@kensio/yulin 1.20.14 → 1.20.16

package/dist/service/cloudformation/resource/resolve/property/sim-cfn-resource-property-resolver.js

@@ -1,6 +1,7 @@
 import { SimCfnParameters } from "../../../parameters/sim-cfn-parameters.js";
 import { SimCfnTemplateValueResolver } from "../../../template/value/sim-cfn-template-value-resolver.js";
 import { makeSimCfnDynamicReferences } from "../../../template/dynamic/make-sim-cfn-dynamic-references.js";
+import { hasSimCfnDynamicReferenceIn } from "../../../template/dynamic/sim-cfn-dynamic-reference-scan.js";
 /**
  * Resolves CloudFormation Resource Properties immediately before Resource
  * creation.
@@ -36,10 +37,13 @@ export class SimCfnResourcePropertyResolver {
      * {@link SimCfnTemplateValueResolver}. If no Parameters are available, an empty
      * Parameter resolver is used so Resource Refs can still resolve.
      *
-     * Resolution itself is synchronous, and the awaiting happens around it. A
-     * dynamic reference naming a service that has to be waited on resolves to a
-     * marker while the properties resolve, and the values replace the markers
-     * here.
+     * Resolution itself is synchronous, and the awaiting happens around it.
+     * Properties holding a dynamic reference are resolved twice: the first pass
+     * reads the references and leaves them as the template wrote them, and the
+     * second finds the answers waiting, so an intrinsic function reading a
+     * reference's value gets the value rather than a marker. A reference the
+     * first pass never reached resolves to a marker instead, and the values
+     * replace the markers here.
      *
      * Resource Refs are read from the creation context. If a referenced Resource
      * is unexpectedly absent, the Ref is preserved as `{ Ref: logicalId }` rather
@@ -72,11 +76,15 @@ export class SimCfnResourcePropertyResolver {
                 },
             },
         });
-        const resolved = resolver.resolveRecord(properties);
         if (dynamicReferences === undefined) {
-            return resolved;
+            return resolver.resolveRecord(properties);
         }
-        return await dynamicReferences.settle(resolved);
+        if (hasSimCfnDynamicReferenceIn(properties)) {
+            await dynamicReferences.prefetch(() => {
+                resolver.resolveRecord(properties);
+            });
+        }
+        return await dynamicReferences.settle(resolver.resolveRecord(properties));
     }
     /**
      * The services answering this Resource's dynamic references.
@@ -84,14 +92,19 @@ export class SimCfnResourcePropertyResolver {
      * Absent where the caller has no simulation to read from, which is how the
      * resolver is used on its own in tests. A reference then stays in the
      * property as the template wrote it.
+     *
+     * The principal the operation runs as goes with the simulation, so a
+     * reference is read as the deployment's own caller rather than as the
+     * Account root.
      */
     dynamicReferences(context) {
-        const { simAws } = context;
+        const { simAws, caller } = context;
         if (simAws === undefined || this.accountRegionScope === undefined) {
             return undefined;
         }
         return makeSimCfnDynamicReferences({
             simAws,
+            caller,
             accountRegionScope: this.accountRegionScope,
             propertyIgnorer: this.propertyIgnorer,
             resourceType: this.resourceType,

package/dist/service/cloudformation/resource/sim-cfn-resource.type.d.ts

@@ -44,6 +44,15 @@ export interface SimCfnResourceResolveContext {
      * another service rather than from the template. A dynamic reference is one.
      */
     readonly simAws?: SimAws | undefined;
+    /**
+     * The principal the operation runs as, which a value read out of another
+     * service is authorized as. Real CloudFormation reads a dynamic reference
+     * under the Stack's execution role rather than as the Account root.
+     *
+     * Left out unless the deployment named one, which leaves each service to its
+     * own omitted-caller default of the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 export interface SimCloudFormationResourceCreateContext {
     readonly simAws: SimAws;

package/dist/service/cloudformation/template/dynamic/make-sim-cfn-dynamic-references.d.ts

@@ -1,10 +1,12 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnPropertyIgnorer } from "../../resource/ignore/sim-cfn-ignored-property.type.js";
 import { SimCfnDynamicReferences } from "./sim-cfn-dynamic-references.js";
 interface MakeSimCfnDynamicReferencesProperties {
     readonly simAws: SimAws;
     readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly caller?: SimAwsCaller | undefined;
     readonly propertyIgnorer?: SimCfnPropertyIgnorer | undefined;
     readonly resourceType?: string | undefined;
 }

package/dist/service/cloudformation/template/dynamic/make-sim-cfn-dynamic-references.js

@@ -4,7 +4,7 @@ import { simCfnDynamicReferenceResolvers } from "./sim-cfn-dynamic-reference-res
  * Build the dynamic reference resolvers for one Account and Region scope.
  */
 export function makeSimCfnDynamicReferences(properties) {
-    const { simAws, accountRegionScope, propertyIgnorer, resourceType } = properties;
+    const { simAws, accountRegionScope, caller, propertyIgnorer, resourceType } = properties;
     const scopedAws = simAws.accountRegionScope(accountRegionScope.accountId, accountRegionScope.regionName);
     return new SimCfnDynamicReferences({
         propertyIgnorer,
@@ -13,7 +13,7 @@ export function makeSimCfnDynamicReferences(properties) {
             .entries()
             .map(([service, resolver]) => [
             service,
-            resolver({ simAws, scopedAws }),
+            resolver({ simAws, scopedAws, caller }),
         ])),
     });
 }

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-resolvers.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionContainer } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnDynamicReferenceResolver } from "./sim-cfn-dynamic-reference.type.js";
 /**
@@ -12,6 +13,15 @@ import type { SimCfnDynamicReferenceResolver } from "./sim-cfn-dynamic-reference
 interface SimCfnDynamicReferenceSimulation {
     readonly simAws: SimAws;
     readonly scopedAws: SimAwsAccountRegionContainer;
+    /**
+     * The principal the deployment runs as, which the reference is read as. Real
+     * CloudFormation resolves a dynamic reference under the Stack's execution
+     * role, so a Stack deployed as a Role reads what that Role may read.
+     *
+     * Left out unless the deployment named one, which leaves each service to its
+     * own omitted-caller default of the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * How one simulated service hands over its dynamic reference resolver, given

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-resolvers.js

@@ -10,19 +10,20 @@ import { SimCfnSecretsManagerDynamicReferenceResolver } from "../../../secretsma
 export const simCfnDynamicReferenceResolvers = new Map([
     [
         "ssm",
-        ({ scopedAws }) => scopedAws.ssm().cfnDynamicReferenceResolver(),
+        ({ scopedAws, caller }) => scopedAws.ssm().cfnDynamicReferenceResolver(caller),
     ],
     [
         "ssm-secure",
-        ({ scopedAws }) => scopedAws.ssm().cfnSecureDynamicReferenceResolver(),
+        ({ scopedAws, caller }) => scopedAws.ssm().cfnSecureDynamicReferenceResolver(caller),
     ],
     [
         "secretsmanager",
-        ({ simAws, scopedAws }) => new SimCfnSecretsManagerDynamicReferenceResolver({
+        ({ simAws, scopedAws, caller }) => new SimCfnSecretsManagerDynamicReferenceResolver({
             secretsManager: scopedAws.secretsManager(),
             secretsManagerIn: (scope) => simAws
                 .accountRegionScope(scope.accountId, scope.regionName)
                 .secretsManager(),
+            caller,
         }),
     ],
 ]);

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-scan.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnTemplateValue } from "../value/sim-cfn-template-value.js";
 import type { SimCfnDynamicReference } from "./sim-cfn-dynamic-reference.type.js";
 /**
  * What a caller answers each reference with.
@@ -10,6 +11,16 @@ type SimCfnDynamicReferenceSubstitution = (reference: SimCfnDynamicReference) =>
  * Whether a string holds anything worth scanning.
  */
 export declare function hasSimCfnDynamicReference(text: string): boolean;
+/**
+ * Whether anything in a template value was written as a dynamic reference.
+ *
+ * The opening is written literally in every template but a contrived one, so
+ * this answers whether a Resource's properties are worth reading references
+ * out of before they are resolved. A template building the opening itself,
+ * out of an `Fn::Join` over its characters, is answered no and reads its
+ * references while resolving instead.
+ */
+export declare function hasSimCfnDynamicReferenceIn(value: SimCfnTemplateValue): boolean;
 /**
  * Replace every dynamic reference in a string with what the caller answers.
  *

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-scan.js

@@ -17,6 +17,27 @@ const dynamicReferencePattern = /\{\{resolve:([A-Za-z][\w-]*):([^{}]*)\}\}/g;
 export function hasSimCfnDynamicReference(text) {
     return text.includes(dynamicReferenceOpening);
 }
+/**
+ * Whether anything in a template value was written as a dynamic reference.
+ *
+ * The opening is written literally in every template but a contrived one, so
+ * this answers whether a Resource's properties are worth reading references
+ * out of before they are resolved. A template building the opening itself,
+ * out of an `Fn::Join` over its characters, is answered no and reads its
+ * references while resolving instead.
+ */
+export function hasSimCfnDynamicReferenceIn(value) {
+    if (typeof value === "string") {
+        return hasSimCfnDynamicReference(value);
+    }
+    if (Array.isArray(value)) {
+        return value.some((entry) => hasSimCfnDynamicReferenceIn(entry));
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.values(value).some((entry) => hasSimCfnDynamicReferenceIn(entry));
+    }
+    return false;
+}
 /**
  * Replace every dynamic reference in a string with what the caller answers.
  *

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-references.d.ts

@@ -19,15 +19,33 @@ interface SimCfnDynamicReferencesProperties {
  * what the ones this simulation has yet to implement do.
  *
  * One of these belongs to a single Resource's property resolution. That is
- * what lets it hold the references still being read. `substitute` runs while
- * the properties resolve, and `settle` finishes them afterwards.
+ * what lets it hold the references still being read. `prefetch` reads them
+ * ahead of resolution, `substitute` runs while the properties resolve, and
+ * `settle` finishes whatever the prefetch pass never reached.
  */
 export declare class SimCfnDynamicReferences {
     private readonly resolvers;
     private readonly propertyIgnorer;
     private readonly resourceType;
     private readonly awaited;
+    private readonly prefetched;
     constructor(properties: SimCfnDynamicReferencesProperties);
+    /**
+     * Read every reference the properties hold, before resolving them for real.
+     *
+     * A service that has to be waited on cannot answer during resolution, which
+     * is synchronous, so an `Fn::Split` over a reference would otherwise split
+     * something that is not the value yet. Resolving the properties twice is
+     * what avoids that: this pass leaves every reference as the template wrote
+     * it and only collects what the services answer, and the pass after it finds
+     * the answers already here.
+     *
+     * Nothing is recorded here and no failure escapes. A template this pass
+     * cannot resolve is resolved again straight afterwards, and that is the pass
+     * whose failure the Resource reports. A reference the pass never reached, or
+     * one whose service refused it, is left to `substitute` and `settle`.
+     */
+    prefetch(resolve: () => void): Promise<void>;
     /**
      * Replace every dynamic reference in a resolved string.
      *
@@ -44,6 +62,10 @@ export declare class SimCfnDynamicReferences {
      * whose properties name only services answering at once.
      */
     settle(properties: SimCfnTemplateValueRecord): Promise<SimCfnTemplateValueRecord>;
+    /**
+     * What one reference is replaced with, given the service answering it.
+     */
+    private substituted;
     /**
      * The value one reference resolved to.
      *

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-references.js

@@ -2,6 +2,7 @@ import { currentSimCfnValuePath } from "../value/sim-cfn-value-path.js";
 import { SimCfnAwaitedDynamicReferences } from "./sim-cfn-awaited-dynamic-references.js";
 import { fillSimCfnDynamicReferencePlaceholders } from "./sim-cfn-dynamic-reference-placeholder.js";
 import { substituteSimCfnDynamicReferences } from "./sim-cfn-dynamic-reference-scan.js";
+import { SimCfnPrefetchedDynamicReferences } from "./sim-cfn-prefetched-dynamic-references.js";
 /**
  * The services a Stack's dynamic references are answered by.
  *
@@ -11,19 +12,39 @@ import { substituteSimCfnDynamicReferences } from "./sim-cfn-dynamic-reference-s
  * what the ones this simulation has yet to implement do.
  *
  * One of these belongs to a single Resource's property resolution. That is
- * what lets it hold the references still being read. `substitute` runs while
- * the properties resolve, and `settle` finishes them afterwards.
+ * what lets it hold the references still being read. `prefetch` reads them
+ * ahead of resolution, `substitute` runs while the properties resolve, and
+ * `settle` finishes whatever the prefetch pass never reached.
  */
 export class SimCfnDynamicReferences {
     resolvers;
     propertyIgnorer;
     resourceType;
     awaited = new SimCfnAwaitedDynamicReferences();
+    prefetched = new SimCfnPrefetchedDynamicReferences();
     constructor(properties) {
         this.resolvers = properties.resolvers;
         this.propertyIgnorer = properties.propertyIgnorer;
         this.resourceType = properties.resourceType;
     }
+    /**
+     * Read every reference the properties hold, before resolving them for real.
+     *
+     * A service that has to be waited on cannot answer during resolution, which
+     * is synchronous, so an `Fn::Split` over a reference would otherwise split
+     * something that is not the value yet. Resolving the properties twice is
+     * what avoids that: this pass leaves every reference as the template wrote
+     * it and only collects what the services answer, and the pass after it finds
+     * the answers already here.
+     *
+     * Nothing is recorded here and no failure escapes. A template this pass
+     * cannot resolve is resolved again straight afterwards, and that is the pass
+     * whose failure the Resource reports. A reference the pass never reached, or
+     * one whose service refused it, is left to `substitute` and `settle`.
+     */
+    async prefetch(resolve) {
+        await this.prefetched.read(resolve);
+    }
     /**
      * Replace every dynamic reference in a resolved string.
      *
@@ -37,15 +58,7 @@ export class SimCfnDynamicReferences {
             if (resolver === undefined) {
                 return;
             }
-            const path = currentSimCfnValuePath();
-            const resolution = resolver.resolve(reference, {
-                resourceType: this.resourceType,
-                propertyPath: path,
-            });
-            if (resolution instanceof Promise) {
-                return this.awaited.hold(resolution, path);
-            }
-            return this.answer(resolution, path);
+            return this.substituted(resolver, reference);
         });
     }
     /**
@@ -66,6 +79,32 @@ export class SimCfnDynamicReferences {
         ]));
         return fillSimCfnDynamicReferencePlaceholders(properties, values);
     }
+    /**
+     * What one reference is replaced with, given the service answering it.
+     */
+    substituted(resolver, reference) {
+        const path = currentSimCfnValuePath();
+        const key = `${path} ${reference.text}`;
+        const prefetched = this.prefetched.answerFor(key);
+        if (prefetched !== undefined) {
+            return this.answer(prefetched, path);
+        }
+        if (this.prefetched.isHeld(key)) {
+            return reference.text;
+        }
+        const resolution = resolver.resolve(reference, {
+            resourceType: this.resourceType,
+            propertyPath: path,
+        });
+        if (this.prefetched.isReading) {
+            this.prefetched.hold(key, resolution);
+            return reference.text;
+        }
+        if (resolution instanceof Promise) {
+            return this.awaited.hold(resolution, path);
+        }
+        return this.answer(resolution, path);
+    }
     /**
      * The value one reference resolved to.
      *

package/dist/service/cloudformation/template/dynamic/sim-cfn-prefetched-dynamic-references.d.ts

@@ -0,0 +1,42 @@
+import type { SimCfnDynamicReferenceResolution } from "./sim-cfn-dynamic-reference.type.js";
+/**
+ * The references of one property resolution that were read before it ran.
+ *
+ * A service that has to be waited on cannot answer while the properties
+ * resolve, because resolution is synchronous, so properties holding a
+ * reference are resolved twice. The first pass leaves every reference as the
+ * template wrote it and keeps what the services answer here. The second finds
+ * the answers waiting, so an `Fn::Split` over a reference splits the value
+ * rather than something standing in for it.
+ *
+ * A read that failed is not kept. The resolution pass asks its service again,
+ * and the failure reaches the Resource from there, which is what fails a
+ * Resource holding a reference the deployment may not read.
+ */
+export declare class SimCfnPrefetchedDynamicReferences {
+    private readonly answers;
+    private reads;
+    /** Whether the pass running now is the one reading references ahead. */
+    get isReading(): boolean;
+    /**
+     * What one reference was already answered with, where it was.
+     */
+    answerFor(key: string): SimCfnDynamicReferenceResolution | undefined;
+    /**
+     * Whether the pass running now has already started reading one reference.
+     *
+     * A property holding the same reference twice would otherwise read it twice.
+     */
+    isHeld(key: string): boolean;
+    /**
+     * Keep one reference's answer for the resolution pass to use.
+     */
+    hold(key: string, resolution: SimCfnDynamicReferenceResolution | Promise<SimCfnDynamicReferenceResolution>): void;
+    /**
+     * Run one pass over the properties, keeping what its references answer.
+     *
+     * Nothing the pass throws escapes. The resolution pass after it resolves the
+     * same properties, and that is the pass whose failure the Resource reports.
+     */
+    read(pass: () => void): Promise<void>;
+}

package/dist/service/cloudformation/template/dynamic/sim-cfn-prefetched-dynamic-references.js

@@ -0,0 +1,80 @@
+/**
+ * The references of one property resolution that were read before it ran.
+ *
+ * A service that has to be waited on cannot answer while the properties
+ * resolve, because resolution is synchronous, so properties holding a
+ * reference are resolved twice. The first pass leaves every reference as the
+ * template wrote it and keeps what the services answer here. The second finds
+ * the answers waiting, so an `Fn::Split` over a reference splits the value
+ * rather than something standing in for it.
+ *
+ * A read that failed is not kept. The resolution pass asks its service again,
+ * and the failure reaches the Resource from there, which is what fails a
+ * Resource holding a reference the deployment may not read.
+ */
+export class SimCfnPrefetchedDynamicReferences {
+    answers = new Map();
+    reads;
+    /** Whether the pass running now is the one reading references ahead. */
+    get isReading() {
+        return this.reads !== undefined;
+    }
+    /**
+     * What one reference was already answered with, where it was.
+     */
+    answerFor(key) {
+        return this.answers.get(key);
+    }
+    /**
+     * Whether the pass running now has already started reading one reference.
+     *
+     * A property holding the same reference twice would otherwise read it twice.
+     */
+    isHeld(key) {
+        return this.reads?.has(key) === true;
+    }
+    /**
+     * Keep one reference's answer for the resolution pass to use.
+     */
+    hold(key, resolution) {
+        this.reads?.set(key, Promise.resolve(resolution));
+    }
+    /**
+     * Run one pass over the properties, keeping what its references answer.
+     *
+     * Nothing the pass throws escapes. The resolution pass after it resolves the
+     * same properties, and that is the pass whose failure the Resource reports.
+     */
+    async read(pass) {
+        const reads = new Map();
+        this.reads = reads;
+        try {
+            pass();
+        }
+        catch {
+            // The resolution pass after this one is the one that reports it.
+        }
+        finally {
+            this.reads = undefined;
+        }
+        const answers = await Promise.all(reads
+            .entries()
+            .map(async ([key, read]) => await prefetchedReference(key, read)));
+        for (const answer of answers) {
+            if (answer !== undefined) {
+                this.answers.set(answer.key, answer.resolution);
+            }
+        }
+    }
+}
+/**
+ * What one read answered, or nothing where it failed.
+ */
+async function prefetchedReference(key, read) {
+    try {
+        return { key, resolution: await read };
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-failures.d.ts

@@ -6,6 +6,13 @@ interface SimEventBridgeDeliveryFailureProperties {
     readonly eventId: string;
     readonly error: unknown;
 }
+/**
+ * A failed delivery as it serialises. Every property the failure holds, plus
+ * the message the getter reads off the error.
+ */
+export interface SimEventBridgeDeliveryFailureJson extends SimEventBridgeDeliveryFailureProperties {
+    readonly message: string;
+}
 /**
  * One event a rule could not get to one of its targets.
  */
@@ -21,6 +28,15 @@ export declare class SimEventBridgeDeliveryFailure {
      * What went wrong, as a message.
      */
     get message(): string;
+    /**
+     * The failure as JSON.stringify renders it, message included.
+     *
+     * Serialising a failure is the first thing to reach for when a target
+     * received nothing. The message is a getter on the prototype and would be
+     * left out. An Error keeps its own message on a non-enumerable property and
+     * prints as `{}`.
+     */
+    toJSON(): SimEventBridgeDeliveryFailureJson;
 }
 /**
  * Every delivery one simulated EventBridge scope could not make.

package/dist/service/eventbridge/delivery/sim-event-bridge-delivery-failures.js

@@ -25,6 +25,25 @@ export class SimEventBridgeDeliveryFailure {
         }
         return String(this.error);
     }
+    /**
+     * The failure as JSON.stringify renders it, message included.
+     *
+     * Serialising a failure is the first thing to reach for when a target
+     * received nothing. The message is a getter on the prototype and would be
+     * left out. An Error keeps its own message on a non-enumerable property and
+     * prints as `{}`.
+     */
+    toJSON() {
+        return {
+            ruleName: this.ruleName,
+            ruleArn: this.ruleArn,
+            targetId: this.targetId,
+            targetArn: this.targetArn,
+            eventId: this.eventId,
+            message: this.message,
+            error: this.error,
+        };
+    }
 }
 /**
  * Every delivery one simulated EventBridge scope could not make.

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.d.ts

@@ -1,28 +1,51 @@
 import { type SimAwsCredentialIdentityResolver, type SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
-import type { SimAwsCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimIamAuthZPolicySource } from "./sim-iam-auth-z-context.js";
 export interface SimIamAuthZCallerContext {
     readonly caller: SimAwsResolvedCaller;
     readonly rootPolicySources: readonly SimIamAuthZPolicySource[];
 }
+/**
+ * What building a caller context needs beyond the request's own caller.
+ */
+export interface SimIamAuthZCallerContextBuilderProperties {
+    /**
+     * The root principal of the Account deciding the request.
+     *
+     * This is both the last fallback for a request that names no caller and the
+     * principal holding the Account's intrinsic unrestricted access. The default
+     * caller stands apart from it. Naming a default says who an unattributed
+     * call comes from, and leaves the root's own access where AWS puts it.
+     */
+    readonly accountRootPrincipal: SimAwsPrincipal;
+    readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
+    /**
+     * The caller this simulation attributes an unattributed request to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+}
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * The configured default principal represents the simulated account root. It is
- * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root.
+ * A request that omits a caller is decided as the simulation's default caller,
+ * and as the Account root where the simulation named none. An explicit
+ * anonymous caller falls back to neither.
  */
 export declare class SimIamAuthZCallerContextBuilder {
     private readonly callerResolver;
-    private readonly defaultCallerPrincipal;
-    constructor(defaultCallerPrincipal: SimAwsPrincipal, credentialIdentityResolver: SimAwsCredentialIdentityResolver);
+    private readonly accountRootPrincipal;
+    private readonly accountRootArn?;
+    constructor(properties: SimIamAuthZCallerContextBuilderProperties);
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
     build(caller: SimAwsCaller | undefined): SimIamAuthZCallerContext;
     /**
-     * Give the configured account-root principal unrestricted identity access.
+     * Give the Account's root principal unrestricted identity access.
+     *
+     * The comparison names the root principal explicitly, so a simulation with a
+     * default caller keeps this access on the root where AWS has it.
      */
     private rootPolicySources;
 }

package/dist/service/iam/authorize/context/sim-iam-auth-z-caller-context-builder.js

@@ -2,34 +2,43 @@ import { SimAwsCallerResolver, } from "../../../aws/caller/sim-aws-caller-resolv
 /**
  * Resolves the caller and any policy sources implied by that caller.
  *
- * The configured default principal represents the simulated account root. It is
- * used only when the request omits a caller. An explicit anonymous caller does
- * not fall back to root.
+ * A request that omits a caller is decided as the simulation's default caller,
+ * and as the Account root where the simulation named none. An explicit
+ * anonymous caller falls back to neither.
  */
 export class SimIamAuthZCallerContextBuilder {
     callerResolver;
-    defaultCallerPrincipal;
-    constructor(defaultCallerPrincipal, credentialIdentityResolver) {
-        this.defaultCallerPrincipal = defaultCallerPrincipal;
-        this.callerResolver = new SimAwsCallerResolver(credentialIdentityResolver);
+    accountRootPrincipal;
+    accountRootArn;
+    constructor(properties) {
+        const root = properties.accountRootPrincipal;
+        this.accountRootPrincipal = root;
+        this.accountRootArn = root.kind === "arn" ? root.arn : undefined;
+        this.callerResolver = new SimAwsCallerResolver({
+            credentialIdentityResolver: properties.credentialIdentityResolver,
+            defaultCaller: properties.defaultCaller,
+        });
     }
     /**
      * Resolve request caller data and add the simulated root policy when
      * applicable.
      */
     build(caller) {
-        const resolvedCaller = this.callerResolver.resolve(caller, this.defaultCallerPrincipal);
+        const resolvedCaller = this.callerResolver.resolve(caller, this.accountRootPrincipal);
         return {
             caller: resolvedCaller,
             rootPolicySources: this.rootPolicySources(resolvedCaller),
         };
     }
     /**
-     * Give the configured account-root principal unrestricted identity access.
+     * Give the Account's root principal unrestricted identity access.
+     *
+     * The comparison names the root principal explicitly, so a simulation with a
+     * default caller keeps this access on the root where AWS has it.
      */
     rootPolicySources(caller) {
-        const defaultCaller = this.callerResolver.resolve(this.defaultCallerPrincipal, this.defaultCallerPrincipal);
-        if (defaultCaller.arn === undefined || caller.arn !== defaultCaller.arn) {
+        if (this.accountRootArn === undefined ||
+            caller.arn !== this.accountRootArn) {
             return [];
         }
         return [