@kensio/yulin 0.38.0 → 0.40.0

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-versions.js

@@ -0,0 +1,83 @@
+import { SimSecretsManagerStagingLabel, } from "./sim-secrets-manager-secret-version.js";
+/**
+ * The versions of one simulated secret, and how staging labels move between
+ * them.
+ *
+ * The label rules are the interesting part of Secrets Manager's data model and
+ * they belong together: a label names exactly one version at a time, and
+ * making a version current demotes the one that was.
+ */
+export class SimSecretsManagerSecretVersions {
+    versions = new Map();
+    /**
+     * Store a version and give it the staging labels it was written with.
+     */
+    add(version, stages) {
+        this.versions.set(version.versionId, version);
+        for (const stage of stages) {
+            this.moveStage(stage, version);
+        }
+    }
+    /**
+     * Find a version by its version id.
+     */
+    byId(versionId) {
+        return this.versions.get(versionId);
+    }
+    /**
+     * Find the version a staging label currently names.
+     */
+    byStage(label) {
+        return this.versions.values().find((version) => version.hasStage(label));
+    }
+    /**
+     * The version AWSCURRENT names, which is what a plain read returns.
+     */
+    get current() {
+        return this.byStage(SimSecretsManagerStagingLabel.Current);
+    }
+    /**
+     * The version ids carrying at least one staging label, as DescribeSecret
+     * reports them.
+     *
+     * Versions that have lost every label are left out, because that is how real
+     * Secrets Manager reports a version on its way out of existence.
+     */
+    versionIdsToStages() {
+        const entries = this.versions
+            .values()
+            .filter((version) => version.isLabelled)
+            .map((version) => [
+            version.versionId,
+            [...version.stages],
+        ]);
+        return Object.fromEntries(entries);
+    }
+    /**
+     * Attach a staging label to one version, taking it off whichever version
+     * held it before.
+     *
+     * Making a version current is the one move with a consequence of its own:
+     * the version that was current becomes AWSPREVIOUS, and whatever was
+     * AWSPREVIOUS loses the label.
+     */
+    moveStage(label, version) {
+        if (label === SimSecretsManagerStagingLabel.Current) {
+            this.demoteCurrent(version);
+        }
+        for (const other of this.versions.values()) {
+            other.removeStage(label);
+        }
+        version.addStage(label);
+    }
+    demoteCurrent(incoming) {
+        const outgoing = this.current;
+        if (outgoing === undefined || outgoing === incoming) {
+            return;
+        }
+        const previous = this.byStage(SimSecretsManagerStagingLabel.Previous);
+        previous?.removeStage(SimSecretsManagerStagingLabel.Previous);
+        outgoing.addStage(SimSecretsManagerStagingLabel.Previous);
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-secret-versions.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-versions.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IACzB,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAC;IAE9E;;OAEG;IACH,GAAG,CACD,OAAuC,EACvC,MAAyB;QAEzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,SAAiB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;aAC1B,MAAM,EAAE;aACR,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;aACvC,GAAG,CAAC,CAAC,OAAO,EAAsB,EAAE,CAAC;YACpC,OAAO,CAAC,SAAS;YACjB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;SACpB,CAAC,CAAC;QAEL,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACK,SAAS,CACf,KAAa,EACb,OAAuC;QAEvC,IAAI,KAAK,KAAK,6BAA6B,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAEO,aAAa,CAAC,QAAwC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAE9B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACtE,QAAQ,EAAE,WAAW,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAE9D,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret.d.ts

@@ -0,0 +1,75 @@
+import type { SimSecretsManagerSecretArn } from "./sim-secrets-manager-secret-arn.js";
+import { SimSecretsManagerSecretVersions } from "./sim-secrets-manager-secret-versions.js";
+/**
+ * A tag on a simulated secret, in the shape the SDK carries it.
+ */
+export interface SimSecretsManagerTag {
+    readonly Key?: string | undefined;
+    readonly Value?: string | undefined;
+}
+interface SimSecretsManagerSecretProperties {
+    readonly arn: SimSecretsManagerSecretArn;
+    readonly createdDate: Date;
+    readonly description?: string | undefined;
+    readonly kmsKeyId?: string | undefined;
+    readonly tags?: readonly SimSecretsManagerTag[] | undefined;
+}
+/**
+ * One stored simulated secret: its identity, its metadata and its versions.
+ *
+ * Deletion state lives here rather than in the store because it is the secret
+ * that behaves differently once it is scheduled: it can still be described and
+ * restored, but it refuses to be read or written.
+ */
+export declare class SimSecretsManagerSecret {
+    readonly arn: SimSecretsManagerSecretArn;
+    readonly createdDate: Date;
+    readonly versions: SimSecretsManagerSecretVersions;
+    description: string | undefined;
+    /**
+     * The KMS key the secret says it is encrypted under.
+     *
+     * Nothing is actually encrypted with it and no kms:Decrypt check happens, so
+     * this is looser than real AWS. Simulated KMS is not wired into this service
+     * yet; the value is stored and reported so that code reading it behaves the
+     * same, and the divergence is documented.
+     */
+    kmsKeyId: string | undefined;
+    tags: readonly SimSecretsManagerTag[];
+    lastChangedDate: Date;
+    private scheduledDeletionDate;
+    constructor(properties: SimSecretsManagerSecretProperties);
+    /**
+     * The friendly name of the secret, without the ARN suffix.
+     */
+    get name(): string;
+    /**
+     * When the secret is due to be deleted for good, if deletion is scheduled.
+     */
+    get deletionDate(): Date | undefined;
+    /**
+     * Whether the secret is waiting out its recovery window.
+     */
+    get isScheduledForDeletion(): boolean;
+    /**
+     * Schedule the secret for deletion after a recovery window.
+     */
+    scheduleDeletion(deletionDate: Date): void;
+    /**
+     * Cancel a scheduled deletion.
+     *
+     * Real Secrets Manager accepts this whether or not the secret was scheduled,
+     * so a restore of a live secret is a no-op rather than a failure.
+     */
+    cancelDeletion(): void;
+    /**
+     * Refuse an operation that a scheduled secret cannot serve.
+     *
+     * Real Secrets Manager keeps a scheduled secret describable and restorable
+     * while refusing to read or write its value, which is what makes the
+     * recovery window a recovery window.
+     */
+    requireNotScheduledForDeletion(): void;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-secret.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAE3F;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;;GAMG;AACH,qBAAa,uBAAuB;IAClC,SAAgB,GAAG,EAAE,0BAA0B,CAAC;IAChD,SAAgB,WAAW,EAAE,IAAI,CAAC;IAClC,SAAgB,QAAQ,kCAAyC;IAE1D,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC;;;;;;;OAOG;IACI,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAE7B,IAAI,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACtC,eAAe,EAAE,IAAI,CAAC;IAE7B,OAAO,CAAC,qBAAqB,CAAmB;IAEhD,YAAY,UAAU,EAAE,iCAAiC,EAOxD;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAQzC;IAED;;;;;OAKG;IACH,cAAc,IAAI,IAAI,CAErB;IAED;;;;;;OAMG;IACH,8BAA8B,IAAI,IAAI,CASrC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret.js

@@ -0,0 +1,86 @@
+import { SimSecretsManagerInvalidRequestException } from "../error/sim-secrets-manager.error.js";
+import { SimSecretsManagerSecretVersions } from "./sim-secrets-manager-secret-versions.js";
+/**
+ * One stored simulated secret: its identity, its metadata and its versions.
+ *
+ * Deletion state lives here rather than in the store because it is the secret
+ * that behaves differently once it is scheduled: it can still be described and
+ * restored, but it refuses to be read or written.
+ */
+export class SimSecretsManagerSecret {
+    arn;
+    createdDate;
+    versions = new SimSecretsManagerSecretVersions();
+    description;
+    /**
+     * The KMS key the secret says it is encrypted under.
+     *
+     * Nothing is actually encrypted with it and no kms:Decrypt check happens, so
+     * this is looser than real AWS. Simulated KMS is not wired into this service
+     * yet; the value is stored and reported so that code reading it behaves the
+     * same, and the divergence is documented.
+     */
+    kmsKeyId;
+    tags;
+    lastChangedDate;
+    scheduledDeletionDate;
+    constructor(properties) {
+        this.arn = properties.arn;
+        this.createdDate = properties.createdDate;
+        this.lastChangedDate = properties.createdDate;
+        this.description = properties.description;
+        this.kmsKeyId = properties.kmsKeyId;
+        this.tags = properties.tags ?? [];
+    }
+    /**
+     * The friendly name of the secret, without the ARN suffix.
+     */
+    get name() {
+        return this.arn.name;
+    }
+    /**
+     * When the secret is due to be deleted for good, if deletion is scheduled.
+     */
+    get deletionDate() {
+        return this.scheduledDeletionDate;
+    }
+    /**
+     * Whether the secret is waiting out its recovery window.
+     */
+    get isScheduledForDeletion() {
+        return this.scheduledDeletionDate !== undefined;
+    }
+    /**
+     * Schedule the secret for deletion after a recovery window.
+     */
+    scheduleDeletion(deletionDate) {
+        if (this.scheduledDeletionDate !== undefined) {
+            throw new SimSecretsManagerInvalidRequestException(`Secret ${this.arn.value} is already scheduled for deletion`);
+        }
+        this.scheduledDeletionDate = deletionDate;
+    }
+    /**
+     * Cancel a scheduled deletion.
+     *
+     * Real Secrets Manager accepts this whether or not the secret was scheduled,
+     * so a restore of a live secret is a no-op rather than a failure.
+     */
+    cancelDeletion() {
+        this.scheduledDeletionDate = undefined;
+    }
+    /**
+     * Refuse an operation that a scheduled secret cannot serve.
+     *
+     * Real Secrets Manager keeps a scheduled secret describable and restorable
+     * while refusing to read or write its value, which is what makes the
+     * recovery window a recovery window.
+     */
+    requireNotScheduledForDeletion() {
+        if (this.scheduledDeletionDate === undefined) {
+            return;
+        }
+        throw new SimSecretsManagerInvalidRequestException(`Secret ${this.arn.value} is scheduled for deletion and cannot be used. ` +
+            `Restore it with RestoreSecret first.`);
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-secret.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wCAAwC,EAAE,MAAM,uCAAuC,CAAC;AAEjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAkB3F;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IAClB,GAAG,CAA6B;IAChC,WAAW,CAAO;IAClB,QAAQ,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAE1D,WAAW,CAAqB;IAEvC;;;;;;;OAOG;IACI,QAAQ,CAAqB;IAE7B,IAAI,CAAkC;IACtC,eAAe,CAAO;IAErB,qBAAqB,CAAmB;IAEhD,YAAY,UAA6C;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAkB;QACjC,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,wCAAwC,CAChD,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK,oCAAoC,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,IAAI,CAAC,qBAAqB,GAAG,SAAS,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,8BAA8B;QAC5B,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wCAAwC,CAChD,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK,iDAAiD;YACvE,sCAAsC,CACzC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-selector.d.ts

@@ -0,0 +1,28 @@
+import type { SimSecretsManagerSecret } from "./sim-secrets-manager-secret.js";
+import { type SimSecretsManagerSecretVersion } from "./sim-secrets-manager-secret-version.js";
+/**
+ * The version-naming fields a read request can carry.
+ */
+export interface SimSecretsManagerVersionSelection {
+    readonly VersionId?: string | undefined;
+    readonly VersionStage?: string | undefined;
+}
+/**
+ * Picks the version of a secret a read request asks for.
+ *
+ * Real Secrets Manager lets a caller name a version by id, by staging label,
+ * by both, or by neither, and defaults to AWSCURRENT. Keeping those four cases
+ * in one place is what stops the read command being mostly about them.
+ */
+export declare class SimSecretsManagerVersionSelector {
+    /**
+     * Resolve the version a request names, or refuse.
+     *
+     * A request naming both a version id and a staging label has to agree with
+     * itself, as it does on real AWS: the label must be on that very version.
+     */
+    select(secret: SimSecretsManagerSecret, selection: SimSecretsManagerVersionSelection): SimSecretsManagerSecretVersion;
+    private byStage;
+    private byId;
+}
+//# sourceMappingURL=sim-secrets-manager-version-selector.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-selector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-version-selector.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-selector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,KAAK,8BAA8B,EAEpC,MAAM,yCAAyC,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,qBAAa,gCAAgC;IAC3C;;;;;OAKG;IACH,MAAM,CACJ,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,iCAAiC,GAC3C,8BAA8B,CAShC;IAED,OAAO,CAAC,OAAO;IAgBf,OAAO,CAAC,IAAI;CAsBb"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-selector.js

@@ -0,0 +1,43 @@
+import { SimSecretsManagerResourceNotFoundException } from "../error/sim-secrets-manager.error.js";
+import { SimSecretsManagerStagingLabel, } from "./sim-secrets-manager-secret-version.js";
+/**
+ * Picks the version of a secret a read request asks for.
+ *
+ * Real Secrets Manager lets a caller name a version by id, by staging label,
+ * by both, or by neither, and defaults to AWSCURRENT. Keeping those four cases
+ * in one place is what stops the read command being mostly about them.
+ */
+export class SimSecretsManagerVersionSelector {
+    /**
+     * Resolve the version a request names, or refuse.
+     *
+     * A request naming both a version id and a staging label has to agree with
+     * itself, as it does on real AWS: the label must be on that very version.
+     */
+    select(secret, selection) {
+        if (selection.VersionId !== undefined) {
+            return this.byId(secret, selection.VersionId, selection.VersionStage);
+        }
+        return this.byStage(secret, selection.VersionStage ?? SimSecretsManagerStagingLabel.Current);
+    }
+    byStage(secret, stage) {
+        const version = secret.versions.byStage(stage);
+        if (version === undefined) {
+            throw new SimSecretsManagerResourceNotFoundException(`Secrets Manager can't find the specified secret value for staging ` +
+                `label: ${stage}`);
+        }
+        return version;
+    }
+    byId(secret, versionId, stage) {
+        const version = secret.versions.byId(versionId);
+        if (version === undefined) {
+            throw new SimSecretsManagerResourceNotFoundException(`Secrets Manager can't find the specified secret value for ` +
+                `VersionId: ${versionId}`);
+        }
+        if (stage !== undefined && !version.hasStage(stage)) {
+            throw new SimSecretsManagerResourceNotFoundException(`Version ${versionId} does not carry the staging label ${stage}`);
+        }
+        return version;
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-version-selector.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-version-selector.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-selector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,uCAAuC,CAAC;AAEnG,OAAO,EAEL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAUjD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;;;;OAKG;IACH,MAAM,CACJ,MAA+B,EAC/B,SAA4C;QAE5C,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,SAAS,CAAC,YAAY,IAAI,6BAA6B,CAAC,OAAO,CAChE,CAAC;IACJ,CAAC;IAEO,OAAO,CACb,MAA+B,EAC/B,KAAa;QAEb,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAA0C,CAClD,oEAAoE;gBAClE,UAAU,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,IAAI,CACV,MAA+B,EAC/B,SAAiB,EACjB,KAAyB;QAEzB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAA0C,CAClD,4DAA4D;gBAC1D,cAAc,SAAS,EAAE,CAC5B,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,0CAA0C,CAClD,WAAW,SAAS,qCAAqC,KAAK,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.d.ts

@@ -0,0 +1,42 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimSecretsManagerSecret } from "./sim-secrets-manager-secret.js";
+import { SimSecretsManagerSecretVersion } from "./sim-secrets-manager-secret-version.js";
+import type { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+/**
+ * The version-shaping fields a write request can carry.
+ */
+export interface SimSecretsManagerVersionWriteInput {
+    readonly ClientRequestToken?: string | undefined;
+    readonly VersionStages?: readonly string[] | undefined;
+}
+interface SimSecretsManagerVersionWriterProperties {
+    readonly clock: SimClock;
+}
+/**
+ * Writes a new version of a secret, the way every Secrets Manager write does.
+ *
+ * CreateSecret, PutSecretValue and UpdateSecret all end in the same place:
+ * a new version carrying the value, labelled AWSCURRENT unless told otherwise.
+ * Keeping that in one collaborator is what stops the three commands drifting
+ * apart on staging labels or on request-token idempotency.
+ */
+export declare class SimSecretsManagerVersionWriter {
+    private readonly clock;
+    constructor(properties: SimSecretsManagerVersionWriterProperties);
+    /**
+     * Write a value as a new version of a secret.
+     *
+     * A ClientRequestToken becomes the version id, as it does on real AWS. A
+     * repeat of the same token with the same value is ignored, which is what
+     * makes a retried write safe; the same token with a different value is
+     * refused, because a version's value never changes once written.
+     */
+    write(secret: SimSecretsManagerSecret, value: SimSecretsManagerSecretValue, input: SimSecretsManagerVersionWriteInput): SimSecretsManagerSecretVersion;
+    /**
+     * Resolve the staging labels a new version is written with.
+     */
+    private stages;
+    private repeatedWrite;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-version-writer.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-version-writer.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-writer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAKjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,8BAA8B,EAE/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACxD;AAED,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;;;;;OAOG;IACH,KAAK,CACH,MAAM,EAAE,uBAAuB,EAC/B,KAAK,EAAE,4BAA4B,EACnC,KAAK,EAAE,kCAAkC,GACxC,8BAA8B,CAkBhC;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,aAAa;CAatB"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.js

@@ -0,0 +1,60 @@
+import { randomUUID } from "node:crypto";
+import { SimSecretsManagerInvalidParameterException, SimSecretsManagerResourceExistsException, } from "../error/sim-secrets-manager.error.js";
+import { SimSecretsManagerSecretVersion, SimSecretsManagerStagingLabel, } from "./sim-secrets-manager-secret-version.js";
+/**
+ * Writes a new version of a secret, the way every Secrets Manager write does.
+ *
+ * CreateSecret, PutSecretValue and UpdateSecret all end in the same place:
+ * a new version carrying the value, labelled AWSCURRENT unless told otherwise.
+ * Keeping that in one collaborator is what stops the three commands drifting
+ * apart on staging labels or on request-token idempotency.
+ */
+export class SimSecretsManagerVersionWriter {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Write a value as a new version of a secret.
+     *
+     * A ClientRequestToken becomes the version id, as it does on real AWS. A
+     * repeat of the same token with the same value is ignored, which is what
+     * makes a retried write safe; the same token with a different value is
+     * refused, because a version's value never changes once written.
+     */
+    write(secret, value, input) {
+        const versionId = input.ClientRequestToken ?? randomUUID();
+        const existing = secret.versions.byId(versionId);
+        if (existing !== undefined) {
+            return this.repeatedWrite(existing, value);
+        }
+        const version = new SimSecretsManagerSecretVersion({
+            versionId,
+            value,
+            createdDate: this.clock.now(),
+        });
+        secret.versions.add(version, this.stages(input.VersionStages));
+        secret.lastChangedDate = this.clock.now();
+        return version;
+    }
+    /**
+     * Resolve the staging labels a new version is written with.
+     */
+    stages(requested) {
+        if (requested === undefined) {
+            return [SimSecretsManagerStagingLabel.Current];
+        }
+        if (requested.length === 0) {
+            throw new SimSecretsManagerInvalidParameterException("VersionStages must name at least one staging label");
+        }
+        return requested;
+    }
+    repeatedWrite(existing, value) {
+        if (existing.value.equals(value)) {
+            return existing;
+        }
+        throw new SimSecretsManagerResourceExistsException(`Version ${existing.versionId} already exists with a different value. ` +
+            `A secret version cannot be modified once written.`);
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-version-writer.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-version-writer.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAejD;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CACH,MAA+B,EAC/B,KAAmC,EACnC,KAAyC;QAEzC,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,IAAI,UAAU,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAAC;YACjD,SAAS;YACT,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,SAAwC;QACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,0CAA0C,CAClD,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,aAAa,CACnB,QAAwC,EACxC,KAAmC;QAEnC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,wCAAwC,CAChD,WAAW,QAAQ,CAAC,SAAS,0CAA0C;YACrE,mDAAmD,CACtD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/sim-secrets-manager.d.ts

@@ -0,0 +1,85 @@
+import { type BackgroundScheduler } from "../../util/background/background.js";
+import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
+import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimSecretsManagerCfnResourceFactory } from "./cfn/sim-cfn-secrets-manager-resource-factory.js";
+import type * as simSecretsManagerCommands from "./command/sim-secrets-manager-command.types.js";
+import type { SimSecretsManagerSecret } from "./secret/sim-secrets-manager-secret.js";
+export interface SimSecretsManagerRequestOptions {
+    readonly caller?: SimAwsCaller;
+}
+interface SimSecretsManagerProperties {
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated Secrets Manager. Handles SDK commands. Emulates AWS behaviour and
+ * state.
+ *
+ * Secrets are scoped to an account and region, as they are on real AWS: a
+ * secret name is unique within one of those scopes and nowhere wider.
+ */
+export declare class SimSecretsManager {
+    private readonly secrets;
+    private readonly secretCommands;
+    private readonly updateSecretCommand;
+    private readonly lifecycleCommands;
+    private readonly listSecretsCommand;
+    private readonly valueCommands;
+    private readonly background;
+    private readonly sdkRouter;
+    private readonly cfnFactory;
+    constructor(properties?: SimSecretsManagerProperties);
+    /**
+     * Find a secret by friendly name, full ARN or partial ARN.
+     *
+     * This is the simulator's own accessor, for tests seeding or inspecting
+     * secret state without going through a Command and its authorization.
+     */
+    findSecret(secretId: string): SimSecretsManagerSecret | undefined;
+    /**
+     * Handle a CreateSecret Command from the SDK.
+     */
+    createSecret(command: simSecretsManagerCommands.SimCreateSecretCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimCreateSecretCommandOutput>;
+    /**
+     * Handle a DescribeSecret Command from the SDK.
+     */
+    describeSecret(command: simSecretsManagerCommands.SimDescribeSecretCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimDescribeSecretCommandOutput>;
+    /**
+     * Handle an UpdateSecret Command from the SDK.
+     */
+    updateSecret(command: simSecretsManagerCommands.SimUpdateSecretCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimUpdateSecretCommandOutput>;
+    /**
+     * Handle a ListSecrets Command from the SDK.
+     */
+    listSecrets(command: simSecretsManagerCommands.SimListSecretsCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimListSecretsCommandOutput>;
+    /**
+     * Handle a GetSecretValue Command from the SDK.
+     */
+    getSecretValue(command: simSecretsManagerCommands.SimGetSecretValueCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimGetSecretValueCommandOutput>;
+    /**
+     * Handle a PutSecretValue Command from the SDK.
+     */
+    putSecretValue(command: simSecretsManagerCommands.SimPutSecretValueCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimPutSecretValueCommandOutput>;
+    /**
+     * Handle a DeleteSecret Command from the SDK.
+     */
+    deleteSecret(command: simSecretsManagerCommands.SimDeleteSecretCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimDeleteSecretCommandOutput>;
+    /**
+     * Handle a RestoreSecret Command from the SDK.
+     */
+    restoreSecret(command: simSecretsManagerCommands.SimRestoreSecretCommand, options?: SimSecretsManagerRequestOptions): Promise<simSecretsManagerCommands.SimRestoreSecretCommandOutput>;
+    /**
+     * Get this service's CloudFormation Resource factory, which creates
+     * simulated secrets from AWS::SecretsManager::* Resources.
+     */
+    cfnResourceFactory(): SimSecretsManagerCfnResourceFactory;
+    /**
+     * Get this service's SDK Command router for SDK client interception.
+     */
+    sdkCommandRouter(): SimSdkCommandRouter;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager.d.ts.map

package/dist/service/secretsmanager/sim-secrets-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/service/secretsmanager/sim-secrets-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AAMxG,OAAO,KAAK,KAAK,yBAAyB,MAAM,gDAAgD,CAAC;AAEjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAOtF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IACjE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA+B;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+C;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,UAAU,GAAE,2BAAgC,EA+CvD;IAED;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,yBAAyB,CAAC,qBAAqB,EACxD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAGhE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,yBAAyB,CAAC,uBAAuB,EAC1D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,6BAA6B,CAAC,CAGlE;IAED;;;OAGG;IACH,kBAAkB,IAAI,mCAAmC,CAExD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}