@kensio/yulin 1.18.2 → 1.19.1

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-document.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-document.ts"],"names":[],"mappings":""}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-keys.d.ts

@@ -0,0 +1,37 @@
+import type { KeyObject } from "node:crypto";
+/**
+ * One passkey as the device holds it, which is the half a pool never sees.
+ */
+export interface SimCognitoWebAuthnStoredKey {
+    readonly privateKey: KeyObject;
+    /**
+     * How many times this passkey has signed, which travels in the
+     * authenticator data of every assertion it produces.
+     */
+    signCount: number;
+}
+/**
+ * The passkeys one stand-in authenticator is holding.
+ *
+ * A real authenticator keeps the private half of every credential it has made
+ * and hands out signatures. This holds the same thing for the same reason. The
+ * pool stores the public half, and the two have to be apart for a signature to
+ * mean anything.
+ */
+export declare class SimCognitoWebAuthnKeys {
+    #private;
+    /** Keep the private key of a credential this device has just made. */
+    add(credentialId: string, privateKey: KeyObject): void;
+    /** Forget a passkey, because the pool that held its public half has. */
+    forget(credentialId: string): void;
+    /**
+     * The passkey this device would present, out of the ones a sign-in allows.
+     *
+     * A challenge allowing none in particular is answered with whichever this
+     * device holds, which is what a discoverable credential prompt does. One
+     * naming credentials is answered with the first of them this device has,
+     * which is the choice a person makes at a real prompt.
+     */
+    requireOneOf(allowed: readonly string[]): readonly [string, SimCognitoWebAuthnStoredKey];
+}
+//# sourceMappingURL=sim-cognito-web-authn-keys.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-keys.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAE/B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAsB;;IAGjC,sEAAsE;IACtE,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,GAAG,IAAI,CAErD;IAED,wEAAwE;IACxE,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAEjC;IAED;;;;;;;OAOG;IACH,YAAY,CACV,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,SAAS,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAYhD;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-keys.js

@@ -0,0 +1,39 @@
+import { SimCognitoInvalidParameterException } from "../../../error/sim-cognito.error.js";
+/**
+ * The passkeys one stand-in authenticator is holding.
+ *
+ * A real authenticator keeps the private half of every credential it has made
+ * and hands out signatures. This holds the same thing for the same reason. The
+ * pool stores the public half, and the two have to be apart for a signature to
+ * mean anything.
+ */
+export class SimCognitoWebAuthnKeys {
+    #keys = new Map();
+    /** Keep the private key of a credential this device has just made. */
+    add(credentialId, privateKey) {
+        this.#keys.set(credentialId, { privateKey, signCount: 0 });
+    }
+    /** Forget a passkey, because the pool that held its public half has. */
+    forget(credentialId) {
+        this.#keys.delete(credentialId);
+    }
+    /**
+     * The passkey this device would present, out of the ones a sign-in allows.
+     *
+     * A challenge allowing none in particular is answered with whichever this
+     * device holds, which is what a discoverable credential prompt does. One
+     * naming credentials is answered with the first of them this device has,
+     * which is the choice a person makes at a real prompt.
+     */
+    requireOneOf(allowed) {
+        for (const [credentialId, key] of this.#keys) {
+            if (allowed.length === 0 || allowed.includes(credentialId)) {
+                return [credentialId, key];
+            }
+        }
+        throw new SimCognitoInvalidParameterException("This user has registered no passkey the challenge would accept: " +
+            "register one with StartWebAuthnRegistration and " +
+            "CompleteWebAuthnRegistration first");
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-keys.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-keys.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-keys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAe1F;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACxB,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEhE,sEAAsE;IACtE,GAAG,CAAC,YAAoB,EAAE,UAAqB;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,wEAAwE;IACxE,MAAM,CAAC,YAAoB;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CACV,OAA0B;QAE1B,KAAK,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,kEAAkE;YAChE,kDAAkD;YAClD,oCAAoC,CACvC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-public-key.d.ts

@@ -0,0 +1,21 @@
+import { type KeyObject } from "node:crypto";
+/**
+ * The public key as it travels in a credential, which is base64url of its
+ * SubjectPublicKeyInfo.
+ *
+ * This is the encoding `PublicKeyCredential.toJSON()` uses for the `publicKey`
+ * a browser reports, so a credential built here carries the key in the shape a
+ * real one carries it.
+ */
+export declare function simCognitoWebAuthnPublicKey(publicKey: KeyObject): string;
+/**
+ * Read a public key back out of a credential, or nothing where the value is
+ * not a key this pool can use.
+ *
+ * A registration asks for ECDSA over P-256 and nothing else, so a key of
+ * another kind is no more usable than a value that is not a key at all. The
+ * algorithm a credential names is the caller's word for it, and this is the
+ * key itself.
+ */
+export declare function simCognitoWebAuthnKeyFrom(encoded: string): KeyObject | undefined;
+//# sourceMappingURL=sim-cognito-web-authn-public-key.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-public-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-public-key.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-public-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAO9D;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAIxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,GACd,SAAS,GAAG,SAAS,CAmBvB"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-public-key.js

@@ -0,0 +1,45 @@
+import { createPublicKey } from "node:crypto";
+/**
+ * The curve an ES256 key is over, as `node:crypto` names it.
+ */
+const namedCurve = "prime256v1";
+/**
+ * The public key as it travels in a credential, which is base64url of its
+ * SubjectPublicKeyInfo.
+ *
+ * This is the encoding `PublicKeyCredential.toJSON()` uses for the `publicKey`
+ * a browser reports, so a credential built here carries the key in the shape a
+ * real one carries it.
+ */
+export function simCognitoWebAuthnPublicKey(publicKey) {
+    return publicKey
+        .export({ format: "der", type: "spki" })
+        .toString("base64url");
+}
+/**
+ * Read a public key back out of a credential, or nothing where the value is
+ * not a key this pool can use.
+ *
+ * A registration asks for ECDSA over P-256 and nothing else, so a key of
+ * another kind is no more usable than a value that is not a key at all. The
+ * algorithm a credential names is the caller's word for it, and this is the
+ * key itself.
+ */
+export function simCognitoWebAuthnKeyFrom(encoded) {
+    try {
+        const publicKey = createPublicKey({
+            key: Buffer.from(encoded, "base64url"),
+            format: "der",
+            type: "spki",
+        });
+        if (publicKey.asymmetricKeyType !== "ec" ||
+            publicKey.asymmetricKeyDetails?.namedCurve !== namedCurve) {
+            return undefined;
+        }
+        return publicKey;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-public-key.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-public-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-public-key.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-public-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAoB;IAC9D,OAAO,SAAS;SACb,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACvC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC;YAChC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,IACE,SAAS,CAAC,iBAAiB,KAAK,IAAI;YACpC,SAAS,CAAC,oBAAoB,EAAE,UAAU,KAAK,UAAU,EACzD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.d.ts

@@ -0,0 +1,52 @@
+import { type KeyObject } from "node:crypto";
+/**
+ * The COSE algorithm identifier for ECDSA over P-256 with SHA-256, which every
+ * platform authenticator supports and which Cognito asks for.
+ */
+export declare const simCognitoWebAuthnAlgorithm = -7;
+/**
+ * A key pair standing in for the one a passkey lives as.
+ */
+export interface SimCognitoWebAuthnKeyPair {
+    readonly publicKey: KeyObject;
+    readonly privateKey: KeyObject;
+}
+/**
+ * Issue the key pair a new passkey is made of.
+ *
+ * The private half is what an authenticator would keep and never hand over,
+ * and the public half is what the pool stores against the credential.
+ */
+export declare function simCognitoWebAuthnKeyPair(): SimCognitoWebAuthnKeyPair;
+/**
+ * A run of random bytes as base64url, which is how a challenge and a
+ * credential id both travel.
+ */
+export declare function simCognitoWebAuthnChallenge(): string;
+/**
+ * The identifier an authenticator gives a credential it has just created.
+ */
+export declare function simCognitoWebAuthnCredentialId(): string;
+/**
+ * The client data a browser would have collected, as the JSON bytes an
+ * authenticator signs over.
+ *
+ * The origin is the relying party's own, because a passkey registered against
+ * a domain is presented from that domain and nowhere else.
+ */
+export declare function simCognitoWebAuthnClientData(type: "webauthn.create" | "webauthn.get", challenge: string, relyingPartyId: string): Buffer;
+/**
+ * The authenticator data of one ceremony: the relying party the credential
+ * answers for, what the authenticator checked, and how many times it has
+ * signed.
+ */
+export declare function simCognitoWebAuthnAuthenticatorData(relyingPartyId: string, signCount: number): Buffer;
+/**
+ * Sign one ceremony with a passkey's private half.
+ */
+export declare function simCognitoWebAuthnSignature(privateKey: KeyObject, authenticatorData: Buffer, clientDataJson: Buffer): string;
+/**
+ * Whether a signature is the one this passkey would have produced.
+ */
+export declare function simCognitoWebAuthnVerified(publicKey: KeyObject, authenticatorData: Buffer, clientDataJson: Buffer, signature: Buffer): boolean;
+//# sourceMappingURL=sim-cognito-web-authn-signing.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-signing.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAuB9C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,IAAI,yBAAyB,CAErE;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,GAAG,cAAc,EACxC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,MAAM,CASR;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAgBD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,SAAS,EACrB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAOT"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.js

@@ -0,0 +1,98 @@
+import { createHash, generateKeyPairSync, randomBytes, sign, verify, } from "node:crypto";
+/**
+ * The COSE algorithm identifier for ECDSA over P-256 with SHA-256, which every
+ * platform authenticator supports and which Cognito asks for.
+ */
+export const simCognitoWebAuthnAlgorithm = -7;
+/**
+ * How many bytes of challenge a ceremony is given.
+ */
+const challengeBytes = 32;
+/**
+ * How many bytes of credential id an authenticator allocates.
+ */
+const credentialIdBytes = 16;
+/**
+ * The authenticator data flags this simulation sets, which say the user was
+ * present and the authenticator verified who was holding it.
+ *
+ * Real flags also say whether attested credential data follows, which is a
+ * registration's own business. Nothing here reads a registration's
+ * authenticator data beyond the relying party it names, so the two ceremonies
+ * set the same flags.
+ */
+const presentAndVerified = 0x05;
+/**
+ * Issue the key pair a new passkey is made of.
+ *
+ * The private half is what an authenticator would keep and never hand over,
+ * and the public half is what the pool stores against the credential.
+ */
+export function simCognitoWebAuthnKeyPair() {
+    return generateKeyPairSync("ec", { namedCurve: "P-256" });
+}
+/**
+ * A run of random bytes as base64url, which is how a challenge and a
+ * credential id both travel.
+ */
+export function simCognitoWebAuthnChallenge() {
+    return randomBytes(challengeBytes).toString("base64url");
+}
+/**
+ * The identifier an authenticator gives a credential it has just created.
+ */
+export function simCognitoWebAuthnCredentialId() {
+    return randomBytes(credentialIdBytes).toString("base64url");
+}
+/**
+ * The client data a browser would have collected, as the JSON bytes an
+ * authenticator signs over.
+ *
+ * The origin is the relying party's own, because a passkey registered against
+ * a domain is presented from that domain and nowhere else.
+ */
+export function simCognitoWebAuthnClientData(type, challenge, relyingPartyId) {
+    return Buffer.from(JSON.stringify({
+        type,
+        challenge,
+        origin: `https://${relyingPartyId}`,
+        crossOrigin: false,
+    }));
+}
+/**
+ * The authenticator data of one ceremony: the relying party the credential
+ * answers for, what the authenticator checked, and how many times it has
+ * signed.
+ */
+export function simCognitoWebAuthnAuthenticatorData(relyingPartyId, signCount) {
+    const flags = Buffer.alloc(5);
+    flags.writeUInt8(presentAndVerified, 0);
+    flags.writeUInt32BE(signCount, 1);
+    return Buffer.concat([
+        createHash("sha256").update(relyingPartyId).digest(),
+        flags,
+    ]);
+}
+/**
+ * What a passkey signs, which is the authenticator data followed by a hash of
+ * the client data.
+ */
+function signedBytes(authenticatorData, clientDataJson) {
+    return Buffer.concat([
+        authenticatorData,
+        createHash("sha256").update(clientDataJson).digest(),
+    ]);
+}
+/**
+ * Sign one ceremony with a passkey's private half.
+ */
+export function simCognitoWebAuthnSignature(privateKey, authenticatorData, clientDataJson) {
+    return sign("sha256", signedBytes(authenticatorData, clientDataJson), privateKey).toString("base64url");
+}
+/**
+ * Whether a signature is the one this passkey would have produced.
+ */
+export function simCognitoWebAuthnVerified(publicKey, authenticatorData, clientDataJson, signature) {
+    return verify("sha256", signedBytes(authenticatorData, clientDataJson), publicKey, signature);
+}
+//# sourceMappingURL=sim-cognito-web-authn-signing.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-signing.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-signing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,IAAI,EACJ,MAAM,GAEP,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,CAAC;AAE9C;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;GAEG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAUhC;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAwC,EACxC,SAAiB,EACjB,cAAsB;IAEtB,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI;QACJ,SAAS;QACT,MAAM,EAAE,WAAW,cAAc,EAAE;QACnC,WAAW,EAAE,KAAK;KACnB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,SAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,KAAK,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IACxC,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;QACpD,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,iBAAyB,EACzB,cAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,iBAAiB;QACjB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAqB,EACrB,iBAAyB,EACzB,cAAsB;IAEtB,OAAO,IAAI,CACT,QAAQ,EACR,WAAW,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAC9C,UAAU,CACX,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAoB,EACpB,iBAAyB,EACzB,cAAsB,EACtB,SAAiB;IAEjB,OAAO,MAAM,CACX,QAAQ,EACR,WAAW,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAC9C,SAAS,EACT,SAAS,CACV,CAAC;AACJ,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts

@@ -6,9 +6,10 @@
  * request is the first encoding, which is why a literal `/` in a path segment
  * and a separator are still distinguishable here.
  *
- * S3 is the exception on real AWS: it signs the path singly encoded. Only
- * doubly encoded services are supported for now, which is every service the
- * simulator serves.
+ * A request signed for S3 gets neither step, and is signed over the path it
+ * arrived with. An Object key holds any byte S3 accepts (a space, an
+ * ampersand, a `.` segment, a doubled slash), and the path naming it survives
+ * to the signature untouched.
  */
-export declare function simIamSigV4CanonicalPath(path: string): string;
+export declare function simIamSigV4CanonicalPath(path: string, serviceName: string): string;
 //# sourceMappingURL=sim-iam-sigv4-canonical-path.d.ts.map

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-path.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB7D"}
+{"version":3,"file":"sim-iam-sigv4-canonical-path.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,MAAM,CAyBR"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js

@@ -1,4 +1,13 @@
 import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
+/**
+ * The signing services that sign a path encoded once, as it arrived.
+ *
+ * SigV4 encodes the canonical path a second time, and real S3 is the exception
+ * to that. The name comes from the credential scope the request was signed
+ * under. The client picked its own rule from that same scope. Any further
+ * exception is one more entry here.
+ */
+const singlyEncodedServices = new Set(["s3"]);
 /**
  * Build the canonical URI of a signed request.
  *
@@ -7,11 +16,15 @@ import { escapeSigV4Uri } from "../sigv4-uri-escape.js";
  * request is the first encoding, which is why a literal `/` in a path segment
  * and a separator are still distinguishable here.
  *
- * S3 is the exception on real AWS: it signs the path singly encoded. Only
- * doubly encoded services are supported for now, which is every service the
- * simulator serves.
+ * A request signed for S3 gets neither step, and is signed over the path it
+ * arrived with. An Object key holds any byte S3 accepts (a space, an
+ * ampersand, a `.` segment, a doubled slash), and the path naming it survives
+ * to the signature untouched.
  */
-export function simIamSigV4CanonicalPath(path) {
+export function simIamSigV4CanonicalPath(path, serviceName) {
+    if (singlyEncodedServices.has(serviceName)) {
+        return path.length === 0 ? "/" : path;
+    }
     const segments = [];
     for (const segment of path.split("/")) {
         if (segment === "" || segment === ".") {

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-path.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;IAE1E,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-canonical-path.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,WAAmB;IAEnB,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;IAE1E,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts

@@ -1,3 +1,4 @@
+import type { SimIamSigV4SignatureStatement } from "../sim-iam-sigv4-signature-statement.js";
 import type { SimIamSigV4SignedRequest } from "../sim-iam-sigv4-signed-request.js";
 import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
 /**
@@ -8,12 +9,18 @@ import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
  * out, is the whole of SigV4 verification. Anything the canonical form covers
  * cannot be altered in transit without detection, and anything it leaves out
  * can be.
+ *
+ * The statement the request carries says which headers are signed and which
+ * service the signature is scoped to. Both belong to the canonical form. S3
+ * canonicalizes its path by a rule of its own, and the client read that rule
+ * from the scope it signed under.
  */
 export declare class SimIamSigV4CanonicalRequest {
     private readonly canonicalHeaders;
     private readonly signedRequest;
+    private readonly statement;
     private readonly payload;
-    constructor(signedRequest: SimIamSigV4SignedRequest, signedHeaderNames: readonly string[], payload?: SimIamSigV4PayloadDeclaration);
+    constructor(signedRequest: SimIamSigV4SignedRequest, statement: SimIamSigV4SignatureStatement, payload?: SimIamSigV4PayloadDeclaration);
     /**
      * The canonical request string, ready to be hashed into a string to sign.
      */

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAInF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IAExD,YACE,aAAa,EAAE,wBAAwB,EACvC,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,OAAO,GAAE,6BAER,EASF;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}
+{"version":3,"file":"sim-iam-sigv4-canonical-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAInF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IAExD,YACE,aAAa,EAAE,wBAAwB,EACvC,SAAS,EAAE,6BAA6B,EACxC,OAAO,GAAE,6BAER,EAUF;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAWjB;CACF"}

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js

@@ -10,15 +10,22 @@ import { SimIamSigV4PayloadDeclaration } from "./sim-iam-sigv4-payload-hash.js";
  * out, is the whole of SigV4 verification. Anything the canonical form covers
  * cannot be altered in transit without detection, and anything it leaves out
  * can be.
+ *
+ * The statement the request carries says which headers are signed and which
+ * service the signature is scoped to. Both belong to the canonical form. S3
+ * canonicalizes its path by a rule of its own, and the client read that rule
+ * from the scope it signed under.
  */
 export class SimIamSigV4CanonicalRequest {
     canonicalHeaders;
     signedRequest;
+    statement;
     payload;
-    constructor(signedRequest, signedHeaderNames, payload = SimIamSigV4PayloadDeclaration.fromHeaders(signedRequest.headers)) {
+    constructor(signedRequest, statement, payload = SimIamSigV4PayloadDeclaration.fromHeaders(signedRequest.headers)) {
         this.signedRequest = signedRequest;
+        this.statement = statement;
         this.payload = payload;
-        this.canonicalHeaders = new SimIamSigV4CanonicalHeaders(signedRequest.headers, signedHeaderNames, signedRequest.url);
+        this.canonicalHeaders = new SimIamSigV4CanonicalHeaders(signedRequest.headers, statement.signedHeaderNames, signedRequest.url);
     }
     /**
      * The canonical request string, ready to be hashed into a string to sign.
@@ -27,7 +34,7 @@ export class SimIamSigV4CanonicalRequest {
         const { method, url, body } = this.signedRequest;
         return [
             method.toUpperCase(),
-            simIamSigV4CanonicalPath(url.pathname),
+            simIamSigV4CanonicalPath(url.pathname, this.statement.scope.serviceName),
             simIamSigV4CanonicalQuery(url.search),
             `${this.canonicalHeaders.toString()}\n`,
             this.canonicalHeaders.signedHeaderList(),

package/dist/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IACxC,OAAO,CAAgC;IAExD,YACE,aAAuC,EACvC,iBAAoC,EACpC,OAAO,GAAkC,6BAA6B,CAAC,WAAW,CAChF,aAAa,CAAC,OAAO,CACtB;QAED,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,iBAAiB,EACjB,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAEjD,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-iam-sigv4-canonical-request.js","sourceRoot":"","sources":["../../../../../src/service/iam/sigv4/canonical/sim-iam-sigv4-canonical-request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,2BAA2B;IACrB,gBAAgB,CAA8B;IAC9C,aAAa,CAA2B;IACxC,SAAS,CAAgC;IACzC,OAAO,CAAgC;IAExD,YACE,aAAuC,EACvC,SAAwC,EACxC,OAAO,GAAkC,6BAA6B,CAAC,WAAW,CAChF,aAAa,CAAC,OAAO,CACtB;QAED,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,IAAI,2BAA2B,CACrD,aAAa,CAAC,OAAO,EACrB,SAAS,CAAC,iBAAiB,EAC3B,aAAa,CAAC,GAAG,CAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAEjD,OAAO;YACL,MAAM,CAAC,WAAW,EAAE;YACpB,wBAAwB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC;YACxE,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;YACrC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI;YACvC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACxC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF"}

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js

@@ -11,7 +11,7 @@ import { simIamSigV4Signature, simIamSigV4StringToSign, } from "./sim-iam-sigv4-
  */
 export function simIamSigV4CheckSignature(input) {
     const { signedRequest, statement, signingKey, amzDate, payload } = input;
-    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, statement.signedHeaderNames, payload).toString();
+    const canonicalRequest = new SimIamSigV4CanonicalRequest(signedRequest, statement, payload).toString();
     const expected = simIamSigV4Signature(signingKey, simIamSigV4StringToSign({
         amzDate,
         scope: statement.scope,

package/dist/service/iam/sigv4/sim-iam-sigv4-signature-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAE7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAexC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEzE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,SAAS,CAAC,iBAAiB,EAC3B,OAAO,CACR,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,SAAS,CAAC,WAAW,EAAE,EACtD,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"sim-iam-sigv4-signature-check.js","sourceRoot":"","sources":["../../../../src/service/iam/sigv4/sim-iam-sigv4-signature-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAE7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAGhF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAexC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC;IAErC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEzE,MAAM,gBAAgB,GAAG,IAAI,2BAA2B,CACtD,aAAa,EACb,SAAS,EACT,OAAO,CACR,CAAC,QAAQ,EAAE,CAAC;IAEb,MAAM,QAAQ,GAAG,oBAAoB,CACnC,UAAU,EACV,uBAAuB,CAAC;QACtB,OAAO;QACP,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB;KACjB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,2BAA2B,CACnC,+DAA+D;YAC7D,6BAA6B,SAAS,CAAC,WAAW,EAAE,EACtD,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.d.ts

@@ -0,0 +1,26 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimLambdaEventInvokeConfig } from "../../function/event-invoke/sim-lambda-event-invoke-config.js";
+import type { SimLambda } from "../../sim-lambda.js";
+interface SimCfnLambdaEventInvokeConfigCreatorProperties {
+    readonly lambda: SimLambda;
+}
+/**
+ * Creates simulated event invoke configs from CloudFormation Resources.
+ *
+ * This is what CDK emits for `onFailure`, `onSuccess`, `retryAttempts` and
+ * `maxEventAge` on a function, so a synthesized template is the usual way a
+ * config comes into existence outside a direct SDK call. It is written through
+ * the ordinary PutFunctionEventInvokeConfig command, so a template deploying
+ * one gets the same validation and the same authorization an SDK caller would.
+ */
+export declare class SimCfnLambdaEventInvokeConfigCreator {
+    private readonly lambda;
+    constructor(properties: SimCfnLambdaEventInvokeConfigCreatorProperties);
+    /**
+     * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaEventInvokeConfig>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-creator.d.ts.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+DAA+D,CAAC;AAChH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,UAAU,8CAA8C;IACtD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IAEnC,YAAY,UAAU,EAAE,8CAA8C,EAErE;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAkBrC;CACF"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.js

@@ -0,0 +1,32 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnLambdaEventInvokeConfigProperties } from "./sim-cfn-lambda-event-invoke-config-properties.js";
+/**
+ * Creates simulated event invoke configs from CloudFormation Resources.
+ *
+ * This is what CDK emits for `onFailure`, `onSuccess`, `retryAttempts` and
+ * `maxEventAge` on a function, so a synthesized template is the usual way a
+ * config comes into existence outside a direct SDK call. It is written through
+ * the ordinary PutFunctionEventInvokeConfig command, so a template deploying
+ * one gets the same validation and the same authorization an SDK caller would.
+ */
+export class SimCfnLambdaEventInvokeConfigCreator {
+    lambda;
+    constructor(properties) {
+        this.lambda = properties.lambda;
+    }
+    /**
+     * Create a config from an AWS::Lambda::EventInvokeConfig Resource.
+     */
+    async create(resource, properties) {
+        const { functionName, qualifier, input } = new SimCfnLambdaEventInvokeConfigProperties({
+            resource,
+            properties,
+        }).createInput();
+        await this.lambda.putFunctionEventInvokeConfig({ input });
+        const config = this.lambda.getSimEventInvokeConfig(functionName, qualifier);
+        assertDefined(config, `Sim Lambda event invoke config ${resource.logicalId} after ` +
+            "CloudFormation creation");
+        return config;
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-creator.js.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-creator.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,oDAAoD,CAAC;AAM7G;;;;;;;;GAQG;AACH,MAAM,OAAO,oCAAoC;IAC9B,MAAM,CAAY;IAEnC,YAAY,UAA0D;QACpE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GACtC,IAAI,uCAAuC,CAAC;YAC1C,QAAQ;YACR,UAAU;SACX,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAE5E,aAAa,CACX,MAAM,EACN,kCAAkC,QAAQ,CAAC,SAAS,SAAS;YAC3D,yBAAyB,CAC5B,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.d.ts

@@ -0,0 +1,40 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimPutFunctionEventInvokeConfigCommandInput } from "../../command/put-function-event-invoke-config/put-function-event-invoke-config.command.js";
+interface SimCfnLambdaEventInvokeConfigPropertiesProperties {
+    readonly resource: SimCfnResource;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * The PutFunctionEventInvokeConfig input, and which function it is for.
+ *
+ * The function and qualifier are carried beside the input because they are
+ * what the config is held under, and the creator reads the config back with
+ * them once the command has written it.
+ */
+export interface SimCfnLambdaEventInvokeConfigInput {
+    readonly functionName: string;
+    readonly qualifier: string | undefined;
+    readonly input: SimPutFunctionEventInvokeConfigCommandInput;
+}
+/**
+ * Reads an AWS::Lambda::EventInvokeConfig Resource into the input
+ * PutFunctionEventInvokeConfig takes.
+ *
+ * Nothing about retry counts or event ages is decided here. The command
+ * refuses what real Lambda refuses, so a config a template deployed is the
+ * same thing an SDK caller would have got.
+ */
+export declare class SimCfnLambdaEventInvokeConfigProperties {
+    private readonly resource;
+    private readonly properties;
+    private readonly parser;
+    private readonly destinations;
+    constructor(properties: SimCfnLambdaEventInvokeConfigPropertiesProperties);
+    /**
+     * The put input this Resource asks for.
+     */
+    createInput(): SimCfnLambdaEventInvokeConfigInput;
+}
+export {};
+//# sourceMappingURL=sim-cfn-lambda-event-invoke-config-properties.d.ts.map

package/dist/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-event-invoke-config-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/event-invoke-config/sim-cfn-lambda-event-invoke-config-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,4FAA4F,CAAC;AAM9J,UAAU,iDAAiD;IACzD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,2CAA2C,CAAC;CAC7D;AAED;;;;;;;GAOG;AACH,qBAAa,uCAAuC;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6C;IAE1E,YAAY,UAAU,EAAE,iDAAiD,EAGxE;IAED;;OAEG;IACH,WAAW,IAAI,kCAAkC,CAsChD;CACF"}