@kensio/yulin 1.21.4 → 1.21.6

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.d.ts

@@ -6,6 +6,7 @@ export interface SimCfnIamRoleProperties {
     readonly path: string | undefined;
     readonly description: string | undefined;
     readonly assumeRolePolicyDocument: string;
+    readonly permissionsBoundary: string | undefined;
     readonly inlinePolicies: readonly SimCfnIamInlinePolicy[];
     readonly managedPolicyArns: readonly string[];
 }

package/dist/service/iam/cfn/role/sim-cfn-iam-role-properties-parser.js

@@ -1,6 +1,9 @@
+/* oxlint-disable security/detect-object-injection -- each lookup here reads a
+   template property under the name this parser asks for by literal. */
 import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
-import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
+import { simCfnIamJsonObject, simCfnIamOptionalString, } from "../sim-cfn-iam-property.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
+const resourceType = "AWS::IAM::Role";
 /**
  * Parses and validates AWS::IAM::Role CloudFormation properties into the shape
  * the sim IAM Role creator needs.
@@ -10,34 +13,38 @@ import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
  */
 export class SimCfnIamRolePropertiesParser {
     policiesParser = new SimCfnIamPoliciesParser({
-        resourceType: "AWS::IAM::Role",
+        resourceType,
     });
     /**
      * Parse the resolved CloudFormation properties for an AWS::IAM::Role.
      */
     parse(resource, properties) {
         return {
-            roleName: this.optionalString(resource, properties["RoleName"], "RoleName") ??
+            roleName: this.optionalString(resource, properties, "RoleName") ??
                 simCfnIamPrincipalGeneratedName(resource),
-            path: this.optionalString(resource, properties["Path"], "Path"),
-            description: this.optionalString(resource, properties["Description"], "Description"),
-            assumeRolePolicyDocument: this.jsonObject(resource, properties["AssumeRolePolicyDocument"], "AssumeRolePolicyDocument"),
+            path: this.optionalString(resource, properties, "Path"),
+            description: this.optionalString(resource, properties, "Description"),
+            assumeRolePolicyDocument: this.jsonObject(resource, properties),
+            permissionsBoundary: this.optionalString(resource, properties, "PermissionsBoundary"),
             inlinePolicies: this.policiesParser.inlinePolicies(resource, properties),
             managedPolicyArns: this.policiesParser.managedPolicyArns(resource, properties),
         };
     }
-    optionalString(resource, value, label) {
+    optionalString(resource, properties, label) {
         return simCfnIamOptionalString({
-            resourceType: "AWS::IAM::Role",
+            resourceType,
             resource,
-            value,
+            value: properties[label],
             label,
         });
     }
-    jsonObject(resource, value, label) {
-        if (typeof value !== "object" || value === null || Array.isArray(value)) {
-            throw new TypeError(`Invalid AWS::IAM::Role ${resource.logicalId}: ${label} must be an object`);
-        }
-        return JSON.stringify(value);
+    jsonObject(resource, properties) {
+        const label = "AssumeRolePolicyDocument";
+        return simCfnIamJsonObject({
+            resourceType,
+            resource,
+            value: properties[label],
+            label,
+        });
     }
 }

package/dist/service/iam/cfn/{sim-cfn-iam-optional-string.d.ts → sim-cfn-iam-property.d.ts}

@@ -1,6 +1,6 @@
 import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../cloudformation/template/value/sim-cfn-template-value.js";
-interface SimCfnIamOptionalStringProperties {
+interface SimCfnIamPropertyInput {
     readonly resourceType: string;
     readonly resource: SimCfnResource;
     readonly value: SimCfnTemplateValueRecord[string] | undefined;
@@ -13,5 +13,13 @@ interface SimCfnIamOptionalStringProperties {
  * refuse a non-string the same way, naming the Resource type the template
  * declared.
  */
-export declare function simCfnIamOptionalString(properties: SimCfnIamOptionalStringProperties): string | undefined;
+export declare function simCfnIamOptionalString(properties: SimCfnIamPropertyInput): string | undefined;
+/**
+ * Read a JSON-object property an IAM Resource requires.
+ *
+ * A Role's trust policy arrives as the object the template wrote, and IAM
+ * takes its policy documents as JSON text. A value of any other shape fails
+ * the Resource, naming the Resource type the template declared.
+ */
+export declare function simCfnIamJsonObject(properties: SimCfnIamPropertyInput): string;
 export {};

package/dist/service/iam/cfn/sim-cfn-iam-property.js

@@ -0,0 +1,31 @@
+/**
+ * Read a string property an IAM Resource may leave out.
+ *
+ * A Role and a User read most of their own properties this way, and both
+ * refuse a non-string the same way, naming the Resource type the template
+ * declared.
+ */
+export function simCfnIamOptionalString(properties) {
+    const { resourceType, resource, value, label } = properties;
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be a string`);
+    }
+    return value;
+}
+/**
+ * Read a JSON-object property an IAM Resource requires.
+ *
+ * A Role's trust policy arrives as the object the template wrote, and IAM
+ * takes its policy documents as JSON text. A value of any other shape fails
+ * the Resource, naming the Resource type the template declared.
+ */
+export function simCfnIamJsonObject(properties) {
+    const { resourceType, resource, value, label } = properties;
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new TypeError(`Invalid ${resourceType} ${resource.logicalId}: ${label} must be an object`);
+    }
+    return JSON.stringify(value);
+}

package/dist/service/iam/cfn/user/sim-cfn-iam-user-properties-parser.js

@@ -1,5 +1,5 @@
 import { simCfnIamPrincipalGeneratedName } from "../name/sim-cfn-iam-generated-name.js";
-import { simCfnIamOptionalString } from "../sim-cfn-iam-optional-string.js";
+import { simCfnIamOptionalString } from "../sim-cfn-iam-property.js";
 import { SimCfnIamPoliciesParser, } from "../sim-cfn-iam-policies-parser.js";
 const resourceType = "AWS::IAM::User";
 /**

package/dist/service/iam/command/role/create-role/create-role-record-factory.js

@@ -1,4 +1,5 @@
 import { makeSimIamRoleId } from "../../../role/sim-iam-role-id.js";
+import { simIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 /**
  * Creates simulated IAM Role records and command outputs.
  */
@@ -19,6 +20,7 @@ export class CreateRoleRecordFactory {
             assumeRolePolicyDocument: cmd.input.AssumeRolePolicyDocument,
             description: cmd.input.Description,
             creationDate,
+            permissionsBoundaryArn: cmd.input.PermissionsBoundary,
             inlinePolicies: new Map(),
             attachedPolicyArns: new Set(),
         };
@@ -36,6 +38,7 @@ export class CreateRoleRecordFactory {
                 CreateDate: role.creationDate,
                 AssumeRolePolicyDocument: role.assumeRolePolicyDocument,
                 Description: role.description,
+                PermissionsBoundary: simIamAttachedPermissionsBoundary(role),
             },
         };
     }

package/dist/service/iam/command/role/create-role/create-role.command.d.ts

@@ -1,9 +1,18 @@
 import type { SimArn } from "../../../../aws/arn.js";
+import type { SimIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 export interface SimCreateRoleCommandInput {
     readonly RoleName?: string | undefined;
     readonly Path?: string | undefined;
     readonly AssumeRolePolicyDocument?: string | undefined;
     readonly Description?: string | undefined;
+    /**
+     * ARN of the managed policy to attach to the new Role as its permissions
+     * boundary.
+     *
+     * The request carries this ARN as `iam:PermissionsBoundary`, which is the
+     * key an account requiring a boundary conditions `iam:CreateRole` on.
+     */
+    readonly PermissionsBoundary?: string | undefined;
 }
 export interface SimCreateRoleCommand {
     readonly input: SimCreateRoleCommandInput;
@@ -17,5 +26,6 @@ export interface SimCreateRoleCommandOutput {
         readonly CreateDate: Date;
         readonly AssumeRolePolicyDocument?: string | undefined;
         readonly Description?: string | undefined;
+        readonly PermissionsBoundary?: SimIamAttachedPermissionsBoundary | undefined;
     };
 }

package/dist/service/iam/command/role/get-role/get-role.command.d.ts

@@ -1,5 +1,6 @@
 import type { SimArn } from "../../../../aws/arn.js";
 import type { SimIamRoleName } from "../../../role/sim-iam-role.js";
+import type { SimIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 export interface SimGetRoleCommandInput {
     readonly RoleName?: string | undefined;
 }
@@ -15,5 +16,6 @@ export interface SimGetRoleCommandOutput {
         readonly CreateDate: Date;
         readonly AssumeRolePolicyDocument?: string | undefined;
         readonly Description?: string | undefined;
+        readonly PermissionsBoundary?: SimIamAttachedPermissionsBoundary | undefined;
     };
 }

package/dist/service/iam/command/role/get-role/get-role.handler.js

@@ -1,5 +1,6 @@
 import { BackgroundTasks, } from "../../../../../util/background/background.js";
 import { SimIamNoSuchEntity } from "../../../error/sim-iam.error.js";
+import { simIamAttachedPermissionsBoundary } from "../../../role/sim-iam-role-boundary.js";
 /**
  * IAM GetRoleCommand handler.
  *
@@ -36,6 +37,7 @@ export class GetRoleCommandHandler {
                 CreateDate: role.creationDate,
                 AssumeRolePolicyDocument: role.assumeRolePolicyDocument,
                 Description: role.description,
+                PermissionsBoundary: simIamAttachedPermissionsBoundary(role),
             },
         };
     }

package/dist/service/iam/command/role/sim-iam-role-command-handlers.js

@@ -31,7 +31,7 @@ export class SimIamRoleCommandHandlers {
      * Handle a CreateRole command from the SDK.
      */
     async createRole(command, options) {
-        this.authorizer.authorize("iam:CreateRole", this.roleArn(command.input.RoleName), options?.caller);
+        this.authorizer.authorize("iam:CreateRole", this.roleArn(command.input.RoleName), options?.caller, permissionsBoundaryCondition(command.input.PermissionsBoundary));
         const handler = new CreateRoleCommandHandler({
             accountId: this.accountId,
             roles: this.roles,
@@ -123,3 +123,17 @@ export class SimIamRoleCommandHandlers {
         return `arn:aws:iam::${this.accountId}:role/${roleName ?? "*"}`;
     }
 }
+/**
+ * What a Role-creating request says about the boundary it declares.
+ *
+ * An account that requires a permissions boundary allows `iam:CreateRole`
+ * only under `StringEquals` on `iam:PermissionsBoundary`, and the CDK
+ * permissions-boundary guard is written that way. A request declaring no
+ * boundary leaves the key out, which is what refuses it: a positive operator
+ * over an absent key matches nothing.
+ */
+function permissionsBoundaryCondition(permissionsBoundary) {
+    return permissionsBoundary === undefined
+        ? undefined
+        : { "iam:PermissionsBoundary": permissionsBoundary };
+}

package/dist/service/iam/role/sim-iam-role-boundary.d.ts

@@ -0,0 +1,24 @@
+import type { SimArn } from "../../aws/arn.js";
+import type { SimIamRole } from "./sim-iam-role.js";
+/**
+ * A permissions boundary attached to a Role, as IAM describes one.
+ *
+ * IAM answers with the attachment rather than the bare ARN, and the type has
+ * only ever taken one value.
+ */
+export interface SimIamAttachedPermissionsBoundary {
+    readonly PermissionsBoundaryType: "PermissionsBoundaryPolicy";
+    readonly PermissionsBoundaryArn: SimArn;
+}
+/**
+ * The member names IAM describes an attached boundary with.
+ */
+export declare const simIamAttachedBoundaryMembers: string[];
+/**
+ * How a Role's boundary appears in a CreateRole or GetRole answer.
+ *
+ * A Role created without one has no attachment to describe, and IAM leaves
+ * the field out. `ListRoles` leaves it out whatever the Role carries, along
+ * with the Role's tags and last use, and points the caller at `GetRole`.
+ */
+export declare function simIamAttachedPermissionsBoundary(role: SimIamRole): SimIamAttachedPermissionsBoundary | undefined;

package/dist/service/iam/role/sim-iam-role-boundary.js

@@ -0,0 +1,24 @@
+/**
+ * The member names IAM describes an attached boundary with.
+ */
+export const simIamAttachedBoundaryMembers = [
+    "PermissionsBoundaryType",
+    "PermissionsBoundaryArn",
+];
+/**
+ * How a Role's boundary appears in a CreateRole or GetRole answer.
+ *
+ * A Role created without one has no attachment to describe, and IAM leaves
+ * the field out. `ListRoles` leaves it out whatever the Role carries, along
+ * with the Role's tags and last use, and points the caller at `GetRole`.
+ */
+export function simIamAttachedPermissionsBoundary(role) {
+    const permissionsBoundaryArn = role.permissionsBoundaryArn;
+    if (permissionsBoundaryArn === undefined) {
+        return undefined;
+    }
+    return {
+        PermissionsBoundaryType: "PermissionsBoundaryPolicy",
+        PermissionsBoundaryArn: permissionsBoundaryArn,
+    };
+}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -56,4 +56,5 @@ export declare const simIamRoleWithPolicyFactory: AsyncMappedFactory<SimIamRoleW
     readonly CreateDate: Date;
     readonly AssumeRolePolicyDocument?: string | undefined;
     readonly Description?: string | undefined;
+    readonly PermissionsBoundary?: import("./sim-iam-role-boundary.js").SimIamAttachedPermissionsBoundary | undefined;
 }, SimAws>;

package/dist/service/iam/role/sim-iam-role.d.ts

@@ -19,6 +19,16 @@ export interface SimIamRole extends SimIamPrincipal {
     readonly assumeRolePolicyDocument?: JSONString<SimIamPolicyDocument> | undefined;
     readonly description?: string | undefined;
     readonly creationDate: Date;
+    /**
+     * ARN of the managed policy attached to this Role as its permissions
+     * boundary, where the request creating it declared one.
+     *
+     * This records what the Role was created with, so that a policy conditioned
+     * on `iam:PermissionsBoundary` can be tested against the Roles a deployment
+     * makes. The boundary is not yet evaluated as a policy source, so it does
+     * not narrow what the Role itself may do.
+     */
+    readonly permissionsBoundaryArn?: SimArn | undefined;
     /**
      * Inline identity-based permissions policies stored directly on this role.
      */

package/dist/service/iam/serve/sim-iam-query-entity.d.ts

@@ -7,5 +7,10 @@ import type { SimQueryOutput } from "../../../serve/http/api/query/sim-query-res
  * same structures are what a listing repeats. The Query layer writes the
  * members of a structure and the items of a list, and this is the one shape
  * left between them.
+ *
+ * An entity carrying a member of its own that is a structure passes `nested`,
+ * which writes whatever a scalar member cannot. A Role's permissions boundary
+ * is the case that exists for, and a listing that leaves it out passes
+ * nothing.
  */
-export declare function iamQueryEntity(output: SimQueryOutput, name: string, members: readonly string[]): string;
+export declare function iamQueryEntity(output: SimQueryOutput, name: string, members: readonly string[], nested?: (entity: SimQueryOutput) => string): string;

package/dist/service/iam/serve/sim-iam-query-entity.js

@@ -12,10 +12,16 @@ import { xmlElement } from "../../../util/xml/xml-writer.js";
  * same structures are what a listing repeats. The Query layer writes the
  * members of a structure and the items of a list, and this is the one shape
  * left between them.
+ *
+ * An entity carrying a member of its own that is a structure passes `nested`,
+ * which writes whatever a scalar member cannot. A Role's permissions boundary
+ * is the case that exists for, and a listing that leaves it out passes
+ * nothing.
  */
-export function iamQueryEntity(output, name, members) {
+export function iamQueryEntity(output, name, members, nested) {
     const entity = output[name];
-    return isRecord(entity)
-        ? xmlElement(name, queryMembers(entity, members))
-        : "";
+    if (!isRecord(entity)) {
+        return "";
+    }
+    return xmlElement(name, queryMembers(entity, members) + (nested?.(entity) ?? ""));
 }

package/dist/service/iam/serve/sim-iam-query-role-operations.js

@@ -1,4 +1,5 @@
-import { queryList, queryMembers, } from "../../../serve/http/api/query/sim-query-result.js";
+import { queryList, queryMembers, queryStructure, } from "../../../serve/http/api/query/sim-query-result.js";
+import { simIamAttachedBoundaryMembers } from "../role/sim-iam-role-boundary.js";
 import { iamQueryEntity } from "./sim-iam-query-entity.js";
 import { iamQueryListingInput, iamQueryListingResult, } from "./sim-iam-query-listing.js";
 /**
@@ -13,6 +14,16 @@ const roleMembers = [
     "AssumeRolePolicyDocument",
     "Description",
 ];
+/**
+ * Write the permissions boundary a Role carries, where it carries one.
+ *
+ * A boundary is a structure of its own, and `queryMembers` would write it as
+ * the JSON text of an object. `ListRoles` leaves the field out altogether, as
+ * IAM does, so only the create and the get pass this.
+ */
+function roleBoundary(role) {
+    return queryStructure(role, "PermissionsBoundary", (boundary) => queryMembers(boundary, simIamAttachedBoundaryMembers));
+}
 /**
  * The Role operations simulated IAM serves over the Query protocol.
  *
@@ -30,8 +41,9 @@ export function simIamQueryRoleOperations() {
                     Path: fields.text("Path"),
                     AssumeRolePolicyDocument: fields.text("AssumeRolePolicyDocument"),
                     Description: fields.text("Description"),
+                    PermissionsBoundary: fields.text("PermissionsBoundary"),
                 }),
-                result: (output) => iamQueryEntity(output, "Role", roleMembers),
+                result: (output) => iamQueryEntity(output, "Role", roleMembers, roleBoundary),
             },
         ],
         [
@@ -40,7 +52,7 @@ export function simIamQueryRoleOperations() {
                 input: (fields) => ({
                     RoleName: fields.text("RoleName"),
                 }),
-                result: (output) => iamQueryEntity(output, "Role", roleMembers),
+                result: (output) => iamQueryEntity(output, "Role", roleMembers, roleBoundary),
             },
         ],
         [

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.d.ts

@@ -26,6 +26,12 @@ import type { SimCfnLambdaFunctionProperties } from "./sim-cfn-lambda-function-p
  * CloudFormation carries out itself is recorded as inert instead, because this
  * message would otherwise tell a reader to bind a handler to a function that
  * has nothing left to do.
+ *
+ * The refusal carries the function's name, which the properties parser has
+ * already worked out by the time this gate is asked. CDK writes a function's
+ * log group name as `/aws/lambda/` joined to a Ref of the function. A refusal
+ * carrying no name puts the log group under `/aws/lambda/` and a logical ID,
+ * a name no account would hold.
  */
 export declare class SimCfnLambdaRuntimeSkip {
     /**

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.js

@@ -1,3 +1,4 @@
+import { SimCfnNamedSkip } from "../../../cloudformation/resource/unsupported/sim-cfn-named-skip.js";
 /**
  * Sim Lambda runs handler modules in a Node.js vm, so it simulates the
  * Node.js managed runtimes.
@@ -29,6 +30,12 @@ const nodeJsRuntimePrefix = "nodejs";
  * CloudFormation carries out itself is recorded as inert instead, because this
  * message would otherwise tell a reader to bind a handler to a function that
  * has nothing left to do.
+ *
+ * The refusal carries the function's name, which the properties parser has
+ * already worked out by the time this gate is asked. CDK writes a function's
+ * log group name as `/aws/lambda/` joined to a Ref of the function. A refusal
+ * carrying no name puts the log group under `/aws/lambda/` and a logical ID,
+ * a name no account would hold.
  */
 export class SimCfnLambdaRuntimeSkip {
     /**
@@ -42,9 +49,9 @@ export class SimCfnLambdaRuntimeSkip {
             runtimeName.startsWith(nodeJsRuntimePrefix)) {
             return undefined;
         }
-        return new Error(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
+        return new SimCfnNamedSkip(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
             `sim Lambda simulates Node.js runtimes, and this function declares ` +
             `Runtime ${runtimeName}. Bind a real in-process handler to this ` +
-            `function to simulate it.`);
+            `function to simulate it.`, functionProperties.functionName);
     }
 }

package/dist/service/route53/command/create-hosted-zone/sim-route53-zone-id.js

@@ -34,10 +34,32 @@ export function makeSimRoute53HostedZoneId(existing = new Set()) {
 export function normalizeSimRoute53HostedZoneId(value) {
     const hostedZoneId = value?.replace(/^\/?hostedzone\//u, "");
     if (!isSimRoute53HostedZoneId(hostedZoneId)) {
-        throw new SimRoute53InvalidInput(`Invalid Route53 Hosted Zone ID: ${value ?? "(missing)"}`);
+        throw new SimRoute53InvalidInput(rejectedSimRoute53HostedZoneId(value, hostedZoneId));
     }
     return hostedZoneId;
 }
+/**
+ * The literal CDK writes into a synthesized template when
+ * `HostedZone.fromLookup` runs against no credentials and no cached context.
+ */
+const cdkUnresolvedLookupHostedZoneId = "DUMMY";
+/**
+ * The message for a Hosted Zone ID that fails the shape check.
+ *
+ * CDK writes its unresolved lookup stand-in into every RecordSet of the
+ * synthesized template, and that value arrives here looking like any other
+ * malformed ID. Reporting it as one sends the reader to check an ID they never
+ * wrote, so the stand-in is named and the synth that produced it is pointed at.
+ */
+function rejectedSimRoute53HostedZoneId(value, hostedZoneId) {
+    const reported = `Invalid Route53 Hosted Zone ID: ${value ?? "(missing)"}`;
+    if (hostedZoneId !== cdkUnresolvedLookupHostedZoneId) {
+        return reported;
+    }
+    return (`${reported}. CDK fills an unresolved \`HostedZone.fromLookup\` with this ` +
+        "stand-in. Run `cdk synth` with credentials for the account holding the " +
+        "zone, or commit the `cdk.context.json` a resolved lookup writes.");
+}
 /**
  * Whether a value has the shape of a Route53 Hosted Zone ID.
  */

package/dist/service/s3/bucket/sim-s3-bucket-maker.d.ts

@@ -0,0 +1,31 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { SimS3Bucket, type SimS3BucketName } from "./sim-s3-bucket.js";
+import type { SimS3GlobalRegistry } from "../sim-s3-global-registry.js";
+interface SimS3BucketMakerProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly s3GlobalRegistry: SimS3GlobalRegistry;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * Puts a Bucket into a simulated S3 scope, once something has decided it may
+ * be there.
+ *
+ * `CreateBucketCommand` decides that by authorizing the caller. A Bucket real
+ * AWS provisions outside the deployment being simulated, such as the CDK
+ * bootstrap staging Bucket, has no caller to authorize and comes through
+ * `SimS3.makeSimBucket` instead. Both arrive at the same Bucket registered in
+ * the same two places, because the name check and the registration are here
+ * rather than in the command handler.
+ */
+export declare class SimS3BucketMaker {
+    private readonly properties;
+    constructor(properties: SimS3BucketMakerProperties);
+    /**
+     * Make a Bucket of the given name, reporting a name this scope cannot take
+     * the way `CreateBucketCommand` reports it.
+     */
+    make(bucketName: string): SimS3Bucket;
+}
+export {};

package/dist/service/s3/bucket/sim-s3-bucket-maker.js

@@ -0,0 +1,41 @@
+import { SimS3BucketNameAvailability } from "./name-availability/sim-s3-bucket-name-availability.js";
+import { validateS3BucketName } from "./validate/validate-s3-bucket-name.js";
+import { SimS3Bucket } from "./sim-s3-bucket.js";
+/**
+ * Puts a Bucket into a simulated S3 scope, once something has decided it may
+ * be there.
+ *
+ * `CreateBucketCommand` decides that by authorizing the caller. A Bucket real
+ * AWS provisions outside the deployment being simulated, such as the CDK
+ * bootstrap staging Bucket, has no caller to authorize and comes through
+ * `SimS3.makeSimBucket` instead. Both arrive at the same Bucket registered in
+ * the same two places, because the name check and the registration are here
+ * rather than in the command handler.
+ */
+export class SimS3BucketMaker {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * Make a Bucket of the given name, reporting a name this scope cannot take
+     * the way `CreateBucketCommand` reports it.
+     */
+    make(bucketName) {
+        const { accountRegionScope, buckets, s3GlobalRegistry, background } = this.properties;
+        validateS3BucketName(bucketName);
+        new SimS3BucketNameAvailability({
+            accountRegionScope,
+            buckets,
+            s3GlobalRegistry,
+        }).ensureCanCreateBucketNamed(bucketName);
+        const bucket = new SimS3Bucket({
+            bucketName,
+            accountRegionScope,
+            clock: background,
+        });
+        buckets.set(bucketName, bucket);
+        s3GlobalRegistry.registerBucket(bucketName, accountRegionScope);
+        return bucket;
+    }
+}

package/dist/service/s3/command/create-bucket/create-bucket.handler.d.ts

@@ -1,6 +1,6 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { SimCreateBucketCommand, SimCreateBucketCommandOutput } from "./create-bucket.command.js";
-import { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
 import type { SimS3GlobalRegistry } from "../../sim-s3-global-registry.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
@@ -8,7 +8,7 @@ import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-int
 import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
 interface CreateBucketCommandHandlerProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
-    readonly buckets: Map<string, SimS3Bucket>;
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
     readonly s3GlobalRegistry: SimS3GlobalRegistry;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;

package/dist/service/s3/command/create-bucket/create-bucket.handler.js

@@ -1,7 +1,6 @@
-import { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
-import { SimS3BucketNameAvailability } from "../../bucket/name-availability/sim-s3-bucket-name-availability.js";
+import { SimS3BucketMaker } from "../../bucket/sim-s3-bucket-maker.js";
 import { validateS3BucketName } from "../../bucket/validate/validate-s3-bucket-name.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
@@ -49,19 +48,12 @@ export class CreateBucketCommandHandler {
                 resource,
             });
         }
-        const simS3BucketNameAvailability = new SimS3BucketNameAvailability({
+        new SimS3BucketMaker({
             accountRegionScope: this.accountRegionScope,
             buckets: this.buckets,
             s3GlobalRegistry: this.s3GlobalRegistry,
-        });
-        simS3BucketNameAvailability.ensureCanCreateBucketNamed(bucketName);
-        const bucket = new SimS3Bucket({
-            bucketName,
-            accountRegionScope: this.accountRegionScope,
-            clock: this.background,
-        });
-        this.buckets.set(bucketName, bucket);
-        this.s3GlobalRegistry.registerBucket(bucketName, this.accountRegionScope);
+            background: this.background,
+        }).make(bucketName);
         return {
             BucketArn: resource,
             Location: `/${bucketName}`,

package/dist/service/s3/sim-s3-commands.d.ts

@@ -63,6 +63,12 @@ export declare class SimS3Commands {
     readonly objectTagging: SimS3ObjectTaggingCommands;
     readonly multipartUploads: SimS3MultipartCommands;
     readonly objectNotifier: SimS3ObjectNotifier;
+    /**
+     * The scheduler and clock every command area here shares, which a
+     * simulator-only control on the service facade needs to hand a Bucket it
+     * makes outside the commands.
+     */
+    readonly background: BackgroundScheduler;
     constructor(properties: SimS3CommandsProperties);
 }
 export {};

package/dist/service/s3/sim-s3-commands.js

@@ -35,8 +35,15 @@ export class SimS3Commands {
     objectTagging;
     multipartUploads;
     objectNotifier;
+    /**
+     * The scheduler and clock every command area here shares, which a
+     * simulator-only control on the service facade needs to hand a Bucket it
+     * makes outside the commands.
+     */
+    background;
     constructor(properties) {
         const { background = new BackgroundTasks(), notificationDestinations = new SimS3NoNotificationDestinations(), } = properties;
+        this.background = background;
         const iam = simIamInRegion(properties.iam, properties.accountRegionScope.regionName);
         this.objectNotifier = new SimS3ObjectNotifier({
             destinations: notificationDestinations,