@kensio/yulin 1.21.4 → 1.21.6

package/dist/service/cloudfront/cfn/origin-request-policy/sim-cfn-cf-orp-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfOriginRequestPolicyConfig } from "./sim-cfn-cf-orp-config.js";
  * AWS::CloudFront::OriginRequestPolicy Resources.
  */
 export class SimCfnCfOriginRequestPolicyCreator {
+    static createAction = "cloudfront:CreateOriginRequestPolicy";
+    static deleteAction = "cloudfront:DeleteOriginRequestPolicy";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfOriginRequestPolicyCreator {
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfOriginRequestPolicyCreator.createAction, options);
         const policy = new SimCfnCfOriginRequestPolicyConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfOriginRequestPolicyCreator {
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const policy = resource.simResource;
         if (policy === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfOriginRequestPolicyCreator.deleteAction, `origin-request-policy/${policy.id}`, options);
         this.cloudFront.removeOriginRequestPolicy(policy.id);
     }
 }

package/dist/service/cloudfront/cfn/policy/sim-cfn-cf-policy-creators.d.ts

@@ -0,0 +1,33 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCloudFront } from "../../sim-cloudfront.js";
+/**
+ * What the four creators in here have in common.
+ *
+ * Each builds its own kind of policy from a Resource's properties and stores
+ * it on the simulated CloudFront, and each authorizes the deployment's caller
+ * for its own pair of actions.
+ */
+interface SimCfnCfPolicyCreator {
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): object;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
+}
+/**
+ * The CloudFront Resource types a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here. The Resource factory hands
+ * all four to this one lookup, and its own switch stays about the Resource
+ * types a command creates.
+ */
+export declare class SimCfnCfPolicyCreators {
+    private readonly creators;
+    constructor(cloudFront: SimCloudFront);
+    /**
+     * The creator owning one Resource type, or nothing where another part of
+     * the factory owns it.
+     */
+    creatorFor(resourceTypeName: string): SimCfnCfPolicyCreator | undefined;
+}
+export {};

package/dist/service/cloudfront/cfn/policy/sim-cfn-cf-policy-creators.js

@@ -0,0 +1,39 @@
+import { SimCfnCfCachePolicyCreator } from "../cache-policy/sim-cfn-cf-cache-policy-creator.js";
+import { SimCfnCfOriginAccessControlCreator } from "../origin-access-control/sim-cfn-cf-oac-creator.js";
+import { SimCfnCfOriginRequestPolicyCreator } from "../origin-request-policy/sim-cfn-cf-orp-creator.js";
+import { SimCfnCfResponseHeadersPolicyCreator } from "../response-headers-policy/sim-cfn-cf-rh-policy-creator.js";
+/**
+ * The CloudFront Resource types a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here. The Resource factory hands
+ * all four to this one lookup, and its own switch stays about the Resource
+ * types a command creates.
+ */
+export class SimCfnCfPolicyCreators {
+    creators;
+    constructor(cloudFront) {
+        this.creators = new Map([
+            [
+                "ResponseHeadersPolicy",
+                new SimCfnCfResponseHeadersPolicyCreator({ cloudFront }),
+            ],
+            ["CachePolicy", new SimCfnCfCachePolicyCreator({ cloudFront })],
+            [
+                "OriginRequestPolicy",
+                new SimCfnCfOriginRequestPolicyCreator({ cloudFront }),
+            ],
+            [
+                "OriginAccessControl",
+                new SimCfnCfOriginAccessControlCreator({ cloudFront }),
+            ],
+        ]);
+    }
+    /**
+     * The creator owning one Resource type, or nothing where another part of
+     * the factory owns it.
+     */
+    creatorFor(resourceTypeName) {
+        return this.creators.get(resourceTypeName);
+    }
+}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 import type { SimCloudFront } from "../../sim-cloudfront.js";
@@ -10,15 +11,17 @@ interface SimCfnCfResponseHeadersPolicyCreatorProperties {
  * AWS::CloudFront::ResponseHeadersPolicy Resources.
  */
 export declare class SimCfnCfResponseHeadersPolicyCreator {
+    private static readonly createAction;
+    private static readonly deleteAction;
     private readonly cloudFront;
     constructor(properties: SimCfnCfResponseHeadersPolicyCreatorProperties);
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontResponseHeadersPolicy;
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord, options?: SimCfnResourceCallerOptions): SimCloudFrontResponseHeadersPolicy;
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource: SimCfnResource): void;
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): void;
 }
 export {};

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.js

@@ -4,6 +4,8 @@ import { SimCfnCfResponseHeadersPolicyConfig } from "./sim-cfn-cf-rh-policy-conf
  * AWS::CloudFront::ResponseHeadersPolicy Resources.
  */
 export class SimCfnCfResponseHeadersPolicyCreator {
+    static createAction = "cloudfront:CreateResponseHeadersPolicy";
+    static deleteAction = "cloudfront:DeleteResponseHeadersPolicy";
     cloudFront;
     constructor(properties) {
         this.cloudFront = properties.cloudFront;
@@ -11,7 +13,10 @@ export class SimCfnCfResponseHeadersPolicyCreator {
     /**
      * Create and store the policy one Resource describes.
      */
-    create(resource, properties) {
+    create(resource, properties, options) {
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeAny(SimCfnCfResponseHeadersPolicyCreator.createAction, options);
         const policy = new SimCfnCfResponseHeadersPolicyConfig({
             resource,
             properties,
@@ -22,11 +27,14 @@ export class SimCfnCfResponseHeadersPolicyCreator {
     /**
      * Remove a policy created from a Resource.
      */
-    delete(resource) {
+    delete(resource, options) {
         const policy = resource.simResource;
         if (policy === undefined) {
             return;
         }
+        this.cloudFront
+            .cfnAuthorizer()
+            .authorizeResource(SimCfnCfResponseHeadersPolicyCreator.deleteAction, `response-headers-policy/${policy.id}`, options);
         this.cloudFront.removeResponseHeadersPolicy(policy.id);
     }
 }

package/dist/service/cloudfront/cfn/sim-cfn-cf-authorizer.d.ts

@@ -0,0 +1,40 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimCfnResourceCallerOptions } from "../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface SimCfnCfAuthorizerProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Authorizes the CloudFront Resources a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here, so their CloudFormation
+ * creators reach the stored policy directly rather than through a command that
+ * would ask IAM on the way. This is where those creators ask instead, so a
+ * deploy Role holding no CloudFront permission is refused the way real
+ * CloudFormation refuses it.
+ */
+export declare class SimCfnCfAuthorizer {
+    private readonly accountId;
+    private readonly iam;
+    constructor(properties: SimCfnCfAuthorizerProperties);
+    /**
+     * Ensure the caller may take an action that names nothing yet.
+     *
+     * A create action has no ID to authorize against until it succeeds, and
+     * CloudFront offers no resource-level permission for one, so a policy
+     * granting it writes `*` and that is what it is decided against.
+     */
+    authorizeAny(action: string, options?: SimCfnResourceCallerOptions): void;
+    /**
+     * Ensure the caller may take an action on the CloudFront resource a path
+     * names, such as `cache-policy/8f1a2b3c`.
+     *
+     * A delete names the thing it is deleting, so a policy can grant deleting
+     * one cache policy without granting deleting every cache policy in the
+     * Account.
+     */
+    authorizeResource(action: string, resourcePath: string, options?: SimCfnResourceCallerOptions): void;
+}
+export {};

package/dist/service/cloudfront/cfn/sim-cfn-cf-authorizer.js

@@ -0,0 +1,50 @@
+import { simCfAuthorize } from "../sim-cf-authorize.js";
+/**
+ * Authorizes the CloudFront Resources a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here, so their CloudFormation
+ * creators reach the stored policy directly rather than through a command that
+ * would ask IAM on the way. This is where those creators ask instead, so a
+ * deploy Role holding no CloudFront permission is refused the way real
+ * CloudFormation refuses it.
+ */
+export class SimCfnCfAuthorizer {
+    accountId;
+    iam;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may take an action that names nothing yet.
+     *
+     * A create action has no ID to authorize against until it succeeds, and
+     * CloudFront offers no resource-level permission for one, so a policy
+     * granting it writes `*` and that is what it is decided against.
+     */
+    authorizeAny(action, options) {
+        simCfAuthorize({
+            iam: this.iam,
+            action,
+            resource: "*",
+            caller: options?.caller,
+        });
+    }
+    /**
+     * Ensure the caller may take an action on the CloudFront resource a path
+     * names, such as `cache-policy/8f1a2b3c`.
+     *
+     * A delete names the thing it is deleting, so a policy can grant deleting
+     * one cache policy without granting deleting every cache policy in the
+     * Account.
+     */
+    authorizeResource(action, resourcePath, options) {
+        simCfAuthorize({
+            iam: this.iam,
+            action,
+            resource: `arn:aws:cloudfront::${this.accountId}:${resourcePath}`,
+            caller: options?.caller,
+        });
+    }
+}

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.d.ts

@@ -8,10 +8,7 @@ export declare class SimCloudFrontCloudFormationResourceFactory implements SimCf
     private readonly distroCreator;
     private readonly functionCreator;
     private readonly distroDeleter;
-    private readonly responseHeadersPolicyCreator;
-    private readonly cachePolicyCreator;
-    private readonly originRequestPolicyCreator;
-    private readonly originAccessControlCreator;
+    private readonly policyCreators;
     private readonly keyValueStoreCreator;
     constructor(cloudFront: SimCloudFront);
     /**

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.js

@@ -2,10 +2,7 @@ import { simCfnResourceCallerOptions } from "../../cloudformation/resource/calle
 import { SimCfnCfDistroCreator } from "./distro/sim-cfn-cf-distro-creator.js";
 import { SimCfnCffCreator } from "./cff/sim-cfn-cff-creator.js";
 import { SimCfnCfDistroDeleter } from "./distro/sim-cfn-cf-distro-deleter.js";
-import { SimCfnCfResponseHeadersPolicyCreator } from "./response-headers-policy/sim-cfn-cf-rh-policy-creator.js";
-import { SimCfnCfCachePolicyCreator } from "./cache-policy/sim-cfn-cf-cache-policy-creator.js";
-import { SimCfnCfOriginRequestPolicyCreator } from "./origin-request-policy/sim-cfn-cf-orp-creator.js";
-import { SimCfnCfOriginAccessControlCreator } from "./origin-access-control/sim-cfn-cf-oac-creator.js";
+import { SimCfnCfPolicyCreators } from "./policy/sim-cfn-cf-policy-creators.js";
 import { SimCfnCfKeyValueStoreCreator } from "./key-value-store/sim-cfn-cf-kvs-creator.js";
 /**
  * CloudFormation Resource factory for simulated CloudFront resources.
@@ -14,24 +11,13 @@ export class SimCloudFrontCloudFormationResourceFactory {
     distroCreator;
     functionCreator;
     distroDeleter;
-    responseHeadersPolicyCreator;
-    cachePolicyCreator;
-    originRequestPolicyCreator;
-    originAccessControlCreator;
+    policyCreators;
     keyValueStoreCreator;
     constructor(cloudFront) {
         this.distroCreator = new SimCfnCfDistroCreator({ cloudFront });
         this.functionCreator = new SimCfnCffCreator({ cloudFront });
         this.distroDeleter = new SimCfnCfDistroDeleter({ cloudFront });
-        this.responseHeadersPolicyCreator =
-            new SimCfnCfResponseHeadersPolicyCreator({ cloudFront });
-        this.cachePolicyCreator = new SimCfnCfCachePolicyCreator({ cloudFront });
-        this.originRequestPolicyCreator = new SimCfnCfOriginRequestPolicyCreator({
-            cloudFront,
-        });
-        this.originAccessControlCreator = new SimCfnCfOriginAccessControlCreator({
-            cloudFront,
-        });
+        this.policyCreators = new SimCfnCfPolicyCreators(cloudFront);
         this.keyValueStoreCreator = new SimCfnCfKeyValueStoreCreator({
             cloudFront,
         });
@@ -41,6 +27,11 @@ export class SimCloudFrontCloudFormationResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
+        const policyCreator = this.policyCreators.creatorFor(resourceTypeName);
+        if (policyCreator !== undefined) {
+            return policyCreator.create(resource, properties, options);
+        }
         switch (resourceTypeName) {
             case "Distribution": {
                 return await this.distroCreator.create(resource, properties, context);
@@ -48,20 +39,8 @@ export class SimCloudFrontCloudFormationResourceFactory {
             case "Function": {
                 return await this.functionCreator.create(resource, properties, context);
             }
-            case "ResponseHeadersPolicy": {
-                return this.responseHeadersPolicyCreator.create(resource, properties);
-            }
-            case "CachePolicy": {
-                return this.cachePolicyCreator.create(resource, properties);
-            }
-            case "OriginRequestPolicy": {
-                return this.originRequestPolicyCreator.create(resource, properties);
-            }
-            case "OriginAccessControl": {
-                return this.originAccessControlCreator.create(resource, properties);
-            }
             case "KeyValueStore": {
-                return await this.keyValueStoreCreator.create(resource, properties, simCfnResourceCallerOptions(context.caller));
+                return await this.keyValueStoreCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim CloudFront CloudFormation Resource ${resourceTypeName}`);
@@ -74,6 +53,11 @@ export class SimCloudFrontCloudFormationResourceFactory {
      */
     async delete(resourceTypeName, resource, context) {
         const options = simCfnResourceCallerOptions(context.caller);
+        const policyCreator = this.policyCreators.creatorFor(resourceTypeName);
+        if (policyCreator !== undefined) {
+            policyCreator.delete(resource, options);
+            return;
+        }
         switch (resourceTypeName) {
             case "Distribution": {
                 await this.distroDeleter.delete(resource, options);
@@ -83,22 +67,6 @@ export class SimCloudFrontCloudFormationResourceFactory {
                 await this.functionCreator.delete(resource, options);
                 return;
             }
-            case "ResponseHeadersPolicy": {
-                this.responseHeadersPolicyCreator.delete(resource);
-                return;
-            }
-            case "CachePolicy": {
-                this.cachePolicyCreator.delete(resource);
-                return;
-            }
-            case "OriginRequestPolicy": {
-                this.originRequestPolicyCreator.delete(resource);
-                return;
-            }
-            case "OriginAccessControl": {
-                this.originAccessControlCreator.delete(resource);
-                return;
-            }
             case "KeyValueStore": {
                 await this.keyValueStoreCreator.delete(resource, options);
                 return;

package/dist/service/cloudfront/sim-cloudfront-commands.d.ts

@@ -23,6 +23,7 @@ import { SimCfKeyValueStoreCommands } from "./key-value-store/sim-cf-key-value-s
 import { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.js";
 import { SimCfFunctionCommands } from "./cff/sim-cf-function-commands.js";
 import { SimCfInvalidationCommands } from "./command/invalidation/sim-cf-invalidation-commands.js";
+import { SimCfnCfAuthorizer } from "./cfn/sim-cfn-cf-authorizer.js";
 /**
  * How one simulated CloudFront is put together.
  */
@@ -92,6 +93,11 @@ export declare class SimCloudFrontCommands {
      * The invalidation commands, and the Distributions they clear.
      */
     readonly invalidations: SimCfInvalidationCommands;
+    /**
+     * How the CloudFormation Resource factory authorizes the Resources it
+     * creates without a command of their own.
+     */
+    readonly cfnAuthorizer: SimCfnCfAuthorizer;
     private readonly distributionState;
     private readonly configurationState;
     constructor(properties: SimCloudFrontCommandsProperties);

package/dist/service/cloudfront/sim-cloudfront-commands.js

@@ -13,6 +13,7 @@ import { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.
 import { SimCffKeyValueStoreUsers } from "./cff/kvs/sim-cff-key-value-store-users.js";
 import { SimCfFunctionCommands } from "./cff/sim-cf-function-commands.js";
 import { SimCfInvalidationCommands } from "./command/invalidation/sim-cf-invalidation-commands.js";
+import { SimCfnCfAuthorizer } from "./cfn/sim-cfn-cf-authorizer.js";
 /**
  * The commands of one simulated CloudFront, and the state they share.
  *
@@ -45,6 +46,11 @@ export class SimCloudFrontCommands {
      * The invalidation commands, and the Distributions they clear.
      */
     invalidations;
+    /**
+     * How the CloudFormation Resource factory authorizes the Resources it
+     * creates without a command of their own.
+     */
+    cfnAuthorizer;
     distributionState;
     configurationState;
     constructor(properties) {
@@ -74,6 +80,7 @@ export class SimCloudFrontCommands {
             iam,
             background,
         });
+        this.cfnAuthorizer = new SimCfnCfAuthorizer({ accountId, iam });
         this.configurationState = {
             s3OriginResolver,
             customOriginDispatcher,

package/dist/service/cloudfront/sim-cloudfront.d.ts

@@ -2,6 +2,7 @@ import type { SimArn } from "../aws/arn.js";
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimCloudFrontFunction, SimCloudFrontFunctionName } from "./cff/sim-cloudfront-function.js";
+import type { SimCfnCfAuthorizer } from "./cfn/sim-cfn-cf-authorizer.js";
 import type { SimCreateDistributionCommand, SimCreateDistributionCommandOutput } from "./command/create-distribution/create-distribution.command.js";
 import type { SimCreateFunctionCommand, SimCreateFunctionCommandOutput } from "./command/create-function/create-function.command.js";
 import type { SimDeleteDistributionCommand, SimDeleteDistributionCommandOutput } from "./command/delete-distribution/delete-distribution.command.js";
@@ -92,6 +93,11 @@ export declare class SimCloudFront extends SimCloudFrontDistributions {
      * Get a sim CloudFront Function by name.
      */
     getCloudFrontFunctionByName(cloudFrontFunctionName: SimCloudFrontFunctionName | string): SimCloudFrontFunction | undefined;
+    /**
+     * How the CloudFormation Resource factory authorizes a deployment's caller
+     * for the Resources it creates without a command of their own.
+     */
+    cfnAuthorizer(): SimCfnCfAuthorizer;
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/cloudfront/sim-cloudfront.js

@@ -129,6 +129,13 @@ export class SimCloudFront extends SimCloudFrontDistributions {
     getCloudFrontFunctionByName(cloudFrontFunctionName) {
         return this.cloudFrontFunctions.get(cloudFrontFunctionName);
     }
+    /**
+     * How the CloudFormation Resource factory authorizes a deployment's caller
+     * for the Resources it creates without a command of their own.
+     */
+    cfnAuthorizer() {
+        return this.commands.cfnAuthorizer;
+    }
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/dynamodb/document/sim-dynamodb-document-command-paths.d.ts

@@ -54,4 +54,12 @@ export declare const simDynamoDbDocumentCommandPaths: {
         readonly input: SimDynamoDbDocumentPath;
         readonly output: SimDynamoDbDocumentPath;
     };
+    readonly transactWrite: {
+        readonly input: SimDynamoDbDocumentPath;
+        readonly output: SimDynamoDbDocumentPath;
+    };
+    readonly transactGet: {
+        readonly input: SimDynamoDbDocumentPath;
+        readonly output: SimDynamoDbDocumentPath;
+    };
 };

package/dist/service/dynamodb/document/sim-dynamodb-document-command-paths.js

@@ -47,6 +47,58 @@ const batchWriteRequests = simDynamoDbDocumentEach(simDynamoDbDocumentEach(batch
  * The keys every table is read by in a batch get.
  */
 const batchGetKeys = simDynamoDbDocumentEach(simDynamoDbDocumentFields({ Keys: valueRecords }));
+/**
+ * One action of a transactional write that names an item by its key, which a
+ * ConditionCheck, a Delete and an Update all do.
+ */
+const transactWriteKeyed = simDynamoDbDocumentFields({
+    Key: simDynamoDbDocumentValues(),
+    ExpressionAttributeValues: simDynamoDbDocumentValues(),
+});
+/**
+ * The Put of a transactional write, which carries a whole item.
+ */
+const transactWritePut = simDynamoDbDocumentFields({
+    Item: simDynamoDbDocumentValues(),
+    ExpressionAttributeValues: simDynamoDbDocumentValues(),
+});
+/**
+ * The actions a transactional write applies.
+ *
+ * An entry carries exactly one of the four, so each is named here and the
+ * three the entry left out are left out of the conversion with it. Every
+ * action carries its own condition, so its expression values are converted
+ * alongside the item they compare against.
+ */
+const transactWriteActions = simDynamoDbDocumentEach(simDynamoDbDocumentFields({
+    ConditionCheck: transactWriteKeyed,
+    Put: transactWritePut,
+    Delete: transactWriteKeyed,
+    Update: transactWriteKeyed,
+}));
+/**
+ * One Get of a transactional read, which names an item by its key.
+ */
+const transactGet = simDynamoDbDocumentFields({
+    Get: simDynamoDbDocumentFields({ Key: simDynamoDbDocumentValues() }),
+});
+/**
+ * What a transactional read answers with, one entry per Get.
+ */
+const transactGetResponses = simDynamoDbDocumentEach(simDynamoDbDocumentFields({ Item: simDynamoDbDocumentValues() }));
+/**
+ * What a transactional write answers with, which is nothing to convert.
+ *
+ * `ItemCollectionMetrics` is the one place the real document client converts
+ * this output, and it is only reported when a request asks for it with
+ * `ReturnItemCollectionMetrics`, which simulated DynamoDB refuses.
+ *
+ * A cancelled transaction is not converted either. `CancellationReasons` reach
+ * a caller on a thrown `TransactionCanceledException` rather than in an
+ * answer, and the real document client leaves the `Item` of a reason as the
+ * descriptors the low-level Command reports.
+ */
+const transactWritten = simDynamoDbDocumentFields({});
 /**
  * Where each supported document Command carries native values.
  *
@@ -108,4 +160,14 @@ export const simDynamoDbDocumentCommandPaths = {
             UnprocessedKeys: batchGetKeys,
         }),
     },
+    transactWrite: {
+        input: simDynamoDbDocumentFields({ TransactItems: transactWriteActions }),
+        output: transactWritten,
+    },
+    transactGet: {
+        input: simDynamoDbDocumentFields({
+            TransactItems: simDynamoDbDocumentEach(transactGet),
+        }),
+        output: simDynamoDbDocumentFields({ Responses: transactGetResponses }),
+    },
 };

package/dist/service/dynamodb/document/sim-dynamodb-document-routes.d.ts

@@ -25,7 +25,7 @@ export declare function simDynamoDbDocumentSharedNameRoutes(dynamoDb: SimDynamoD
  * so are routed by `simDynamoDbDocumentSharedNameRoutes` instead.
  *
  * An operation with no document route at all, such as a document
- * `TransactWriteCommand`, is refused by name like any other unsupported
+ * `ExecuteStatementCommand`, is refused by name like any other unsupported
  * Command, rather than failing part way through a conversion.
  */
 export declare function simDynamoDbDocumentRoutes(dynamoDb: SimDynamoDb): readonly (readonly [string, SimSdkCommandRoute])[];

package/dist/service/dynamodb/document/sim-dynamodb-document-routes.js

@@ -43,7 +43,7 @@ export function simDynamoDbDocumentSharedNameRoutes(dynamoDb) {
  * so are routed by `simDynamoDbDocumentSharedNameRoutes` instead.
  *
  * An operation with no document route at all, such as a document
- * `TransactWriteCommand`, is refused by name like any other unsupported
+ * `ExecuteStatementCommand`, is refused by name like any other unsupported
  * Command, rather than failing part way through a conversion.
  */
 export function simDynamoDbDocumentRoutes(dynamoDb) {
@@ -54,5 +54,7 @@ export function simDynamoDbDocumentRoutes(dynamoDb) {
         namedDocumentRoute("UpdateCommand", paths.update, async (input, options) => await dynamoDb.updateItem({ input }, options)),
         namedDocumentRoute("BatchWriteCommand", paths.batchWrite, async (input, options) => await dynamoDb.batchWriteItem({ input }, options)),
         namedDocumentRoute("BatchGetCommand", paths.batchGet, async (input, options) => await dynamoDb.batchGetItem({ input }, options)),
+        namedDocumentRoute("TransactWriteCommand", paths.transactWrite, async (input, options) => await dynamoDb.transactWriteItems({ input }, options)),
+        namedDocumentRoute("TransactGetCommand", paths.transactGet, async (input, options) => await dynamoDb.transactGetItems({ input }, options)),
     ];
 }

package/dist/service/iam/authorize/sim-iam-action-authorizer.d.ts

@@ -1,4 +1,5 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamConditionValue } from "../policy/sim-iam-policy.js";
 import type { SimIamInterServiceAuthZ } from "./sim-iam-inter-service-auth-z.js";
 interface SimIamActionAuthorizerProperties {
     readonly iam: SimIamInterServiceAuthZ;
@@ -9,8 +10,9 @@ interface SimIamActionAuthorizerProperties {
  *
  * This shared authorizer suits services whose commands map one-to-one onto an
  * IAM action and resource ARN, such as the IAM and CloudFormation control
- * planes. Commands needing richer context, such as condition values, use
- * their own per-command authorizers instead.
+ * planes. A command carrying a condition value of its own passes it here.
+ * Commands needing more than that, such as a service that hands a Role over,
+ * use their own per-command authorizers instead.
  */
 export declare class SimIamActionAuthorizer {
     private readonly iam;
@@ -21,7 +23,10 @@ export declare class SimIamActionAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit
      * anonymous caller, which has no identity policy permissions.
+     *
+     * Condition values the request itself carries are supplied last, since most
+     * commands carry none and read better without an empty record.
      */
-    authorize(action: string, resource: string, caller?: SimAwsCaller): void;
+    authorize(action: string, resource: string, caller?: SimAwsCaller, conditionContext?: Readonly<Record<string, SimIamConditionValue>>): void;
 }
 export {};

package/dist/service/iam/authorize/sim-iam-action-authorizer.js

@@ -5,8 +5,9 @@ import { SimIamAccessDenied } from "../error/sim-iam.error.js";
  *
  * This shared authorizer suits services whose commands map one-to-one onto an
  * IAM action and resource ARN, such as the IAM and CloudFormation control
- * planes. Commands needing richer context, such as condition values, use
- * their own per-command authorizers instead.
+ * planes. A command carrying a condition value of its own passes it here.
+ * Commands needing more than that, such as a service that hands a Role over,
+ * use their own per-command authorizers instead.
  */
 export class SimIamActionAuthorizer {
     iam;
@@ -19,9 +20,17 @@ export class SimIamActionAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit
      * anonymous caller, which has no identity policy permissions.
+     *
+     * Condition values the request itself carries are supplied last, since most
+     * commands carry none and read better without an empty record.
      */
-    authorize(action, resource, caller) {
-        const decision = this.iam.authorize({ action, resource, caller });
+    authorize(action, resource, caller, conditionContext) {
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller,
+            conditionContext,
+        });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,

package/dist/service/iam/cfn/role/sim-cfn-iam-role-creator.js

@@ -20,6 +20,7 @@ export class SimCfnIamRoleCreator {
                 Path: roleProperties.path,
                 Description: roleProperties.description,
                 AssumeRolePolicyDocument: roleProperties.assumeRolePolicyDocument,
+                PermissionsBoundary: roleProperties.permissionsBoundary,
             },
         }, options);
         await Promise.all([