@kensio/yulin 1.21.24 → 1.21.26

package/dist/index.d.ts

@@ -7,5 +7,6 @@ export { type SimClock, SimFixedClock, SimRealClock, } from "./util/clock/sim-cl
 export { SimControllableClock } from "./util/clock/sim-controllable-clock.js";
 export { SimClockControl } from "./util/clock/sim-clock-control.js";
 export { SimTokenBucket } from "./util/throttle/sim-token-bucket.js";
+export { SimHostRandom, type SimRandom, SimSeededRandom, } from "./util/random/sim-random.js";
 export { SimDuration, type SimDurationInput, SimInvalidDuration, } from "./util/clock/sim-duration.js";
 export { SimAwsTimeNotControllable } from "./service/aws/sim-aws-timekeeping.js";

package/dist/index.js

@@ -4,5 +4,6 @@ export { SimFixedClock, SimRealClock, } from "./util/clock/sim-clock.js";
 export { SimControllableClock } from "./util/clock/sim-controllable-clock.js";
 export { SimClockControl } from "./util/clock/sim-clock-control.js";
 export { SimTokenBucket } from "./util/throttle/sim-token-bucket.js";
+export { SimHostRandom, SimSeededRandom, } from "./util/random/sim-random.js";
 export { SimDuration, SimInvalidDuration, } from "./util/clock/sim-duration.js";
 export { SimAwsTimeNotControllable } from "./service/aws/sim-aws-timekeeping.js";

package/dist/sdk/error/sim-sdk.error.d.ts

@@ -1,3 +1,4 @@
+import type { SimResponseMetadata } from "../../service/aws/metadata/response-metadata.type.js";
 /**
  * Base class for simulated AWS SDK errors.
  */
@@ -44,6 +45,23 @@ export declare class SimSdkAlreadyInterceptedError extends SimSdkError {
 export declare class SimSdkCallbackNotSupportedError extends SimSdkError {
     readonly name = "SimSdkCallbackNotSupportedError";
 }
+/**
+ * An intercepted SDK send was aborted through its `abortSignal` option.
+ *
+ * This reproduces the error the SDK's own HTTP handler throws, so it extends
+ * Error directly and is named `AbortError`, as code catching an aborted send
+ * expects. A signal's Error reason becomes the cause, and any other reason
+ * becomes the message.
+ */
+export declare class SimSdkAbortError extends Error {
+    readonly name = "AbortError";
+    readonly $metadata: SimResponseMetadata;
+    /**
+     * Build the error for a signal that fired with a reason, mirroring
+     * `buildAbortError` in `@smithy/node-http-handler`.
+     */
+    static fromReason(reason: unknown): SimSdkAbortError;
+}
 /**
  * A serialized AWS API request cannot be routed into the simulation.
  *

package/dist/sdk/error/sim-sdk.error.js

@@ -44,6 +44,47 @@ export class SimSdkAlreadyInterceptedError extends SimSdkError {
 export class SimSdkCallbackNotSupportedError extends SimSdkError {
     name = "SimSdkCallbackNotSupportedError";
 }
+/**
+ * An intercepted SDK send was aborted through its `abortSignal` option.
+ *
+ * This reproduces the error the SDK's own HTTP handler throws, so it extends
+ * Error directly and is named `AbortError`, as code catching an aborted send
+ * expects. A signal's Error reason becomes the cause, and any other reason
+ * becomes the message.
+ */
+export class SimSdkAbortError extends Error {
+    name = "AbortError";
+    $metadata = {
+        attempts: 1,
+        totalRetryDelay: 0,
+    };
+    /**
+     * Build the error for a signal that fired with a reason, mirroring
+     * `buildAbortError` in `@smithy/node-http-handler`.
+     */
+    static fromReason(reason) {
+        if (reason instanceof Error) {
+            return new SimSdkAbortError("Request aborted", { cause: reason });
+        }
+        if (isFalsy(reason)) {
+            return new SimSdkAbortError("Request aborted");
+        }
+        // oxlint-disable-next-line typescript/no-base-to-string -- the SDK stringifies any other reason as it is, so this matches whatever it prints.
+        return new SimSdkAbortError(String(reason));
+    }
+}
+/**
+ * Whether an abort reason is falsy, which the SDK treats as no reason.
+ */
+function isFalsy(reason) {
+    return (reason === undefined ||
+        reason === null ||
+        reason === false ||
+        reason === "" ||
+        reason === 0 ||
+        reason === 0n ||
+        Number.isNaN(reason));
+}
 /**
  * A serialized AWS API request cannot be routed into the simulation.
  *

package/dist/sdk/index.d.ts

@@ -7,4 +7,4 @@ export type { SimSdkCallerOptions } from "./router/sim-sdk-caller-options.js";
 export { simSdkEventStream, type SimSdkEventStream, } from "./stream/sim-sdk-event-stream.js";
 export { simSdkStreamBody } from "./stream/sim-sdk-stream-body.js";
 export type { SimSdkStreamBody, SimSdkStreamBodyMethods, } from "./stream/sim-sdk-stream-body.js";
-export { SimSdkError, SimSdkAlreadyInterceptedError, SimSdkCallbackNotSupportedError, SimSdkCommandNotInterceptedError, SimSdkInvalidClientError, SimSdkStreamAlreadyConsumedError, SimSdkUnbridgedWireRequestError, SimSdkUnknownServiceError, SimSdkUnsupportedCommandError, } from "./error/sim-sdk.error.js";
+export { SimSdkError, SimSdkAbortError, SimSdkAlreadyInterceptedError, SimSdkCallbackNotSupportedError, SimSdkCommandNotInterceptedError, SimSdkInvalidClientError, SimSdkStreamAlreadyConsumedError, SimSdkUnbridgedWireRequestError, SimSdkUnknownServiceError, SimSdkUnsupportedCommandError, } from "./error/sim-sdk.error.js";

package/dist/sdk/index.js

@@ -3,4 +3,4 @@ export { SimSdkInterception } from "./sim-sdk-interception.js";
 export { simSdkCallerOptions } from "./router/sim-sdk-caller-options.js";
 export { simSdkEventStream, } from "./stream/sim-sdk-event-stream.js";
 export { simSdkStreamBody } from "./stream/sim-sdk-stream-body.js";
-export { SimSdkError, SimSdkAlreadyInterceptedError, SimSdkCallbackNotSupportedError, SimSdkCommandNotInterceptedError, SimSdkInvalidClientError, SimSdkStreamAlreadyConsumedError, SimSdkUnbridgedWireRequestError, SimSdkUnknownServiceError, SimSdkUnsupportedCommandError, } from "./error/sim-sdk.error.js";
+export { SimSdkError, SimSdkAbortError, SimSdkAlreadyInterceptedError, SimSdkCallbackNotSupportedError, SimSdkCommandNotInterceptedError, SimSdkInvalidClientError, SimSdkStreamAlreadyConsumedError, SimSdkUnbridgedWireRequestError, SimSdkUnknownServiceError, SimSdkUnsupportedCommandError, } from "./error/sim-sdk.error.js";

package/dist/sdk/send-abort.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The abort signal given to one intercepted SDK send, if any.
+ *
+ * The real SDK checks the signal in its HTTP handler. A signal aborted before
+ * the request goes out rejects the send, and one that fires while the request
+ * is pending rejects it then. Either way the send rejects with an AbortError.
+ *
+ * A real request spends at least one turn of the host's timers on the network,
+ * so `AbortSignal.timeout(0)` created for a send aborts it. A simulated
+ * operation can settle within microtasks, so a send carrying a signal waits
+ * one host timer turn before it is dispatched.
+ *
+ * The simulated operation is not cancelled. Once dispatched, it carries on, as
+ * a request already received by AWS does.
+ */
+export declare class SimSdkSendAbort {
+    private readonly signal;
+    private constructor();
+    /**
+     * Read the abort signal from the arguments given to send after the Command.
+     */
+    static fromSendArguments(rest: readonly unknown[]): SimSdkSendAbort;
+    /**
+     * Run a simulated operation unless the signal has already fired, rejecting
+     * with an AbortError if it fires before the operation settles.
+     */
+    run(operation: () => Promise<unknown>): Promise<unknown>;
+}

package/dist/sdk/send-abort.js

@@ -0,0 +1,112 @@
+import { setTimeout } from "node:timers";
+import { SimSdkAbortError } from "./error/sim-sdk.error.js";
+/**
+ * The abort signal given to one intercepted SDK send, if any.
+ *
+ * The real SDK checks the signal in its HTTP handler. A signal aborted before
+ * the request goes out rejects the send, and one that fires while the request
+ * is pending rejects it then. Either way the send rejects with an AbortError.
+ *
+ * A real request spends at least one turn of the host's timers on the network,
+ * so `AbortSignal.timeout(0)` created for a send aborts it. A simulated
+ * operation can settle within microtasks, so a send carrying a signal waits
+ * one host timer turn before it is dispatched.
+ *
+ * The simulated operation is not cancelled. Once dispatched, it carries on, as
+ * a request already received by AWS does.
+ */
+export class SimSdkSendAbort {
+    signal;
+    constructor(signal) {
+        this.signal = signal;
+    }
+    /**
+     * Read the abort signal from the arguments given to send after the Command.
+     */
+    static fromSendArguments(rest) {
+        const options = rest[0];
+        if (typeof options !== "object" || options === null) {
+            return new SimSdkSendAbort(undefined);
+        }
+        const signal = options.abortSignal;
+        if (!isAbortSignal(signal)) {
+            return new SimSdkSendAbort(undefined);
+        }
+        return new SimSdkSendAbort(signal);
+    }
+    /**
+     * Run a simulated operation unless the signal has already fired, rejecting
+     * with an AbortError if it fires before the operation settles.
+     */
+    async run(operation) {
+        const signal = this.signal;
+        if (signal === undefined) {
+            return await operation();
+        }
+        if (signal.aborted) {
+            throw SimSdkAbortError.fromReason(signal.reason);
+        }
+        const abort = Promise.withResolvers();
+        const unsubscribe = subscribe(signal, () => {
+            abort.reject(SimSdkAbortError.fromReason(signal.reason));
+        });
+        try {
+            return await Promise.race([
+                dispatchAfterRoundTrip(signal, operation),
+                abort.promise,
+            ]);
+        }
+        finally {
+            unsubscribe();
+        }
+    }
+}
+/**
+ * Dispatch a simulated operation after one turn of the host's timers, unless
+ * the signal fires first.
+ *
+ * Node runs timers of the same delay in the order they were set, so a signal
+ * set to time out after 0 or 1 milliseconds before the send fires before this
+ * turn ends.
+ */
+async function dispatchAfterRoundTrip(signal, operation) {
+    await new Promise((resolve) => {
+        setTimeout(resolve, 0);
+    });
+    if (signal.aborted) {
+        throw SimSdkAbortError.fromReason(signal.reason);
+    }
+    return await operation();
+}
+/**
+ * Whether a send option is usable as an abort signal.
+ */
+function isAbortSignal(signal) {
+    return (typeof signal === "object" &&
+        signal !== null &&
+        typeof signal.aborted === "boolean");
+}
+/**
+ * Listen for a signal firing, the way the SDK's HTTP handler does: through
+ * addEventListener where the signal has it, and through onabort otherwise.
+ *
+ * Returns the function that stops listening.
+ */
+function subscribe(signal, listener) {
+    if (typeof signal.addEventListener === "function" &&
+        typeof signal.removeEventListener === "function") {
+        signal.addEventListener("abort", listener);
+        return () => {
+            signal.removeEventListener?.("abort", listener);
+        };
+    }
+    // The older Smithy signal offers no addEventListener, so onabort is the only
+    // way to listen, and the previous handler is put back afterwards.
+    const previous = signal.onabort ?? null;
+    // oxlint-disable-next-line unicorn-js/prefer-add-event-listener -- this signal has no addEventListener to prefer.
+    signal.onabort = listener;
+    return () => {
+        // oxlint-disable-next-line unicorn-js/prefer-add-event-listener -- this signal has no addEventListener to prefer.
+        signal.onabort = previous;
+    };
+}

package/dist/sdk/send-patch.js

@@ -1,4 +1,5 @@
 import { SimSdkAlreadyInterceptedError, SimSdkCallbackNotSupportedError, } from "./error/sim-sdk.error.js";
+import { SimSdkSendAbort } from "./send-abort.js";
 /**
  * All send functions installed by simulated SDK interception, so a second
  * interception of an already-intercepted target can be rejected, including
@@ -26,8 +27,9 @@ export function installSendPatch(target, handler) {
             throw new SimSdkCallbackNotSupportedError("Simulated SDK interception does not support callback-style send; " +
                 "use the promise form instead");
         }
+        return await SimSdkSendAbort.fromSendArguments(rest).run(
         // oxlint-disable-next-line unicorn-js/no-this-outside-of-class -- this is the client instance send was called on, which the handler needs for per-send config resolution.
-        return await handler(command, this);
+        async () => await handler(command, this));
     };
     installedSends.add(patched);
     Object.defineProperty(target, "send", {

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js

@@ -250,6 +250,7 @@ export class SimAwsAccountRegionServiceBuilder {
         return new SimScheduler({
             ...this.scoped(scope),
             deliveryTargets: simAwsSchedulerDeliveryTargets(this.simAws),
+            random: this.simAws.random,
         });
     }
     /**

package/dist/service/aws/sim-aws-properties.d.ts

@@ -1,5 +1,6 @@
 import type { BackgroundCompleter, BackgroundScheduler } from "../../util/background/background.js";
 import type { SimClock } from "../../util/clock/sim-clock.js";
+import type { SimRandom } from "../../util/random/sim-random.js";
 import type { SimIamSigV4ExpectedScope } from "../iam/sigv4/sim-iam-sigv4-expected-scope.js";
 import type { SimAwsAccountId } from "./sim-aws-account.js";
 import type { SimAwsDefaultCaller } from "./caller/sim-aws-caller.js";
@@ -52,4 +53,11 @@ export interface SimAwsProperties {
      * its own clock and time control is refused.
      */
     readonly clock?: SimClock;
+    /**
+     * Where this simulation draws the values AWS leaves to chance, such as the
+     * moment a Scheduler flexible time window invokes its target. It defaults to
+     * the host's `Math.random`. Pass a `SimSeededRandom` to make those values
+     * repeatable from run to run.
+     */
+    readonly random?: SimRandom;
 }

package/dist/service/aws/sim-aws.d.ts

@@ -10,6 +10,7 @@ import type { SimClockControl } from "../../util/clock/sim-clock-control.js";
 import type { SimAwsProperties, SimAwsRequestCallerOptions } from "./sim-aws-properties.js";
 import type { SimIamCredentialIdentity } from "../iam/credential/sim-aws-credentials.js";
 import type { SimAwsRequestCaller } from "../iam/request/sim-aws-request-caller.js";
+import { type SimRandom } from "../../util/random/sim-random.js";
 import { type SimCloseOnSignalOptions } from "../../util/process/close-on-signal.js";
 /**
  * Top-level container for simulated AWS.
@@ -32,6 +33,10 @@ export declare class SimAws extends SimAwsServiceAccessors {
      * Sim IAM registry for this sim AWS instance.
      */
     readonly iamRegistry: SimIamRegistry;
+    /**
+     * Where this simulation draws the values AWS leaves to chance.
+     */
+    readonly random: SimRandom;
     private readonly background;
     private readonly scopes;
     private readonly timekeeping;

package/dist/service/aws/sim-aws.js

@@ -6,6 +6,7 @@ import { SimAwsServiceAccessors } from "./sim-aws-service-accessors.js";
 import { simAwsRunAsContext } from "./caller/sim-aws-run-as-context.js";
 import { SimAwsTimekeeping } from "./sim-aws-timekeeping.js";
 import { SimAwsRequestAuthentication } from "./sim-aws-request-authentication.js";
+import { SimHostRandom } from "../../util/random/sim-random.js";
 import { closeOnSignal, } from "../../util/process/close-on-signal.js";
 /**
  * Top-level container for simulated AWS.
@@ -28,13 +29,17 @@ export class SimAws extends SimAwsServiceAccessors {
      * Sim IAM registry for this sim AWS instance.
      */
     iamRegistry;
+    /**
+     * Where this simulation draws the values AWS leaves to chance.
+     */
+    random;
     background;
     scopes;
     timekeeping;
     requestAuthentication;
     constructor(properties = {}) {
         super();
-        const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, defaultCaller, background: suppliedBackground, } = properties;
+        const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, defaultCaller, background: suppliedBackground, random = new SimHostRandom(), } = properties;
         const timekeeping = new SimAwsTimekeeping({
             clock,
             background: suppliedBackground,
@@ -44,6 +49,7 @@ export class SimAws extends SimAwsServiceAccessors {
         this.defaultRegionName = defaultRegionName;
         this.timekeeping = timekeeping;
         this.background = background;
+        this.random = random;
         this.serviceFactory = new SimAwsServiceFactory({
             simAws: this,
             background,

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.d.ts

@@ -12,7 +12,8 @@ interface SimDynamoDbAuthorizerProperties {
  *
  * AWS maps each DynamoDB API operation to the `dynamodb:` action of the same
  * name, and the resource is the ARN of the table the operation names. ListTables
- * is the exception: it names no table, so it authorizes against `*`.
+ * is the exception: it names no table, so it authorizes against `*`. A Query or
+ * Scan naming an `IndexName` authorizes against the index's own ARN.
  */
 export declare class SimDynamoDbAuthorizer {
     private readonly iam;
@@ -29,6 +30,23 @@ export declare class SimDynamoDbAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
+     *
+     * A request reaching one of the table's indexes is authorized against the
+     * index's ARN. The service authorization reference for DynamoDB gives Query and Scan two
+     * resource types, `table` and `index`. The `index` ARN is the table's with
+     * `/index/<name>` after it. The developer guide's fine-grained access control
+     * page grants index queries on that ARN (its examples 5 and 6). A read naming
+     * an index is authorized against the index ARN alone. A statement naming only
+     * the table refuses it, and one naming only an index does not reach the
+     * table. CDK's `grantReadData` adds `<table ARN>/index/*` only for a table it
+     * knows has indexes, and a grant on a table imported by name covers none.
+     *
+     * The reference also lists `index` for PartiQLSelect, SearchVectors and the
+     * contributor insights actions, none of which are simulated. DescribeTable
+     * and the item actions take `table` only.
+     *
+     * The condition keys are the ones the action supplies on the table, with
+     * the partition key values read through the index's own key schema.
      */
     authorizeTable(action: string, tableName: string, caller?: SimAwsCaller, reached?: SimDynamoDbReached): SimAwsResolvedCaller;
     /**

package/dist/service/dynamodb/command/authorize/sim-dynamodb-authorizer.js

@@ -1,12 +1,13 @@
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
-import { simDynamoDbTableArn } from "../../table/sim-dynamodb-table-arn.js";
+import { simDynamoDbReadArn } from "../../table/sim-dynamodb-table-arn.js";
 import { simDynamoDbConditionContextOf } from "./sim-dynamodb-reached.js";
 /**
  * Applies simulated IAM authorization to DynamoDB requests.
  *
  * AWS maps each DynamoDB API operation to the `dynamodb:` action of the same
  * name, and the resource is the ARN of the table the operation names. ListTables
- * is the exception: it names no table, so it authorizes against `*`.
+ * is the exception: it names no table, so it authorizes against `*`. A Query or
+ * Scan naming an `IndexName` authorizes against the index's own ARN.
  */
 export class SimDynamoDbAuthorizer {
     iam;
@@ -26,9 +27,26 @@ export class SimDynamoDbAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit anonymous
      * caller.
+     *
+     * A request reaching one of the table's indexes is authorized against the
+     * index's ARN. The service authorization reference for DynamoDB gives Query and Scan two
+     * resource types, `table` and `index`. The `index` ARN is the table's with
+     * `/index/<name>` after it. The developer guide's fine-grained access control
+     * page grants index queries on that ARN (its examples 5 and 6). A read naming
+     * an index is authorized against the index ARN alone. A statement naming only
+     * the table refuses it, and one naming only an index does not reach the
+     * table. CDK's `grantReadData` adds `<table ARN>/index/*` only for a table it
+     * knows has indexes, and a grant on a table imported by name covers none.
+     *
+     * The reference also lists `index` for PartiQLSelect, SearchVectors and the
+     * contributor insights actions, none of which are simulated. DescribeTable
+     * and the item actions take `table` only.
+     *
+     * The condition keys are the ones the action supplies on the table, with
+     * the partition key values read through the index's own key schema.
      */
     authorizeTable(action, tableName, caller, reached = {}) {
-        return this.authorizeResource(action, simDynamoDbTableArn(this.accountRegionScope, tableName), caller, reached);
+        return this.authorizeResource(action, simDynamoDbReadArn(this.accountRegionScope, tableName, reached.indexName), caller, reached);
     }
     /**
      * Ensure the caller may perform an action on a table's stream.

package/dist/service/dynamodb/command/authorize/sim-dynamodb-reached.d.ts

@@ -1,11 +1,14 @@
 /**
  * What one request reaches in the table it names.
  *
- * Each entry becomes a DynamoDB condition key. A request reaching nothing
- * under one of them leaves it out, as AWS leaves a key out for an operation
- * that reaches nothing it names.
+ * The partition key values and attribute names each become a DynamoDB
+ * condition key. A request reaching nothing under one of them leaves it out,
+ * as AWS leaves a key out for an operation that reaches nothing it names. The
+ * index name decides the resource authorized.
  */
 export interface SimDynamoDbReached {
+    /** The index the request reads, when it names one. */
+    readonly indexName?: string | undefined;
     /** The partition key values the request reaches. */
     readonly leadingKeys?: readonly string[] | undefined;
     /** The top-level attribute names the request names. */

package/dist/service/dynamodb/command/query/sim-dynamodb-query.js

@@ -33,11 +33,13 @@ export class SimDynamoDbQuery {
         const expressions = readSimDynamoDbQueryExpressions(input);
         // The one partition key the query reads is what authorization needs, and
         // reading it needs the view rather than the table, so it is read again
-        // here against whichever of the two the request names.
+        // here against whichever of the two the request names. A query naming an
+        // index is authorized against the index's own ARN.
         const table = this.access.required("dynamodb:Query", input.TableName, options?.caller, {
             leadingKeys: (reached) => simDynamoDbLeadingKeyOf(expressions.terms.forTable(reached.view(input.IndexName))
                 .partitionKeyValue),
             attributes: expressions.attributes,
+            indexName: input.IndexName,
         });
         // What is being read is settled here: the table, or one of its indexes. An
         // IndexName the table does not have is refused rather than read as the

package/dist/service/dynamodb/command/scan/sim-dynamodb-scan.js

@@ -37,9 +37,11 @@ export class SimDynamoDbScan {
         // input DynamoDB would refuse is refused whether or not the table is
         // there. A scan narrows nothing, so unlike a query its filter may name any
         // attribute, including a key attribute, and needs no key schema to check.
+        // A scan naming an index of either kind is authorized against the index's
+        // own ARN.
         const segment = readSimDynamoDbScanSegment(input);
         const expressions = readSimDynamoDbScanExpressions(input);
-        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes });
+        const table = this.access.required("dynamodb:Scan", input.TableName, options?.caller, { attributes: expressions.attributes, indexName: input.IndexName });
         // What is being read is settled here: the table, or one of its indexes.
         const view = table.view(input.IndexName);
         const scan = view.scan();

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.d.ts

@@ -8,10 +8,14 @@ import type { SimDynamoDbTable } from "../../table/sim-dynamodb-table.js";
  * The partition key values need the table to read them, so they arrive as a
  * function of it. The attribute names are read from the request's own
  * parameters before the table is reached, so they arrive as they are.
+ *
+ * A read naming one of the table's indexes carries the index name. The index
+ * is then the resource authorized.
  */
 export interface SimDynamoDbTableReach {
     readonly leadingKeys?: SimDynamoDbLeadingKeys | undefined;
     readonly attributes?: readonly string[] | undefined;
+    readonly indexName?: string | undefined;
 }
 /**
  * Resolve what a request reaches against the table it named.

package/dist/service/dynamodb/command/table/sim-dynamodb-table-reach.js

@@ -9,6 +9,7 @@
  */
 export function simDynamoDbReachedIn(reach, table) {
     return {
+        indexName: reach.indexName,
         leadingKeys: table === undefined ? undefined : leadingKeysIn(reach, table),
         attributes: reach.attributes,
     };

package/dist/service/dynamodb/table/sim-dynamodb-table-arn.d.ts

@@ -7,3 +7,16 @@ import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-
  * about to have, as real IAM does before the service handles the request.
  */
 export declare function simDynamoDbTableArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string): SimArn;
+/**
+ * The ARN an index of a table has in an Account and Region.
+ *
+ * It is the table's ARN with `/index/` and the index name after it, the form
+ * the service authorization reference gives the `index` resource type. Like
+ * the table, the index need not exist.
+ */
+export declare function simDynamoDbIndexArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string, indexName: string): SimArn;
+/**
+ * The ARN a read is authorized against: the table's, or the index's when the
+ * read names one.
+ */
+export declare function simDynamoDbReadArn(accountRegionScope: SimAwsAccountRegionScope, tableName: string, indexName: string | undefined): SimArn;

package/dist/service/dynamodb/table/sim-dynamodb-table-arn.js

@@ -7,3 +7,23 @@
 export function simDynamoDbTableArn(accountRegionScope, tableName) {
     return `arn:aws:dynamodb:${accountRegionScope.regionName}:${accountRegionScope.accountId}:table/${tableName}`;
 }
+/**
+ * The ARN an index of a table has in an Account and Region.
+ *
+ * It is the table's ARN with `/index/` and the index name after it, the form
+ * the service authorization reference gives the `index` resource type. Like
+ * the table, the index need not exist.
+ */
+export function simDynamoDbIndexArn(accountRegionScope, tableName, indexName) {
+    return `${simDynamoDbTableArn(accountRegionScope, tableName)}/index/${indexName}`;
+}
+/**
+ * The ARN a read is authorized against: the table's, or the index's when the
+ * read names one.
+ */
+export function simDynamoDbReadArn(accountRegionScope, tableName, indexName) {
+    if (indexName === undefined) {
+        return simDynamoDbTableArn(accountRegionScope, tableName);
+    }
+    return simDynamoDbIndexArn(accountRegionScope, tableName, indexName);
+}

package/dist/service/scheduler/cfn/sim-cfn-schedule-properties.d.ts

@@ -33,10 +33,6 @@ export declare class SimCfnScheduleProperties {
      * than refusing it for being the wrong type.
      */
     scheduleInput(): SimSchedulerScheduleInput;
-    /**
-     * The time window, which AWS requires on this Resource type.
-     */
-    private flexibleTimeWindow;
     /**
      * The schedule's target, which AWS requires on this Resource type.
      *

package/dist/service/scheduler/cfn/sim-cfn-schedule-properties.js

@@ -1,6 +1,7 @@
 import { isRecord } from "../../../util/type-guard/record.js";
 import { SimCfnGeneratedResourceName } from "../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
 import { schedulerScheduleResourceType, simCfnSchedulerResourceError, } from "./sim-cfn-scheduler-resource-error.js";
+import { cfnFlexibleTimeWindow } from "./sim-cfn-schedule-time-window.js";
 const maximumNameLength = 64;
 /**
  * Reads AWS::Scheduler::Schedule properties into the shape CreateSchedule
@@ -52,7 +53,7 @@ export class SimCfnScheduleProperties {
             GroupName: this.stringProperty("GroupName"),
             ScheduleExpression: this.stringProperty("ScheduleExpression"),
             ScheduleExpressionTimezone: this.stringProperty("ScheduleExpressionTimezone"),
-            FlexibleTimeWindow: this.flexibleTimeWindow(),
+            FlexibleTimeWindow: cfnFlexibleTimeWindow(this.properties.get("FlexibleTimeWindow"), (reason) => this.propertyError(reason)),
             Target: this.target(),
             State: this.stringProperty("State"),
             Description: this.stringProperty("Description"),
@@ -62,24 +63,6 @@ export class SimCfnScheduleProperties {
             KmsKeyArn: this.stringProperty("KmsKeyArn"),
         };
     }
-    /**
-     * The time window, which AWS requires on this Resource type.
-     */
-    flexibleTimeWindow() {
-        const window = this.properties.get("FlexibleTimeWindow");
-        if (window === undefined) {
-            return undefined;
-        }
-        if (!isRecord(window)) {
-            throw this.propertyError("FlexibleTimeWindow is an object");
-        }
-        return {
-            Mode: typeof window["Mode"] === "string" ? window["Mode"] : undefined,
-            MaximumWindowInMinutes: typeof window["MaximumWindowInMinutes"] === "number"
-                ? window["MaximumWindowInMinutes"]
-                : undefined,
-        };
-    }
     /**
      * The schedule's target, which AWS requires on this Resource type.
      *

package/dist/service/scheduler/cfn/sim-cfn-schedule-time-window.d.ts

@@ -0,0 +1,10 @@
+import type { SimCfnTemplateValue } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimSchedulerFlexibleTimeWindow } from "../command/schedule/schedule.command.js";
+/**
+ * Read an `AWS::Scheduler::Schedule` time window into the shape
+ * CreateSchedule takes.
+ *
+ * Whether the window is valid is left to simulated Scheduler, so a template
+ * and an SDK request are refused for the same reasons.
+ */
+export declare function cfnFlexibleTimeWindow(window: SimCfnTemplateValue | undefined, propertyError: (reason: string) => Error): SimSchedulerFlexibleTimeWindow | undefined;