@kensio/yulin 1.21.5 → 1.21.7

package/dist/service/cloudfront/cfn/sim-cfn-cf-authorizer.js

@@ -0,0 +1,50 @@
+import { simCfAuthorize } from "../sim-cf-authorize.js";
+/**
+ * Authorizes the CloudFront Resources a template is the only way to make.
+ *
+ * A cache policy, an origin request policy, a response headers policy and an
+ * origin access control have no SDK command here, so their CloudFormation
+ * creators reach the stored policy directly rather than through a command that
+ * would ask IAM on the way. This is where those creators ask instead, so a
+ * deploy Role holding no CloudFront permission is refused the way real
+ * CloudFormation refuses it.
+ */
+export class SimCfnCfAuthorizer {
+    accountId;
+    iam;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may take an action that names nothing yet.
+     *
+     * A create action has no ID to authorize against until it succeeds, and
+     * CloudFront offers no resource-level permission for one, so a policy
+     * granting it writes `*` and that is what it is decided against.
+     */
+    authorizeAny(action, options) {
+        simCfAuthorize({
+            iam: this.iam,
+            action,
+            resource: "*",
+            caller: options?.caller,
+        });
+    }
+    /**
+     * Ensure the caller may take an action on the CloudFront resource a path
+     * names, such as `cache-policy/8f1a2b3c`.
+     *
+     * A delete names the thing it is deleting, so a policy can grant deleting
+     * one cache policy without granting deleting every cache policy in the
+     * Account.
+     */
+    authorizeResource(action, resourcePath, options) {
+        simCfAuthorize({
+            iam: this.iam,
+            action,
+            resource: `arn:aws:cloudfront::${this.accountId}:${resourcePath}`,
+            caller: options?.caller,
+        });
+    }
+}

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.d.ts

@@ -8,10 +8,7 @@ export declare class SimCloudFrontCloudFormationResourceFactory implements SimCf
     private readonly distroCreator;
     private readonly functionCreator;
     private readonly distroDeleter;
-    private readonly responseHeadersPolicyCreator;
-    private readonly cachePolicyCreator;
-    private readonly originRequestPolicyCreator;
-    private readonly originAccessControlCreator;
+    private readonly policyCreators;
     private readonly keyValueStoreCreator;
     constructor(cloudFront: SimCloudFront);
     /**

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.js

@@ -2,10 +2,7 @@ import { simCfnResourceCallerOptions } from "../../cloudformation/resource/calle
 import { SimCfnCfDistroCreator } from "./distro/sim-cfn-cf-distro-creator.js";
 import { SimCfnCffCreator } from "./cff/sim-cfn-cff-creator.js";
 import { SimCfnCfDistroDeleter } from "./distro/sim-cfn-cf-distro-deleter.js";
-import { SimCfnCfResponseHeadersPolicyCreator } from "./response-headers-policy/sim-cfn-cf-rh-policy-creator.js";
-import { SimCfnCfCachePolicyCreator } from "./cache-policy/sim-cfn-cf-cache-policy-creator.js";
-import { SimCfnCfOriginRequestPolicyCreator } from "./origin-request-policy/sim-cfn-cf-orp-creator.js";
-import { SimCfnCfOriginAccessControlCreator } from "./origin-access-control/sim-cfn-cf-oac-creator.js";
+import { SimCfnCfPolicyCreators } from "./policy/sim-cfn-cf-policy-creators.js";
 import { SimCfnCfKeyValueStoreCreator } from "./key-value-store/sim-cfn-cf-kvs-creator.js";
 /**
  * CloudFormation Resource factory for simulated CloudFront resources.
@@ -14,24 +11,13 @@ export class SimCloudFrontCloudFormationResourceFactory {
     distroCreator;
     functionCreator;
     distroDeleter;
-    responseHeadersPolicyCreator;
-    cachePolicyCreator;
-    originRequestPolicyCreator;
-    originAccessControlCreator;
+    policyCreators;
     keyValueStoreCreator;
     constructor(cloudFront) {
         this.distroCreator = new SimCfnCfDistroCreator({ cloudFront });
         this.functionCreator = new SimCfnCffCreator({ cloudFront });
         this.distroDeleter = new SimCfnCfDistroDeleter({ cloudFront });
-        this.responseHeadersPolicyCreator =
-            new SimCfnCfResponseHeadersPolicyCreator({ cloudFront });
-        this.cachePolicyCreator = new SimCfnCfCachePolicyCreator({ cloudFront });
-        this.originRequestPolicyCreator = new SimCfnCfOriginRequestPolicyCreator({
-            cloudFront,
-        });
-        this.originAccessControlCreator = new SimCfnCfOriginAccessControlCreator({
-            cloudFront,
-        });
+        this.policyCreators = new SimCfnCfPolicyCreators(cloudFront);
         this.keyValueStoreCreator = new SimCfnCfKeyValueStoreCreator({
             cloudFront,
         });
@@ -41,6 +27,11 @@ export class SimCloudFrontCloudFormationResourceFactory {
      */
     async create(resourceTypeName, resource, context) {
         const properties = context.resolvedProperties ?? resource.properties;
+        const options = simCfnResourceCallerOptions(context.caller);
+        const policyCreator = this.policyCreators.creatorFor(resourceTypeName);
+        if (policyCreator !== undefined) {
+            return policyCreator.create(resource, properties, options);
+        }
         switch (resourceTypeName) {
             case "Distribution": {
                 return await this.distroCreator.create(resource, properties, context);
@@ -48,20 +39,8 @@ export class SimCloudFrontCloudFormationResourceFactory {
             case "Function": {
                 return await this.functionCreator.create(resource, properties, context);
             }
-            case "ResponseHeadersPolicy": {
-                return this.responseHeadersPolicyCreator.create(resource, properties);
-            }
-            case "CachePolicy": {
-                return this.cachePolicyCreator.create(resource, properties);
-            }
-            case "OriginRequestPolicy": {
-                return this.originRequestPolicyCreator.create(resource, properties);
-            }
-            case "OriginAccessControl": {
-                return this.originAccessControlCreator.create(resource, properties);
-            }
             case "KeyValueStore": {
-                return await this.keyValueStoreCreator.create(resource, properties, simCfnResourceCallerOptions(context.caller));
+                return await this.keyValueStoreCreator.create(resource, properties, options);
             }
             default: {
                 throw new Error(`Unsupported sim CloudFront CloudFormation Resource ${resourceTypeName}`);
@@ -74,6 +53,11 @@ export class SimCloudFrontCloudFormationResourceFactory {
      */
     async delete(resourceTypeName, resource, context) {
         const options = simCfnResourceCallerOptions(context.caller);
+        const policyCreator = this.policyCreators.creatorFor(resourceTypeName);
+        if (policyCreator !== undefined) {
+            policyCreator.delete(resource, options);
+            return;
+        }
         switch (resourceTypeName) {
             case "Distribution": {
                 await this.distroDeleter.delete(resource, options);
@@ -83,22 +67,6 @@ export class SimCloudFrontCloudFormationResourceFactory {
                 await this.functionCreator.delete(resource, options);
                 return;
             }
-            case "ResponseHeadersPolicy": {
-                this.responseHeadersPolicyCreator.delete(resource);
-                return;
-            }
-            case "CachePolicy": {
-                this.cachePolicyCreator.delete(resource);
-                return;
-            }
-            case "OriginRequestPolicy": {
-                this.originRequestPolicyCreator.delete(resource);
-                return;
-            }
-            case "OriginAccessControl": {
-                this.originAccessControlCreator.delete(resource);
-                return;
-            }
             case "KeyValueStore": {
                 await this.keyValueStoreCreator.delete(resource, options);
                 return;

package/dist/service/cloudfront/sim-cloudfront-commands.d.ts

@@ -23,6 +23,7 @@ import { SimCfKeyValueStoreCommands } from "./key-value-store/sim-cf-key-value-s
 import { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.js";
 import { SimCfFunctionCommands } from "./cff/sim-cf-function-commands.js";
 import { SimCfInvalidationCommands } from "./command/invalidation/sim-cf-invalidation-commands.js";
+import { SimCfnCfAuthorizer } from "./cfn/sim-cfn-cf-authorizer.js";
 /**
  * How one simulated CloudFront is put together.
  */
@@ -92,6 +93,11 @@ export declare class SimCloudFrontCommands {
      * The invalidation commands, and the Distributions they clear.
      */
     readonly invalidations: SimCfInvalidationCommands;
+    /**
+     * How the CloudFormation Resource factory authorizes the Resources it
+     * creates without a command of their own.
+     */
+    readonly cfnAuthorizer: SimCfnCfAuthorizer;
     private readonly distributionState;
     private readonly configurationState;
     constructor(properties: SimCloudFrontCommandsProperties);

package/dist/service/cloudfront/sim-cloudfront-commands.js

@@ -13,6 +13,7 @@ import { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.
 import { SimCffKeyValueStoreUsers } from "./cff/kvs/sim-cff-key-value-store-users.js";
 import { SimCfFunctionCommands } from "./cff/sim-cf-function-commands.js";
 import { SimCfInvalidationCommands } from "./command/invalidation/sim-cf-invalidation-commands.js";
+import { SimCfnCfAuthorizer } from "./cfn/sim-cfn-cf-authorizer.js";
 /**
  * The commands of one simulated CloudFront, and the state they share.
  *
@@ -45,6 +46,11 @@ export class SimCloudFrontCommands {
      * The invalidation commands, and the Distributions they clear.
      */
     invalidations;
+    /**
+     * How the CloudFormation Resource factory authorizes the Resources it
+     * creates without a command of their own.
+     */
+    cfnAuthorizer;
     distributionState;
     configurationState;
     constructor(properties) {
@@ -74,6 +80,7 @@ export class SimCloudFrontCommands {
             iam,
             background,
         });
+        this.cfnAuthorizer = new SimCfnCfAuthorizer({ accountId, iam });
         this.configurationState = {
             s3OriginResolver,
             customOriginDispatcher,

package/dist/service/cloudfront/sim-cloudfront.d.ts

@@ -2,6 +2,7 @@ import type { SimArn } from "../aws/arn.js";
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimCloudFrontFunction, SimCloudFrontFunctionName } from "./cff/sim-cloudfront-function.js";
+import type { SimCfnCfAuthorizer } from "./cfn/sim-cfn-cf-authorizer.js";
 import type { SimCreateDistributionCommand, SimCreateDistributionCommandOutput } from "./command/create-distribution/create-distribution.command.js";
 import type { SimCreateFunctionCommand, SimCreateFunctionCommandOutput } from "./command/create-function/create-function.command.js";
 import type { SimDeleteDistributionCommand, SimDeleteDistributionCommandOutput } from "./command/delete-distribution/delete-distribution.command.js";
@@ -92,6 +93,11 @@ export declare class SimCloudFront extends SimCloudFrontDistributions {
      * Get a sim CloudFront Function by name.
      */
     getCloudFrontFunctionByName(cloudFrontFunctionName: SimCloudFrontFunctionName | string): SimCloudFrontFunction | undefined;
+    /**
+     * How the CloudFormation Resource factory authorizes a deployment's caller
+     * for the Resources it creates without a command of their own.
+     */
+    cfnAuthorizer(): SimCfnCfAuthorizer;
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/cloudfront/sim-cloudfront.js

@@ -129,6 +129,13 @@ export class SimCloudFront extends SimCloudFrontDistributions {
     getCloudFrontFunctionByName(cloudFrontFunctionName) {
         return this.cloudFrontFunctions.get(cloudFrontFunctionName);
     }
+    /**
+     * How the CloudFormation Resource factory authorizes a deployment's caller
+     * for the Resources it creates without a command of their own.
+     */
+    cfnAuthorizer() {
+        return this.commands.cfnAuthorizer;
+    }
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/dynamodb/document/sim-dynamodb-document-command-paths.d.ts

@@ -54,4 +54,12 @@ export declare const simDynamoDbDocumentCommandPaths: {
         readonly input: SimDynamoDbDocumentPath;
         readonly output: SimDynamoDbDocumentPath;
     };
+    readonly transactWrite: {
+        readonly input: SimDynamoDbDocumentPath;
+        readonly output: SimDynamoDbDocumentPath;
+    };
+    readonly transactGet: {
+        readonly input: SimDynamoDbDocumentPath;
+        readonly output: SimDynamoDbDocumentPath;
+    };
 };

package/dist/service/dynamodb/document/sim-dynamodb-document-command-paths.js

@@ -47,6 +47,58 @@ const batchWriteRequests = simDynamoDbDocumentEach(simDynamoDbDocumentEach(batch
  * The keys every table is read by in a batch get.
  */
 const batchGetKeys = simDynamoDbDocumentEach(simDynamoDbDocumentFields({ Keys: valueRecords }));
+/**
+ * One action of a transactional write that names an item by its key, which a
+ * ConditionCheck, a Delete and an Update all do.
+ */
+const transactWriteKeyed = simDynamoDbDocumentFields({
+    Key: simDynamoDbDocumentValues(),
+    ExpressionAttributeValues: simDynamoDbDocumentValues(),
+});
+/**
+ * The Put of a transactional write, which carries a whole item.
+ */
+const transactWritePut = simDynamoDbDocumentFields({
+    Item: simDynamoDbDocumentValues(),
+    ExpressionAttributeValues: simDynamoDbDocumentValues(),
+});
+/**
+ * The actions a transactional write applies.
+ *
+ * An entry carries exactly one of the four, so each is named here and the
+ * three the entry left out are left out of the conversion with it. Every
+ * action carries its own condition, so its expression values are converted
+ * alongside the item they compare against.
+ */
+const transactWriteActions = simDynamoDbDocumentEach(simDynamoDbDocumentFields({
+    ConditionCheck: transactWriteKeyed,
+    Put: transactWritePut,
+    Delete: transactWriteKeyed,
+    Update: transactWriteKeyed,
+}));
+/**
+ * One Get of a transactional read, which names an item by its key.
+ */
+const transactGet = simDynamoDbDocumentFields({
+    Get: simDynamoDbDocumentFields({ Key: simDynamoDbDocumentValues() }),
+});
+/**
+ * What a transactional read answers with, one entry per Get.
+ */
+const transactGetResponses = simDynamoDbDocumentEach(simDynamoDbDocumentFields({ Item: simDynamoDbDocumentValues() }));
+/**
+ * What a transactional write answers with, which is nothing to convert.
+ *
+ * `ItemCollectionMetrics` is the one place the real document client converts
+ * this output, and it is only reported when a request asks for it with
+ * `ReturnItemCollectionMetrics`, which simulated DynamoDB refuses.
+ *
+ * A cancelled transaction is not converted either. `CancellationReasons` reach
+ * a caller on a thrown `TransactionCanceledException` rather than in an
+ * answer, and the real document client leaves the `Item` of a reason as the
+ * descriptors the low-level Command reports.
+ */
+const transactWritten = simDynamoDbDocumentFields({});
 /**
  * Where each supported document Command carries native values.
  *
@@ -108,4 +160,14 @@ export const simDynamoDbDocumentCommandPaths = {
             UnprocessedKeys: batchGetKeys,
         }),
     },
+    transactWrite: {
+        input: simDynamoDbDocumentFields({ TransactItems: transactWriteActions }),
+        output: transactWritten,
+    },
+    transactGet: {
+        input: simDynamoDbDocumentFields({
+            TransactItems: simDynamoDbDocumentEach(transactGet),
+        }),
+        output: simDynamoDbDocumentFields({ Responses: transactGetResponses }),
+    },
 };

package/dist/service/dynamodb/document/sim-dynamodb-document-routes.d.ts

@@ -25,7 +25,7 @@ export declare function simDynamoDbDocumentSharedNameRoutes(dynamoDb: SimDynamoD
  * so are routed by `simDynamoDbDocumentSharedNameRoutes` instead.
  *
  * An operation with no document route at all, such as a document
- * `TransactWriteCommand`, is refused by name like any other unsupported
+ * `ExecuteStatementCommand`, is refused by name like any other unsupported
  * Command, rather than failing part way through a conversion.
  */
 export declare function simDynamoDbDocumentRoutes(dynamoDb: SimDynamoDb): readonly (readonly [string, SimSdkCommandRoute])[];

package/dist/service/dynamodb/document/sim-dynamodb-document-routes.js

@@ -43,7 +43,7 @@ export function simDynamoDbDocumentSharedNameRoutes(dynamoDb) {
  * so are routed by `simDynamoDbDocumentSharedNameRoutes` instead.
  *
  * An operation with no document route at all, such as a document
- * `TransactWriteCommand`, is refused by name like any other unsupported
+ * `ExecuteStatementCommand`, is refused by name like any other unsupported
  * Command, rather than failing part way through a conversion.
  */
 export function simDynamoDbDocumentRoutes(dynamoDb) {
@@ -54,5 +54,7 @@ export function simDynamoDbDocumentRoutes(dynamoDb) {
         namedDocumentRoute("UpdateCommand", paths.update, async (input, options) => await dynamoDb.updateItem({ input }, options)),
         namedDocumentRoute("BatchWriteCommand", paths.batchWrite, async (input, options) => await dynamoDb.batchWriteItem({ input }, options)),
         namedDocumentRoute("BatchGetCommand", paths.batchGet, async (input, options) => await dynamoDb.batchGetItem({ input }, options)),
+        namedDocumentRoute("TransactWriteCommand", paths.transactWrite, async (input, options) => await dynamoDb.transactWriteItems({ input }, options)),
+        namedDocumentRoute("TransactGetCommand", paths.transactGet, async (input, options) => await dynamoDb.transactGetItems({ input }, options)),
     ];
 }

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-creator.js

@@ -24,6 +24,7 @@ export class SimCfnEventBusCreator {
             properties,
         });
         busProperties.refuseUnsimulated();
+        busProperties.recordIgnoredProperties();
         const name = busProperties.name();
         const description = busProperties.description();
         return await simCfnEventBridgeResourceCreation(eventBusResourceType, resource.logicalId, async () => {

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-properties.d.ts

@@ -27,6 +27,10 @@ export declare class SimCfnEventBusProperties {
      * Refuse what this simulation does not model, naming the property.
      */
     refuseUnsimulated(): void;
+    /**
+     * Record the properties the bus is created without acting on.
+     */
+    recordIgnoredProperties(): void;
     private propertyError;
 }
 export {};

package/dist/service/eventbridge/cfn/bus/sim-cfn-event-bus-properties.js

@@ -19,8 +19,23 @@ const unsimulatedProperties = [
     ["EventSourceName", "partner event buses are not simulated"],
     ["KmsKeyIdentifier", "events are not encrypted with a customer managed key"],
     ["LogConfig", "event bus logging is not simulated"],
-    ["Tags", "event bus tags are not simulated"],
 ];
+/**
+ * What a template can say about an event bus that this simulation has nothing
+ * to act on, and why.
+ *
+ * `Tags` is the whole list, and it is recorded rather than refused. A bus
+ * behaves the same way with a tag and without one, and a CDK app calling
+ * `Tags.of(app).add(...)` tags every bus in it.
+ */
+const ignoredPropertyReasons = new Map([
+    [
+        "Tags",
+        `${eventBusResourceType} property Tags is not simulated, so the bus is ` +
+            "created without them. Nothing reads them back and nothing is grouped " +
+            "or billed by them.",
+    ],
+]);
 /**
  * Reads AWS::Events::EventBus properties into the shape CreateEventBus takes.
  */
@@ -71,6 +86,16 @@ export class SimCfnEventBusProperties {
             }
         }
     }
+    /**
+     * Record the properties the bus is created without acting on.
+     */
+    recordIgnoredProperties() {
+        for (const [property, reason] of ignoredPropertyReasons) {
+            if (this.properties.has(property)) {
+                this.resource.ignoreProperty(property, reason);
+            }
+        }
+    }
     propertyError(reason) {
         return simCfnEventBridgeResourceError(eventBusResourceType, this.resource.logicalId, reason);
     }

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-creator.js

@@ -2,6 +2,7 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simCfnEventBridgeResourceCreation } from "../sim-cfn-event-bridge-resource-error.js";
 import { eventRuleResourceType } from "../sim-cfn-event-bridge-resource-types.js";
 import { SimCfnEventRuleProperties } from "./sim-cfn-event-rule-properties.js";
+import { recordIgnoredEventRuleProperties, refuseUnsimulatedEventRuleProperties, } from "./sim-cfn-event-rule-unsimulated-properties.js";
 /**
  * Creates simulated rules from AWS::Events::Rule Resources.
  *
@@ -27,7 +28,8 @@ export class SimCfnEventRuleCreator {
             resource,
             properties,
         });
-        ruleProperties.refuseUnsimulated();
+        refuseUnsimulatedEventRuleProperties(resource, properties);
+        recordIgnoredEventRuleProperties(resource, properties);
         const name = ruleProperties.name();
         const busName = ruleProperties.busName();
         const targets = ruleProperties.targets();

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-properties.d.ts

@@ -48,13 +48,6 @@ export declare class SimCfnEventRuleProperties {
      * The rule's inline targets.
      */
     targets(): readonly SimCfnEventRuleTarget[];
-    /**
-     * Refuse what this simulation does not model, naming the property.
-     *
-     * Both are asked by key rather than by value, so a template writing `null`
-     * for one is refused rather than read as having left it out.
-     */
-    refuseUnsimulated(): void;
     private stringProperty;
     private propertyError;
 }

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-properties.js

@@ -89,26 +89,6 @@ export class SimCfnEventRuleProperties {
     targets() {
         return simCfnEventRuleTargets(this.properties.get("Targets"), (reason) => this.propertyError(reason));
     }
-    /**
-     * Refuse what this simulation does not model, naming the property.
-     *
-     * Both are asked by key rather than by value, so a template writing `null`
-     * for one is refused rather than read as having left it out.
-     */
-    refuseUnsimulated() {
-        if (this.properties.has("RoleArn")) {
-            throw this.propertyError("RoleArn is not simulated, so the Resource is refused rather than " +
-                "deployed without it: a rule reaches its target as the EventBridge " +
-                "service principal, admitted by the target's own resource policy");
-        }
-        // Rule tags never reach PutRule, which is the one place that would
-        // otherwise refuse them, so a tagged rule would deploy and quietly lose
-        // its tags.
-        if (this.properties.has("Tags")) {
-            throw this.propertyError("Tags are not simulated, so the Resource is refused rather than " +
-                "deployed without them");
-        }
-    }
     stringProperty(name) {
         const value = this.properties.get(name);
         if (value === undefined) {

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-unsimulated-properties.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * Refuse what this simulation does not model, naming the property.
+ *
+ * Asked by key rather than by value, so a template writing `null` for one of
+ * these is refused rather than read as having left it out.
+ */
+export declare function refuseUnsimulatedEventRuleProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;
+/**
+ * Record the properties the rule is created without acting on.
+ */
+export declare function recordIgnoredEventRuleProperties(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): void;

package/dist/service/eventbridge/cfn/rule/sim-cfn-event-rule-unsimulated-properties.js

@@ -0,0 +1,59 @@
+import { simCfnEventBridgeResourceError } from "../sim-cfn-event-bridge-resource-error.js";
+import { eventRuleResourceType } from "../sim-cfn-event-bridge-resource-types.js";
+/**
+ * What a template can say about a rule that this simulation does not model,
+ * and why each one fails the Resource.
+ *
+ * `RoleArn` is the whole list. A rule reaches its target as the EventBridge
+ * service principal, admitted by the target's own resource policy, so a rule
+ * deployed with a role would sit in a test looking as though the role decided
+ * something.
+ */
+const refusedPropertyReasons = new Map([
+    [
+        "RoleArn",
+        "RoleArn is not simulated, so the Resource is refused rather than " +
+            "deployed without it: a rule reaches its target as the EventBridge " +
+            "service principal, admitted by the target's own resource policy",
+    ],
+]);
+/**
+ * What a template can say about a rule that this simulation has nothing to act
+ * on, and why each one is recorded rather than refused.
+ *
+ * `Tags` is the whole list. Rule tags never reach `PutRule`, so the record is
+ * the only place a tagged rule says it lost them. A rule routes the same
+ * events with a tag and without one, and a CDK app calling
+ * `Tags.of(app).add(...)` tags every rule in it.
+ */
+const ignoredPropertyReasons = new Map([
+    [
+        "Tags",
+        `${eventRuleResourceType} property Tags is not simulated, so the rule is ` +
+            "created without them. Nothing reads them back and nothing is grouped " +
+            "or billed by them.",
+    ],
+]);
+/**
+ * Refuse what this simulation does not model, naming the property.
+ *
+ * Asked by key rather than by value, so a template writing `null` for one of
+ * these is refused rather than read as having left it out.
+ */
+export function refuseUnsimulatedEventRuleProperties(resource, properties) {
+    for (const [property, reason] of refusedPropertyReasons) {
+        if (Object.hasOwn(properties, property)) {
+            throw simCfnEventBridgeResourceError(eventRuleResourceType, resource.logicalId, reason);
+        }
+    }
+}
+/**
+ * Record the properties the rule is created without acting on.
+ */
+export function recordIgnoredEventRuleProperties(resource, properties) {
+    for (const [property, reason] of ignoredPropertyReasons) {
+        if (Object.hasOwn(properties, property)) {
+            resource.ignoreProperty(property, reason);
+        }
+    }
+}

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-error.d.ts

@@ -15,7 +15,7 @@ export declare function simCfnEventBridgeResourceError(resourceType: string, log
  * Every Resource type here goes through the ordinary EventBridge commands, so
  * what a template may ask for is decided once, by simulated EventBridge, rather
  * than again in the CloudFormation layer. What that leaves out is where the
- * request came from: a deployment failing with `Rule tags are not simulated`
+ * request came from: a deployment failing with `Rule pattern is not valid`
  * says nothing about which Resource asked for it. Only EventBridge's own errors
  * are renamed, so a refusal the CloudFormation layer decided keeps the wording
  * it was written with.

package/dist/service/eventbridge/cfn/sim-cfn-event-bridge-resource-error.js

@@ -20,7 +20,7 @@ export function simCfnEventBridgeResourceError(resourceType, logicalId, reason,
  * Every Resource type here goes through the ordinary EventBridge commands, so
  * what a template may ask for is decided once, by simulated EventBridge, rather
  * than again in the CloudFormation layer. What that leaves out is where the
- * request came from: a deployment failing with `Rule tags are not simulated`
+ * request came from: a deployment failing with `Rule pattern is not valid`
  * says nothing about which Resource asked for it. Only EventBridge's own errors
  * are renamed, so a refusal the CloudFormation layer decided keeps the wording
  * it was written with.

package/dist/service/iam/authorize/sim-iam-action-authorizer.d.ts

@@ -1,4 +1,5 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamConditionValue } from "../policy/sim-iam-policy.js";
 import type { SimIamInterServiceAuthZ } from "./sim-iam-inter-service-auth-z.js";
 interface SimIamActionAuthorizerProperties {
     readonly iam: SimIamInterServiceAuthZ;
@@ -9,8 +10,9 @@ interface SimIamActionAuthorizerProperties {
  *
  * This shared authorizer suits services whose commands map one-to-one onto an
  * IAM action and resource ARN, such as the IAM and CloudFormation control
- * planes. Commands needing richer context, such as condition values, use
- * their own per-command authorizers instead.
+ * planes. A command carrying a condition value of its own passes it here.
+ * Commands needing more than that, such as a service that hands a Role over,
+ * use their own per-command authorizers instead.
  */
 export declare class SimIamActionAuthorizer {
     private readonly iam;
@@ -21,7 +23,10 @@ export declare class SimIamActionAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit
      * anonymous caller, which has no identity policy permissions.
+     *
+     * Condition values the request itself carries are supplied last, since most
+     * commands carry none and read better without an empty record.
      */
-    authorize(action: string, resource: string, caller?: SimAwsCaller): void;
+    authorize(action: string, resource: string, caller?: SimAwsCaller, conditionContext?: Readonly<Record<string, SimIamConditionValue>>): void;
 }
 export {};

package/dist/service/iam/authorize/sim-iam-action-authorizer.js

@@ -5,8 +5,9 @@ import { SimIamAccessDenied } from "../error/sim-iam.error.js";
  *
  * This shared authorizer suits services whose commands map one-to-one onto an
  * IAM action and resource ARN, such as the IAM and CloudFormation control
- * planes. Commands needing richer context, such as condition values, use
- * their own per-command authorizers instead.
+ * planes. A command carrying a condition value of its own passes it here.
+ * Commands needing more than that, such as a service that hands a Role over,
+ * use their own per-command authorizers instead.
  */
 export class SimIamActionAuthorizer {
     iam;
@@ -19,9 +20,17 @@ export class SimIamActionAuthorizer {
      * The caller is passed through unchanged so sim IAM can distinguish an
      * omitted caller, which defaults to Account root, from an explicit
      * anonymous caller, which has no identity policy permissions.
+     *
+     * Condition values the request itself carries are supplied last, since most
+     * commands carry none and read better without an empty record.
      */
-    authorize(action, resource, caller) {
-        const decision = this.iam.authorize({ action, resource, caller });
+    authorize(action, resource, caller, conditionContext) {
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller,
+            conditionContext,
+        });
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,