@kensio/yulin 0.38.0 → 0.40.0

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-character-sets.js

@@ -0,0 +1,66 @@
+import { SimSecretsManagerInvalidParameterException } from "../../error/sim-secrets-manager.error.js";
+import { secretsManagerPasswordCharacters, SimSecretsManagerPasswordCharacterSet, } from "./sim-secrets-manager-password-character-set.js";
+/**
+ * The character sets one generated password is allowed to draw on.
+ *
+ * The `Exclude*` flags decide which types are included at all, and
+ * `ExcludeCharacters` then narrows each included type. Keeping the types apart
+ * rather than merging them into one alphabet is what lets
+ * `RequireEachIncludedType` mean anything.
+ */
+export class SimSecretsManagerPasswordCharacterSets {
+    included;
+    constructor(options = {}) {
+        this.included = SimSecretsManagerPasswordCharacterSets.include(options);
+    }
+    static include(options) {
+        const excluded = options.excludeCharacters ?? "";
+        const candidates = secretsManagerPasswordCharacters
+            .filter((set) => {
+            return this.isIncluded(set.name, options);
+        })
+            .map((set) => {
+            return new SimSecretsManagerPasswordCharacterSet(set.name, set.characters).without(excluded);
+        });
+        for (const set of candidates) {
+            set.requireNotEmpty();
+        }
+        if (candidates.length === 0) {
+            throw new SimSecretsManagerInvalidParameterException("A generated password needs at least one character type: every one " +
+                "of uppercase, lowercase, numbers and punctuation was excluded");
+        }
+        return candidates;
+    }
+    /**
+     * Whether a character type is included, by the flag that governs it.
+     *
+     * Every type but the space is included unless excluded; the space is the
+     * other way round, as it is on real AWS.
+     */
+    static isIncluded(name, options) {
+        switch (name) {
+            case "uppercase": {
+                return options.excludeUppercase !== true;
+            }
+            case "lowercase": {
+                return options.excludeLowercase !== true;
+            }
+            case "numbers": {
+                return options.excludeNumbers !== true;
+            }
+            case "punctuation": {
+                return options.excludePunctuation !== true;
+            }
+            case "space": {
+                return options.includeSpace === true;
+            }
+        }
+    }
+    /**
+     * Every character any included type allows, as one pool.
+     */
+    get alphabet() {
+        return this.included.map((set) => set.characters).join("");
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-password-character-sets.js.map

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-character-sets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-password-character-sets.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/secret/generate/sim-secrets-manager-password-character-sets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,0CAA0C,CAAC;AACtG,OAAO,EACL,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,iDAAiD,CAAC;AAiBzD;;;;;;;GAOG;AACH,MAAM,OAAO,sCAAsC;IACjC,QAAQ,CAAmD;IAE3E,YAAY,OAAO,GAA8C,EAAE;QACjE,IAAI,CAAC,QAAQ,GAAG,sCAAsC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,OAAO,CACpB,OAAkD;QAElD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,gCAAgC;aAChD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,OAAO,IAAI,qCAAqC,CAC9C,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,UAAU,CACf,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEL,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,0CAA0C,CAClD,oEAAoE;gBAClE,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,UAAU,CACvB,IAA+D,EAC/D,OAAkD;QAElD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,WAAW,EAAE,CAAC;gBACjB,OAAO,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC;YAC3C,CAAC;YACD,KAAK,WAAW,EAAE,CAAC;gBACjB,OAAO,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC;YAC3C,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC;YACzC,CAAC;YACD,KAAK,aAAa,EAAE,CAAC;gBACnB,OAAO,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC;YAC7C,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-generator.d.ts

@@ -0,0 +1,31 @@
+import type { SimSecretsManagerPasswordSpec } from "./sim-secrets-manager-password-spec.js";
+/**
+ * Generates the random passwords Secrets Manager generates.
+ *
+ * The randomness is real rather than seedable: a test that wants the value
+ * reads it back out of the simulation, the same way a deployed application
+ * does, rather than predicting it. A predictable generator would make a test
+ * pass for a reason that says nothing about the deployed system.
+ */
+export declare class SimSecretsManagerPasswordGenerator {
+    /**
+     * Generate one password meeting a validated spec.
+     *
+     * Each required type contributes a character first and the rest is drawn
+     * from the whole pool, then the result is shuffled so the required
+     * characters do not always land at the front.
+     */
+    generate(spec: SimSecretsManagerPasswordSpec): string;
+    private requiredCharacters;
+    /**
+     * Pick one character uniformly, without the modulo bias a raw random byte
+     * would introduce.
+     */
+    private pick;
+    /**
+     * Take characters from the pool at random until it is empty, which is the
+     * Fisher-Yates shuffle written as a drawing rather than as index swaps.
+     */
+    private shuffled;
+}
+//# sourceMappingURL=sim-secrets-manager-password-generator.d.ts.map

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-password-generator.d.ts","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/secret/generate/sim-secrets-manager-password-generator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F;;;;;;;GAOG;AACH,qBAAa,kCAAkC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,6BAA6B,GAAG,MAAM,CASpD;IAED,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,IAAI;IAIZ;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAUjB"}

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-generator.js

@@ -0,0 +1,52 @@
+import { randomInt } from "node:crypto";
+/**
+ * Generates the random passwords Secrets Manager generates.
+ *
+ * The randomness is real rather than seedable: a test that wants the value
+ * reads it back out of the simulation, the same way a deployed application
+ * does, rather than predicting it. A predictable generator would make a test
+ * pass for a reason that says nothing about the deployed system.
+ */
+export class SimSecretsManagerPasswordGenerator {
+    /**
+     * Generate one password meeting a validated spec.
+     *
+     * Each required type contributes a character first and the rest is drawn
+     * from the whole pool, then the result is shuffled so the required
+     * characters do not always land at the front.
+     */
+    generate(spec) {
+        const characters = this.requiredCharacters(spec);
+        const alphabet = spec.characterSets.alphabet;
+        while (characters.length < spec.length) {
+            characters.push(this.pick(alphabet));
+        }
+        return this.shuffled(characters).join("");
+    }
+    requiredCharacters(spec) {
+        if (!spec.requireEachIncludedType) {
+            return [];
+        }
+        return spec.characterSets.included.map((set) => this.pick(set.characters));
+    }
+    /**
+     * Pick one character uniformly, without the modulo bias a raw random byte
+     * would introduce.
+     */
+    pick(characters) {
+        return characters.charAt(randomInt(characters.length));
+    }
+    /**
+     * Take characters from the pool at random until it is empty, which is the
+     * Fisher-Yates shuffle written as a drawing rather than as index swaps.
+     */
+    shuffled(characters) {
+        const pool = [...characters];
+        const shuffled = [];
+        while (pool.length > 0) {
+            shuffled.push(...pool.splice(randomInt(pool.length), 1));
+        }
+        return shuffled;
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-password-generator.js.map

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-password-generator.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/secret/generate/sim-secrets-manager-password-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC;;;;;;;GAOG;AACH,MAAM,OAAO,kCAAkC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAmC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAE7C,OAAO,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,IAAmC;QAC5D,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACK,IAAI,CAAC,UAAkB;QAC7B,OAAO,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,UAA6B;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-spec.d.ts

@@ -0,0 +1,35 @@
+import type { SimSecretsManagerPasswordCharacterOptions } from "./sim-secrets-manager-password-character-sets.js";
+import { SimSecretsManagerPasswordCharacterSets } from "./sim-secrets-manager-password-character-sets.js";
+/**
+ * Everything a Secrets Manager password request can ask for.
+ */
+export interface SimSecretsManagerPasswordOptions extends SimSecretsManagerPasswordCharacterOptions {
+    readonly passwordLength?: number | undefined;
+    readonly requireEachIncludedType?: boolean | undefined;
+}
+/**
+ * A validated request for one generated password.
+ *
+ * Validation lives here rather than in the generator so a contradictory
+ * request — a length of zero, or four required character types in a
+ * three-character password — is refused when it is described rather than
+ * silently honoured in part when it is generated.
+ */
+export declare class SimSecretsManagerPasswordSpec {
+    readonly length: number;
+    readonly characterSets: SimSecretsManagerPasswordCharacterSets;
+    /**
+     * Whether every included character type has to appear at least once.
+     *
+     * Real Secrets Manager defaults this on, so a generated password contains
+     * one of everything it was not told to exclude.
+     */
+    readonly requireEachIncludedType: boolean;
+    constructor(options?: SimSecretsManagerPasswordOptions);
+    private static validLength;
+    /**
+     * Refuse a password too short to hold one of each required type.
+     */
+    private requireTypesFit;
+}
+//# sourceMappingURL=sim-secrets-manager-password-spec.d.ts.map

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-password-spec.d.ts","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/secret/generate/sim-secrets-manager-password-spec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,kDAAkD,CAAC;AAClH,OAAO,EAAE,sCAAsC,EAAE,MAAM,kDAAkD,CAAC;AAU1G;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yCAAyC;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxD;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA6B;IACxC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,aAAa,EAAE,sCAAsC,CAAC;IAEtE;;;;;OAKG;IACH,SAAgB,uBAAuB,EAAE,OAAO,CAAC;IAEjD,YAAY,OAAO,GAAE,gCAAqC,EAQzD;IAED,OAAO,CAAC,MAAM,CAAC,WAAW;IAsB1B;;OAEG;IACH,OAAO,CAAC,eAAe;CAiBxB"}

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-spec.js

@@ -0,0 +1,64 @@
+import { SimSecretsManagerInvalidParameterException } from "../../error/sim-secrets-manager.error.js";
+import { SimSecretsManagerPasswordCharacterSets } from "./sim-secrets-manager-password-character-sets.js";
+/**
+ * The length real Secrets Manager generates when a request does not ask for
+ * one, and the range it accepts.
+ */
+const defaultPasswordLength = 32;
+const minimumPasswordLength = 1;
+const maximumPasswordLength = 4096;
+/**
+ * A validated request for one generated password.
+ *
+ * Validation lives here rather than in the generator so a contradictory
+ * request — a length of zero, or four required character types in a
+ * three-character password — is refused when it is described rather than
+ * silently honoured in part when it is generated.
+ */
+export class SimSecretsManagerPasswordSpec {
+    length;
+    characterSets;
+    /**
+     * Whether every included character type has to appear at least once.
+     *
+     * Real Secrets Manager defaults this on, so a generated password contains
+     * one of everything it was not told to exclude.
+     */
+    requireEachIncludedType;
+    constructor(options = {}) {
+        this.length = SimSecretsManagerPasswordSpec.validLength(options.passwordLength);
+        this.characterSets = new SimSecretsManagerPasswordCharacterSets(options);
+        this.requireEachIncludedType = options.requireEachIncludedType !== false;
+        this.requireTypesFit();
+    }
+    static validLength(length) {
+        if (length === undefined) {
+            return defaultPasswordLength;
+        }
+        if (!Number.isSafeInteger(length)) {
+            throw new SimSecretsManagerInvalidParameterException(`PasswordLength ${String(length)} must be a whole number`);
+        }
+        if (length < minimumPasswordLength || length > maximumPasswordLength) {
+            throw new SimSecretsManagerInvalidParameterException(`PasswordLength ${String(length)} must be between ` +
+                `${String(minimumPasswordLength)} and ` +
+                `${String(maximumPasswordLength)} characters`);
+        }
+        return length;
+    }
+    /**
+     * Refuse a password too short to hold one of each required type.
+     */
+    requireTypesFit() {
+        if (!this.requireEachIncludedType) {
+            return;
+        }
+        const typeCount = this.characterSets.included.length;
+        if (typeCount <= this.length) {
+            return;
+        }
+        throw new SimSecretsManagerInvalidParameterException(`PasswordLength ${String(this.length)} is too short to include one of ` +
+            `each of the ${String(typeCount)} character types the request ` +
+            `requires. Exclude a character type or ask for a longer password.`);
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-password-spec.js.map

package/dist/service/secretsmanager/secret/generate/sim-secrets-manager-password-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-password-spec.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/secret/generate/sim-secrets-manager-password-spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,0CAA0C,CAAC;AAEtG,OAAO,EAAE,sCAAsC,EAAE,MAAM,kDAAkD,CAAC;AAE1G;;;GAGG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAUnC;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA6B;IACxB,MAAM,CAAS;IACf,aAAa,CAAyC;IAEtE;;;;;OAKG;IACa,uBAAuB,CAAU;IAEjD,YAAY,OAAO,GAAqC,EAAE;QACxD,IAAI,CAAC,MAAM,GAAG,6BAA6B,CAAC,WAAW,CACrD,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,sCAAsC,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,KAAK,KAAK,CAAC;QAEzE,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,MAA0B;QACnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,0CAA0C,CAClD,kBAAkB,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,GAAG,qBAAqB,IAAI,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACrE,MAAM,IAAI,0CAA0C,CAClD,kBAAkB,MAAM,CAAC,MAAM,CAAC,mBAAmB;gBACjD,GAAG,MAAM,CAAC,qBAAqB,CAAC,OAAO;gBACvC,GAAG,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAChD,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QAErD,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,0CAA0C,CAClD,kBAAkB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,kCAAkC;YACrE,eAAe,MAAM,CAAC,SAAS,CAAC,+BAA+B;YAC/D,kEAAkE,CACrE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-deletion-schedule.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The two ways a DeleteSecret request can ask for a secret to go.
+ */
+export interface SimSecretsManagerDeletionScheduleInput {
+    readonly RecoveryWindowInDays?: number | undefined;
+    readonly ForceDeleteWithoutRecovery?: boolean | undefined;
+}
+/**
+ * How soon a DeleteSecret request wants the secret gone.
+ *
+ * Real Secrets Manager does not delete on request: it waits out a recovery
+ * window of 7 to 30 days, defaulting to 30, during which the secret can be
+ * restored and its name cannot be reused. ForceDeleteWithoutRecovery skips
+ * that, and asking for both at once is a contradiction real AWS refuses.
+ */
+export declare class SimSecretsManagerDeletionSchedule {
+    readonly isImmediate: boolean;
+    /**
+     * The recovery window in days, or undefined when deletion is immediate.
+     */
+    readonly recoveryWindowInDays: number | undefined;
+    constructor(input: SimSecretsManagerDeletionScheduleInput);
+    private static refuseWindowWithForce;
+    private static validatedDays;
+    /**
+     * When the secret is due to be gone for good.
+     *
+     * An immediate deletion is due now, which is what makes the name reusable
+     * straight away.
+     */
+    deletionDateFrom(now: Date): Date;
+}
+//# sourceMappingURL=sim-secrets-manager-deletion-schedule.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-deletion-schedule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-deletion-schedule.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-deletion-schedule.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC3D;AAED;;;;;;;GAOG;AACH,qBAAa,iCAAiC;IAC5C,SAAgB,WAAW,EAAE,OAAO,CAAC;IAErC;;OAEG;IACH,SAAgB,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzD,YAAY,KAAK,EAAE,sCAAsC,EAgBxD;IAED,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAWpC,OAAO,CAAC,MAAM,CAAC,aAAa;IAc5B;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAQhC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-deletion-schedule.js

@@ -0,0 +1,60 @@
+import { SimSecretsManagerInvalidParameterException } from "../error/sim-secrets-manager.error.js";
+const minDays = 7;
+const maxDays = 30;
+const defaultDays = 30;
+const millisecondsPerDay = 24 * 60 * 60 * 1000;
+/**
+ * How soon a DeleteSecret request wants the secret gone.
+ *
+ * Real Secrets Manager does not delete on request: it waits out a recovery
+ * window of 7 to 30 days, defaulting to 30, during which the secret can be
+ * restored and its name cannot be reused. ForceDeleteWithoutRecovery skips
+ * that, and asking for both at once is a contradiction real AWS refuses.
+ */
+export class SimSecretsManagerDeletionSchedule {
+    isImmediate;
+    /**
+     * The recovery window in days, or undefined when deletion is immediate.
+     */
+    recoveryWindowInDays;
+    constructor(input) {
+        const { RecoveryWindowInDays: requestedDays, ForceDeleteWithoutRecovery: forced, } = input;
+        this.isImmediate = forced === true;
+        if (this.isImmediate) {
+            SimSecretsManagerDeletionSchedule.refuseWindowWithForce(requestedDays);
+            this.recoveryWindowInDays = undefined;
+            return;
+        }
+        this.recoveryWindowInDays =
+            SimSecretsManagerDeletionSchedule.validatedDays(requestedDays);
+    }
+    static refuseWindowWithForce(days) {
+        if (days === undefined) {
+            return;
+        }
+        throw new SimSecretsManagerInvalidParameterException("RecoveryWindowInDays cannot be used with ForceDeleteWithoutRecovery: " +
+            "a forced deletion has no recovery window");
+    }
+    static validatedDays(days) {
+        if (days === undefined) {
+            return defaultDays;
+        }
+        if (!Number.isSafeInteger(days) || days < minDays || days > maxDays) {
+            throw new SimSecretsManagerInvalidParameterException(`RecoveryWindowInDays must be a whole number between ${String(minDays)} and ${String(maxDays)}`);
+        }
+        return days;
+    }
+    /**
+     * When the secret is due to be gone for good.
+     *
+     * An immediate deletion is due now, which is what makes the name reusable
+     * straight away.
+     */
+    deletionDateFrom(now) {
+        if (this.recoveryWindowInDays === undefined) {
+            return now;
+        }
+        return new Date(now.getTime() + this.recoveryWindowInDays * millisecondsPerDay);
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-deletion-schedule.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-deletion-schedule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-deletion-schedule.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-deletion-schedule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,uCAAuC,CAAC;AAEnG,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAU/C;;;;;;;GAOG;AACH,MAAM,OAAO,iCAAiC;IAC5B,WAAW,CAAU;IAErC;;OAEG;IACa,oBAAoB,CAAqB;IAEzD,YAAY,KAA6C;QACvD,MAAM,EACJ,oBAAoB,EAAE,aAAa,EACnC,0BAA0B,EAAE,MAAM,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,WAAW,GAAG,MAAM,KAAK,IAAI,CAAC;QAEnC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iCAAiC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,oBAAoB;YACvB,iCAAiC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IACnE,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,IAAwB;QAC3D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,0CAA0C,CAClD,uEAAuE;YACrE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,IAAwB;QACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;YACpE,MAAM,IAAI,0CAA0C,CAClD,uDAAuD,MAAM,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,GAAS;QACxB,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,IAAI,IAAI,CACb,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,oBAAoB,GAAG,kBAAkB,CAC/D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-arn.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+export declare const secretArnSuffixLength = 6;
+/**
+ * A name already carrying something shaped like an ARN suffix.
+ *
+ * This is the pattern that makes a partial ARN ambiguous, so both ARN building
+ * and secret name validation need it.
+ */
+export declare const secretArnSuffixPattern: RegExp;
+interface SimSecretsManagerSecretArnProperties {
+    readonly name: string;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly suffix?: string | undefined;
+}
+/**
+ * The ARN of one simulated secret, and the parts a caller can name it by.
+ *
+ * Real Secrets Manager appends a hyphen and six random characters to the
+ * secret name in its ARN, which is why an IAM policy written against a secret
+ * has to end in `-??????` or a wildcard rather than the bare name. Reproducing
+ * that is the whole point of this class: a policy that works here is one that
+ * would work on real AWS.
+ */
+export declare class SimSecretsManagerSecretArn {
+    readonly name: string;
+    readonly suffix: string;
+    /**
+     * The name with its ARN suffix, which is the resource part of the ARN.
+     */
+    readonly suffixedName: string;
+    readonly value: string;
+    constructor(properties: SimSecretsManagerSecretArnProperties);
+    /**
+     * Whether a resource part from a full or partial ARN names this secret.
+     *
+     * A full ARN carries the suffix and a partial ARN does not, and both are
+     * valid ways to name a secret on real AWS.
+     */
+    matchesResource(resource: string): boolean;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-secret-arn.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-arn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAS1F,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAoB,CAAC;AAgBxD,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA0B;IACrC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,UAAU,EAAE,oCAAoC,EAS3D;IAED;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-arn.js

@@ -0,0 +1,64 @@
+import { randomBytes } from "node:crypto";
+/**
+ * The alphabet and length of the suffix real Secrets Manager appends to a
+ * secret ARN.
+ */
+const suffixAlphabet = 
+// eslint-disable-next-line no-secrets/no-secrets -- an alphabet, not a secret.
+"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+export const secretArnSuffixLength = 6;
+/**
+ * A name already carrying something shaped like an ARN suffix.
+ *
+ * This is the pattern that makes a partial ARN ambiguous, so both ARN building
+ * and secret name validation need it.
+ */
+export const secretArnSuffixPattern = /-[\dA-Za-z]{6}$/;
+/**
+ * Six random characters, as real Secrets Manager appends to every secret ARN.
+ */
+function randomSuffix() {
+    const bytes = randomBytes(secretArnSuffixLength);
+    let suffix = "";
+    for (const byte of bytes) {
+        suffix += suffixAlphabet.charAt(byte % suffixAlphabet.length);
+    }
+    return suffix;
+}
+/**
+ * The ARN of one simulated secret, and the parts a caller can name it by.
+ *
+ * Real Secrets Manager appends a hyphen and six random characters to the
+ * secret name in its ARN, which is why an IAM policy written against a secret
+ * has to end in `-??????` or a wildcard rather than the bare name. Reproducing
+ * that is the whole point of this class: a policy that works here is one that
+ * would work on real AWS.
+ */
+export class SimSecretsManagerSecretArn {
+    name;
+    suffix;
+    /**
+     * The name with its ARN suffix, which is the resource part of the ARN.
+     */
+    suffixedName;
+    value;
+    constructor(properties) {
+        const { name, accountRegionScope, suffix = randomSuffix() } = properties;
+        this.name = name;
+        this.suffix = suffix;
+        this.suffixedName = `${name}-${suffix}`;
+        this.value =
+            `arn:aws:secretsmanager:${accountRegionScope.regionName}:` +
+                `${accountRegionScope.accountId}:secret:${this.suffixedName}`;
+    }
+    /**
+     * Whether a resource part from a full or partial ARN names this secret.
+     *
+     * A full ARN carries the suffix and a partial ARN does not, and both are
+     * valid ways to name a secret on real AWS.
+     */
+    matchesResource(resource) {
+        return resource === this.suffixedName || resource === this.name;
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-secret-arn.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-arn.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C;;;GAGG;AACH,MAAM,cAAc;AAClB,+EAA+E;AAC/E,gEAAgE,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAExD;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACjD,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA0B;IACrB,IAAI,CAAS;IACb,MAAM,CAAS;IAE/B;;OAEG;IACa,YAAY,CAAS;IAErB,KAAK,CAAS;IAE9B,YAAY,UAAgD;QAC1D,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,GAAG,YAAY,EAAE,EAAE,GAAG,UAAU,CAAC;QAEzE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK;YACR,0BAA0B,kBAAkB,CAAC,UAAU,GAAG;gBAC1D,GAAG,kBAAkB,CAAC,SAAS,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,QAAgB;QAC9B,OAAO,QAAQ,KAAK,IAAI,CAAC,YAAY,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC;IAClE,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-expiry.d.ts

@@ -0,0 +1,30 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimSecretsManagerSecret } from "./sim-secrets-manager-secret.js";
+import type { SimSecretsManagerSecretStore } from "./sim-secrets-manager-secret-store.js";
+interface SimSecretsManagerSecretExpiryProperties {
+    readonly secrets: SimSecretsManagerSecretStore;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * Removes a secret once its recovery window runs out.
+ *
+ * The window is scheduled on the simulation's clock rather than the host's, so
+ * advancing simulated time past it is what frees the name up again. That is
+ * the failure people actually hit when a stack is deleted and redeployed, and
+ * it is only testable if the window really elapses.
+ */
+export declare class SimSecretsManagerSecretExpiry {
+    private readonly secrets;
+    private readonly background;
+    constructor(properties: SimSecretsManagerSecretExpiryProperties);
+    /**
+     * Arrange for a secret to be gone once its deletion date arrives.
+     *
+     * The scheduled work checks the secret is still due to go at that same
+     * instant, so a RestoreSecret in the meantime, or a second deletion with a
+     * different window, leaves the earlier schedule with nothing to do.
+     */
+    scheduleRemoval(secret: SimSecretsManagerSecret, deletionDate: Date): void;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-secret-expiry.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-expiry.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-expiry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;;;;;OAMG;IACH,eAAe,CAAC,MAAM,EAAE,uBAAuB,EAAE,YAAY,EAAE,IAAI,GAAG,IAAI,CAQzE;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-expiry.js

@@ -0,0 +1,32 @@
+/**
+ * Removes a secret once its recovery window runs out.
+ *
+ * The window is scheduled on the simulation's clock rather than the host's, so
+ * advancing simulated time past it is what frees the name up again. That is
+ * the failure people actually hit when a stack is deleted and redeployed, and
+ * it is only testable if the window really elapses.
+ */
+export class SimSecretsManagerSecretExpiry {
+    secrets;
+    background;
+    constructor(properties) {
+        this.secrets = properties.secrets;
+        this.background = properties.background;
+    }
+    /**
+     * Arrange for a secret to be gone once its deletion date arrives.
+     *
+     * The scheduled work checks the secret is still due to go at that same
+     * instant, so a RestoreSecret in the meantime, or a second deletion with a
+     * different window, leaves the earlier schedule with nothing to do.
+     */
+    scheduleRemoval(secret, deletionDate) {
+        this.background.scheduleAt(deletionDate, () => {
+            if (secret.deletionDate?.getTime() === deletionDate.getTime()) {
+                this.secrets.remove(secret);
+            }
+            return Promise.resolve();
+        });
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-secret-expiry.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-expiry.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-expiry.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA6B;IACvB,OAAO,CAA+B;IACtC,UAAU,CAAsB;IAEjD,YAAY,UAAmD;QAC7D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,MAA+B,EAAE,YAAkB;QACjE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,EAAE,GAAkB,EAAE;YAC3D,IAAI,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-factory.d.ts

@@ -0,0 +1,31 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { SimSecretsManagerSecret, type SimSecretsManagerTag } from "./sim-secrets-manager-secret.js";
+interface SimSecretsManagerSecretFactoryProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly clock: SimClock;
+}
+interface SimSecretsManagerMakeSecretProperties {
+    readonly name: string | undefined;
+    readonly description?: string | undefined;
+    readonly kmsKeyId?: string | undefined;
+    readonly tags?: readonly SimSecretsManagerTag[] | undefined;
+}
+/**
+ * Builds simulated secrets, including their name validation and their ARN.
+ *
+ * Creation has to produce a validated name, an ARN carrying the random suffix
+ * that name gets, and a creation timestamp from the simulation's clock, so it
+ * happens in one place rather than at each call site that needs a secret.
+ */
+export declare class SimSecretsManagerSecretFactory {
+    private readonly accountRegionScope;
+    private readonly clock;
+    constructor(properties: SimSecretsManagerSecretFactoryProperties);
+    /**
+     * Make a new secret with no versions yet.
+     */
+    make(properties: SimSecretsManagerMakeSecretProperties): SimSecretsManagerSecret;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-secret-factory.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EACL,uBAAuB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAIzC,UAAU,wCAAwC;IAChD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;;GAMG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAG/D;IAED;;OAEG;IACH,IAAI,CACF,UAAU,EAAE,qCAAqC,GAChD,uBAAuB,CAazB;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-factory.js

@@ -0,0 +1,35 @@
+import { SimSecretsManagerSecret, } from "./sim-secrets-manager-secret.js";
+import { SimSecretsManagerSecretArn } from "./sim-secrets-manager-secret-arn.js";
+import { SimSecretsManagerSecretName } from "./sim-secrets-manager-secret-name.js";
+/**
+ * Builds simulated secrets, including their name validation and their ARN.
+ *
+ * Creation has to produce a validated name, an ARN carrying the random suffix
+ * that name gets, and a creation timestamp from the simulation's clock, so it
+ * happens in one place rather than at each call site that needs a secret.
+ */
+export class SimSecretsManagerSecretFactory {
+    accountRegionScope;
+    clock;
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
+        this.clock = properties.clock;
+    }
+    /**
+     * Make a new secret with no versions yet.
+     */
+    make(properties) {
+        const name = new SimSecretsManagerSecretName(properties.name);
+        return new SimSecretsManagerSecret({
+            arn: new SimSecretsManagerSecretArn({
+                name: name.value,
+                accountRegionScope: this.accountRegionScope,
+            }),
+            createdDate: this.clock.now(),
+            description: properties.description,
+            kmsKeyId: properties.kmsKeyId,
+            tags: properties.tags,
+        });
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-secret-factory.js.map