@kensio/yulin 1.11.1 → 1.12.1

package/dist/service/scheduler/delivery/sim-aws-scheduler-delivery-targets.js

@@ -0,0 +1,56 @@
+import { SimSchedulerDeliveryFunction } from "./sim-scheduler-delivery-function.js";
+import { SimSchedulerDeliveryQueue } from "./sim-scheduler-delivery-queue.js";
+import { SimSchedulerDeliveryTopic } from "./sim-scheduler-delivery-topic.js";
+import { assumeSchedulerExecutionRole, schedulerExecutionRoleTarget, } from "./sim-scheduler-execution-role.js";
+/**
+ * Everywhere the schedules of one simulated AWS instance can invoke.
+ *
+ * The target is looked up when a schedule fires, never when this is built:
+ * reaching another service while this one is being constructed is a cycle with
+ * no bottom to it.
+ *
+ * A target in another Account or Region is allowed, since real Scheduler
+ * invokes across both, and it is the target's own Account that evaluates
+ * whether the execution role may.
+ */
+export class SimAwsSchedulerDeliveryTargets {
+    simAws;
+    constructor(properties) {
+        this.simAws = properties.simAws;
+    }
+    /**
+     * Assume the schedule's execution role, then invoke its target as that role.
+     *
+     * The role is assumed in its own Account, and the target is reached in the
+     * target's, which are not necessarily the same one.
+     */
+    async deliver(request) {
+        const arn = request.schedule.target.arn;
+        const role = schedulerExecutionRoleTarget(request.schedule.target.roleArn);
+        const roleScope = this.simAws.accountRegionScope(role.accountId, arn.regionName);
+        const caller = await assumeSchedulerExecutionRole(role, roleScope.iam());
+        await this.invoke(arn.service, { request, caller });
+    }
+    /**
+     * Hand the invocation to the one destination that knows this service.
+     */
+    async invoke(service, delivery) {
+        const arn = delivery.request.schedule.target.arn;
+        const scope = this.simAws.accountRegionScope(arn.accountId, arn.regionName);
+        switch (service) {
+            case "lambda": {
+                await new SimSchedulerDeliveryFunction({ scope }).deliver(delivery);
+                return;
+            }
+            case "sqs": {
+                await new SimSchedulerDeliveryQueue({ scope }).deliver(delivery);
+                return;
+            }
+            case "sns": {
+                await new SimSchedulerDeliveryTopic({ scope }).deliver(delivery);
+                return;
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-aws-scheduler-delivery-targets.js.map

package/dist/service/scheduler/delivery/sim-aws-scheduler-delivery-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-scheduler-delivery-targets.js","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-aws-scheduler-delivery-targets.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAM3C;;;;;;;;;;GAUG;AACH,MAAM,OAAO,8BAA8B;IACxB,MAAM,CAAS;IAEhC,YAAY,UAAoD;QAC9D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAoC;QAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACxC,MAAM,IAAI,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC9C,IAAI,CAAC,SAAS,EACd,GAAG,CAAC,UAAU,CACf,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAClB,OAAkC,EAClC,QAAqC;QAErC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5E,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,4BAA4B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.d.ts

@@ -0,0 +1,53 @@
+interface SimSchedulerDeliveryFailureProperties {
+    readonly scheduleName: string;
+    readonly scheduleArn: string;
+    readonly targetArn: string;
+    readonly roleArn: string;
+    readonly at: Date;
+    readonly error: unknown;
+}
+/**
+ * One invocation a schedule could not make.
+ */
+export declare class SimSchedulerDeliveryFailure {
+    readonly scheduleName: string;
+    readonly scheduleArn: string;
+    readonly targetArn: string;
+    /**
+     * The execution role the invocation was attempted as, which is where most of
+     * these are fixed.
+     */
+    readonly roleArn: string;
+    /**
+     * The instant the schedule fell due, on the simulation's clock.
+     */
+    readonly at: Date;
+    readonly error: unknown;
+    constructor(properties: SimSchedulerDeliveryFailureProperties);
+    /**
+     * What went wrong, as a message.
+     */
+    get message(): string;
+}
+/**
+ * Every invocation one simulated Scheduler scope could not make.
+ *
+ * Real Scheduler tells nobody about a failed invocation as it happens: it goes
+ * to CloudWatch metrics, or to a dead letter queue if one is configured, and
+ * the caller who created the schedule is long gone. So a target that is
+ * unexpectedly empty is explained here rather than by anything an SDK call
+ * returned.
+ */
+export declare class SimSchedulerDeliveryFailures {
+    private readonly failures;
+    /**
+     * Every failure so far, oldest first.
+     */
+    get all(): readonly SimSchedulerDeliveryFailure[];
+    /**
+     * Keep a failed invocation.
+     */
+    record(properties: SimSchedulerDeliveryFailureProperties): void;
+}
+export {};
+//# sourceMappingURL=sim-scheduler-delivery-failures.d.ts.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-failures.d.ts","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-failures.ts"],"names":[],"mappings":"AAAA,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,qBAAa,2BAA2B;IACtC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC;;;OAGG;IACH,SAAgB,OAAO,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,SAAgB,EAAE,EAAE,IAAI,CAAC;IAEzB,SAAgB,KAAK,EAAE,OAAO,CAAC;IAE/B,YAAY,UAAU,EAAE,qCAAqC,EAO5D;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,CAMpB;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAE9D;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,2BAA2B,EAAE,CAEhD;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,EAAE,qCAAqC,GAAG,IAAI,CAE9D;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.js

@@ -0,0 +1,60 @@
+/**
+ * One invocation a schedule could not make.
+ */
+export class SimSchedulerDeliveryFailure {
+    scheduleName;
+    scheduleArn;
+    targetArn;
+    /**
+     * The execution role the invocation was attempted as, which is where most of
+     * these are fixed.
+     */
+    roleArn;
+    /**
+     * The instant the schedule fell due, on the simulation's clock.
+     */
+    at;
+    error;
+    constructor(properties) {
+        this.scheduleName = properties.scheduleName;
+        this.scheduleArn = properties.scheduleArn;
+        this.targetArn = properties.targetArn;
+        this.roleArn = properties.roleArn;
+        this.at = properties.at;
+        this.error = properties.error;
+    }
+    /**
+     * What went wrong, as a message.
+     */
+    get message() {
+        if (this.error instanceof Error) {
+            return this.error.message;
+        }
+        return String(this.error);
+    }
+}
+/**
+ * Every invocation one simulated Scheduler scope could not make.
+ *
+ * Real Scheduler tells nobody about a failed invocation as it happens: it goes
+ * to CloudWatch metrics, or to a dead letter queue if one is configured, and
+ * the caller who created the schedule is long gone. So a target that is
+ * unexpectedly empty is explained here rather than by anything an SDK call
+ * returned.
+ */
+export class SimSchedulerDeliveryFailures {
+    failures = [];
+    /**
+     * Every failure so far, oldest first.
+     */
+    get all() {
+        return [...this.failures];
+    }
+    /**
+     * Keep a failed invocation.
+     */
+    record(properties) {
+        this.failures.push(new SimSchedulerDeliveryFailure(properties));
+    }
+}
+//# sourceMappingURL=sim-scheduler-delivery-failures.js.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-failures.js","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-failures.ts"],"names":[],"mappings":"AASA;;GAEG;AACH,MAAM,OAAO,2BAA2B;IACtB,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,SAAS,CAAS;IAElC;;;OAGG;IACa,OAAO,CAAS;IAEhC;;OAEG;IACa,EAAE,CAAO;IAET,KAAK,CAAU;IAE/B,YAAY,UAAiD;QAC3D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,IAAI,IAAI,CAAC,KAAK,YAAY,KAAK,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,4BAA4B;IACtB,QAAQ,GAAkC,EAAE,CAAC;IAE9D;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAiD;QACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-function.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimSchedulerAssumedDelivery } from "./sim-scheduler-delivery.js";
+interface SimSchedulerDeliveryFunctionProperties {
+    readonly scope: SimAwsAccountRegionContainer;
+}
+/**
+ * A Lambda function a simulated schedule invokes.
+ *
+ * The function's own resource policy is not consulted, which is the difference
+ * from an EventBridge rule target: the schedule arrives as an assumed role
+ * rather than as a service principal, and a role in the same Account needs only
+ * its own identity policy to invoke a function.
+ */
+export declare class SimSchedulerDeliveryFunction {
+    private readonly scope;
+    constructor(properties: SimSchedulerDeliveryFunctionProperties);
+    /**
+     * Invoke the function, if the execution role may.
+     */
+    deliver(delivery: SimSchedulerAssumedDelivery): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-scheduler-delivery-function.d.ts.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-function.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-function.d.ts","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-function.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAK9F,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,6BAA6B,CAAC;AAIrC,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IAErD,YAAY,UAAU,EAAE,sCAAsC,EAE7D;IAED;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BlE;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-function.js

@@ -0,0 +1,45 @@
+import { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "../error/sim-scheduler-delivery.error.js";
+import { simSchedulerDeliveryDocument, } from "./sim-scheduler-delivery.js";
+const invokeAction = "lambda:InvokeFunction";
+/**
+ * A Lambda function a simulated schedule invokes.
+ *
+ * The function's own resource policy is not consulted, which is the difference
+ * from an EventBridge rule target: the schedule arrives as an assumed role
+ * rather than as a service principal, and a role in the same Account needs only
+ * its own identity policy to invoke a function.
+ */
+export class SimSchedulerDeliveryFunction {
+    scope;
+    constructor(properties) {
+        this.scope = properties.scope;
+    }
+    /**
+     * Invoke the function, if the execution role may.
+     */
+    async deliver(delivery) {
+        const targetArn = delivery.request.schedule.target.arn;
+        const simFunction = this.scope
+            .lambda()
+            .getSimFunctionByName(targetArn.functionName);
+        if (simFunction === undefined) {
+            throw new SimSchedulerTargetNotFound(`${targetArn.value} is not a simulated Lambda function.`);
+        }
+        const decision = this.scope.iam().authorize({
+            action: invokeAction,
+            resource: targetArn.value,
+            caller: delivery.caller,
+        });
+        if (decision.isDenied) {
+            throw new SimSchedulerDeliveryNotPermitted(`${delivery.request.schedule.target.roleArn} is not allowed to ` +
+                `${invokeAction} on ${targetArn.value}. Grant it in a policy on ` +
+                `the execution role.`);
+        }
+        // Invoked directly rather than through an Invoke command, because the
+        // schedule is already inside the background task standing for the
+        // asynchronous invocation real Scheduler makes, and because a handler
+        // failure has to reach the delivery outcome rather than being swallowed.
+        await simFunction.invoke(simSchedulerDeliveryDocument(delivery.request));
+    }
+}
+//# sourceMappingURL=sim-scheduler-delivery-function.js.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-function.js","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-function.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAM7C;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAA+B;IAErD,YAAY,UAAkD;QAC5D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,QAAqC;QACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK;aAC3B,MAAM,EAAE;aACR,oBAAoB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,0BAA0B,CAClC,GAAG,SAAS,CAAC,KAAK,sCAAsC,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC1C,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,SAAS,CAAC,KAAK;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,gCAAgC,CACxC,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,qBAAqB;gBAC9D,GAAG,YAAY,OAAO,SAAS,CAAC,KAAK,4BAA4B;gBACjE,qBAAqB,CACxB,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,WAAW,CAAC,MAAM,CAAC,4BAA4B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-queue.d.ts

@@ -0,0 +1,18 @@
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimSchedulerAssumedDelivery } from "./sim-scheduler-delivery.js";
+interface SimSchedulerDeliveryQueueProperties {
+    readonly scope: SimAwsAccountRegionContainer;
+}
+/**
+ * An SQS queue a simulated schedule sends to.
+ */
+export declare class SimSchedulerDeliveryQueue {
+    private readonly scope;
+    constructor(properties: SimSchedulerDeliveryQueueProperties);
+    /**
+     * Send the schedule's input to the queue, if the execution role may.
+     */
+    deliver(delivery: SimSchedulerAssumedDelivery): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-scheduler-delivery-queue.d.ts.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-queue.d.ts","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-queue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAK9F,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,6BAA6B,CAAC;AAIrC,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IAErD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoClE;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-queue.js

@@ -0,0 +1,42 @@
+import { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "../error/sim-scheduler-delivery.error.js";
+import { simSchedulerDeliveryJson, } from "./sim-scheduler-delivery.js";
+const sendAction = "sqs:SendMessage";
+/**
+ * An SQS queue a simulated schedule sends to.
+ */
+export class SimSchedulerDeliveryQueue {
+    scope;
+    constructor(properties) {
+        this.scope = properties.scope;
+    }
+    /**
+     * Send the schedule's input to the queue, if the execution role may.
+     */
+    async deliver(delivery) {
+        const targetArn = delivery.request.schedule.target.arn;
+        const queue = this.scope.sqs().findQueue(targetArn.resource);
+        if (queue === undefined) {
+            throw new SimSchedulerTargetNotFound(`${targetArn.value} is not a simulated SQS queue.`);
+        }
+        const decision = this.scope.iam().authorize({
+            action: sendAction,
+            resource: targetArn.value,
+            caller: delivery.caller,
+        });
+        if (decision.isDenied) {
+            throw new SimSchedulerDeliveryNotPermitted(`${delivery.request.schedule.target.roleArn} is not allowed to ` +
+                `${sendAction} on ${targetArn.value}. Grant it in a policy on the ` +
+                `execution role.`);
+        }
+        // Sent through the ordinary SendMessage path, as the execution role, so a
+        // delivered message is the same thing an SDK caller would have sent and is
+        // authorized again on the way in.
+        await this.scope.sqs().sendMessage({
+            input: {
+                QueueUrl: queue.arn.url,
+                MessageBody: simSchedulerDeliveryJson(delivery.request),
+            },
+        }, { caller: delivery.caller });
+    }
+}
+//# sourceMappingURL=sim-scheduler-delivery-queue.js.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-queue.js","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-queue.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAErC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAMrC;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,CAA+B;IAErD,YAAY,UAA+C;QACzD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,QAAqC;QACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,0BAA0B,CAClC,GAAG,SAAS,CAAC,KAAK,gCAAgC,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC1C,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,SAAS,CAAC,KAAK;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,gCAAgC,CACxC,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,qBAAqB;gBAC9D,GAAG,UAAU,OAAO,SAAS,CAAC,KAAK,gCAAgC;gBACnE,iBAAiB,CACpB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAChC;YACE,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG;gBACvB,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC;aACxD;SACF,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-topic.d.ts

@@ -0,0 +1,18 @@
+import type { SimAwsAccountRegionContainer } from "../../aws/sim-aws-account-region-scope.js";
+import { type SimSchedulerAssumedDelivery } from "./sim-scheduler-delivery.js";
+interface SimSchedulerDeliveryTopicProperties {
+    readonly scope: SimAwsAccountRegionContainer;
+}
+/**
+ * An SNS topic a simulated schedule publishes to.
+ */
+export declare class SimSchedulerDeliveryTopic {
+    private readonly scope;
+    constructor(properties: SimSchedulerDeliveryTopicProperties);
+    /**
+     * Publish the schedule's input to the topic, if the execution role may.
+     */
+    deliver(delivery: SimSchedulerAssumedDelivery): Promise<void>;
+}
+export {};
+//# sourceMappingURL=sim-scheduler-delivery-topic.d.ts.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-topic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-topic.d.ts","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-topic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAK9F,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,6BAA6B,CAAC;AAIrC,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IAErD,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoClE;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery-topic.js

@@ -0,0 +1,42 @@
+import { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "../error/sim-scheduler-delivery.error.js";
+import { simSchedulerDeliveryJson, } from "./sim-scheduler-delivery.js";
+const publishAction = "sns:Publish";
+/**
+ * An SNS topic a simulated schedule publishes to.
+ */
+export class SimSchedulerDeliveryTopic {
+    scope;
+    constructor(properties) {
+        this.scope = properties.scope;
+    }
+    /**
+     * Publish the schedule's input to the topic, if the execution role may.
+     */
+    async deliver(delivery) {
+        const targetArn = delivery.request.schedule.target.arn;
+        const topic = this.scope.sns().findTopic(targetArn.resource);
+        if (topic === undefined) {
+            throw new SimSchedulerTargetNotFound(`${targetArn.value} is not a simulated SNS topic.`);
+        }
+        const decision = this.scope.iam().authorize({
+            action: publishAction,
+            resource: targetArn.value,
+            caller: delivery.caller,
+        });
+        if (decision.isDenied) {
+            throw new SimSchedulerDeliveryNotPermitted(`${delivery.request.schedule.target.roleArn} is not allowed to ` +
+                `${publishAction} on ${targetArn.value}. Grant it in a policy on ` +
+                `the execution role.`);
+        }
+        // Published through the ordinary Publish path, as the execution role, so a
+        // delivered message fans out to the topic's subscriptions exactly as an SDK
+        // caller's would.
+        await this.scope.sns().publish({
+            input: {
+                TopicArn: topic.arn.value,
+                Message: simSchedulerDeliveryJson(delivery.request),
+            },
+        }, { caller: delivery.caller });
+    }
+}
+//# sourceMappingURL=sim-scheduler-delivery-topic.js.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery-topic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery-topic.js","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery-topic.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAErC,MAAM,aAAa,GAAG,aAAa,CAAC;AAMpC;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,CAA+B;IAErD,YAAY,UAA+C;QACzD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,QAAqC;QACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,0BAA0B,CAClC,GAAG,SAAS,CAAC,KAAK,gCAAgC,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC1C,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,SAAS,CAAC,KAAK;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,gCAAgC,CACxC,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,qBAAqB;gBAC9D,GAAG,aAAa,OAAO,SAAS,CAAC,KAAK,4BAA4B;gBAClE,qBAAqB,CACxB,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,kBAAkB;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAC5B;YACE,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK;gBACzB,OAAO,EAAE,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC;aACpD;SACF,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery.d.ts

@@ -0,0 +1,56 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimSchedulerSchedule } from "../schedule/sim-scheduler-schedule.js";
+/**
+ * The service principal Scheduler assumes an execution role as.
+ *
+ * This is the principal a role's trust policy has to admit, which is what makes
+ * `scheduler.amazonaws.com` the thing to put in an `AssumeRolePolicyDocument`
+ * for a schedule to work at all.
+ */
+export declare const simSchedulerServicePrincipal = "scheduler.amazonaws.com";
+/**
+ * One schedule on its way to its target.
+ *
+ * The due instant travels with it because a schedule invokes with whatever its
+ * target's `Input` says and nothing about when it fired, so the due time is
+ * only of interest to whatever records a failure.
+ */
+export interface SimSchedulerDeliveryRequest {
+    readonly schedule: SimSchedulerSchedule;
+    readonly at: Date;
+}
+/**
+ * Somewhere a simulated schedule can invoke.
+ *
+ * One implementation per target service, because what each is asked and what
+ * each is handed differ: a function receives an invocation payload, and a queue
+ * and a topic receive a message body.
+ */
+export interface SimSchedulerDeliveryTargets {
+    /**
+     * Invoke a schedule's target, refusing if its execution role may not.
+     */
+    deliver(request: SimSchedulerDeliveryRequest): Promise<void>;
+}
+/**
+ * What a target receives, as the JSON text a queue or a topic carries.
+ *
+ * A schedule has no event of its own, so a target with no `Input` is sent an
+ * empty JSON object rather than an envelope describing the schedule. AWS
+ * documents that behaviour for a function and says nothing about it for a queue
+ * or a topic, so the same answer is used for all three rather than inventing a
+ * different one for each.
+ */
+export declare function simSchedulerDeliveryJson(request: SimSchedulerDeliveryRequest): string;
+/**
+ * What a target receives, as the value a Lambda handler is handed.
+ */
+export declare function simSchedulerDeliveryDocument(request: SimSchedulerDeliveryRequest): unknown;
+/**
+ * A schedule's target, and the caller its execution role makes it as.
+ */
+export interface SimSchedulerAssumedDelivery {
+    readonly request: SimSchedulerDeliveryRequest;
+    readonly caller: SimAwsCaller;
+}
+//# sourceMappingURL=sim-scheduler-delivery.d.ts.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery.d.ts","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAElF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,4BAA4B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,2BAA2B,GACnC,MAAM,CAER;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAeT;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B"}

package/dist/service/scheduler/delivery/sim-scheduler-delivery.js

@@ -0,0 +1,39 @@
+/**
+ * The service principal Scheduler assumes an execution role as.
+ *
+ * This is the principal a role's trust policy has to admit, which is what makes
+ * `scheduler.amazonaws.com` the thing to put in an `AssumeRolePolicyDocument`
+ * for a schedule to work at all.
+ */
+export const simSchedulerServicePrincipal = "scheduler.amazonaws.com";
+/**
+ * What a target receives, as the JSON text a queue or a topic carries.
+ *
+ * A schedule has no event of its own, so a target with no `Input` is sent an
+ * empty JSON object rather than an envelope describing the schedule. AWS
+ * documents that behaviour for a function and says nothing about it for a queue
+ * or a topic, so the same answer is used for all three rather than inventing a
+ * different one for each.
+ */
+export function simSchedulerDeliveryJson(request) {
+    return request.schedule.target.input ?? "{}";
+}
+/**
+ * What a target receives, as the value a Lambda handler is handed.
+ */
+export function simSchedulerDeliveryDocument(request) {
+    const input = request.schedule.target.input;
+    if (input === undefined) {
+        return {};
+    }
+    // A target's Input is text rather than JSON as far as AWS is concerned, so
+    // one that does not parse is handed over as the string it is instead of
+    // failing the invocation.
+    try {
+        return JSON.parse(input);
+    }
+    catch {
+        return input;
+    }
+}
+//# sourceMappingURL=sim-scheduler-delivery.js.map

package/dist/service/scheduler/delivery/sim-scheduler-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-delivery.js","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-delivery.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AA4BtE;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAoC;IAEpC,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAoC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;IAE5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,0BAA0B;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/service/scheduler/delivery/sim-scheduler-execution-role.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIam } from "../../iam/sim-iam.js";
+/**
+ * Which IAM a role ARN belongs to, and what the role is called there.
+ */
+export interface SimSchedulerExecutionRoleTarget {
+    readonly accountId: SimAwsAccountId;
+    readonly roleName: string;
+    readonly roleArn: string;
+}
+/**
+ * Read the Account and name out of a schedule's execution role ARN.
+ *
+ * The ARN was checked for being a role ARN when the schedule was written, so
+ * this is reading a known shape rather than validating an unknown one.
+ */
+export declare function schedulerExecutionRoleTarget(roleArn: string): SimSchedulerExecutionRoleTarget;
+/**
+ * Assume a schedule's execution role, and answer with the caller it makes.
+ *
+ * This is the whole of what makes Scheduler's execution model different from an
+ * EventBridge rule's. A rule reaches its target as the `events.amazonaws.com`
+ * service principal and the target's own resource policy decides; a schedule
+ * assumes a role, and the role's policies decide. So the two things checked
+ * here are the two things that go wrong in a real account: whether the role
+ * trusts Scheduler at all, and then, separately, whether it may do the thing.
+ *
+ * The caller carries both principals. The request is attributed to the session,
+ * as it is on AWS, while the policies that apply are the role's, which is
+ * exactly the split `SimResolvedCaller` exists for.
+ */
+export declare function assumeSchedulerExecutionRole(target: SimSchedulerExecutionRoleTarget, iam: SimIam): Promise<SimAwsCaller>;
+//# sourceMappingURL=sim-scheduler-execution-role.d.ts.map

package/dist/service/scheduler/delivery/sim-scheduler-execution-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-execution-role.d.ts","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-execution-role.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAUnD;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,GACd,+BAA+B,CAIjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,+BAA+B,EACvC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,CA+BvB"}

package/dist/service/scheduler/delivery/sim-scheduler-execution-role.js

@@ -0,0 +1,75 @@
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+import { IamRoleArnParser } from "../../iam/role/arn/sim-iam-role-arn-parser.js";
+import { AssumeRoleTrustPolicyAuthorizer } from "../../sts/auth-z/assume-role-trust-policy-authorizer.js";
+import { SimSchedulerDeliveryNotPermitted } from "../error/sim-scheduler-delivery.error.js";
+import { simSchedulerServicePrincipal } from "./sim-scheduler-delivery.js";
+/**
+ * The session name AWS gives a role Scheduler assumes for an invocation.
+ */
+const sessionName = "EventBridgeScheduler";
+/**
+ * Read the Account and name out of a schedule's execution role ARN.
+ *
+ * The ARN was checked for being a role ARN when the schedule was written, so
+ * this is reading a known shape rather than validating an unknown one.
+ */
+export function schedulerExecutionRoleTarget(roleArn) {
+    const parts = new IamRoleArnParser().parse(roleArn);
+    return { accountId: parts.accountId, roleName: parts.roleName, roleArn };
+}
+/**
+ * Assume a schedule's execution role, and answer with the caller it makes.
+ *
+ * This is the whole of what makes Scheduler's execution model different from an
+ * EventBridge rule's. A rule reaches its target as the `events.amazonaws.com`
+ * service principal and the target's own resource policy decides; a schedule
+ * assumes a role, and the role's policies decide. So the two things checked
+ * here are the two things that go wrong in a real account: whether the role
+ * trusts Scheduler at all, and then, separately, whether it may do the thing.
+ *
+ * The caller carries both principals. The request is attributed to the session,
+ * as it is on AWS, while the policies that apply are the role's, which is
+ * exactly the split `SimResolvedCaller` exists for.
+ */
+export async function assumeSchedulerExecutionRole(target, iam) {
+    const role = await roleOrRefuse(target, iam);
+    try {
+        new AssumeRoleTrustPolicyAuthorizer().authorize({
+            roleArn: target.roleArn,
+            role,
+            targetIam: iam,
+            caller: { kind: "service", service: simSchedulerServicePrincipal },
+        });
+    }
+    catch (error) {
+        if (error instanceof SimIamAccessDenied) {
+            throw new SimSchedulerDeliveryNotPermitted(`The trust policy of ${target.roleArn} does not allow ` +
+                `${simSchedulerServicePrincipal} to assume it, so the schedule ` +
+                `could not invoke its target. Add it to the role's ` +
+                `AssumeRolePolicyDocument.`);
+        }
+        throw error;
+    }
+    return {
+        kind: "resolved",
+        principal: {
+            kind: "arn",
+            arn: `arn:aws:sts::${target.accountId}:assumed-role/${target.roleName}/${sessionName}`,
+        },
+        identityPolicyPrincipal: { kind: "arn", arn: target.roleArn },
+    };
+}
+/**
+ * Load the execution role, refusing when it is not there.
+ */
+async function roleOrRefuse(target, iam) {
+    try {
+        const found = await iam.getRole({ input: { RoleName: target.roleName } });
+        return found.Role;
+    }
+    catch {
+        throw new SimSchedulerDeliveryNotPermitted(`${target.roleArn} is not a simulated IAM role, so the schedule could ` +
+            `not assume it to invoke its target.`);
+    }
+}
+//# sourceMappingURL=sim-scheduler-execution-role.js.map

package/dist/service/scheduler/delivery/sim-scheduler-execution-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-scheduler-execution-role.js","sourceRoot":"","sources":["../../../../src/service/scheduler/delivery/sim-scheduler-execution-role.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAEjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAC1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAW3C;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEpD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAuC,EACvC,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,IAAI,+BAA+B,EAAE,CAAC,SAAS,CAAC;YAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,gCAAgC,CACxC,uBAAuB,MAAM,CAAC,OAAO,kBAAkB;gBACrD,GAAG,4BAA4B,iCAAiC;gBAChE,oDAAoD;gBACpD,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE;YACT,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,gBAAgB,MAAM,CAAC,SAAS,iBAAiB,MAAM,CAAC,QAAQ,IAAI,WAAW,EAAE;SACvF;QACD,uBAAuB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,MAAuC,EACvC,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE1E,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gCAAgC,CACxC,GAAG,MAAM,CAAC,OAAO,sDAAsD;YACrE,qCAAqC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC"}