@kensio/yulin 1.20.15 → 1.20.17

package/README.md

@@ -22,6 +22,8 @@ npm i -D @kensio/yulin
 - [ACM](https://yulinsim.dev/services/acm/ "Simulated ACM docs")
 - [API Gateway HTTP APIs](https://yulinsim.dev/services/apigatewayv2/ "Simulated API Gateway HTTP API docs")
 - [API Gateway REST APIs](https://yulinsim.dev/services/apigateway/ "Simulated API Gateway REST API docs")
+- [Athena](https://yulinsim.dev/services/athena/ "Simulated Amazon Athena docs")
+- [Bedrock](https://yulinsim.dev/services/bedrock/ "Simulated Amazon Bedrock docs")
 - [CloudFormation](https://yulinsim.dev/services/cloudformation/ "Simulated CloudFormation docs")
 - [CloudFront](https://yulinsim.dev/services/cloudfront/ "Simulated CloudFront docs")
 - [CloudWatch metrics](https://yulinsim.dev/services/cloudwatch/ "Simulated CloudWatch metrics docs")
@@ -29,12 +31,16 @@ npm i -D @kensio/yulin
 - [DynamoDB](https://yulinsim.dev/services/dynamodb/ "Simulated DynamoDB docs")
 - [ECR](https://yulinsim.dev/services/ecr/ "Simulated ECR docs")
 - [ECS](https://yulinsim.dev/services/ecs/ "Simulated ECS docs")
+- [Elastic Load Balancing](https://yulinsim.dev/services/elbv2/ "Simulated Application Load Balancer docs")
 - [EventBridge](https://yulinsim.dev/services/eventbridge/ "Simulated EventBridge docs")
 - [Glue](https://yulinsim.dev/services/glue/ "Simulated Glue Data Catalog docs")
 - [IAM](https://yulinsim.dev/services/iam/ "Simulated IAM docs")
+- [Kinesis Data Firehose](https://yulinsim.dev/services/firehose/ "Simulated Kinesis Data Firehose docs")
+- [Kinesis Data Streams](https://yulinsim.dev/services/kinesis/ "Simulated Kinesis Data Streams docs")
 - [KMS](https://yulinsim.dev/services/kms/ "Simulated KMS docs")
 - [Lambda](https://yulinsim.dev/services/lambda/ "Simulated Lambda docs")
 - [CloudWatch Logs](https://yulinsim.dev/services/logs/ "Simulated CloudWatch Logs docs")
+- [Organizations](https://yulinsim.dev/services/organizations/ "Simulated Organizations service control policies docs")
 - [Personalize](https://yulinsim.dev/services/personalize/ "Simulated Amazon Personalize docs")
 - [Rekognition](https://yulinsim.dev/services/rekognition/ "Simulated Rekognition docs")
 - [Route53](https://yulinsim.dev/services/route53/ "Simulated Route53 docs")
@@ -54,10 +60,17 @@ npm i -D @kensio/yulin
 - [AI skill](https://yulinsim.dev/ai-skill/ "Yulin AI skill docs")
 - [The AWS CLI](https://yulinsim.dev/cli/ "The AWS CLI against simulated AWS docs")
 - [AWS SDK interception](https://yulinsim.dev/sdk/ "Simulated AWS SDK docs")
+- [Event factories](https://yulinsim.dev/factories/ "Test factories for AWS event shapes docs")
+- [Linting CloudFront Functions JS2](https://yulinsim.dev/lint/ "CloudFront Functions JS2 lint config docs")
+- [Non-AWS dependencies](https://yulinsim.dev/non-aws-dependencies/ "Dependencies Yulin does not simulate docs")
 - [Serving on localhost](https://yulinsim.dev/serve/ "Serving simulated AWS on localhost docs")
 - [Simulated time](https://yulinsim.dev/time/ "Simulated time docs")
 - [Terraform](https://yulinsim.dev/terraform/ "Deploying Terraform into simulated AWS docs")
 
+Every page listed above also ships inside the package as markdown, documenting the version
+installed. `node_modules/@kensio/yulin/llms.txt` indexes them, and a coding agent with no network
+reach can read them from there.
+
 ## Usage
 
 ### Intercept AWS SDK clients

package/dist/sdk/module/sim-sdk-module-client-interceptor.d.ts

@@ -40,6 +40,11 @@ export declare class SimSdkModuleClientInterceptor {
      *
      * Reflect.construct with the incoming new target preserves subclassing and
      * instanceof against the real class.
+     *
+     * The class's own static methods are wrapped as well, so a client built by
+     * a static factory such as `DynamoDBDocumentClient.from` is patched too.
+     * Such a factory constructs from the class binding it closes over rather
+     * than through this proxy, so the construct trap never sees it.
      */
     private wrapClientClass;
     /**

package/dist/sdk/module/sim-sdk-module-client-interceptor.js

@@ -1,4 +1,5 @@
 import { installSendPatch } from "../send-patch.js";
+import { SimSdkStaticClientFactories } from "./sim-sdk-static-client-factory.js";
 /**
  * Intercepts the SDK client classes exported by an AWS SDK package module.
  *
@@ -56,16 +57,29 @@ export class SimSdkModuleClientInterceptor {
      *
      * Reflect.construct with the incoming new target preserves subclassing and
      * instanceof against the real class.
+     *
+     * The class's own static methods are wrapped as well, so a client built by
+     * a static factory such as `DynamoDBDocumentClient.from` is patched too.
+     * Such a factory constructs from the class binding it closes over rather
+     * than through this proxy, so the construct trap never sees it.
      */
     wrapClientClass(clientClass) {
         const sendHandler = this.sendHandler;
         const configureArguments = (constructorArguments) => this.regionDefaultedArguments(constructorArguments);
+        const staticFactories = new SimSdkStaticClientFactories(sendHandler);
         return new Proxy(clientClass, {
             construct(target, constructorArguments, newTarget) {
                 const instance = Reflect.construct(target, configureArguments(constructorArguments), newTarget);
                 installSendPatch(instance, sendHandler);
                 return instance;
             },
+            get(target, property, receiver) {
+                const value = Reflect.get(target, property, receiver);
+                if (typeof value !== "function" || !Object.hasOwn(target, property)) {
+                    return value;
+                }
+                return staticFactories.wrap(value);
+            },
         });
     }
     /**

package/dist/sdk/module/sim-sdk-static-client-factory.d.ts

@@ -0,0 +1,26 @@
+import { type SimSdkSendHandler } from "../send-patch.js";
+/**
+ * The wrapped static methods of one intercepted SDK client class.
+ *
+ * A static factory such as `DynamoDBDocumentClient.from` constructs from the
+ * class binding it closes over rather than through the class the calling code
+ * holds, so the client it builds is never seen by the interception's construct
+ * trap. Wrapping the method send-patches that client on the way back out.
+ *
+ * Each method is wrapped once, so the class keeps handing out the same
+ * function for the same static.
+ */
+export declare class SimSdkStaticClientFactories {
+    private readonly sendHandler;
+    private readonly wrappers;
+    constructor(sendHandler: SimSdkSendHandler);
+    /**
+     * The patching wrapper for one static method.
+     */
+    wrap(method: object): unknown;
+    /**
+     * A Proxy rather than a plain function keeps the method's own identity
+     * surface, such as its name, length and any properties hung off it.
+     */
+    private wrapMethod;
+}

package/dist/sdk/module/sim-sdk-static-client-factory.js

@@ -0,0 +1,59 @@
+import { hasSendPatch, installSendPatch, } from "../send-patch.js";
+/**
+ * The wrapped static methods of one intercepted SDK client class.
+ *
+ * A static factory such as `DynamoDBDocumentClient.from` constructs from the
+ * class binding it closes over rather than through the class the calling code
+ * holds, so the client it builds is never seen by the interception's construct
+ * trap. Wrapping the method send-patches that client on the way back out.
+ *
+ * Each method is wrapped once, so the class keeps handing out the same
+ * function for the same static.
+ */
+export class SimSdkStaticClientFactories {
+    sendHandler;
+    wrappers = new WeakMap();
+    constructor(sendHandler) {
+        this.sendHandler = sendHandler;
+    }
+    /**
+     * The patching wrapper for one static method.
+     */
+    wrap(method) {
+        const wrapped = this.wrappers.get(method) ?? this.wrapMethod(method);
+        this.wrappers.set(method, wrapped);
+        return wrapped;
+    }
+    /**
+     * A Proxy rather than a plain function keeps the method's own identity
+     * surface, such as its name, length and any properties hung off it.
+     */
+    wrapMethod(method) {
+        const sendHandler = this.sendHandler;
+        return new Proxy(method, {
+            apply(target, thisArgument, callArguments) {
+                const result = Reflect.apply(target, thisArgument, callArguments);
+                if (isUnpatchedClient(result)) {
+                    installSendPatch(result, sendHandler);
+                }
+                return result;
+            },
+        });
+    }
+}
+/**
+ * Whether a static method's return value is a client still to be patched.
+ *
+ * A factory building through the intercepted class itself has already been
+ * patched by the construct trap, so patching again is skipped rather than
+ * rejected as a double interception.
+ */
+function isUnpatchedClient(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    if (typeof value.send !== "function") {
+        return false;
+    }
+    return !hasSendPatch(value);
+}

package/dist/sdk/send-patch.d.ts

@@ -29,3 +29,11 @@ export interface SimSdkSendPatch {
  * inherited send resolves again.
  */
 export declare function installSendPatch(target: object, handler: SimSdkSendHandler): SimSdkSendPatch;
+/**
+ * Whether a simulated send patch is currently installed on a target.
+ *
+ * Only an own patched send counts, which is the property installSendPatch
+ * writes, so an instance inheriting a patched send from a patched prototype
+ * reports false.
+ */
+export declare function hasSendPatch(target: object): boolean;

package/dist/sdk/send-patch.js

@@ -50,6 +50,17 @@ export function installSendPatch(target, handler) {
         },
     };
 }
+/**
+ * Whether a simulated send patch is currently installed on a target.
+ *
+ * Only an own patched send counts, which is the property installSendPatch
+ * writes, so an instance inheriting a patched send from a patched prototype
+ * reports false.
+ */
+export function hasSendPatch(target) {
+    const send = Object.getOwnPropertyDescriptor(target, "send")?.value;
+    return typeof send === "function" && installedSends.has(send);
+}
 /**
  * Name a patch target for diagnostics: the client's class name for instances
  * and prototypes alike, when it has one.

package/dist/service/aws/caller/sim-aws-ambient-caller.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsPrincipal } from "./sim-aws-caller.js";
+import { type SimAwsRunAsOwner } from "./sim-aws-run-as-context.js";
+/**
+ * Where a call that names no caller of its own looks for one first.
+ *
+ * A `SimAws.runAs` block is what sets an ambient caller today. Asking through
+ * this interface keeps the resolver clear of Node.js asynchronous context
+ * tracking, and leaves room for the other thing that will set one, a simulated
+ * Lambda invocation running under an execution role.
+ */
+export interface SimAwsAmbientCaller {
+    /**
+     * The caller ambient where the call is being made, if there is one.
+     */
+    currentCaller(): SimAwsPrincipal | undefined;
+}
+/**
+ * The ambient caller of the `runAs` block one simulation is inside.
+ *
+ * Only that simulation's own runs count. Each SimAws instance is its own
+ * simulated universe, so a `runAs` on one never decides what another observes.
+ */
+export declare function simAwsRunAsAmbientCaller(owner: SimAwsRunAsOwner): SimAwsAmbientCaller;

package/dist/service/aws/caller/sim-aws-ambient-caller.js

@@ -0,0 +1,12 @@
+import { simAwsRunAsContext, } from "./sim-aws-run-as-context.js";
+/**
+ * The ambient caller of the `runAs` block one simulation is inside.
+ *
+ * Only that simulation's own runs count. Each SimAws instance is its own
+ * simulated universe, so a `runAs` on one never decides what another observes.
+ */
+export function simAwsRunAsAmbientCaller(owner) {
+    return {
+        currentCaller: () => simAwsRunAsContext.currentCaller(owner),
+    };
+}

package/dist/service/aws/caller/sim-aws-caller-resolver.d.ts

@@ -1,4 +1,5 @@
-import type { SimAwsCaller, SimAwsPrincipal, SimCredentialCaller } from "./sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "./sim-aws-ambient-caller.js";
+import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal, SimCredentialCaller } from "./sim-aws-caller.js";
 import type { SimIamCredentialIdentity } from "../../iam/credential/sim-aws-credentials.js";
 export interface SimAwsCredentialIdentityResolver {
     resolveCredentials(credentials: SimCredentialCaller["credentials"], now?: Date): SimIamCredentialIdentity;
@@ -17,19 +18,51 @@ export interface SimAwsResolvedCaller {
     readonly accountId?: string | undefined;
     readonly service?: string | undefined;
 }
+/**
+ * What resolving a caller needs beyond the caller itself.
+ */
+export interface SimAwsCallerResolverProperties {
+    /**
+     * Authenticates a caller that presents credentials.
+     */
+    readonly credentialIdentityResolver?: SimAwsCredentialIdentityResolver | undefined;
+    /**
+     * The caller a request naming none of its own is attributed to.
+     *
+     * A simulation sets this to say who its unattributed calls come from. It is
+     * consulted ahead of the operation default. A simulation that names no
+     * default caller keeps the Account root fallback.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     *
+     * A `runAs` block says who is making the calls inside it, which is more
+     * specific than what a simulation holds for its unattributed calls
+     * generally, so it is consulted first.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
+}
 /**
  * Resolves caller input at a simulated AWS operation boundary.
  *
- * An omitted caller resolves to the supplied operation default. Explicit
- * anonymity is preserved. Credential callers are authenticated before a
- * resolved caller is returned, and a caller already resolved elsewhere is
- * taken as it stands.
+ * An omitted caller resolves to the ambient caller of the `runAs` block the
+ * call is inside, then to the simulation's default caller, and to the supplied
+ * operation default where there is neither. Explicit anonymity is preserved.
+ * Credential callers are authenticated before a resolved caller is returned,
+ * and a caller already resolved elsewhere is taken as it stands.
  */
 export declare class SimAwsCallerResolver {
     private readonly credentialIdentityResolver?;
-    constructor(credentialIdentityResolver?: SimAwsCredentialIdentityResolver);
+    private readonly defaultCaller?;
+    private readonly ambientCaller?;
+    constructor(properties?: SimAwsCallerResolverProperties);
     /**
      * Resolve and normalize a simulated AWS caller.
+     *
+     * The request's own caller is used where it has one. A request without one
+     * falls back to the ambient `runAs` caller, then to the simulation's default
+     * caller, and then to the operation default the call site supplies.
      */
     resolve(caller: SimAwsCaller | undefined, defaultPrincipal: SimAwsPrincipal): SimAwsResolvedCaller;
     private normalized;

package/dist/service/aws/caller/sim-aws-caller-resolver.js

@@ -2,54 +2,56 @@ import { assertDefined } from "../../../util/type-guard/defined.js";
 /**
  * Resolves caller input at a simulated AWS operation boundary.
  *
- * An omitted caller resolves to the supplied operation default. Explicit
- * anonymity is preserved. Credential callers are authenticated before a
- * resolved caller is returned, and a caller already resolved elsewhere is
- * taken as it stands.
+ * An omitted caller resolves to the ambient caller of the `runAs` block the
+ * call is inside, then to the simulation's default caller, and to the supplied
+ * operation default where there is neither. Explicit anonymity is preserved.
+ * Credential callers are authenticated before a resolved caller is returned,
+ * and a caller already resolved elsewhere is taken as it stands.
  */
 export class SimAwsCallerResolver {
     credentialIdentityResolver;
-    constructor(credentialIdentityResolver) {
-        this.credentialIdentityResolver = credentialIdentityResolver;
+    defaultCaller;
+    ambientCaller;
+    constructor(properties = {}) {
+        this.credentialIdentityResolver = properties.credentialIdentityResolver;
+        this.defaultCaller = properties.defaultCaller;
+        this.ambientCaller = properties.ambientCaller;
     }
     /**
      * Resolve and normalize a simulated AWS caller.
+     *
+     * The request's own caller is used where it has one. A request without one
+     * falls back to the ambient `runAs` caller, then to the simulation's default
+     * caller, and then to the operation default the call site supplies.
      */
     resolve(caller, defaultPrincipal) {
-        if (caller?.kind === "resolved") {
-            return this.normalized(caller.principal, caller.identityPolicyPrincipal);
+        const stated = caller ?? this.ambientCaller?.currentCaller() ?? this.defaultCaller;
+        if (stated?.kind === "resolved") {
+            return this.normalized(stated.principal, stated.identityPolicyPrincipal);
         }
-        if (caller?.kind === "credentials") {
+        if (stated?.kind === "credentials") {
             assertDefined(this.credentialIdentityResolver, "Simulated credential callers require an IAM credential resolver");
-            const identity = this.credentialIdentityResolver.resolveCredentials(caller.credentials);
+            const identity = this.credentialIdentityResolver.resolveCredentials(stated.credentials);
             return this.normalized(identity.principal, identity.identityPolicyPrincipal);
         }
-        const principal = caller ?? defaultPrincipal;
+        const principal = stated ?? defaultPrincipal;
         return this.normalized(principal, principal);
     }
     normalized(principal, identityPolicyPrincipal) {
-        if (principal.kind === "arn") {
-            const identityPolicyArn = identityPolicyPrincipal.kind === "arn"
-                ? identityPolicyPrincipal.arn
-                : undefined;
-            return {
-                principal,
-                identityPolicyPrincipal,
-                arn: principal.arn,
-                identityPolicyArn,
-                accountId: this.accountId(principal.arn),
-            };
-        }
+        const both = { principal, identityPolicyPrincipal };
         if (principal.kind === "service") {
-            return {
-                principal,
-                identityPolicyPrincipal,
-                service: principal.service,
-            };
+            return { ...both, service: principal.service };
+        }
+        if (principal.kind !== "arn") {
+            return both;
         }
         return {
-            principal,
-            identityPolicyPrincipal,
+            ...both,
+            arn: principal.arn,
+            identityPolicyArn: identityPolicyPrincipal.kind === "arn"
+                ? identityPolicyPrincipal.arn
+                : undefined,
+            accountId: this.accountId(principal.arn),
         };
     }
     /**

package/dist/service/aws/caller/sim-aws-caller.d.ts

@@ -52,3 +52,12 @@ export interface SimResolvedCaller {
  * Caller accepted by simulated AWS service operations.
  */
 export type SimAwsCaller = SimAwsPrincipal | SimCredentialCaller | SimResolvedCaller;
+/**
+ * Caller a simulation attributes a request that names none of its own to.
+ *
+ * A principal, or a caller something else has already resolved. Credentials
+ * are left out because the Account that issued a key is the only thing able to
+ * authenticate it, while a default is held for a whole simulation. A key from
+ * one Account would fail wherever another Account decided the request.
+ */
+export type SimAwsDefaultCaller = SimAwsPrincipal | SimResolvedCaller;

package/dist/service/aws/caller/sim-aws-resolved-caller.d.ts

@@ -0,0 +1,19 @@
+import type { SimAwsPrincipal, SimResolvedCaller } from "./sim-aws-caller.js";
+import { type SimAwsResolvedCaller } from "./sim-aws-caller-resolver.js";
+/**
+ * State an already-resolved caller as the caller of another request.
+ *
+ * A resolver answers with a SimAwsResolvedCaller, and a service that goes on
+ * to ask IAM about the same caller has to pass one back in. Both principals
+ * travel together, so an assumed-role session keeps the Role its policies come
+ * from instead of arriving as a session ARN that owns none.
+ */
+export declare function simAwsCallerFor(caller: SimAwsResolvedCaller): SimResolvedCaller;
+/**
+ * Resolve a principal that needs nothing authenticated.
+ *
+ * A service principal, or an ARN something else has already established, is
+ * its own answer. This is the short way to the SimAwsResolvedCaller that an
+ * authorization boundary asks for.
+ */
+export declare function simAwsResolvedCallerOf(principal: SimAwsPrincipal): SimAwsResolvedCaller;

package/dist/service/aws/caller/sim-aws-resolved-caller.js

@@ -0,0 +1,26 @@
+import { SimAwsCallerResolver, } from "./sim-aws-caller-resolver.js";
+/**
+ * State an already-resolved caller as the caller of another request.
+ *
+ * A resolver answers with a SimAwsResolvedCaller, and a service that goes on
+ * to ask IAM about the same caller has to pass one back in. Both principals
+ * travel together, so an assumed-role session keeps the Role its policies come
+ * from instead of arriving as a session ARN that owns none.
+ */
+export function simAwsCallerFor(caller) {
+    return {
+        kind: "resolved",
+        principal: caller.principal,
+        identityPolicyPrincipal: caller.identityPolicyPrincipal,
+    };
+}
+/**
+ * Resolve a principal that needs nothing authenticated.
+ *
+ * A service principal, or an ARN something else has already established, is
+ * its own answer. This is the short way to the SimAwsResolvedCaller that an
+ * authorization boundary asks for.
+ */
+export function simAwsResolvedCallerOf(principal) {
+    return new SimAwsCallerResolver().resolve(principal, principal);
+}

package/dist/service/aws/factory/sim-aws-account-region-service-builder.d.ts

@@ -1,6 +1,8 @@
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
+import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../caller/sim-aws-ambient-caller.js";
 import { SimCloudFormation } from "../../cloudformation/index.js";
 import { SimCloudWatch } from "../../cloudwatch/index.js";
 import { SimCognitoIdentityProvider } from "../../cognito/index.js";
@@ -30,6 +32,14 @@ interface SimAwsAccountRegionServiceBuilderProperties {
     readonly lambdaUrlRegistry: SimLambdaUrlRegistry;
     readonly accountServices: SimAwsAccountServiceCache;
     readonly messageLog: SimAwsMessageLog;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * Builder for simulated AWS services scoped to one Account and Region.
@@ -61,6 +71,8 @@ export declare class SimAwsAccountRegionServiceBuilder {
     private readonly lambdaUrlRegistry;
     private readonly accountServices;
     private readonly messageLog;
+    private readonly defaultCaller?;
+    private readonly ambientCaller?;
     constructor(properties: SimAwsAccountRegionServiceBuilderProperties);
     /** Create simulated ACM for an Account Region scope. */
     /** Create simulated CloudFormation for an Account Region scope. */

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js

@@ -55,6 +55,8 @@ export class SimAwsAccountRegionServiceBuilder {
     lambdaUrlRegistry;
     accountServices;
     messageLog;
+    defaultCaller;
+    ambientCaller;
     constructor(properties) {
         this.simAws = properties.simAws;
         this.background = properties.background;
@@ -63,6 +65,8 @@ export class SimAwsAccountRegionServiceBuilder {
         this.lambdaUrlRegistry = properties.lambdaUrlRegistry;
         this.accountServices = properties.accountServices;
         this.messageLog = properties.messageLog;
+        this.defaultCaller = properties.defaultCaller;
+        this.ambientCaller = properties.ambientCaller;
     }
     /** Create simulated ACM for an Account Region scope. */
     /** Create simulated CloudFormation for an Account Region scope. */
@@ -269,6 +273,8 @@ export class SimAwsAccountRegionServiceBuilder {
             accountRegionScope: scope.accountRegionScope,
             background: this.background,
             iamResolver: this.iamRegistry,
+            defaultCaller: this.defaultCaller,
+            ambientCaller: this.ambientCaller,
         });
     }
     /**

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts

@@ -1,6 +1,8 @@
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
+import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../caller/sim-aws-ambient-caller.js";
 import type { SimAcmRegistry } from "../../acm/registry/sim-acm-registry.js";
 import type { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-front-registry.js";
 import { SimCloudFront } from "../../cloudfront/sim-cloudfront.js";
@@ -25,6 +27,14 @@ interface SimAwsAccountServiceCacheProperties {
     readonly iamRegistry: SimIamRegistry;
     readonly accessKeyRegistry: SimIamAccessKeyRegistry;
     readonly scpResolver: SimIamServiceControlPolicyResolver;
+    /**
+     * The caller this simulation attributes a request naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * Account-level cache for simulated AWS service instances.
@@ -55,6 +65,8 @@ export declare class SimAwsAccountServiceCache {
     private readonly iamRegistry;
     private readonly accessKeyRegistry;
     private readonly scpResolver;
+    private readonly defaultCaller?;
+    private readonly ambientCaller?;
     private readonly route53Registry;
     private readonly kmsRegistry;
     private readonly serviceHosts;

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -38,6 +38,8 @@ export class SimAwsAccountServiceCache {
     iamRegistry;
     accessKeyRegistry;
     scpResolver;
+    defaultCaller;
+    ambientCaller;
     route53Registry;
     kmsRegistry;
     serviceHosts;
@@ -57,6 +59,8 @@ export class SimAwsAccountServiceCache {
         this.cloudFrontRegistry = properties.cloudFrontRegistry;
         this.iamRegistry = properties.iamRegistry;
         this.scpResolver = properties.scpResolver;
+        this.defaultCaller = properties.defaultCaller;
+        this.ambientCaller = properties.ambientCaller;
         this.accessKeyRegistry = properties.accessKeyRegistry;
         this.route53Registry = properties.route53Registry;
         this.kmsRegistry = properties.kmsRegistry;
@@ -114,6 +118,11 @@ export class SimAwsAccountServiceCache {
                 // What the Account's organization allows it to do is decided outside
                 // the Account, so IAM asks simulated Organizations about it.
                 scpResolver: this.scpResolver,
+                // Who a request naming no caller comes from is decided for the
+                // whole simulation. Every Account in it applies the same default,
+                // and answers to the same run-as block ahead of it.
+                defaultCaller: this.defaultCaller,
+                ambientCaller: this.ambientCaller,
                 // Access keys are indexed simulation-wide as they are issued, so a
                 // signed request naming only a key id can be traced to this Account.
                 credentialRegistry: new SimIamCredentialRegistry({

package/dist/service/aws/factory/sim-aws-registered-service-builder.js

@@ -82,8 +82,10 @@ export class SimAwsRegisteredServiceBuilder {
      * nothing but that URI, and the function need not be in this scope.
      */
     createEcr(scope) {
+        const { accountRegionScope, iam } = this.scoped(scope);
         return new SimEcr({
-            accountRegionScope: scope.accountRegionScope,
+            accountRegionScope,
+            iam,
             registry: this.registries.ecr,
         });
     }

package/dist/service/aws/factory/sim-aws-service-factory.d.ts

@@ -1,6 +1,7 @@
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
+import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
 import type { SimAcm } from "../../acm/sim-acm.js";
 import type { SimApiGateway } from "../../apigateway/index.js";
 import type { SimApiGatewayV2 } from "../../apigatewayv2/index.js";
@@ -45,6 +46,10 @@ import { SimAwsMessageLog } from "../message/sim-aws-message-log.js";
 interface SimAwsServiceFactoryProperties {
     readonly simAws: SimAws;
     readonly background: BackgroundScheduler & BackgroundCompleter;
+    /**
+     * The caller this simulation attributes a call naming none to.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller | undefined;
 }
 /**
  * Factory for simulated AWS services used by one SimAws instance.