@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.d.ts

@@ -0,0 +1,14 @@
+import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
+/**
+ * IAM `ArnEquals` condition operator.
+ *
+ * AWS documents `ArnEquals` and `ArnLike` as behaving identically: both
+ * compare the six components of an ARN separately, and both accept `*` and `?`
+ * wildcards in any of them. So a policy written with either operator is
+ * evaluated the same way here, rather than `ArnEquals` being the exact-string
+ * comparison its name suggests.
+ */
+export declare class SimIamArnEquals extends SimIamScalarStringConditionOperator {
+    protected valueMatches(actual: string, expected: string): boolean;
+}
+//# sourceMappingURL=sim-iam-arn-equals.d.ts.map

package/dist/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-arn-equals.d.ts","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,0DAA0D,CAAC;AAE/G;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,mCAAmC;IACtE,UAAmB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzE;CACF"}

package/dist/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.js

@@ -0,0 +1,17 @@
+import { simIamArnMatch } from "../../../../sim-iam-arn-match.js";
+import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
+/**
+ * IAM `ArnEquals` condition operator.
+ *
+ * AWS documents `ArnEquals` and `ArnLike` as behaving identically: both
+ * compare the six components of an ARN separately, and both accept `*` and `?`
+ * wildcards in any of them. So a policy written with either operator is
+ * evaluated the same way here, rather than `ArnEquals` being the exact-string
+ * comparison its name suggests.
+ */
+export class SimIamArnEquals extends SimIamScalarStringConditionOperator {
+    valueMatches(actual, expected) {
+        return simIamArnMatch(expected, actual);
+    }
+}
+//# sourceMappingURL=sim-iam-arn-equals.js.map

package/dist/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-arn-equals.js","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/arn/equals/sim-iam-arn-equals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,mCAAmC,EAAE,MAAM,0DAA0D,CAAC;AAE/G;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,mCAAmC;IACnD,YAAY,CAAC,MAAc,EAAE,QAAgB;QAC9D,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.d.ts

@@ -0,0 +1,13 @@
+import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
+/**
+ * IAM `ArnLike` condition operator.
+ *
+ * This is `StringLike` over an ARN, with the wildcards confined to the
+ * component they are written in. It is what `AddPermission` writes a
+ * `SourceArn` under, so it is the operator an invoking service's grant is
+ * evaluated with.
+ */
+export declare class SimIamArnLike extends SimIamScalarStringConditionOperator {
+    protected valueMatches(actual: string, expected: string): boolean;
+}
+//# sourceMappingURL=sim-iam-arn-like.d.ts.map

package/dist/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-arn-like.d.ts","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,0DAA0D,CAAC;AAE/G;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,mCAAmC;IACpE,UAAmB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzE;CACF"}

package/dist/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.js

@@ -0,0 +1,16 @@
+import { simIamArnMatch } from "../../../../sim-iam-arn-match.js";
+import { SimIamScalarStringConditionOperator } from "../../string/sim-iam-scalar-string-condition-operator.js";
+/**
+ * IAM `ArnLike` condition operator.
+ *
+ * This is `StringLike` over an ARN, with the wildcards confined to the
+ * component they are written in. It is what `AddPermission` writes a
+ * `SourceArn` under, so it is the operator an invoking service's grant is
+ * evaluated with.
+ */
+export class SimIamArnLike extends SimIamScalarStringConditionOperator {
+    valueMatches(actual, expected) {
+        return simIamArnMatch(expected, actual);
+    }
+}
+//# sourceMappingURL=sim-iam-arn-like.js.map

package/dist/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-arn-like.js","sourceRoot":"","sources":["../../../../../../../../src/service/iam/authorize/match/condition/arn/like/sim-iam-arn-like.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,mCAAmC,EAAE,MAAM,0DAA0D,CAAC;AAE/G;;;;;;;GAOG;AACH,MAAM,OAAO,aAAc,SAAQ,mCAAmC;IACjD,YAAY,CAAC,MAAc,EAAE,QAAgB;QAC9D,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-condition-operator-parser.d.ts","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAoC/E;;;;;GAKG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAE1D;CACF"}
+{"version":3,"file":"sim-iam-condition-operator-parser.d.ts","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAwC/E;;;;;GAKG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAE1D;CACF"}

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js

@@ -5,7 +5,11 @@ import { SimIamForAnyValueStringLike } from "./string/any-value/sim-iam-for-any-
 import { SimIamStringEquals } from "./string/equals/sim-iam-string-equals.js";
 import { SimIamStringLike } from "./string/like/sim-iam-string-like.js";
 import { SimIamNumericLessThanEquals } from "./numeric/less-than-equals/sim-iam-number-lte.js";
+import { SimIamArnEquals } from "./arn/equals/sim-iam-arn-equals.js";
+import { SimIamArnLike } from "./arn/like/sim-iam-arn-like.js";
 const operatorFactories = new Map([
+    ["ArnEquals", () => new SimIamArnEquals()],
+    ["ArnLike", () => new SimIamArnLike()],
     [
         "NumericLessThanEquals",
         () => new SimIamNumericLessThanEquals(),

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-condition-operator-parser.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,6DAA6D,CAAC;AAC7G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAI/F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAyC;IACxE;QACE,uBAAuB;QACvB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD,CAAC,cAAc,EAAE,GAA4B,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACzE,CAAC,YAAY,EAAE,GAA4B,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;IACrE;QACE,0BAA0B;QAC1B,GAA4B,EAAE,CAAC,IAAI,6BAA6B,EAAE;KACnE;IACD;QACE,wBAAwB;QACxB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD;QACE,2BAA2B;QAC3B,GAA4B,EAAE,CAAC,IAAI,8BAA8B,EAAE;KACpE;IACD;QACE,yBAAyB;QACzB,GAA4B,EAAE,CAAC,IAAI,4BAA4B,EAAE;KAClE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,KAAK,CAAC,OAAe;QACnB,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"sim-iam-condition-operator-parser.js","sourceRoot":"","sources":["../../../../../../src/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,6DAA6D,CAAC;AAC7G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAI/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAyC;IACxE,CAAC,WAAW,EAAE,GAA4B,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;IACnE,CAAC,SAAS,EAAE,GAA4B,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC;IAC/D;QACE,uBAAuB;QACvB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD,CAAC,cAAc,EAAE,GAA4B,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACzE,CAAC,YAAY,EAAE,GAA4B,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;IACrE;QACE,0BAA0B;QAC1B,GAA4B,EAAE,CAAC,IAAI,6BAA6B,EAAE;KACnE;IACD;QACE,wBAAwB;QACxB,GAA4B,EAAE,CAAC,IAAI,2BAA2B,EAAE;KACjE;IACD;QACE,2BAA2B;QAC3B,GAA4B,EAAE,CAAC,IAAI,8BAA8B,EAAE;KACpE;IACD;QACE,yBAAyB;QACzB,GAA4B,EAAE,CAAC,IAAI,4BAA4B,EAAE;KAClE;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACH,KAAK,CAAC,OAAe;QACnB,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts

@@ -51,6 +51,10 @@ export declare class SimIamPolicyPrincipalMatcher {
     private awsPatternMatches;
     /**
      * Compare a service principal pattern with the resolved caller.
+     *
+     * A service principal has no ARN and no Account, so this is a direct grant
+     * or nothing: there is no Account for a statement to delegate to. It is what
+     * admits an API Gateway integration invoking a Lambda function.
      */
     private servicePatternMatches;
     /**

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,oBAAoB,CAqBtB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAiCpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAyBzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}
+{"version":3,"file":"sim-iam-policy-principal-matcher.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,kBAAkB,EAAI;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,2BAA2B,GACrC,oBAAoB,CAqBtB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAgCpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAyBzB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAW7B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js

@@ -63,7 +63,6 @@ export class SimIamPolicyPrincipalMatcher {
             if (type === "AWS") {
                 return this.firstMatch(patterns, (pattern) => this.awsPatternMatches(pattern));
             }
-            /* v8 ignore if -- service principals not yet fully supported */
             if (type === "Service") {
                 return this.firstMatch(patterns, (pattern) => this.servicePatternMatches(pattern));
             }
@@ -101,11 +100,13 @@ export class SimIamPolicyPrincipalMatcher {
     }
     /**
      * Compare a service principal pattern with the resolved caller.
+     *
+     * A service principal has no ARN and no Account, so this is a direct grant
+     * or nothing: there is no Account for a statement to delegate to. It is what
+     * admits an API Gateway integration invoking a Lambda function.
      */
     servicePatternMatches(pattern) {
-        /* v8 ignore next -- service principals not yet fully supported */
         const service = this.context.caller.service;
-        /* v8 ignore next -- service principals not yet fully supported */
         return SimIamPrincipalMatch.direct().when(service !== undefined &&
             simIamWildcardMatch(pattern, service, {
                 caseSensitive: true,

package/dist/service/iam/authorize/match/sim-iam-policy-principal-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-policy-principal-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,SAAS,CAAC,SAAS,KAAK,SAAS;gBAC/B,SAAS,CAAC,YAAY,KAAK,SAAS,CACvC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,uEAAuE;YACvE,4DAA4D;YAC5D,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CACnD,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAClB,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAClD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YACnE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEhE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAChC,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CACpC,CAAC;YACJ,CAAC;YAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,MAAoB,EACpB,KAAyC;QAEzC,OAAO,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAe;QACvC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAClD,MAAM,CAAC,SAAS,KAAK,kBAAkB,CACxC,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YACvC,aAAa,EAAE,IAAI;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,OAAe;QAC3C,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAE5C,kEAAkE;QAClE,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,OAAO,KAAK,SAAS;YACnB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,OAAe;QACxC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"sim-iam-policy-principal-matcher.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/match/sim-iam-policy-principal-matcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,4BAA4B;IACV,OAAO;IAApC,YAA6B,OAA2B;uBAA3B,OAAO;IAAuB,CAAC;IAE5D;;;;;;;;OAQG;IACH,OAAO,CACL,MAA+B,EAC/B,SAAsC;QAEtC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACtE,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,SAAS,CAAC,SAAS,KAAK,SAAS;gBAC/B,SAAS,CAAC,YAAY,KAAK,SAAS,CACvC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,uEAAuE;YACvE,4DAA4D;YAC5D,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CACnD,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAClB,SAAwC;QAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAClD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YACnE,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEhE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAChC,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CACpC,CAAC;YACJ,CAAC;YAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,MAAoB,EACpB,KAAyC;QAEzC,OAAO,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,OAAe;QACvC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAClD,MAAM,CAAC,SAAS,KAAK,kBAAkB,CACxC,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE;YACvC,aAAa,EAAE,IAAI;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAAC,OAAe;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAE5C,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CACvC,OAAO,KAAK,SAAS;YACnB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;gBACpC,aAAa,EAAE,IAAI;aACpB,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,OAAe;QACxC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/service/iam/authorize/sim-iam-arn-match.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Match an ARN against an ARN pattern, as the `ArnLike` and `ArnEquals`
+ * condition operators do.
+ *
+ * AWS compares each of the six colon-delimited components separately, and a
+ * wildcard in one of them stays inside it: `arn:aws:s3:*` does not match an
+ * ARN whose Account or resource happen to make the rest of the string fit. A
+ * pattern with fewer components than an ARN has therefore matches nothing,
+ * which is stricter than comparing the two as plain strings would be.
+ */
+export declare function simIamArnMatch(pattern: string, value: string): boolean;
+//# sourceMappingURL=sim-iam-arn-match.d.ts.map

package/dist/service/iam/authorize/sim-iam-arn-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-arn-match.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-arn-match.ts"],"names":[],"mappings":"AAUA;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAetE"}

package/dist/service/iam/authorize/sim-iam-arn-match.js

@@ -0,0 +1,45 @@
+import { simIamWildcardMatch } from "./sim-iam-wildcard.js";
+/**
+ * The number of colon-delimited components an ARN has.
+ *
+ * The last of them is the resource, which may itself contain colons, so
+ * anything past the fifth colon belongs to it.
+ */
+const arnComponentCount = 6;
+/**
+ * Match an ARN against an ARN pattern, as the `ArnLike` and `ArnEquals`
+ * condition operators do.
+ *
+ * AWS compares each of the six colon-delimited components separately, and a
+ * wildcard in one of them stays inside it: `arn:aws:s3:*` does not match an
+ * ARN whose Account or resource happen to make the rest of the string fit. A
+ * pattern with fewer components than an ARN has therefore matches nothing,
+ * which is stricter than comparing the two as plain strings would be.
+ */
+export function simIamArnMatch(pattern, value) {
+    const patternComponents = arnComponents(pattern);
+    const valueComponents = arnComponents(value);
+    if (patternComponents.length !== valueComponents.length) {
+        return false;
+    }
+    // The two have the same number of components, so the fallback below stands
+    // in for a component that cannot be missing.
+    return patternComponents.every((component, index) => simIamWildcardMatch(component, valueComponents.at(index) ?? "", {
+        caseSensitive: true,
+    }));
+}
+/**
+ * Split an ARN into its six components, leaving any colons in the resource
+ * component where they are.
+ */
+function arnComponents(arn) {
+    const components = arn.split(":");
+    if (components.length <= arnComponentCount) {
+        return components;
+    }
+    return [
+        ...components.slice(0, arnComponentCount - 1),
+        components.slice(arnComponentCount - 1).join(":"),
+    ];
+}
+//# sourceMappingURL=sim-iam-arn-match.js.map

package/dist/service/iam/authorize/sim-iam-arn-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-arn-match.js","sourceRoot":"","sources":["../../../../src/service/iam/authorize/sim-iam-arn-match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;IAC3D,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7C,IAAI,iBAAiB,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAC3E,6CAA6C;IAC7C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAClD,mBAAmB,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE;QAC9D,aAAa,EAAE,IAAI;KACpB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,UAAU,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAC3C,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC;QAC7C,UAAU,CAAC,KAAK,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/service/iam/command/role/list-roles/list-roles.handler.js

@@ -42,8 +42,8 @@ export class ListRolesCommandHandler {
             .toArray()
             .toSorted((a, b) => a.arn.localeCompare(b.arn));
         return roles.filter((role) => {
-            return !(command.input.PathPrefix !== undefined &&
-                !role.path.startsWith(command.input.PathPrefix));
+            return (command.input.PathPrefix === undefined ||
+                role.path.startsWith(command.input.PathPrefix));
         });
     }
 }

package/dist/service/iam/command/role/list-roles/list-roles.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-roles.handler.js","sourceRoot":"","sources":["../../../../../../src/service/iam/command/role/list-roles/list-roles.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,8CAA8C,CAAC;AAMtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAIjB,KAAK,CAAkC;IACvC,UAAU,CAAsB;IAChC,SAAS,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEtD,YAAY,UAA6C;QACvD,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,UAAU,CAAC;QAEjE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA4B;QAE5B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,KAAK,EACL,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,UAAU,EAAE,IAAI,CAAC,YAAY;gBAC7B,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;YACH,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAA4B;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;aACrB,MAAM,EAAE;aACR,OAAO,EAAE;aACT,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAElD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3B,OAAO,CAAC,CACN,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;gBACtC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAChD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"list-roles.handler.js","sourceRoot":"","sources":["../../../../../../src/service/iam/command/role/list-roles/list-roles.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,8CAA8C,CAAC;AAMtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAIjB,KAAK,CAAkC;IACvC,UAAU,CAAsB;IAChC,SAAS,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEtD,YAAY,UAA6C;QACvD,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,UAAU,CAAC;QAEjE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA4B;QAE5B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,KAAK,EACL,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,UAAU,EAAE,IAAI,CAAC,YAAY;gBAC7B,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;YACH,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAA4B;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;aACrB,MAAM,EAAE;aACR,OAAO,EAAE;aACT,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAElD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3B,OAAO,CACL,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;gBACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAC/C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/lambda/command/authorize/sim-lambda-service-invoke-authorizer.d.ts

@@ -0,0 +1,56 @@
+import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunction } from "../../function/sim-lambda-function.js";
+interface SimLambdaServiceInvokeAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+interface SimLambdaServiceInvokeAuthorizationInput {
+    readonly simFunction: SimLambdaFunction;
+    /** The service principal the invoking service calls Lambda as. */
+    readonly servicePrincipal: string;
+    /**
+     * What the service is invoking the function for, such as the API Gateway
+     * route a request matched or the S3 Bucket an event came from.
+     */
+    readonly sourceArn?: string | undefined;
+    /** The Account the invoking service's own resource belongs to. */
+    readonly sourceAccount?: string | undefined;
+}
+/**
+ * Decides whether a simulated AWS service may invoke a Lambda function.
+ *
+ * A function invoked by another service does not run until its resource policy
+ * allows that service principal to invoke it, which is what `AddPermission`
+ * grants. The invoking service is the caller, so the caller's own identity
+ * policies are not what admits the call: a service principal owns none, and the
+ * function's resource policy is the whole decision.
+ *
+ * Who may invoke a function is Lambda's rule rather than the calling service's,
+ * so every service that invokes a function asks here. The answer is a decision
+ * rather than a thrown error, because what a refusal means is the calling
+ * service's own business: API Gateway answers 500, and an event source drops
+ * the event.
+ */
+export declare class SimLambdaServiceInvokeAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(properties: SimLambdaServiceInvokeAuthorizerProperties);
+    /**
+     * Evaluate `lambda:InvokeFunction` for a service against the function.
+     *
+     * The source ARN and the source Account are supplied as `AWS:SourceArn` and
+     * `AWS:SourceAccount`, so a permission granted for one resource does not open
+     * another, and a permission naming an Account only admits that Account's
+     * resources.
+     */
+    authorize(input: SimLambdaServiceInvokeAuthorizationInput): SimIamAuthorizationDecision;
+    /**
+     * The request-time values a statement's conditions are matched against.
+     *
+     * A value the calling service does not have is left out rather than supplied
+     * empty, so a statement conditioned on it fails to match instead of matching
+     * an empty string.
+     */
+    private conditionContext;
+}
+export {};
+//# sourceMappingURL=sim-lambda-service-invoke-authorizer.d.ts.map

package/dist/service/lambda/command/authorize/sim-lambda-service-invoke-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-service-invoke-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/authorize/sim-lambda-service-invoke-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAKhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAI/E,UAAU,0CAA0C;IAClD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,wCAAwC;IAChD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAExC,kEAAkE;IAClE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAEzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;;;;;;OAOG;IACH,SAAS,CACP,KAAK,EAAE,wCAAwC,GAC9C,2BAA2B,CAQ7B;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;CAYzB"}

package/dist/service/lambda/command/authorize/sim-lambda-service-invoke-authorizer.js

@@ -0,0 +1,59 @@
+import { simLambdaSourceAccountConditionKey, simLambdaSourceArnConditionKey, } from "../../function/policy/sim-lambda-permission.js";
+import { simLambdaResourcePolicies } from "./sim-lambda-resource-policies.js";
+/**
+ * Decides whether a simulated AWS service may invoke a Lambda function.
+ *
+ * A function invoked by another service does not run until its resource policy
+ * allows that service principal to invoke it, which is what `AddPermission`
+ * grants. The invoking service is the caller, so the caller's own identity
+ * policies are not what admits the call: a service principal owns none, and the
+ * function's resource policy is the whole decision.
+ *
+ * Who may invoke a function is Lambda's rule rather than the calling service's,
+ * so every service that invokes a function asks here. The answer is a decision
+ * rather than a thrown error, because what a refusal means is the calling
+ * service's own business: API Gateway answers 500, and an event source drops
+ * the event.
+ */
+export class SimLambdaServiceInvokeAuthorizer {
+    static action = "lambda:InvokeFunction";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Evaluate `lambda:InvokeFunction` for a service against the function.
+     *
+     * The source ARN and the source Account are supplied as `AWS:SourceArn` and
+     * `AWS:SourceAccount`, so a permission granted for one resource does not open
+     * another, and a permission naming an Account only admits that Account's
+     * resources.
+     */
+    authorize(input) {
+        return this.iam.authorize({
+            action: SimLambdaServiceInvokeAuthorizer.action,
+            resource: input.simFunction.arn,
+            caller: { kind: "service", service: input.servicePrincipal },
+            resourcePolicies: simLambdaResourcePolicies(input.simFunction),
+            conditionContext: this.conditionContext(input),
+        });
+    }
+    /**
+     * The request-time values a statement's conditions are matched against.
+     *
+     * A value the calling service does not have is left out rather than supplied
+     * empty, so a statement conditioned on it fails to match instead of matching
+     * an empty string.
+     */
+    conditionContext(input) {
+        return {
+            ...(input.sourceArn !== undefined && {
+                [simLambdaSourceArnConditionKey]: input.sourceArn,
+            }),
+            ...(input.sourceAccount !== undefined && {
+                [simLambdaSourceAccountConditionKey]: input.sourceAccount,
+            }),
+        };
+    }
+}
+//# sourceMappingURL=sim-lambda-service-invoke-authorizer.js.map

package/dist/service/lambda/command/authorize/sim-lambda-service-invoke-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-service-invoke-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/authorize/sim-lambda-service-invoke-authorizer.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAGxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAsB9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IACnC,MAAM,CAAU,MAAM,GAAG,uBAAuB,CAAC;IAExC,GAAG,CAA0B;IAE9C,YAAY,UAAsD;QAChE,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CACP,KAA+C;QAE/C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,gCAAgC,CAAC,MAAM;YAC/C,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,gBAAgB,EAAE;YAC5D,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC;YAC9D,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,KAA+C;QAE/C,OAAO;YACL,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI;gBACnC,CAAC,8BAA8B,CAAC,EAAE,KAAK,CAAC,SAAS;aAClD,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI;gBACvC,CAAC,kCAAkC,CAAC,EAAE,KAAK,CAAC,aAAa;aAC1D,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/function/policy/sim-lambda-permission.d.ts

@@ -15,6 +15,16 @@ export declare const simLambdaFunctionUrlAuthTypeConditionKey = "lambda:Function
  * something real AWS would only allow through the URL.
  */
 export declare const simLambdaInvokedViaFunctionUrlConditionKey = "lambda:InvokedViaFunctionUrl";
+/**
+ * The condition key naming what a simulated service is invoking the function
+ * for, such as the API Gateway route a request matched.
+ */
+export declare const simLambdaSourceArnConditionKey = "AWS:SourceArn";
+/**
+ * The condition key naming the Account the invoking simulated service resource
+ * belongs to.
+ */
+export declare const simLambdaSourceAccountConditionKey = "AWS:SourceAccount";
 interface SimLambdaPermissionProperties {
     readonly statementId: string;
     readonly action: string;
@@ -53,11 +63,13 @@ export declare class SimLambdaPermission {
     /**
      * The condition block the qualifying properties expand into.
      *
-     * Only `lambda:FunctionUrlAuthType` is given a value at request time, so it
-     * is the only one that can match. The rest are still written into the
-     * statement, because `GetPolicy` should report the permission that was
-     * granted; a statement carrying one of them simply never matches, which is
-     * the safe direction for a condition the simulator cannot evaluate.
+     * `lambda:FunctionUrlAuthType` is given a value when a Function URL is
+     * invoked, and `AWS:SourceArn` and `AWS:SourceAccount` when a simulated
+     * service invokes the function. `aws:PrincipalOrgID` and
+     * `lambda:InvokedViaFunctionUrl` are still written into the statement,
+     * because `GetPolicy` should report the permission that was granted; a
+     * statement carrying one of them simply never matches, which is the safe
+     * direction for a condition the simulator cannot evaluate.
      */
     private condition;
     private stringEqualsConditions;

package/dist/service/lambda/function/policy/sim-lambda-permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-permission.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/function/policy/sim-lambda-permission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,6BAA6B,EAC9B,MAAM,uCAAuC,CAAC;AAG/C;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,+BACvB,CAAC;AAE/B;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C,iCACvB,CAAC;AAEjC,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAsB;IAE7D,YAAY,UAAU,EAAE,6BAA6B,EAUpD;IAED;;OAEG;IACH,WAAW,IAAI,6BAA6B,CAW3C;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,SAAS;IAsBjB,OAAO,CAAC,sBAAsB;CAa/B"}
+{"version":3,"file":"sim-lambda-permission.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/function/policy/sim-lambda-permission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,6BAA6B,EAC9B,MAAM,uCAAuC,CAAC;AAG/C;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,+BACvB,CAAC;AAE/B;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C,iCACvB,CAAC;AAEjC;;;GAGG;AACH,eAAO,MAAM,8BAA8B,kBAAkB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,kCAAkC,sBAAsB,CAAC;AAEtE,UAAU,6BAA6B;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAsB;IAE7D,YAAY,UAAU,EAAE,6BAA6B,EAUpD;IAED;;OAEG;IACH,WAAW,IAAI,6BAA6B,CAW3C;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS;IAwBjB,OAAO,CAAC,sBAAsB;CAa/B"}

package/dist/service/lambda/function/policy/sim-lambda-permission.js

@@ -15,6 +15,16 @@ export const simLambdaFunctionUrlAuthTypeConditionKey = "lambda:FunctionUrlAuthT
  * something real AWS would only allow through the URL.
  */
 export const simLambdaInvokedViaFunctionUrlConditionKey = "lambda:InvokedViaFunctionUrl";
+/**
+ * The condition key naming what a simulated service is invoking the function
+ * for, such as the API Gateway route a request matched.
+ */
+export const simLambdaSourceArnConditionKey = "AWS:SourceArn";
+/**
+ * The condition key naming the Account the invoking simulated service resource
+ * belongs to.
+ */
+export const simLambdaSourceAccountConditionKey = "AWS:SourceAccount";
 /**
  * One statement of a simulated Lambda function's resource-based policy.
  *
@@ -62,11 +72,13 @@ export class SimLambdaPermission {
     /**
      * The condition block the qualifying properties expand into.
      *
-     * Only `lambda:FunctionUrlAuthType` is given a value at request time, so it
-     * is the only one that can match. The rest are still written into the
-     * statement, because `GetPolicy` should report the permission that was
-     * granted; a statement carrying one of them simply never matches, which is
-     * the safe direction for a condition the simulator cannot evaluate.
+     * `lambda:FunctionUrlAuthType` is given a value when a Function URL is
+     * invoked, and `AWS:SourceArn` and `AWS:SourceAccount` when a simulated
+     * service invokes the function. `aws:PrincipalOrgID` and
+     * `lambda:InvokedViaFunctionUrl` are still written into the statement,
+     * because `GetPolicy` should report the permission that was granted; a
+     * statement carrying one of them simply never matches, which is the safe
+     * direction for a condition the simulator cannot evaluate.
      */
     condition() {
         const stringEquals = this.stringEqualsConditions();
@@ -75,7 +87,9 @@ export class SimLambdaPermission {
             condition["StringEquals"] = stringEquals;
         }
         if (this.sourceArn !== undefined) {
-            condition["ArnLike"] = { "AWS:SourceArn": this.sourceArn };
+            condition["ArnLike"] = {
+                [simLambdaSourceArnConditionKey]: this.sourceArn,
+            };
         }
         if (this.invokedViaFunctionUrl !== undefined) {
             condition["Bool"] = {
@@ -90,7 +104,7 @@ export class SimLambdaPermission {
                 [simLambdaFunctionUrlAuthTypeConditionKey]: this.functionUrlAuthType,
             }),
             ...(this.sourceAccount !== undefined && {
-                "AWS:SourceAccount": this.sourceAccount,
+                [simLambdaSourceAccountConditionKey]: this.sourceAccount,
             }),
             ...(this.principalOrgId !== undefined && {
                 "aws:PrincipalOrgID": this.principalOrgId,

package/dist/service/lambda/function/policy/sim-lambda-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-permission.js","sourceRoot":"","sources":["../../../../../src/service/lambda/function/policy/sim-lambda-permission.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GACnD,4BAA4B,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GACrD,8BAA8B,CAAC;AAcjC;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACd,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,WAAW,CAAS;IAEnB,mBAAmB,CAAsB;IACzC,SAAS,CAAsB;IAC/B,aAAa,CAAsB;IACnC,cAAc,CAAsB;IACpC,qBAAqB,CAAuB;IAE7D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAAqB,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,WAAW;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEnC,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,WAAW;YAC1B,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,SAAS;QACf,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACnD,MAAM,SAAS,GAAyD,EAAE,CAAC;QAE3E,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,SAAS,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,SAAS,CAAC,MAAM,CAAC,GAAG;gBAClB,CAAC,0CAA0C,CAAC,EAC1C,IAAI,CAAC,qBAAqB;aAC7B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI;gBAC5C,CAAC,wCAAwC,CAAC,EAAE,IAAI,CAAC,mBAAmB;aACrE,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gBACtC,mBAAmB,EAAE,IAAI,CAAC,aAAa;aACxC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI;gBACvC,oBAAoB,EAAE,IAAI,CAAC,cAAc;aAC1C,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-permission.js","sourceRoot":"","sources":["../../../../../src/service/lambda/function/policy/sim-lambda-permission.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GACnD,4BAA4B,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GACrD,8BAA8B,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,eAAe,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,mBAAmB,CAAC;AActE;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACd,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,WAAW,CAAS;IAEnB,mBAAmB,CAAsB;IACzC,SAAS,CAAsB;IAC/B,aAAa,CAAsB;IACnC,cAAc,CAAsB;IACpC,qBAAqB,CAAuB;IAE7D,YAAY,UAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAAqB,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,WAAW;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEnC,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,WAAW;YAC1B,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,SAAS;QACf,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACnD,MAAM,SAAS,GAAyD,EAAE,CAAC;QAE3E,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,SAAS,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,SAAS,CAAC,SAAS,CAAC,GAAG;gBACrB,CAAC,8BAA8B,CAAC,EAAE,IAAI,CAAC,SAAS;aACjD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,SAAS,CAAC,MAAM,CAAC,GAAG;gBAClB,CAAC,0CAA0C,CAAC,EAC1C,IAAI,CAAC,qBAAqB;aAC7B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI;gBAC5C,CAAC,wCAAwC,CAAC,EAAE,IAAI,CAAC,mBAAmB;aACrE,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gBACtC,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,aAAa;aACzD,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI;gBACvC,oBAAoB,EAAE,IAAI,CAAC,cAAc;aAC1C,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/serve/event/sim-lambda-url-endpoint.d.ts

@@ -0,0 +1,13 @@
+import type { SimPayload2Endpoint } from "../../../../serve/payload-2/sim-payload-2-endpoint.js";
+import type { SimLambdaFunctionUrl } from "../../function/url/sim-lambda-function-url.js";
+/**
+ * Describe a Function URL as the endpoint a payload format 2.0 event names.
+ *
+ * A Function URL has no API Gateway resources behind it: real Lambda reports
+ * the URL id as the API id and puts `$default` in both the route key and the
+ * stage, whatever the request path was. There are no path parameters, because
+ * there is no route pattern to capture them, and no stage variables, because
+ * there is no stage to configure.
+ */
+export declare function simLambdaUrlEndpoint(functionUrl: SimLambdaFunctionUrl): SimPayload2Endpoint;
+//# sourceMappingURL=sim-lambda-url-endpoint.d.ts.map

package/dist/service/lambda/serve/event/sim-lambda-url-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-url-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/event/sim-lambda-url-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AACjG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAE1F;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,oBAAoB,GAChC,mBAAmB,CAQrB"}

package/dist/service/lambda/serve/event/sim-lambda-url-endpoint.js

@@ -0,0 +1,19 @@
+/**
+ * Describe a Function URL as the endpoint a payload format 2.0 event names.
+ *
+ * A Function URL has no API Gateway resources behind it: real Lambda reports
+ * the URL id as the API id and puts `$default` in both the route key and the
+ * stage, whatever the request path was. There are no path parameters, because
+ * there is no route pattern to capture them, and no stage variables, because
+ * there is no stage to configure.
+ */
+export function simLambdaUrlEndpoint(functionUrl) {
+    return {
+        apiId: functionUrl.urlId,
+        domainName: functionUrl.hostname,
+        domainPrefix: functionUrl.urlId,
+        routeKey: "$default",
+        stage: "$default",
+    };
+}
+//# sourceMappingURL=sim-lambda-url-endpoint.js.map

package/dist/service/lambda/serve/event/sim-lambda-url-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-url-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/event/sim-lambda-url-endpoint.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAiC;IAEjC,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,UAAU,EAAE,WAAW,CAAC,QAAQ;QAChC,YAAY,EAAE,WAAW,CAAC,KAAK;QAC/B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;KAClB,CAAC;AACJ,CAAC"}