@kensio/yulin 0.41.0 → 0.43.0

package/dist/service/cognito/user-pool/user/sim-cognito-user-store.js

@@ -0,0 +1,73 @@
+import { SimCognitoUsernameExistsException, SimCognitoUserNotFoundException, } from "../../error/sim-cognito.error.js";
+/**
+ * The users of one simulated user pool.
+ *
+ * Users are keyed by username, which is what every admin operation names one
+ * by. Usernames are case sensitive here, as they are on a pool created without
+ * a `UsernameConfiguration`, which this simulation refuses.
+ */
+export class SimCognitoUserStore {
+    users = new Map();
+    /**
+     * Every user in this pool, in creation order.
+     */
+    get all() {
+        return this.users.values().toArray();
+    }
+    /**
+     * How many users the pool holds.
+     */
+    get count() {
+        return this.users.size;
+    }
+    /**
+     * Store a newly created user, refusing a username the pool already holds.
+     */
+    add(user) {
+        if (this.users.has(user.username)) {
+            throw new SimCognitoUsernameExistsException(`User account ${user.username} already exists in this user pool.`);
+        }
+        this.users.set(user.username, user);
+    }
+    /**
+     * Forget a deleted user.
+     */
+    remove(user) {
+        this.users.delete(user.username);
+    }
+    /**
+     * Find a user by username.
+     */
+    find(username) {
+        return this.users.get(username);
+    }
+    /**
+     * Resolve a user by username, or refuse.
+     */
+    require(username) {
+        const found = this.find(username);
+        if (found === undefined) {
+            throw new SimCognitoUserNotFoundException(this.missingMessage(username));
+        }
+        return found;
+    }
+    /**
+     * Say why a username reached no user.
+     *
+     * A value that is some user's `sub` gets its own message. Real Cognito
+     * accepts a `sub` where an admin operation asks for a username, and this
+     * simulation resolves users by username only, so the refusal explains
+     * itself rather than looking like the user was never created.
+     */
+    missingMessage(username) {
+        const bySub = this.all.find((user) => user.sub === username);
+        if (bySub !== undefined) {
+            return (`User ${username} does not exist: that is the sub of user ` +
+                `${bySub.username}. Real Cognito also accepts a sub where an admin ` +
+                `operation asks for a username, and this simulation resolves users ` +
+                `by username only.`);
+        }
+        return `User ${username} does not exist.`;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-store.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,kCAAkC,CAAC;AAI1C;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAoB;QACtB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,iCAAiC,CACzC,gBAAgB,IAAI,CAAC,QAAQ,oCAAoC,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAoB;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAA4B;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,cAAc,CAAC,QAA4B;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QAE7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CACL,QAAQ,QAAQ,2CAA2C;gBAC3D,GAAG,KAAK,CAAC,QAAQ,mDAAmD;gBACpE,oEAAoE;gBACpE,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,QAAQ,kBAAkB,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts

@@ -0,0 +1,98 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoAttributeType, SimCognitoUserAttributes } from "./sim-cognito-user-attributes.js";
+import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
+import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
+import type { SimCognitoUsername } from "./sim-cognito-username.js";
+interface SimCognitoUserProperties {
+    readonly username: SimCognitoUsername;
+    readonly sub: string;
+    readonly attributes: SimCognitoUserAttributes;
+    readonly password?: SimCognitoUserPassword | undefined;
+    readonly clock: SimClock;
+}
+/**
+ * One simulated Cognito user.
+ *
+ * The user's `sub` is a UUID Cognito allocates, and is not the username. Code
+ * that keys on the wrong one works only while the two happen to match, which
+ * they never do on a real pool.
+ *
+ * A user starts in `FORCE_CHANGE_PASSWORD`, because `AdminCreateUser` is the
+ * only way to make one here. That is the status that stops a user signing in
+ * with the temporary password it was given.
+ */
+export declare class SimCognitoUser {
+    readonly username: SimCognitoUsername;
+    readonly sub: string;
+    readonly creationDate: Date;
+    private readonly clock;
+    private readonly userAttributes;
+    private userStatus;
+    private userPassword;
+    private isEnabled;
+    private modifiedDate;
+    constructor(properties: SimCognitoUserProperties);
+    /**
+     * When the user last changed.
+     */
+    get lastModifiedDate(): Date;
+    /**
+     * Where the user is in the status lifecycle.
+     */
+    get status(): SimCognitoUserStatus;
+    /**
+     * Whether the user may authenticate at all.
+     *
+     * A disabled user keeps its password and its attributes, and neither real
+     * Cognito nor this simulation signs it in. A refresh is refused too, so
+     * disabling a user ends the sessions it has rather than only stopping new
+     * ones.
+     */
+    get enabled(): boolean;
+    /**
+     * The user's attributes, with the `sub` Cognito allocated among them.
+     *
+     * Real Cognito reports `sub` alongside the attributes a request set, which
+     * is where most code reads a user's identifier from.
+     */
+    get attributes(): readonly SimCognitoAttributeType[];
+    /**
+     * The user's attributes by name, without the `sub` Cognito allocated.
+     *
+     * This is what an id token's claims are built from: every attribute there
+     * has a value, and the sub is a claim of its own.
+     */
+    get attributeValues(): ReadonlyMap<string, string>;
+    /**
+     * Set the password an admin gave this user.
+     *
+     * A permanent password is the user's own, and confirms it. A temporary one
+     * leaves the user in `FORCE_CHANGE_PASSWORD`, having to replace it through
+     * the `NEW_PASSWORD_REQUIRED` challenge before it can sign in normally.
+     */
+    setPassword(password: string, permanent: boolean | undefined): void;
+    /**
+     * Whether a candidate password is this user's.
+     *
+     * A user with no password at all matches nothing. `AdminCreateUser` leaves
+     * one that way when the request named no `TemporaryPassword`: real Cognito
+     * generates one and sends it to the user, and nothing here delivers a
+     * message for the user to read it from.
+     */
+    hasPassword(candidate: string | undefined): boolean;
+    /**
+     * Apply an attribute update to this user.
+     */
+    updateAttributes(requested: readonly SimCognitoAttributeType[] | undefined): void;
+    /**
+     * Let the user authenticate again.
+     */
+    enable(): void;
+    /**
+     * Stop the user authenticating.
+     */
+    disable(): void;
+    private touch;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACzB,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,UAAU,CAA4C;IAC9D,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,wBAAwB,EAQ/C;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,SAAS,uBAAuB,EAAE,CAEnD;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjD;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAIlE;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElD;IAED;;OAEG;IACH,gBAAgB,CACd,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAGN;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAGb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED,OAAO,CAAC,KAAK;CAGd"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.js

@@ -0,0 +1,122 @@
+import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
+import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
+/**
+ * One simulated Cognito user.
+ *
+ * The user's `sub` is a UUID Cognito allocates, and is not the username. Code
+ * that keys on the wrong one works only while the two happen to match, which
+ * they never do on a real pool.
+ *
+ * A user starts in `FORCE_CHANGE_PASSWORD`, because `AdminCreateUser` is the
+ * only way to make one here. That is the status that stops a user signing in
+ * with the temporary password it was given.
+ */
+export class SimCognitoUser {
+    username;
+    sub;
+    creationDate;
+    clock;
+    userAttributes;
+    userStatus = SimCognitoUserStatus.forceChangePassword;
+    userPassword;
+    isEnabled = true;
+    modifiedDate;
+    constructor(properties) {
+        this.username = properties.username;
+        this.sub = properties.sub;
+        this.userAttributes = properties.attributes;
+        this.userPassword = properties.password;
+        this.clock = properties.clock;
+        this.creationDate = this.clock.now();
+        this.modifiedDate = this.creationDate;
+    }
+    /**
+     * When the user last changed.
+     */
+    get lastModifiedDate() {
+        return this.modifiedDate;
+    }
+    /**
+     * Where the user is in the status lifecycle.
+     */
+    get status() {
+        return this.userStatus;
+    }
+    /**
+     * Whether the user may authenticate at all.
+     *
+     * A disabled user keeps its password and its attributes, and neither real
+     * Cognito nor this simulation signs it in. A refresh is refused too, so
+     * disabling a user ends the sessions it has rather than only stopping new
+     * ones.
+     */
+    get enabled() {
+        return this.isEnabled;
+    }
+    /**
+     * The user's attributes, with the `sub` Cognito allocated among them.
+     *
+     * Real Cognito reports `sub` alongside the attributes a request set, which
+     * is where most code reads a user's identifier from.
+     */
+    get attributes() {
+        return [{ Name: "sub", Value: this.sub }, ...this.userAttributes.entries];
+    }
+    /**
+     * The user's attributes by name, without the `sub` Cognito allocated.
+     *
+     * This is what an id token's claims are built from: every attribute there
+     * has a value, and the sub is a claim of its own.
+     */
+    get attributeValues() {
+        return this.userAttributes.values;
+    }
+    /**
+     * Set the password an admin gave this user.
+     *
+     * A permanent password is the user's own, and confirms it. A temporary one
+     * leaves the user in `FORCE_CHANGE_PASSWORD`, having to replace it through
+     * the `NEW_PASSWORD_REQUIRED` challenge before it can sign in normally.
+     */
+    setPassword(password, permanent) {
+        this.userPassword = new SimCognitoUserPassword(password);
+        this.userStatus = SimCognitoUserStatus.afterPasswordSet(permanent);
+        this.touch();
+    }
+    /**
+     * Whether a candidate password is this user's.
+     *
+     * A user with no password at all matches nothing. `AdminCreateUser` leaves
+     * one that way when the request named no `TemporaryPassword`: real Cognito
+     * generates one and sends it to the user, and nothing here delivers a
+     * message for the user to read it from.
+     */
+    hasPassword(candidate) {
+        return this.userPassword?.matches(candidate) ?? false;
+    }
+    /**
+     * Apply an attribute update to this user.
+     */
+    updateAttributes(requested) {
+        this.userAttributes.update(requested);
+        this.touch();
+    }
+    /**
+     * Let the user authenticate again.
+     */
+    enable() {
+        this.isEnabled = true;
+        this.touch();
+    }
+    /**
+     * Stop the user authenticating.
+     */
+    disable() {
+        this.isEnabled = false;
+        this.touch();
+    }
+    touch() {
+        this.modifiedDate = this.clock.now();
+    }
+}
+//# sourceMappingURL=sim-cognito-user.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAWpE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACT,QAAQ,CAAqB;IAC7B,GAAG,CAAS;IACZ,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,cAAc,CAA2B;IAClD,UAAU,GAAG,oBAAoB,CAAC,mBAAmB,CAAC;IACtD,YAAY,CAAqC;IACjD,SAAS,GAAG,IAAI,CAAC;IACjB,YAAY,CAAO;IAE3B,YAAY,UAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,SAA8B;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAA6B;QACvC,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,SAAyD;QAEzD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-username.d.ts

@@ -0,0 +1,10 @@
+import type { Brand } from "../../../../util/brand.type.js";
+export type SimCognitoUsername = Brand<string, "SimCognitoUsername">;
+/**
+ * Read a requested username, or refuse a malformed one.
+ *
+ * A username is the identifier every admin operation names a user by, and it
+ * takes the same form as a group name, which is where the rule lives.
+ */
+export declare function requireSimCognitoUsername(value: string | undefined): SimCognitoUsername;
+//# sourceMappingURL=sim-cognito-username.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-username.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-username.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-username.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAG5D,MAAM,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAErE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,kBAAkB,CAGpB"}

package/dist/service/cognito/user-pool/user/sim-cognito-username.js

@@ -0,0 +1,12 @@
+import { SimCognitoIdentifier } from "../sim-cognito-identifier.js";
+/**
+ * Read a requested username, or refuse a malformed one.
+ *
+ * A username is the identifier every admin operation names a user by, and it
+ * takes the same form as a group name, which is where the rule lives.
+ */
+export function requireSimCognitoUsername(value) {
+    return new SimCognitoIdentifier({ field: "Username", subject: "user", value })
+        .value;
+}
+//# sourceMappingURL=sim-cognito-username.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-username.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-username.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-username.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIpE;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAyB;IAEzB,OAAO,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SAC3E,KAA2B,CAAC;AACjC,CAAC"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../../registry/sim-iam-account-resolver.js";
 import type { SimIamConditionValue, SimIamPolicy, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimIamRole, SimIamRoleName } from "../../role/sim-iam-role.js";
+import type { SimIamCallerConditionSource } from "./sim-iam-caller-condition-source.js";
 import type { SimIamAuthZContext, SimIamAuthZPolicySource, SimIamAuthZPolicySourceType } from "./sim-iam-auth-z-context.js";
 import type { SimAwsCredentialIdentityResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamUser, SimIamUsername } from "../../user/sim-iam-user.js";
@@ -29,6 +30,14 @@ export interface SimIamAuthorizationInput {
      * precedence over supplied values for equivalent keys.
      */
     readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+    /**
+     * Condition values the service can only supply once IAM has resolved the
+     * caller, such as the Account a KMS request came from.
+     *
+     * These are combined with the values supplied directly, and IAM-derived
+     * values still take precedence over both.
+     */
+    readonly callerConditions?: SimIamCallerConditionSource | undefined;
     /**
      * Simulated request caller.
      *
@@ -120,12 +129,22 @@ export declare class SimIamAuthZContextBuilder {
     private ownIdentityPolicySources;
     /**
      * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
-     * identity whose policies apply; for temporary Role credentials this is the
-     * underlying Role ARN, rather than the STS assumed-role session ARN retained
-     * as the effective caller for diagnostics.
+     * derive from the resolved caller.
+     *
+     * A service supplies values it knows from the request, and values it can
+     * only work out once the caller is resolved. IAM's own values are applied
+     * last, so nothing a service supplies can overwrite them.
      */
     private conditionContext;
+    /**
+     * The condition values IAM derives from the caller itself.
+     *
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    private callerDerivedConditions;
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EACV,gCAAgC,EAEjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,2BAA2B,EAC3B,UAAU,GAAG,OAAO,CACrB,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;IAE7D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAEpE;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAE3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAE7E;;;;;;;OAOG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5D;AAED,UAAU,mCAAmC;IAC3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;IAEtE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAuC;IACjF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IAEtE,YAAY,UAAU,EAAE,mCAAmC,EAc1D;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,CAqBzD;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAAS,EAAE,eAAe,GACzB,SAAS,uBAAuB,EAAE,CAIpC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js

@@ -87,21 +87,34 @@ export class SimIamAuthZContextBuilder {
     }
     /**
      * Combine service-provided condition values with global values that IAM can
-     * derive from the resolved caller. AWS:PrincipalArn identifies the IAM
-     * identity whose policies apply; for temporary Role credentials this is the
-     * underlying Role ARN, rather than the STS assumed-role session ARN retained
-     * as the effective caller for diagnostics.
+     * derive from the resolved caller.
+     *
+     * A service supplies values it knows from the request, and values it can
+     * only work out once the caller is resolved. IAM's own values are applied
+     * last, so nothing a service supplies can overwrite them.
      */
     conditionContext(input, caller) {
-        const principalArn = caller.identityPolicyArn ?? caller.arn;
-        if (principalArn === undefined) {
-            return input.conditionContext ?? {};
-        }
         return {
             ...input.conditionContext,
-            "aws:PrincipalArn": principalArn,
+            ...input.callerConditions?.conditionValuesFor(caller),
+            ...this.callerDerivedConditions(caller),
         };
     }
+    /**
+     * The condition values IAM derives from the caller itself.
+     *
+     * AWS:PrincipalArn identifies the IAM identity whose policies apply; for
+     * temporary Role credentials this is the underlying Role ARN, rather than
+     * the STS assumed-role session ARN retained as the effective caller for
+     * diagnostics.
+     */
+    callerDerivedConditions(caller) {
+        const principalArn = caller.identityPolicyArn ?? caller.arn;
+        if (principalArn === undefined) {
+            return {};
+        }
+        return { "aws:PrincipalArn": principalArn };
+    }
     /**
      * Convert resource policies supplied by the resource-owning service into
      * authorization policy sources.

package/dist/service/iam/authorize/context/sim-iam-auth-z-context-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAapF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AAkFpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IACnD,gBAAgB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEtE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC7C,aAAa,EACb,KAAK,CAAC,2BAA2B,CAClC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,kBAAkB,EAAE,YAAY;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"sim-iam-auth-z-context-builder.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-auth-z-context-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAMvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAcpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,EACL,+BAA+B,GAEhC,MAAM,4CAA4C,CAAC;AA2FpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAkC;IACtD,yBAAyB,CAAuC;IAChE,qBAAqB,CAA8B;IACnD,gBAAgB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEtE,YAAY,UAA+C;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,+BAA+B,CAC7D,8BAA8B,CAAC,UAAU,CAAC,SAAS,CAAC,EACpD,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,oCAAoC,CAAC;YACxE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,2BAA2B,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAA+B;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CACtD,aAAa,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,gBAAgB,EAAE;gBAChB,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC;gBAC/C,GAAG,aAAa,CAAC,gBAAgB;aAClC;YACD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAC7C,aAAa,EACb,KAAK,CAAC,2BAA2B,CAClC;YACD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,wBAAwB,CAClC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,wBAAwB,CAC9B,aAAuC;QAEvC,OAAO;YACL,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CACrC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CACvC;YACD,GAAG,aAAa,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CACtB,KAA+B,EAC/B,MAA4B;QAE5B,OAAO;YACL,GAAG,KAAK,CAAC,gBAAgB;YACzB,GAAG,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,CAAC;YACrD,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,uBAAuB,CAC7B,MAA4B;QAE5B,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC;QAE5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,KAA+B;QAE/B,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.d.ts

@@ -0,0 +1,21 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamConditionValue } from "../../policy/sim-iam-policy.js";
+/**
+ * Condition values a service can only work out once IAM has resolved the
+ * caller.
+ *
+ * Most condition values a service supplies are properties of the request, so
+ * it has them before it asks IAM anything. A few are properties of whoever
+ * turns out to be making the request, and only IAM can say who that is: a
+ * caller may arrive as credentials to authenticate or be omitted altogether.
+ * `kms:CallerAccount` is one, naming the Account a KMS request came from.
+ *
+ * The values stay with the service that owns the condition key rather than
+ * being derived by IAM for every request, since a key such as
+ * `kms:CallerAccount` exists only in KMS and matching it elsewhere would be
+ * looser than AWS.
+ */
+export interface SimIamCallerConditionSource {
+    conditionValuesFor(caller: SimAwsResolvedCaller): Readonly<Record<string, SimIamConditionValue>>;
+}
+//# sourceMappingURL=sim-iam-caller-condition-source.d.ts.map

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-condition-source.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-caller-condition-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,2BAA2B;IAC1C,kBAAkB,CAChB,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;CACnD"}

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-iam-caller-condition-source.js.map

package/dist/service/iam/authorize/context/sim-iam-caller-condition-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-caller-condition-source.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/context/sim-iam-caller-condition-source.ts"],"names":[],"mappings":""}

package/dist/service/iam/policy/sim-iam-policy-document.factory.d.ts

@@ -0,0 +1,43 @@
+import { MappedFactory } from "@kensio/part-factory";
+import type { SimIamPolicyDocument } from "./sim-iam-policy.js";
+/**
+ * Builds the JSON string an IAM policy document is supplied as.
+ *
+ * A test states only the part of the statement it is about. The Version, and
+ * an Allow effect, come from the defaults, since a test that has to spell them
+ * out every time buries the Action and Resource it actually cares about.
+ *
+ * ```typescript
+ * await simAws.iam().putRolePolicy(
+ *   new PutRolePolicyCommand({
+ *     RoleName: "FunctionInvoker",
+ *     PolicyName: "InvokePolicy",
+ *     PolicyDocument: simIamPolicyDocumentFactory.make({
+ *       Statement: { Action: "lambda:InvokeFunction", Resource: functionArn },
+ *     }),
+ *   }),
+ * );
+ * ```
+ *
+ * This is equally the shape of a trust policy, a resource policy or a key
+ * policy, so the one factory covers all of them:
+ *
+ * ```typescript
+ * simIamPolicyDocumentFactory.make({
+ *   Statement: {
+ *     Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+ *     Action: "sts:AssumeRole",
+ *   },
+ * });
+ * ```
+ *
+ * There is no default Principal. Leaving it out keeps a statement that names
+ * one from merging with a default that names another.
+ *
+ * The default `Effect: "Allow"` only reaches a single-statement override. A
+ * multi-statement policy overrides `Statement` with an array, which replaces
+ * the default rather than merging into each entry, so every statement in an
+ * array needs its own `Effect`.
+ */
+export declare const simIamPolicyDocumentFactory: MappedFactory<SimIamPolicyDocument, string, undefined>;
+//# sourceMappingURL=sim-iam-policy-document.factory.d.ts.map

package/dist/service/iam/policy/sim-iam-policy-document.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-document.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy-document.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,2BAA2B,wDASvC,CAAC"}

package/dist/service/iam/policy/sim-iam-policy-document.factory.js

@@ -0,0 +1,46 @@
+import { MappedFactory } from "@kensio/part-factory";
+import { jsonStringify } from "../../../util/type-guard/json.js";
+/**
+ * Builds the JSON string an IAM policy document is supplied as.
+ *
+ * A test states only the part of the statement it is about. The Version, and
+ * an Allow effect, come from the defaults, since a test that has to spell them
+ * out every time buries the Action and Resource it actually cares about.
+ *
+ * ```typescript
+ * await simAws.iam().putRolePolicy(
+ *   new PutRolePolicyCommand({
+ *     RoleName: "FunctionInvoker",
+ *     PolicyName: "InvokePolicy",
+ *     PolicyDocument: simIamPolicyDocumentFactory.make({
+ *       Statement: { Action: "lambda:InvokeFunction", Resource: functionArn },
+ *     }),
+ *   }),
+ * );
+ * ```
+ *
+ * This is equally the shape of a trust policy, a resource policy or a key
+ * policy, so the one factory covers all of them:
+ *
+ * ```typescript
+ * simIamPolicyDocumentFactory.make({
+ *   Statement: {
+ *     Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+ *     Action: "sts:AssumeRole",
+ *   },
+ * });
+ * ```
+ *
+ * There is no default Principal. Leaving it out keeps a statement that names
+ * one from merging with a default that names another.
+ *
+ * The default `Effect: "Allow"` only reaches a single-statement override. A
+ * multi-statement policy overrides `Statement` with an array, which replaces
+ * the default rather than merging into each entry, so every statement in an
+ * array needs its own `Effect`.
+ */
+export const simIamPolicyDocumentFactory = new MappedFactory(() => ({
+    Version: "2012-10-17",
+    Statement: { Effect: "Allow" },
+}), (document) => jsonStringify(document));
+//# sourceMappingURL=sim-iam-policy-document.factory.js.map

package/dist/service/iam/policy/sim-iam-policy-document.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-policy-document.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy-document.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAGjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,aAAa,CAI1D,GAAG,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;CAC/B,CAAC,EACF,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CACtC,CAAC"}

package/dist/service/iam/policy/sim-iam-policy.factory.d.ts

@@ -2,5 +2,5 @@ import { DynamicFactory } from "@kensio/part-factory";
 /**
  * Generates fake IAM managed policy records.
  */
-export declare const simIamPolicyFactory: DynamicFactory<import("./sim-iam-policy.js").SimIamManagedPolicy>;
+export declare const simIamPolicyFactory: DynamicFactory<import("./sim-iam-policy.js").SimIamManagedPolicy, undefined>;
 //# sourceMappingURL=sim-iam-policy.factory.d.ts.map

package/dist/service/iam/policy/sim-iam-policy.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKtD;;GAEG;AACH,eAAO,MAAM,mBAAmB,mEAqB9B,CAAC"}
+{"version":3,"file":"sim-iam-policy.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/policy/sim-iam-policy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKtD;;GAEG;AACH,eAAO,MAAM,mBAAmB,8EAqB9B,CAAC"}

package/dist/service/iam/role/sim-iam-role.factory.d.ts

@@ -3,5 +3,5 @@ import type { SimIamRole } from "./sim-iam-role.js";
 /**
  * Generates fake IAM Role records.
  */
-export declare const simIamRoleFactory: DynamicFactory<SimIamRole>;
+export declare const simIamRoleFactory: DynamicFactory<SimIamRole, undefined>;
 //# sourceMappingURL=sim-iam-role.factory.d.ts.map

package/dist/service/iam/role/sim-iam-role.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-role.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,mBAAmB,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,iBAAiB,4BAqB5B,CAAC"}
+{"version":3,"file":"sim-iam-role.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,mBAAmB,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,iBAAiB,uCAqB5B,CAAC"}