@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.d.ts

@@ -0,0 +1,52 @@
+import { type KeyObject } from "node:crypto";
+/**
+ * The COSE algorithm identifier for ECDSA over P-256 with SHA-256, which every
+ * platform authenticator supports and which Cognito asks for.
+ */
+export declare const simCognitoWebAuthnAlgorithm = -7;
+/**
+ * A key pair standing in for the one a passkey lives as.
+ */
+export interface SimCognitoWebAuthnKeyPair {
+    readonly publicKey: KeyObject;
+    readonly privateKey: KeyObject;
+}
+/**
+ * Issue the key pair a new passkey is made of.
+ *
+ * The private half is what an authenticator would keep and never hand over,
+ * and the public half is what the pool stores against the credential.
+ */
+export declare function simCognitoWebAuthnKeyPair(): SimCognitoWebAuthnKeyPair;
+/**
+ * A run of random bytes as base64url, which is how a challenge and a
+ * credential id both travel.
+ */
+export declare function simCognitoWebAuthnChallenge(): string;
+/**
+ * The identifier an authenticator gives a credential it has just created.
+ */
+export declare function simCognitoWebAuthnCredentialId(): string;
+/**
+ * The client data a browser would have collected, as the JSON bytes an
+ * authenticator signs over.
+ *
+ * The origin is the relying party's own, because a passkey registered against
+ * a domain is presented from that domain and nowhere else.
+ */
+export declare function simCognitoWebAuthnClientData(type: "webauthn.create" | "webauthn.get", challenge: string, relyingPartyId: string): Buffer;
+/**
+ * The authenticator data of one ceremony: the relying party the credential
+ * answers for, what the authenticator checked, and how many times it has
+ * signed.
+ */
+export declare function simCognitoWebAuthnAuthenticatorData(relyingPartyId: string, signCount: number): Buffer;
+/**
+ * Sign one ceremony with a passkey's private half.
+ */
+export declare function simCognitoWebAuthnSignature(privateKey: KeyObject, authenticatorData: Buffer, clientDataJson: Buffer): string;
+/**
+ * Whether a signature is the one this passkey would have produced.
+ */
+export declare function simCognitoWebAuthnVerified(publicKey: KeyObject, authenticatorData: Buffer, clientDataJson: Buffer, signature: Buffer): boolean;
+//# sourceMappingURL=sim-cognito-web-authn-signing.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-signing.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAuB9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,IAAI,yBAAyB,CAErE;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,GAAG,cAAc,EACxC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,MAAM,CASR;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAgBD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,SAAS,EACrB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAOT"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.js

@@ -0,0 +1,98 @@
+import { createHash, generateKeyPairSync, randomBytes, sign, verify, } from "node:crypto";
+/**
+ * The COSE algorithm identifier for ECDSA over P-256 with SHA-256, which every
+ * platform authenticator supports and which Cognito asks for.
+ */
+export const simCognitoWebAuthnAlgorithm = -7;
+/**
+ * How many bytes of challenge a ceremony is given.
+ */
+const challengeBytes = 32;
+/**
+ * How many bytes of credential id an authenticator allocates.
+ */
+const credentialIdBytes = 16;
+/**
+ * The authenticator data flags this simulation sets, which say the user was
+ * present and the authenticator verified who was holding it.
+ *
+ * Real flags also say whether attested credential data follows, which is a
+ * registration's own business. Nothing here reads a registration's
+ * authenticator data beyond the relying party it names, so the two ceremonies
+ * set the same flags.
+ */
+const presentAndVerified = 0x05;
+/**
+ * Issue the key pair a new passkey is made of.
+ *
+ * The private half is what an authenticator would keep and never hand over,
+ * and the public half is what the pool stores against the credential.
+ */
+export function simCognitoWebAuthnKeyPair() {
+    return generateKeyPairSync("ec", { namedCurve: "P-256" });
+}
+/**
+ * A run of random bytes as base64url, which is how a challenge and a
+ * credential id both travel.
+ */
+export function simCognitoWebAuthnChallenge() {
+    return randomBytes(challengeBytes).toString("base64url");
+}
+/**
+ * The identifier an authenticator gives a credential it has just created.
+ */
+export function simCognitoWebAuthnCredentialId() {
+    return randomBytes(credentialIdBytes).toString("base64url");
+}
+/**
+ * The client data a browser would have collected, as the JSON bytes an
+ * authenticator signs over.
+ *
+ * The origin is the relying party's own, because a passkey registered against
+ * a domain is presented from that domain and nowhere else.
+ */
+export function simCognitoWebAuthnClientData(type, challenge, relyingPartyId) {
+    return Buffer.from(JSON.stringify({
+        type,
+        challenge,
+        origin: `https://${relyingPartyId}`,
+        crossOrigin: false,
+    }));
+}
+/**
+ * The authenticator data of one ceremony: the relying party the credential
+ * answers for, what the authenticator checked, and how many times it has
+ * signed.
+ */
+export function simCognitoWebAuthnAuthenticatorData(relyingPartyId, signCount) {
+    const flags = Buffer.alloc(5);
+    flags.writeUInt8(presentAndVerified, 0);
+    flags.writeUInt32BE(signCount, 1);
+    return Buffer.concat([
+        createHash("sha256").update(relyingPartyId).digest(),
+        flags,
+    ]);
+}
+/**
+ * What a passkey signs, which is the authenticator data followed by a hash of
+ * the client data.
+ */
+function signedBytes(authenticatorData, clientDataJson) {
+    return Buffer.concat([
+        authenticatorData,
+        createHash("sha256").update(clientDataJson).digest(),
+    ]);
+}
+/**
+ * Sign one ceremony with a passkey's private half.
+ */
+export function simCognitoWebAuthnSignature(privateKey, authenticatorData, clientDataJson) {
+    return sign("sha256", signedBytes(authenticatorData, clientDataJson), privateKey).toString("base64url");
+}
+/**
+ * Whether a signature is the one this passkey would have produced.
+ */
+export function simCognitoWebAuthnVerified(publicKey, authenticatorData, clientDataJson, signature) {
+    return verify("sha256", signedBytes(authenticatorData, clientDataJson), publicKey, signature);
+}
+//# sourceMappingURL=sim-cognito-web-authn-signing.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-signing.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,IAAI,EACJ,MAAM,GAEP,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,CAAC;AAE9C;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;GAEG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAUhC;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAwC,EACxC,SAAiB,EACjB,cAAsB;IAEtB,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI;QACJ,SAAS;QACT,MAAM,EAAE,WAAW,cAAc,EAAE;QACnC,WAAW,EAAE,KAAK;KACnB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,SAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,KAAK,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IACxC,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;QACpD,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,iBAAyB,EACzB,cAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,iBAAiB;QACjB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAqB,EACrB,iBAAyB,EACzB,cAAsB;IAEtB,OAAO,IAAI,CACT,QAAQ,EACR,WAAW,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAC9C,UAAU,CACX,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAoB,EACpB,iBAAyB,EACzB,cAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CACX,QAAQ,EACR,WAAW,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAC9C,SAAS,EACT,SAAS,CACV,CAAC;AACJ,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts

@@ -6,9 +6,10 @@
  * request is the first encoding, which is why a literal `/` in a path segment
  * and a separator are still distinguishable here.
  *
- * S3 is the exception on real AWS: it signs the path singly encoded. Only
- * doubly encoded services are supported for now, which is every service the
- * simulator serves.
+ * A request signed for S3 gets neither step, and is signed over the path it
+ * arrived with. An Object key holds any byte S3 accepts (a space, an
+ * ampersand, a `.` segment, a doubled slash), and the path naming it survives
+ * to the signature untouched.
  */
-export declare function simIamSigV4CanonicalPath(path: string): string;
+export declare function simIamSigV4CanonicalPath(path: string, serviceName: string): string;
 //# sourceMappingURL=sim-iam-sigv4-canonical-path.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-path.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB7D"}
+{"version":3,"file":"sim-iam-sigv4-canonical-path.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,MAAM,CAyBR"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js

@@ -1,4 +1,13 @@
 import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
+/**
+ * The signing services that sign a path encoded once, as it arrived.
+ *
+ * SigV4 encodes the canonical path a second time, and real S3 is the exception
+ * to that. The name comes from the credential scope the request was signed
+ * under. The client picked its own rule from that same scope. Any further
+ * exception is one more entry here.
+ */
+const singlyEncodedServices = new Set(["s3"]);
 /**
  * Build the canonical URI of a signed request.
  *
@@ -7,11 +16,15 @@ import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
  * request is the first encoding, which is why a literal `/` in a path segment
  * and a separator are still distinguishable here.
  *
- * S3 is the exception on real AWS: it signs the path singly encoded. Only
- * doubly encoded services are supported for now, which is every service the
- * simulator serves.
+ * A request signed for S3 gets neither step, and is signed over the path it
+ * arrived with. An Object key holds any byte S3 accepts (a space, an
+ * ampersand, a `.` segment, a doubled slash), and the path naming it survives
+ * to the signature untouched.
  */
-export function simIamSigV4CanonicalPath(path) {
+export function simIamSigV4CanonicalPath(path, serviceName) {
+    if (singlyEncodedServices.has(serviceName)) {
+        return path.length === 0 ? "/" : path;
+    }
     const segments = [];
     for (const segment of path.split("/")) {
         if (segment === "" || segment === ".") {

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-path.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;IAE1E,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-canonical-path.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,WAAmB;IAEnB,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;IAE1E,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts

@@ -1,3 +1,4 @@
+import type { SimIamSigV4SignatureStatement } from "../sim-iam-sigv4-signature-statement.js";
 import type { SimIamSigV4SignedRequest } from "../sim-iam-sigv4-signed-request.js";
 import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
 /**
@@ -8,12 +9,18 @@ import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
  * out, is the whole of SigV4 verification. Anything the canonical form covers
  * cannot be altered in transit without detection, and anything it leaves out
  * can be.
+ *
+ * The statement the request carries says which headers are signed and which
+ * service the signature is scoped to. Both belong to the canonical form. S3
+ * canonicalizes its path by a rule of its own, and the client read that rule
+ * from the scope it signed under.
  */
 export declare class SimIamSigV4CanonicalRequest {
     private readonly canonicalHeaders;
     private readonly signedRequest;
+    private readonly statement;
     private readonly payload;
-    constructor(signedRequest: SimIamSigV4SignedRequest, signedHeaderNames: readonly string[], payload?: SimIamSigV4PayloadDeclaration);
+    constructor(signedRequest: SimIamSigV4SignedRequest, statement: SimIamSigV4SignatureStatement, payload?: SimIamSigV4PayloadDeclaration);
     /**
      * The canonical request string, ready to be hashed into a string to sign.
      */

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAInF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IAExD,YACE,aAAa,EAAE,wBAAwB,EACvC,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,OAAO,GAAE,6BAER,EASF;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}
+{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAInF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IAExD,YACE,aAAa,EAAE,wBAAwB,EACvC,SAAS,EAAE,6BAA6B,EACxC,OAAO,GAAE,6BAER,EAUF;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js

@@ -10,15 +10,22 @@ import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
  * out, is the whole of SigV4 verification. Anything the canonical form covers
  * cannot be altered in transit without detection, and anything it leaves out
  * can be.
+ *
+ * The statement the request carries says which headers are signed and which
+ * service the signature is scoped to. Both belong to the canonical form. S3
+ * canonicalizes its path by a rule of its own, and the client read that rule
+ * from the scope it signed under.
  */
 export class SimIamSigV4CanonicalRequest {
     canonicalHeaders;
     signedRequest;
+    statement;
     payload;
-    constructor(signedRequest, signedHeaderNames, payload = SimIamSigV4PayloadDeclaration.fromHeaders(signedRequest.headers)) {
+    constructor(signedRequest, statement, payload = SimIamSigV4PayloadDeclaration.fromHeaders(signedRequest.headers)) {
         this.signedRequest = signedRequest;
+        this.statement = statement;
         this.payload = payload;
-        this.canonicalHeaders = new SimIamSigV4CanonicalHeaders(signedRequest.headers, signedHeaderNames, signedRequest.url);
+        this.canonicalHeaders = new SimIamSigV4CanonicalHeaders(signedRequest.headers, statement.signedHeaderNames, signedRequest.url);
     }
     /**
      * The canonical request string, ready to be hashed into a string to sign.
@@ -27,7 +34,7 @@ export class SimIamSigV4CanonicalRequest {
         const { method, url, body } = this.signedRequest;
         return [
             method.toUpperCase(),
-            simIamSigV4CanonicalPath(url.pathname),
+            simIamSigV4CanonicalPath(url.pathname, this.statement.scope.serviceName),
             simIamSigV4CanonicalQuery(url.search),
             `${this.canonicalHeaders.toString()}\n`,
             this.canonicalHeaders.signedHeaderList(),

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IACxC,OAAO,CAAgC;IAExD,YACE,aAAuC,EACvC,iBAAoC,EACpC,OAAO,GAAkC,6BAA6B,CAAC,WAAW,CAChF,aAAa,CAAC,OAAO,CACtB;QAED,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,iBAAiB,EACjB,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAEjD,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IACxC,SAAS,CAAgC;IACzC,OAAO,CAAgC;IAExD,YACE,aAAuC,EACvC,SAAwC,EACxC,OAAO,GAAkC,6BAA6B,CAAC,WAAW,CAChF,aAAa,CAAC,OAAO,CACtB;QAED,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,SAAS,CAAC,iBAAiB,EAC3B,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAEjD,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC;YACxE,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js

@@ -11,7 +11,7 @@ import { simIamSigV4Signature, simIamSigV4StringToSign, } from "./sim-iam-sigv4-
  */
 export function simIamSigV4CheckSignature(input) {
     const { signedRequest, statement, signingKey, amzDate, payload } = input;
-    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, statement.signedHeaderNames, payload).toString();
+    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, statement, payload).toString();
     const expected = simIamSigV4Signature(signingKey, simIamSigV4StringToSign({
         amzDate,
         scope: statement.scope,

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAE7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAexC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEzE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,SAAS,CAAC,iBAAiB,EAC3B,OAAO,CACR,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,SAAS,CAAC,WAAW,EAAE,EACtD,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAE7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAexC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEzE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,SAAS,EACT,OAAO,CACR,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,SAAS,CAAC,WAAW,EAAE,EACtD,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimLambdaEventInvokeConfig } from "../../function/event-invoke/sim-lambda-event-invoke-config.js";
+import type { SimLambda } from "../../sim-lambda.js";
+interface SimCfnLambdaEventInvokeConfigCreatorProperties {
+    readonly lambda: SimLambda;
+}
+/**
+ * Creates simulated event invoke configs from CloudFormation Resources.
+ *
+ * This is what CDK emits for `onFailure`, `onSuccess`, `retryAttempts` and
+ * `maxEventAge` on a function, so a synthesized template is the usual way a
+ * config comes into existence outside a direct SDK call. It is written through
+ * the ordinary PutFunctionEventInvokeConfig command, so a template deploying
+ * one gets the same validation and the same authorization an SDK caller would.
+ */
+export declare class SimCfnLambdaEventInvokeConfigCreator {
+    private readonly lambda;
+    constructor(properties: SimCfnLambdaEventInvokeConfigCreatorProperties);
+    /**
+     * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaEventInvokeConfig>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-creator.d.ts.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,UAAU,8CAA8C;IACtD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IAEnC,YAAY,UAAU,EAAE,8CAA8C,EAErE;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAkBrC;CACF"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.js

@@ -0,0 +1,32 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnLambdaEventInvokeConfigProperties } from "./sim-cfn-lambda-event-invoke-config-properties.js";
+/**
+ * Creates simulated event invoke configs from CloudFormation Resources.
+ *
+ * This is what CDK emits for `onFailure`, `onSuccess`, `retryAttempts` and
+ * `maxEventAge` on a function, so a synthesized template is the usual way a
+ * config comes into existence outside a direct SDK call. It is written through
+ * the ordinary PutFunctionEventInvokeConfig command, so a template deploying
+ * one gets the same validation and the same authorization an SDK caller would.
+ */
+export class SimCfnLambdaEventInvokeConfigCreator {
+    lambda;
+    constructor(properties) {
+        this.lambda = properties.lambda;
+    }
+    /**
+     * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
+     */
+    async create(resource, properties) {
+        const { functionName, qualifier, input } = new SimCfnLambdaEventInvokeConfigProperties({
+            resource,
+            properties,
+        }).createInput();
+        await this.lambda.putFunctionEventInvokeConfig({ input });
+        const config = this.lambda.getSimEventInvokeConfig(functionName, qualifier);
+        assertDefined(config, `Sim Lambda event invoke config ${resource.logicalId} after ` +
+            "CloudFormation creation");
+        return config;
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-creator.js.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-creator.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,oDAAoD,CAAC;AAM7G;;;;;;;;GAQG;AACH,MAAM,OAAO,oCAAoC;IAC9B,MAAM,CAAY;IAEnC,YAAY,UAA0D;QACpE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GACtC,IAAI,uCAAuC,CAAC;YAC1C,QAAQ;YACR,UAAU;SACX,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAE5E,aAAa,CACX,MAAM,EACN,kCAAkC,QAAQ,CAAC,SAAS,SAAS;YAC3D,yBAAyB,CAC5B,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.d.ts

@@ -0,0 +1,40 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimPutFunctionEventInvokeConfigCommandInput } from "../../command/put-function-event-invoke-config/put-function-event-invoke-config.command.js";
+interface SimCfnLambdaEventInvokeConfigPropertiesProperties {
+    readonly resource: SimCfnResource;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * The PutFunctionEventInvokeConfig input, and which function it is for.
+ *
+ * The function and qualifier are carried beside the input because they are
+ * what the config is held under, and the creator reads the config back with
+ * them once the command has written it.
+ */
+export interface SimCfnLambdaEventInvokeConfigInput {
+    readonly functionName: string;
+    readonly qualifier: string | undefined;
+    readonly input: SimPutFunctionEventInvokeConfigCommandInput;
+}
+/**
+ * Reads an AWS::Lambda::EventInvokeConfig Resource into the input
+ * PutFunctionEventInvokeConfig takes.
+ *
+ * Nothing about retry counts or event ages is decided here. The command
+ * refuses what real Lambda refuses, so a config a template deployed is the
+ * same thing an SDK caller would have got.
+ */
+export declare class SimCfnLambdaEventInvokeConfigProperties {
+    private readonly resource;
+    private readonly properties;
+    private readonly parser;
+    private readonly destinations;
+    constructor(properties: SimCfnLambdaEventInvokeConfigPropertiesProperties);
+    /**
+     * The put input this Resource asks for.
+     */
+    createInput(): SimCfnLambdaEventInvokeConfigInput;
+}
+export {};
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-properties.d.ts.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,4FAA4F,CAAC;AAM9J,UAAU,iDAAiD;IACzD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,2CAA2C,CAAC;CAC7D;AAED;;;;;;;GAOG;AACH,qBAAa,uCAAuC;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6C;IAE1E,YAAY,UAAU,EAAE,iDAAiD,EAGxE;IAED;;OAEG;IACH,WAAW,IAAI,kCAAkC,CAsChD;CACF"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.js

@@ -0,0 +1,42 @@
+import { SimCfnLambdaPropertyParser } from "../function/sim-cfn-lambda-property-parser.js";
+import { simCfnLambdaTargetFunctionName } from "../function/sim-cfn-lambda-target-function.js";
+import { recordUnreadEventInvokeConfigProperties } from "./sim-cfn-lambda-event-invoke-config-property-rules.js";
+import { SimCfnLambdaEventInvokeDestinations } from "./sim-cfn-lambda-event-invoke-destinations.js";
+/**
+ * Reads an AWS::Lambda::EventInvokeConfig Resource into the input
+ * PutFunctionEventInvokeConfig takes.
+ *
+ * Nothing about retry counts or event ages is decided here. The command
+ * refuses what real Lambda refuses, so a config a template deployed is the
+ * same thing an SDK caller would have got.
+ */
+export class SimCfnLambdaEventInvokeConfigProperties {
+    resource;
+    properties;
+    parser = new SimCfnLambdaPropertyParser();
+    destinations = new SimCfnLambdaEventInvokeDestinations();
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = properties.properties;
+    }
+    /**
+     * The put input this Resource asks for.
+     */
+    createInput() {
+        recordUnreadEventInvokeConfigProperties(this.resource, this.properties);
+        const functionName = simCfnLambdaTargetFunctionName(this.parser.requiredString(this.resource, this.properties["FunctionName"], "FunctionName"));
+        const qualifier = this.parser.optionalString(this.resource, this.properties["Qualifier"], "Qualifier");
+        return {
+            functionName,
+            qualifier,
+            input: {
+                FunctionName: functionName,
+                Qualifier: qualifier,
+                MaximumRetryAttempts: this.parser.optionalNumber(this.resource, this.properties["MaximumRetryAttempts"], "MaximumRetryAttempts"),
+                MaximumEventAgeInSeconds: this.parser.optionalNumber(this.resource, this.properties["MaximumEventAgeInSeconds"], "MaximumEventAgeInSeconds"),
+                DestinationConfig: this.destinations.parse(this.resource, this.properties["DestinationConfig"]),
+            },
+        };
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-properties.js.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-properties.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,mCAAmC,EAAE,MAAM,+CAA+C,CAAC;AAoBpG;;;;;;;GAOG;AACH,MAAM,OAAO,uCAAuC;IACjC,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IACtC,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC1C,YAAY,GAAG,IAAI,mCAAmC,EAAE,CAAC;IAE1E,YAAY,UAA6D;QACvE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,WAAW;QACT,uCAAuC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAExE,MAAM,YAAY,GAAG,8BAA8B,CACjD,IAAI,CAAC,MAAM,CAAC,cAAc,CACxB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAC/B,cAAc,CACf,CACF,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAC1C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAC5B,WAAW,CACZ,CAAC;QAEF,OAAO;YACL,YAAY;YACZ,SAAS;YACT,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;gBAC1B,SAAS,EAAE,SAAS;gBACpB,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EACvC,sBAAsB,CACvB;gBACD,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAClD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAC3C,0BAA0B,CAC3B;gBACD,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CACxC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CACrC;aACF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-property-rules.d.ts

@@ -0,0 +1,12 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * Record a property of an AWS::Lambda::EventInvokeConfig Resource that nothing
+ * reads, rather than failing the Resource over it.
+ *
+ * Every real property of this Resource type is read, so an unread one is a
+ * typo or something AWS has added since. Either way a config carrying the
+ * settings it does state is worth more than a stack that will not deploy.
+ */
+export declare function recordUnreadEventInvokeConfigProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-property-rules.d.ts.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-property-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-property-rules.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-property-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAalH;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,IAAI,CAYN"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-property-rules.js

@@ -0,0 +1,26 @@
+/**
+ * The whole of AWS::Lambda::EventInvokeConfig, every one of which is read.
+ */
+const readPropertyNames = new Set([
+    "DestinationConfig",
+    "FunctionName",
+    "MaximumEventAgeInSeconds",
+    "MaximumRetryAttempts",
+    "Qualifier",
+]);
+/**
+ * Record a property of an AWS::Lambda::EventInvokeConfig Resource that nothing
+ * reads, rather than failing the Resource over it.
+ *
+ * Every real property of this Resource type is read, so an unread one is a
+ * typo or something AWS has added since. Either way a config carrying the
+ * settings it does state is worth more than a stack that will not deploy.
+ */
+export function recordUnreadEventInvokeConfigProperties(resource, properties) {
+    const unread = Object.keys(properties).filter((name) => !readPropertyNames.has(name));
+    for (const name of unread) {
+        resource.ignoreProperty(name, `${name} is not an AWS::Lambda::EventInvokeConfig property, so the ` +
+            `event invoke config is deployed without it`);
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-property-rules.js.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-property-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-property-rules.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-property-rules.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,mBAAmB;IACnB,cAAc;IACd,0BAA0B;IAC1B,sBAAsB;IACtB,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,QAAwB,EACxB,UAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CACvC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,QAAQ,CAAC,cAAc,CACrB,IAAI,EACJ,GAAG,IAAI,6DAA6D;YAClE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimLambda } from "../../sim-lambda.js";
+/**
+ * Take an AWS::Lambda::EventInvokeConfig off the function it was written on,
+ * so what is left of the function retries the default number of times and
+ * sends its results nowhere.
+ *
+ * A config that has already gone is nothing to delete. Deleting a function
+ * takes its configs with it, so a teardown that reached the function first
+ * would otherwise fail here over work it had already done.
+ */
+export declare function simCfnLambdaRemoveEventInvokeConfig(lambda: SimLambda, resource: SimCfnResource): Promise<void>;
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-remover.d.ts.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-remover.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAE3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,CACvD,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.js

@@ -0,0 +1,20 @@
+import { simCfnLambdaCreatedResource } from "../sim-cfn-lambda-created-resource.js";
+/**
+ * Take an AWS::Lambda::EventInvokeConfig off the function it was written on,
+ * so what is left of the function retries the default number of times and
+ * sends its results nowhere.
+ *
+ * A config that has already gone is nothing to delete. Deleting a function
+ * takes its configs with it, so a teardown that reached the function first
+ * would otherwise fail here over work it had already done.
+ */
+export async function simCfnLambdaRemoveEventInvokeConfig(lambda, resource) {
+    const { functionName, qualifier } = simCfnLambdaCreatedResource(resource, "event invoke config");
+    if (lambda.getSimEventInvokeConfig(functionName, qualifier) === undefined) {
+        return;
+    }
+    await lambda.deleteFunctionEventInvokeConfig({
+        input: { FunctionName: functionName, Qualifier: qualifier },
+    });
+}
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-remover.js.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-remover.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-remover.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAiB,EACjB,QAAwB;IAExB,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAC/B,2BAA2B,CACzB,QAAQ,EACR,qBAAqB,CACtB,CAAC;IAEJ,IAAI,MAAM,CAAC,uBAAuB,CAAC,YAAY,EAAE,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,MAAM,MAAM,CAAC,+BAA+B,CAAC;QAC3C,KAAK,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-destinations.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValue } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimLambdaDestinationConfiguration } from "../../function/event-invoke/sim-lambda-event-invoke-config.js";
+/**
+ * Parses the nested AWS::Lambda::EventInvokeConfig DestinationConfig
+ * property.
+ *
+ * Its own parser because DestinationConfig is the one property of the
+ * Resource with a shape rather than a scalar: two ends, each an object holding
+ * somewhere to send to, and each read on its own so a config keeps the end it
+ * can reach when the other names somewhere it cannot.
+ */
+export declare class SimCfnLambdaEventInvokeDestinations {
+    private readonly propertyParser;
+    private readonly targetArn;
+    /**
+     * Parse the DestinationConfig property into where results are sent.
+     */
+    parse(resource: SimCfnResource, config: SimCfnTemplateValue | undefined): SimLambdaDestinationConfiguration | undefined;
+    /**
+     * One end of the config, left off where the simulation has nowhere to send
+     * it.
+     */
+    private destination;
+}
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-destinations.d.ts.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-destinations.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-destinations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAEV,iCAAiC,EAClC,MAAM,+DAA+D,CAAC;AAIvE;;;;;;;;GAQG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IAEzD;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC,iCAAiC,GAAG,SAAS,CAiB/C;IAED;;;OAGG;IACH,OAAO,CAAC,WAAW;CA2BpB"}