMappingURL=sim-cognito-user-pool-store.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;;;;GAKG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAE/D;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAElC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAErC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js

@@ -0,0 +1,51 @@
+import { SimCognitoResourceNotFoundException } from "../error/sim-cognito.error.js";
+/**
+ * The user pools of one simulated Cognito scope.
+ *
+ * Pools are keyed by id rather than by name, as real Cognito keys them: two
+ * pools may share a name, and only the id ever identifies one.
+ */
+export class SimCognitoUserPoolStore {
+    pools = new Map();
+    /**
+     * Every pool in this scope, in creation order.
+     */
+    get all() {
+        return this.pools.values().toArray();
+    }
+    /**
+     * The pool ids already in use, so a new one can avoid them.
+     */
+    get ids() {
+        return new Set(this.pools.keys());
+    }
+    /**
+     * Store a newly created pool.
+     */
+    add(pool) {
+        this.pools.set(pool.id, pool);
+    }
+    /**
+     * Forget a deleted pool.
+     */
+    remove(pool) {
+        this.pools.delete(pool.id);
+    }
+    /**
+     * Find a pool by id.
+     */
+    find(userPoolId) {
+        return this.pools.get(userPoolId);
+    }
+    /**
+     * Resolve a pool by id, or refuse.
+     */
+    require(userPoolId) {
+        const found = this.find(userPoolId);
+        if (found === undefined) {
+            throw new SimCognitoResourceNotFoundException(`User pool ${userPoolId} does not exist.`);
+        }
+        return found;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-store.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIpF;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/D;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts

@@ -0,0 +1,65 @@
+import type { SimCognitoUserPoolClient } from "./client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPoolClientId } from "./client/sim-cognito-user-pool-client-id.js";
+import type { SimCognitoDeletionProtection } from "./sim-cognito-deletion-protection.js";
+import type { SimCognitoName } from "./sim-cognito-name.js";
+import type { SimCognitoPasswordPolicy } from "./sim-cognito-password-policy.js";
+import type { SimCognitoUserPoolArn } from "./sim-cognito-user-pool-arn.js";
+import type { SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
+interface SimCognitoUserPoolProperties {
+    readonly id: SimCognitoUserPoolId;
+    readonly arn: SimCognitoUserPoolArn;
+    readonly name: SimCognitoName;
+    readonly passwordPolicy: SimCognitoPasswordPolicy;
+    readonly deletionProtection: SimCognitoDeletionProtection;
+    readonly createdDate: Date;
+}
+/**
+ * One simulated Cognito user pool.
+ *
+ * The pool owns its app clients, because that is where they live on real
+ * Cognito: deleting a pool takes its clients with it, and a client id means
+ * nothing outside the pool that issued it.
+ */
+export declare class SimCognitoUserPool {
+    readonly id: SimCognitoUserPoolId;
+    readonly arn: SimCognitoUserPoolArn;
+    readonly name: string;
+    readonly passwordPolicy: SimCognitoPasswordPolicy;
+    readonly deletionProtection: SimCognitoDeletionProtection;
+    readonly creationDate: Date;
+    private readonly clientStore;
+    constructor(properties: SimCognitoUserPoolProperties);
+    /**
+     * When the pool last changed.
+     *
+     * Nothing can change a pool here, as `UpdateUserPool` is not simulated, so
+     * this is its creation date.
+     */
+    get lastModifiedDate(): Date;
+    /**
+     * Every app client of this pool, in creation order.
+     */
+    get clients(): readonly SimCognitoUserPoolClient[];
+    /**
+     * The app client ids already in use in this pool.
+     */
+    get clientIds(): Set<string>;
+    /**
+     * Store a newly created app client.
+     */
+    addClient(client: SimCognitoUserPoolClient): void;
+    /**
+     * Forget a deleted app client.
+     */
+    removeClient(client: SimCognitoUserPoolClient): void;
+    /**
+     * Find an app client of this pool by id.
+     */
+    findClient(clientId: string): SimCognitoUserPoolClient | undefined;
+    /**
+     * Resolve an app client of this pool by id, or refuse.
+     */
+    requireClient(clientId: SimCognitoUserPoolClientId): SimCognitoUserPoolClient;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IAEnE,YAAY,UAAU,EAAE,4BAA4B,EAOnD;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js

@@ -0,0 +1,71 @@
+import { SimCognitoUserPoolClientStore } from "./client/sim-cognito-user-pool-client-store.js";
+/**
+ * One simulated Cognito user pool.
+ *
+ * The pool owns its app clients, because that is where they live on real
+ * Cognito: deleting a pool takes its clients with it, and a client id means
+ * nothing outside the pool that issued it.
+ */
+export class SimCognitoUserPool {
+    id;
+    arn;
+    name;
+    passwordPolicy;
+    deletionProtection;
+    creationDate;
+    clientStore = new SimCognitoUserPoolClientStore();
+    constructor(properties) {
+        this.id = properties.id;
+        this.arn = properties.arn;
+        this.name = properties.name.value;
+        this.passwordPolicy = properties.passwordPolicy;
+        this.deletionProtection = properties.deletionProtection;
+        this.creationDate = properties.createdDate;
+    }
+    /**
+     * When the pool last changed.
+     *
+     * Nothing can change a pool here, as `UpdateUserPool` is not simulated, so
+     * this is its creation date.
+     */
+    get lastModifiedDate() {
+        return this.creationDate;
+    }
+    /**
+     * Every app client of this pool, in creation order.
+     */
+    get clients() {
+        return this.clientStore.all;
+    }
+    /**
+     * The app client ids already in use in this pool.
+     */
+    get clientIds() {
+        return this.clientStore.ids;
+    }
+    /**
+     * Store a newly created app client.
+     */
+    addClient(client) {
+        this.clientStore.add(client);
+    }
+    /**
+     * Forget a deleted app client.
+     */
+    removeClient(client) {
+        this.clientStore.remove(client);
+    }
+    /**
+     * Find an app client of this pool by id.
+     */
+    findClient(clientId) {
+        return this.clientStore.find(clientId);
+    }
+    /**
+     * Resolve an app client of this pool by id, or refuse.
+     */
+    requireClient(clientId) {
+        return this.clientStore.require(clientId);
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAgB/F;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,cAAc,CAA2B;IACzC,kBAAkB,CAA+B;IACjD,YAAY,CAAO;IAElB,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAEnE,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
 import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
+import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-source.js";
 import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
@@ -29,6 +30,14 @@ export interface SimIamAuthorizationInput {
      * precedence over supplied values for equivalent keys.
      */
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+    /**
+     * Condition values the service can only supply once IAM has resolved the
+     * caller, such as the Account a KMS request came from.
+     *
+     * These are combined with the values supplied directly, and IAM-derived
+     * values still take precedence over both.
+     */
+    readonly callerConditions?: SimIamCallerConditionSource | undefined;
     /**
      * Simulated request caller.
      *
@@ -120,12 +129,22 @@ export declare class SimIamAuthZContextBuilder {
     private ownIdentityPolicySources;
     /**
      * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
-     * identity whose policies apply; for temporary Role credentials this is the
-     * underlying Role ARN, rather than the STS assumed-role session ARN retained
-     * as the effective caller for diagnostics.
+     * derive from the resolved caller.
+     *
+     * A service supplies values it knows from the request, and values it can
+     * only work out once the caller is resolved. IAM's own values are applied
+     * last, so nothing a service supplies can overwrite them.
      */
     private conditionContext;
+    /**
+     * The condition values IAM derives from the caller itself.
+     *
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    private callerDerivedConditions;
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAEpE;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -87,21 +87,34 @@ export class SimIamAuthZContextBuilder {
     }
     /**
      * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
-     * identity whose policies apply; for temporary Role credentials this is the
-     * underlying Role ARN, rather than the STS assumed-role session ARN retained
-     * as the effective caller for diagnostics.
+     * derive from the resolved caller.
+     *
+     * A service supplies values it knows from the request, and values it can
+     * only work out once the caller is resolved. IAM's own values are applied
+     * last, so nothing a service supplies can overwrite them.
      */
     conditionContext(input, caller) {
-        const principalArn = caller.identityPolicyArn ?? caller.arn;
-        if (principalArn === undefined) {
-            return input.conditionContext ?? {};
-        }
         return {
             ...input.conditionContext,
-            "aws:PrincipalArn": principalArn,
+            ...input.callerConditions?.conditionValuesFor(caller),
+            ...this.callerDerivedConditions(caller),
         };
     }
+    /**
+     * The condition values IAM derives from the caller itself.
+     *
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    callerDerivedConditions(caller) {
+        const principalArn = caller.identityPolicyArn ?? caller.arn;
+        if (principalArn === undefined) {
+            return {};
+        }
+        return { "aws:PrincipalArn": principalArn };
+    }
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.