@kensio/yulin 0.44.0 → 0.45.0

package/dist/service/dynamodb/time-to-live/sim-dynamodb-time-to-live-specification.js

@@ -0,0 +1,56 @@
+import { SimDynamoDbValidationException } from "../error/dynamodb.error.js";
+/**
+ * DynamoDB attribute names run from 1 to 255 characters.
+ */
+const greatestAttributeNameLength = 255;
+/**
+ * What an UpdateTimeToLive request asks for, once it has been checked.
+ *
+ * Real DynamoDB requires both fields, including when switching time to live
+ * off, so a request naming no attribute is refused rather than read as one
+ * asking to leave the attribute as it was.
+ */
+export class SimDynamoDbTimeToLiveSpecification {
+    attributeName;
+    enabled;
+    constructor(attributeName, enabled) {
+        this.attributeName = attributeName;
+        this.enabled = enabled;
+    }
+    /**
+     * Read the specification a request carries.
+     */
+    static fromInput(input) {
+        if (input === undefined) {
+            throw new SimDynamoDbValidationException(`TimeToLiveSpecification is required to update time to live`);
+        }
+        return new this(this.readAttributeName(input.AttributeName), this.readEnabled(input.Enabled));
+    }
+    /**
+     * The attribute items are expired by.
+     */
+    static readAttributeName(attributeName) {
+        if (attributeName === undefined || attributeName.length === 0) {
+            throw new SimDynamoDbValidationException(`TimeToLiveSpecification.AttributeName is required, naming the ` +
+                `attribute items expire by`);
+        }
+        if (attributeName.length > greatestAttributeNameLength) {
+            throw new SimDynamoDbValidationException(`TimeToLiveSpecification.AttributeName has a length of ` +
+                `${attributeName.length.toString()}, where 1 to ` +
+                `${greatestAttributeNameLength.toString()} characters is what ` +
+                `DynamoDB takes`);
+        }
+        return attributeName;
+    }
+    /**
+     * Whether the request is switching time to live on or off.
+     */
+    static readEnabled(enabled) {
+        if (typeof enabled !== "boolean") {
+            throw new SimDynamoDbValidationException(`TimeToLiveSpecification.Enabled is required, and must be true or ` +
+                `false`);
+        }
+        return enabled;
+    }
+}
+//# sourceMappingURL=sim-dynamodb-time-to-live-specification.js.map

package/dist/service/dynamodb/time-to-live/sim-dynamodb-time-to-live-specification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-dynamodb-time-to-live-specification.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/time-to-live/sim-dynamodb-time-to-live-specification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAE5E;;GAEG;AACH,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,OAAO,kCAAkC;IAC7B,aAAa,CAAS;IACtB,OAAO,CAAU;IAEjC,YAAoB,aAAqB,EAAE,OAAgB;QACzD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CACd,KAA0D;QAE1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,8BAA8B,CACtC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,IAAI,CACb,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,EAC3C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,iBAAiB,CAAC,aAAiC;QAChE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,8BAA8B,CACtC,gEAAgE;gBAC9D,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YACvD,MAAM,IAAI,8BAA8B,CACtC,wDAAwD;gBACtD,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe;gBACjD,GAAG,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB;gBAC/D,gBAAgB,CACnB,CAAC;QACJ,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,WAAW,CAAC,OAA4B;QACrD,IAAI,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,8BAA8B,CACtC,mEAAmE;gBACjE,OAAO,CACV,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/service/dynamodb/time-to-live/sim-dynamodb-time-to-live.d.ts

@@ -0,0 +1,69 @@
+import type { SimDynamoDbTimeToLiveDescription, SimDynamoDbTimeToLiveStatus } from "../command/time-to-live/time-to-live.types.js";
+import type { SimDynamoDbTimeToLiveSpecification } from "./sim-dynamodb-time-to-live-specification.js";
+/**
+ * One table's time to live setting.
+ *
+ * An update moves the status to ENABLING or DISABLING and the scheduled work
+ * settles it on ENABLED or DISABLED, which is the same two-step the table's own
+ * status goes through. Nothing here expires anything: this is what a table
+ * expires items by, and `SimDynamoDbTableExpiry` is what acts on it.
+ */
+export declare class SimDynamoDbTimeToLive {
+    #private;
+    private readonly tableName;
+    constructor(tableName: string);
+    /**
+     * Where this table's time to live is now.
+     */
+    get status(): SimDynamoDbTimeToLiveStatus;
+    /**
+     * The attribute items expire by, while time to live is on.
+     *
+     * ENABLING counts as on and DISABLING as off, since each is on its way to
+     * that state and the scheduled work settles it within the same turn.
+     */
+    enabledAttributeName(): string | undefined;
+    /**
+     * Take an update, refusing one that asks for the state it is already in or
+     * that comes too soon after the last.
+     */
+    update(specification: SimDynamoDbTimeToLiveSpecification, at: Date): void;
+    /**
+     * Finish an update that was scheduled.
+     *
+     * A DISABLED table reports no attribute name, as real DynamoDB reports none,
+     * so the attribute is forgotten rather than left describing a table that no
+     * longer expires anything.
+     */
+    settle(): void;
+    /**
+     * Describe this time to live the way DynamoDB reports it.
+     */
+    description(): SimDynamoDbTimeToLiveDescription;
+    /**
+     * Where an update is heading.
+     */
+    private statusFor;
+    /**
+     * Refuse an update asking for the state the table is already in.
+     *
+     * Real DynamoDB refuses this rather than treating it as a no-op, which is why
+     * code that has to be idempotent reads DescribeTimeToLive first. Changing the
+     * attribute an enabled table expires by means switching time to live off and
+     * on again, since an update that leaves it enabled is refused whatever
+     * attribute it names.
+     */
+    private assertChanges;
+    /**
+     * Whether time to live is on, or on its way to being on.
+     */
+    private get isOn();
+    /**
+     * Refuse a second update inside the hour.
+     *
+     * The hour is measured on the simulation's clock, so a test moves past it
+     * with `simAws.clock().advanceBy({ hours: 1 })` rather than by waiting.
+     */
+    private assertUpdatable;
+}
+//# sourceMappingURL=sim-dynamodb-time-to-live.d.ts.map

package/dist/service/dynamodb/time-to-live/sim-dynamodb-time-to-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-dynamodb-time-to-live.d.ts","sourceRoot":"","sources":["../../../../src/service/dynamodb/time-to-live/sim-dynamodb-time-to-live.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,2BAA2B,EAC5B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAOvG;;;;;;;GAOG;AACH,qBAAa,qBAAqB;;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAKnC,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,2BAA2B,CAExC;IAED;;;;;OAKG;IACH,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAMzC;IAED;;;OAGG;IACH,MAAM,CAAC,aAAa,EAAE,kCAAkC,EAAE,EAAE,EAAE,IAAI,GAAG,IAAI,CAOxE;IAED;;;;;;OAMG;IACH,MAAM,IAAI,IAAI,CAWb;IAED;;OAEG;IACH,WAAW,IAAI,gCAAgC,CAK9C;IAED;;OAEG;IACH,OAAO,CAAC,SAAS;IAQjB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAYrB;;OAEG;IACH,OAAO,KAAK,IAAI,GAEf;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAiBxB"}

package/dist/service/dynamodb/time-to-live/sim-dynamodb-time-to-live.js

@@ -0,0 +1,128 @@
+import { SimDynamoDbValidationException } from "../error/dynamodb.error.js";
+/**
+ * Real DynamoDB takes one UpdateTimeToLive per table per hour.
+ */
+const updateWindowMilliseconds = 60 * 60 * 1000;
+/**
+ * One table's time to live setting.
+ *
+ * An update moves the status to ENABLING or DISABLING and the scheduled work
+ * settles it on ENABLED or DISABLED, which is the same two-step the table's own
+ * status goes through. Nothing here expires anything: this is what a table
+ * expires items by, and `SimDynamoDbTableExpiry` is what acts on it.
+ */
+export class SimDynamoDbTimeToLive {
+    tableName;
+    #status = "DISABLED";
+    #attributeName;
+    #updatedAt;
+    constructor(tableName) {
+        this.tableName = tableName;
+    }
+    /**
+     * Where this table's time to live is now.
+     */
+    get status() {
+        return this.#status;
+    }
+    /**
+     * The attribute items expire by, while time to live is on.
+     *
+     * ENABLING counts as on and DISABLING as off, since each is on its way to
+     * that state and the scheduled work settles it within the same turn.
+     */
+    enabledAttributeName() {
+        if (this.isOn) {
+            return this.#attributeName;
+        }
+        return undefined;
+    }
+    /**
+     * Take an update, refusing one that asks for the state it is already in or
+     * that comes too soon after the last.
+     */
+    update(specification, at) {
+        this.assertChanges(specification.enabled);
+        this.assertUpdatable(at);
+        this.#attributeName = specification.attributeName;
+        this.#updatedAt = at;
+        this.#status = this.statusFor(specification.enabled);
+    }
+    /**
+     * Finish an update that was scheduled.
+     *
+     * A DISABLED table reports no attribute name, as real DynamoDB reports none,
+     * so the attribute is forgotten rather than left describing a table that no
+     * longer expires anything.
+     */
+    settle() {
+        if (this.#status === "ENABLING") {
+            this.#status = "ENABLED";
+            return;
+        }
+        if (this.#status === "DISABLING") {
+            this.#status = "DISABLED";
+            this.#attributeName = undefined;
+        }
+    }
+    /**
+     * Describe this time to live the way DynamoDB reports it.
+     */
+    description() {
+        return {
+            TimeToLiveStatus: this.#status,
+            AttributeName: this.#attributeName,
+        };
+    }
+    /**
+     * Where an update is heading.
+     */
+    statusFor(enabled) {
+        if (enabled) {
+            return "ENABLING";
+        }
+        return "DISABLING";
+    }
+    /**
+     * Refuse an update asking for the state the table is already in.
+     *
+     * Real DynamoDB refuses this rather than treating it as a no-op, which is why
+     * code that has to be idempotent reads DescribeTimeToLive first. Changing the
+     * attribute an enabled table expires by means switching time to live off and
+     * on again, since an update that leaves it enabled is refused whatever
+     * attribute it names.
+     */
+    assertChanges(enabled) {
+        if (enabled !== this.isOn) {
+            return;
+        }
+        throw new SimDynamoDbValidationException(`Time to live on Table ${this.tableName} is already ` +
+            `${this.#status}, and DynamoDB refuses an UpdateTimeToLive asking ` +
+            `for the state it is already in`);
+    }
+    /**
+     * Whether time to live is on, or on its way to being on.
+     */
+    get isOn() {
+        return this.#status === "ENABLED" || this.#status === "ENABLING";
+    }
+    /**
+     * Refuse a second update inside the hour.
+     *
+     * The hour is measured on the simulation's clock, so a test moves past it
+     * with `simAws.clock().advanceBy({ hours: 1 })` rather than by waiting.
+     */
+    assertUpdatable(at) {
+        if (this.#updatedAt === undefined) {
+            return;
+        }
+        const elapsed = at.getTime() - this.#updatedAt.getTime();
+        if (elapsed >= updateWindowMilliseconds) {
+            return;
+        }
+        throw new SimDynamoDbValidationException(`Time to live on Table ${this.tableName} was last updated at ` +
+            `${this.#updatedAt.toISOString()}, and DynamoDB takes one ` +
+            `UpdateTimeToLive per table per hour`);
+    }
+}
+//# sourceMappingURL=sim-dynamodb-time-to-live.js.map

package/dist/service/dynamodb/time-to-live/sim-dynamodb-time-to-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-dynamodb-time-to-live.js","sourceRoot":"","sources":["../../../../src/service/dynamodb/time-to-live/sim-dynamodb-time-to-live.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAG5E;;GAEG;AACH,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACf,SAAS,CAAS;IACnC,OAAO,GAAgC,UAAU,CAAC;IAClD,cAAc,CAAqB;IACnC,UAAU,CAAmB;IAE7B,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,aAAiD,EAAE,EAAQ;QAChE,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAEzB,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,MAAM;QACJ,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YAEzB,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;YAC1B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,OAAO;YAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,OAAgB;QAChC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CAAC,OAAgB;QACpC,IAAI,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,8BAA8B,CACtC,yBAAyB,IAAI,CAAC,SAAS,cAAc;YACnD,GAAG,IAAI,CAAC,OAAO,oDAAoD;YACnE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,EAAQ;QAC9B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAEzD,IAAI,OAAO,IAAI,wBAAwB,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,8BAA8B,CACtC,yBAAyB,IAAI,CAAC,SAAS,uBAAuB;YAC5D,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,2BAA2B;YAC3D,qCAAqC,CACxC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts

@@ -0,0 +1,49 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCreateRoleCommandOutput } from "../command/role/create-role/create-role.command.js";
+/**
+ * What a test asks for when it wants a Role that may do something.
+ *
+ * The actions and the resource are what the test is about. The trust policy,
+ * the policy name and the two commands it takes to get there are the same every
+ * time, so they are not asked for.
+ */
+export interface SimIamRoleWithPolicyInput {
+    readonly roleName: string;
+    readonly policyName: string;
+    readonly actions: readonly string[];
+    readonly resource: string;
+}
+/**
+ * The Role a CreateRole request answers with.
+ */
+export type SimIamCreatedRole = SimCreateRoleCommandOutput["Role"];
+/**
+ * Creates a Role allowed the actions it is given, and nothing else.
+ *
+ * This is the caller an authorization test needs: something to pass as
+ * `{ caller: { kind: "arn", arn: role.Arn } }` that IAM will allow one thing
+ * and refuse another.
+ *
+ * ```typescript
+ * const role = await simIamRoleWithPolicyFactory.make(
+ *   { roleName: "OrderWriter", actions: ["dynamodb:PutItem"] },
+ *   simAws,
+ * );
+ * ```
+ *
+ * The Role is assumable by the Account root of the simulated AWS it is given,
+ * which is the trust every test here wants and none of them is about. A Role
+ * trusted by a service, or one allowed several resources, is two ordinary
+ * commands with `simIamPolicyDocumentFactory` supplying the documents.
+ */
+export declare const simIamRoleWithPolicyFactory: AsyncMappedFactory<SimIamRoleWithPolicyInput, {
+    readonly Path: string;
+    readonly RoleName: string;
+    readonly RoleId: string;
+    readonly Arn: import("../../aws/arn.js").SimArn;
+    readonly CreateDate: Date;
+    readonly AssumeRolePolicyDocument?: string | undefined;
+    readonly Description?: string | undefined;
+}, SimAws>;
+//# sourceMappingURL=sim-iam-role-with-policy.factory.d.ts.map

package/dist/service/iam/role/sim-iam-role-with-policy.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-role-with-policy.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role-with-policy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAGrG;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;UAwCvC,CAAC"}

package/dist/service/iam/role/sim-iam-role-with-policy.factory.js

@@ -0,0 +1,53 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import { simIamPolicyDocumentFactory } from "../policy/sim-iam-policy-document.factory.js";
+/**
+ * Creates a Role allowed the actions it is given, and nothing else.
+ *
+ * This is the caller an authorization test needs: something to pass as
+ * `{ caller: { kind: "arn", arn: role.Arn } }` that IAM will allow one thing
+ * and refuse another.
+ *
+ * ```typescript
+ * const role = await simIamRoleWithPolicyFactory.make(
+ *   { roleName: "OrderWriter", actions: ["dynamodb:PutItem"] },
+ *   simAws,
+ * );
+ * ```
+ *
+ * The Role is assumable by the Account root of the simulated AWS it is given,
+ * which is the trust every test here wants and none of them is about. A Role
+ * trusted by a service, or one allowed several resources, is two ordinary
+ * commands with `simIamPolicyDocumentFactory` supplying the documents.
+ */
+export const simIamRoleWithPolicyFactory = new AsyncMappedFactory(() => ({
+    roleName: "ApplicationRole",
+    policyName: "ApplicationPolicy",
+    actions: [],
+    resource: "*",
+}), async (input, simAws) => {
+    const simIam = simAws.iam();
+    const creation = await simIam.createRole({
+        input: {
+            RoleName: input.roleName,
+            AssumeRolePolicyDocument: simIamPolicyDocumentFactory.make({
+                Statement: {
+                    Principal: {
+                        AWS: `arn:aws:iam::${simAws.defaultAccountId}:root`,
+                    },
+                    Action: "sts:AssumeRole",
+                },
+            }),
+        },
+    });
+    await simIam.putRolePolicy({
+        input: {
+            RoleName: input.roleName,
+            PolicyName: input.policyName,
+            PolicyDocument: simIamPolicyDocumentFactory.make({
+                Statement: { Action: input.actions, Resource: input.resource },
+            }),
+        },
+    });
+    return creation.Role;
+});
+//# sourceMappingURL=sim-iam-role-with-policy.factory.js.map

package/dist/service/iam/role/sim-iam-role-with-policy.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-iam-role-with-policy.factory.js","sourceRoot":"","sources":["../../../../src/service/iam/role/sim-iam-role-with-policy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAqB3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,kBAAkB,CAK/D,GAAG,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,mBAAmB;IAC/B,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,GAAG;CACd,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IAE5B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;QACvC,KAAK,EAAE;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,wBAAwB,EAAE,2BAA2B,CAAC,IAAI,CAAC;gBACzD,SAAS,EAAE;oBACT,SAAS,EAAE;wBACT,GAAG,EAAE,gBAAgB,MAAM,CAAC,gBAAgB,OAAO;qBACpD;oBACD,MAAM,EAAE,gBAAgB;iBACzB;aACF,CAAC;SACH;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,aAAa,CAAC;QACzB,KAAK,EAAE;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,2BAA2B,CAAC,IAAI,CAAC;gBAC/C,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;aAC/D,CAAC;SACH;KACF,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC,CACF,CAAC"}

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.d.ts

@@ -5,41 +5,18 @@ interface SimCfnSqsQueueNameProperties {
 /**
  * The name CloudFormation gives a queue whose template does not name it.
  *
- * Real CloudFormation generates `<stack name>-<logical ID>-<random>`. The
- * random part is left out here so a test can predict the name, which is the one
- * thing a template cannot rely on for real. Everything else follows AWS: two
- * stacks deploying the same template get different queue names, because the
- * stack name is part of it.
- *
  * A queue name is at most 80 characters, so a long stack name and logical ID
- * together are trimmed to fit. The start is kept, since that is where the stack
- * name is, and the trimmed name ends in a hash of the untrimmed one. CDK puts
- * its own disambiguating hash at the end of a logical ID, which is exactly what
- * trimming cuts off, so without that two queues in one stack could end up
- * asking for the same name.
+ * together are trimmed to fit. How a generated name is put together and
+ * trimmed is the same for every service, and lives in
+ * {@link SimCfnGeneratedResourceName}.
  */
 export declare class SimCfnSqsQueueName {
-    private readonly stackName;
-    private readonly logicalId;
+    private readonly generated;
     constructor(properties: SimCfnSqsQueueNameProperties);
     /**
      * The generated queue name.
      */
     get value(): string;
-    /**
-     * The tail a trimmed name ends with, derived from the whole untrimmed name.
-     *
-     * It is a hash rather than the random characters real CloudFormation uses, so
-     * the name stays the same between deployments of the same template.
-     */
-    private distinguisher;
-    /**
-     * The name before it is trimmed to the length SQS allows.
-     *
-     * A Resource created outside a stack has no stack name to derive one from, so
-     * it falls back to the logical ID on its own.
-     */
-    private composed;
 }
 export {};
 //# sourceMappingURL=sim-cfn-sqs-queue-name.d.ts.map

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-sqs-queue-name.d.ts","sourceRoot":"","sources":["../../../../../src/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.ts"],"names":[],"mappings":"AAUA,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,UAAU,EAAE,4BAA4B,EAGnD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,MAAM,CAUlB;IAED;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAOrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;CAOjB"}
+{"version":3,"file":"sim-cfn-sqs-queue-name.d.ts","sourceRoot":"","sources":["../../../../../src/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.ts"],"names":[],"mappings":"AAIA,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;IAExD,YAAY,UAAU,EAAE,4BAA4B,EAMnD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,MAAM,CAElB;CACF"}

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.js

@@ -1,67 +1,27 @@
-import { createHash } from "node:crypto";
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
 const maximumNameLength = 80;
-/**
- * How many characters of the hash of the untrimmed name a trimmed one ends
- * with, so two long names that start the same do not become one name.
- */
-const distinguisherLength = 8;
 /**
  * The name CloudFormation gives a queue whose template does not name it.
  *
- * Real CloudFormation generates `<stack name>-<logical ID>-<random>`. The
- * random part is left out here so a test can predict the name, which is the one
- * thing a template cannot rely on for real. Everything else follows AWS: two
- * stacks deploying the same template get different queue names, because the
- * stack name is part of it.
- *
  * A queue name is at most 80 characters, so a long stack name and logical ID
- * together are trimmed to fit. The start is kept, since that is where the stack
- * name is, and the trimmed name ends in a hash of the untrimmed one. CDK puts
- * its own disambiguating hash at the end of a logical ID, which is exactly what
- * trimming cuts off, so without that two queues in one stack could end up
- * asking for the same name.
+ * together are trimmed to fit. How a generated name is put together and
+ * trimmed is the same for every service, and lives in
+ * {@link SimCfnGeneratedResourceName}.
  */
 export class SimCfnSqsQueueName {
-    stackName;
-    logicalId;
+    generated;
     constructor(properties) {
-        this.stackName = properties.stackName;
-        this.logicalId = properties.logicalId;
+        this.generated = new SimCfnGeneratedResourceName({
+            stackName: properties.stackName,
+            logicalId: properties.logicalId,
+            maximumLength: maximumNameLength,
+        });
     }
     /**
      * The generated queue name.
      */
     get value() {
-        const composed = this.composed();
-        if (composed.length <= maximumNameLength) {
-            return composed;
-        }
-        const kept = composed.slice(0, maximumNameLength - distinguisherLength - 1);
-        return `${kept}-${this.distinguisher(composed)}`;
-    }
-    /**
-     * The tail a trimmed name ends with, derived from the whole untrimmed name.
-     *
-     * It is a hash rather than the random characters real CloudFormation uses, so
-     * the name stays the same between deployments of the same template.
-     */
-    distinguisher(composed) {
-        return createHash("sha1")
-            .update(composed)
-            .digest("hex")
-            .slice(0, distinguisherLength);
-    }
-    /**
-     * The name before it is trimmed to the length SQS allows.
-     *
-     * A Resource created outside a stack has no stack name to derive one from, so
-     * it falls back to the logical ID on its own.
-     */
-    composed() {
-        if (this.stackName === undefined || this.stackName === "") {
-            return this.logicalId;
-        }
-        return `${this.stackName}-${this.logicalId}`;
+        return this.generated.value;
     }
 }
 //# sourceMappingURL=sim-cfn-sqs-queue-name.js.map

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-sqs-queue-name.js","sourceRoot":"","sources":["../../../../../src/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAO9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IACZ,SAAS,CAAqB;IAC9B,SAAS,CAAS;IAEnC,YAAY,UAAwC;QAClD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,QAAQ,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACzC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,CAAC,CAAC,CAAC;QAE5E,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,aAAa,CAAC,QAAgB;QACpC,OAAO,UAAU,CAAC,MAAM,CAAC;aACtB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACK,QAAQ;QACd,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-sqs-queue-name.js","sourceRoot":"","sources":["../../../../../src/service/sqs/cfn/queue/sim-cfn-sqs-queue-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0EAA0E,CAAC;AAEvH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAO7B;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,SAAS,CAA8B;IAExD,YAAY,UAAwC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": {
     "type": "git",
@@ -115,6 +115,7 @@
     "@aws-sdk/client-sqs": "^3.1097.0",
     "@aws-sdk/client-ssm": "^3.1095.0",
     "@aws-sdk/client-sts": "^3.1095.0",
+    "@aws-sdk/lib-dynamodb": "^3.1100.0",
     "@aws-sdk/s3-request-presigner": "^3.1095.0",
     "@eslint/js": "^10.0.1",
     "@kensio/smartass": "^1.34.0",

package/dist/service/dynamodb/command/create-table/create-table-authorizer.d.ts

@@ -1,26 +0,0 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
-import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
-interface CreateTableAuthorizerProperties {
-    readonly iam: SimIamInterServiceAuthZ;
-}
-/**
- * Applies IAM authorization to a DynamoDB CreateTable request.
- *
- * AWS maps the CreateTable API operation to the dynamodb:CreateTable IAM
- * action. The resource is the table ARN being created.
- */
-export declare class CreateTableAuthorizer {
-    private static readonly action;
-    private readonly iam;
-    constructor(properties: CreateTableAuthorizerProperties);
-    /**
-     * Ensure the caller may create a DynamoDB table with the given ARN.
-     *
-     * The caller is passed through unchanged so sim IAM can distinguish an
-     * omitted caller, which defaults to Account root, from an explicit anonymous
-     * caller.
-     */
-    authorize(tableArn: string, caller?: SimAwsCaller): void;
-}
-export {};
-//# sourceMappingURL=create-table-authorizer.d.ts.map

package/dist/service/dynamodb/command/create-table/create-table-authorizer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"create-table-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/dynamodb/command/create-table/create-table-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;GAKG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAExD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcvD;CACF"}

package/dist/service/dynamodb/command/create-table/create-table-authorizer.js

@@ -1,36 +0,0 @@
-import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
-/**
- * Applies IAM authorization to a DynamoDB CreateTable request.
- *
- * AWS maps the CreateTable API operation to the dynamodb:CreateTable IAM
- * action. The resource is the table ARN being created.
- */
-export class CreateTableAuthorizer {
-    static action = "dynamodb:CreateTable";
-    iam;
-    constructor(properties) {
-        this.iam = properties.iam;
-    }
-    /**
-     * Ensure the caller may create a DynamoDB table with the given ARN.
-     *
-     * The caller is passed through unchanged so sim IAM can distinguish an
-     * omitted caller, which defaults to Account root, from an explicit anonymous
-     * caller.
-     */
-    authorize(tableArn, caller) {
-        const decision = this.iam.authorize({
-            action: CreateTableAuthorizer.action,
-            resource: tableArn,
-            caller,
-        });
-        if (decision.isDenied) {
-            throw new SimIamAccessDenied({
-                principal: decision.caller.principal,
-                action: CreateTableAuthorizer.action,
-                resource: tableArn,
-            });
-        }
-    }
-}
-//# sourceMappingURL=create-table-authorizer.js.map

package/dist/service/dynamodb/command/create-table/create-table-authorizer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create-table-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/dynamodb/command/create-table/create-table-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAMzE;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAU,MAAM,GAAG,sBAAsB,CAAC;IAEvC,GAAG,CAA0B;IAE9C,YAAY,UAA2C;QACrD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,QAAgB,EAAE,MAAqB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,qBAAqB,CAAC,MAAM;YACpC,QAAQ,EAAE,QAAQ;YAClB,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,qBAAqB,CAAC,MAAM;gBACpC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}