@kensio/yulin 1.12.1 → 1.14.0

package/dist/service/ecs/task/run/secret/sim-aws-ecs-secret-stores.d.ts

@@ -0,0 +1,46 @@
+import type { SimAwsAccountRegionScope } from "../../../../aws/sim-aws-account-region-scope.js";
+import type { SimAws } from "../../../../aws/sim-aws.js";
+import type { SimEcsSecretRead, SimEcsSecretStores } from "./sim-ecs-secret-stores.js";
+interface SimAwsEcsSecretStoresProperties {
+    readonly simAws: SimAws;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The simulated Secrets Manager and SSM Parameter Store of one simulated AWS
+ * instance, as the places a task's container secrets are read from.
+ *
+ * The store is reached when a task starts, never when this is built, for the
+ * same reason S3's notification destinations do it that way: reaching another
+ * service while this one is being constructed is a cycle with no bottom to it.
+ *
+ * A reference naming another Account or Region is read there. Real ECS requires
+ * a secret to be in the task's own Region and allows another Account's through
+ * a resource policy, but a reference carries the scope it names either way, and
+ * reading it where it says it is keeps a wrong Region a missing secret rather
+ * than a secret of the same name in the task's own.
+ */
+export declare class SimAwsEcsSecretStores implements SimEcsSecretStores {
+    private readonly simAws;
+    private readonly accountRegionScope;
+    constructor(properties: SimAwsEcsSecretStoresProperties);
+    /**
+     * Read one secret's value as the caller the request names.
+     */
+    read(request: SimEcsSecretRead): Promise<string>;
+    private secretString;
+    /**
+     * Read a parameter, decrypting it, as a real task agent does.
+     *
+     * `WithDecryption` is always on, because a `SecureString` is the only kind of
+     * parameter worth putting in `secrets` and a real task gets its plaintext.
+     * Parameter Store ignores the flag for the types it stores in the clear.
+     */
+    private parameterValue;
+    /**
+     * The Account and Region a reference is read in, which is the task's own
+     * where the reference named none.
+     */
+    private scopeFor;
+}
+export {};
+//# sourceMappingURL=sim-aws-ecs-secret-stores.d.ts.map

package/dist/service/ecs/task/run/secret/sim-aws-ecs-secret-stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-ecs-secret-stores.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-aws-ecs-secret-stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAGpC,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrD;YAEa,YAAY;IA6B1B;;;;;;OAMG;YACW,cAAc;IAkB5B;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAQjB"}

package/dist/service/ecs/task/run/secret/sim-aws-ecs-secret-stores.js

@@ -0,0 +1,78 @@
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * The simulated Secrets Manager and SSM Parameter Store of one simulated AWS
+ * instance, as the places a task's container secrets are read from.
+ *
+ * The store is reached when a task starts, never when this is built, for the
+ * same reason S3's notification destinations do it that way: reaching another
+ * service while this one is being constructed is a cycle with no bottom to it.
+ *
+ * A reference naming another Account or Region is read there. Real ECS requires
+ * a secret to be in the task's own Region and allows another Account's through
+ * a resource policy, but a reference carries the scope it names either way, and
+ * reading it where it says it is keeps a wrong Region a missing secret rather
+ * than a secret of the same name in the task's own.
+ */
+export class SimAwsEcsSecretStores {
+    simAws;
+    accountRegionScope;
+    constructor(properties) {
+        this.simAws = properties.simAws;
+        this.accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Read one secret's value as the caller the request names.
+     */
+    async read(request) {
+        if (request.reference.store === "secretsmanager") {
+            return await this.secretString(request);
+        }
+        return await this.parameterValue(request);
+    }
+    async secretString(request) {
+        const { reference } = request;
+        const answer = await this.scopeFor(reference)
+            .secretsManager()
+            .getSecretValue({
+            input: {
+                SecretId: reference.identifier,
+                ...(reference.versionId !== undefined && {
+                    VersionId: reference.versionId,
+                }),
+                ...(reference.versionStage !== undefined && {
+                    VersionStage: reference.versionStage,
+                }),
+            },
+        }, { caller: request.caller });
+        if (answer.SecretString === undefined) {
+            throw new SimEcsSecretResolutionError(`${reference.identifier} holds a binary value, and only a string ` +
+                `secret can become an environment variable.`);
+        }
+        return answer.SecretString;
+    }
+    /**
+     * Read a parameter, decrypting it, as a real task agent does.
+     *
+     * `WithDecryption` is always on, because a `SecureString` is the only kind of
+     * parameter worth putting in `secrets` and a real task gets its plaintext.
+     * Parameter Store ignores the flag for the types it stores in the clear.
+     */
+    async parameterValue(request) {
+        const { reference } = request;
+        const answer = await this.scopeFor(reference)
+            .ssm()
+            .getParameter({ input: { Name: reference.identifier, WithDecryption: true } }, { caller: request.caller });
+        if (answer.Parameter?.Value === undefined) {
+            throw new SimEcsSecretResolutionError(`${reference.identifier} has no value to read.`);
+        }
+        return answer.Parameter.Value;
+    }
+    /**
+     * The Account and Region a reference is read in, which is the task's own
+     * where the reference named none.
+     */
+    scopeFor(reference) {
+        return this.simAws.accountRegionScope(reference.accountId ?? this.accountRegionScope.accountId, reference.regionName ?? this.accountRegionScope.regionName);
+    }
+}
+//# sourceMappingURL=sim-aws-ecs-secret-stores.js.map

package/dist/service/ecs/task/run/secret/sim-aws-ecs-secret-stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-ecs-secret-stores.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-aws-ecs-secret-stores.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAOxE;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,qBAAqB;IACf,MAAM,CAAS;IACf,kBAAkB,CAA2B;IAE9D,YAAY,UAA2C;QACrD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAyB;QAClC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACjD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAyB;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;aAC1C,cAAc,EAAE;aAChB,cAAc,CACb;YACE,KAAK,EAAE;gBACL,QAAQ,EAAE,SAAS,CAAC,UAAU;gBAC9B,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI;oBACvC,SAAS,EAAE,SAAS,CAAC,SAAS;iBAC/B,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI;oBAC1C,YAAY,EAAE,SAAS,CAAC,YAAY;iBACrC,CAAC;aACH;SACF,EACD,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAC3B,CAAC;QAEJ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,2BAA2B,CACnC,GAAG,SAAS,CAAC,UAAU,2CAA2C;gBAChE,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,cAAc,CAAC,OAAyB;QACpD,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;aAC1C,GAAG,EAAE;aACL,YAAY,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,EAC/D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAC3B,CAAC;QAEJ,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,2BAA2B,CACnC,GAAG,SAAS,CAAC,UAAU,wBAAwB,CAChD,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACK,QAAQ,CACd,SAAgC;QAEhC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CACnC,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,EACxD,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAC3D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-container-secrets.d.ts

@@ -0,0 +1,46 @@
+import type { SimEcsContainerDefinition } from "../../../task-definition/container/sim-ecs-container-definition.js";
+import type { SimEcsSecretStores } from "./sim-ecs-secret-stores.js";
+interface SimEcsContainerSecretsProperties {
+    readonly stores: SimEcsSecretStores;
+    readonly executionRoleArn: string | undefined;
+}
+/**
+ * Resolves one container's declared `secrets` into environment variables.
+ *
+ * Every read is made as the task execution Role, which is the Role a real task
+ * agent pulls secrets with before a container starts. It is not the task Role:
+ * a Role allowed to read the secret is not thereby allowed to do what the
+ * container does, and a Role allowed what the container does is not thereby
+ * allowed to read the secret.
+ *
+ * A secret that cannot be read stops the whole task, so the reason names the
+ * variable rather than the secret alone. The variable is what the container
+ * code was going to read, and the name of a secret nobody could reach says
+ * less about which part of the definition is wrong.
+ */
+export declare class SimEcsContainerSecrets {
+    private readonly stores;
+    private readonly executionRoleArn;
+    constructor(properties: SimEcsContainerSecretsProperties);
+    /**
+     * The variable a secret entry sets, which it has to name.
+     */
+    private static variableName;
+    private static requiredValueFrom;
+    /**
+     * What this container's `secrets` become in its environment.
+     */
+    resolve(declared: SimEcsContainerDefinition): Promise<Record<string, string>>;
+    private value;
+    private read;
+    /**
+     * The Role the read is made as.
+     *
+     * A task definition declaring secrets and no `executionRoleArn` says so
+     * rather than being read anonymously and denied. Real ECS refuses the same
+     * thing, and forgetting the execution role is the ordinary way to get here.
+     */
+    private requiredExecutionRoleArn;
+}
+export {};
+//# sourceMappingURL=sim-ecs-container-secrets.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-container-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-secrets.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-container-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAIpH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IAEtD,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IAc3B,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAYhC;;OAEG;IACG,OAAO,CACX,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAajC;YAEa,KAAK;YAYL,IAAI;IAgBlB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;CAUjC"}

package/dist/service/ecs/task/run/secret/sim-ecs-container-secrets.js

@@ -0,0 +1,92 @@
+import { SimEcsSecretJsonKey } from "./sim-ecs-secret-json-key.js";
+import { parseSimEcsSecretReference } from "./sim-ecs-secret-reference-parse.js";
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * Resolves one container's declared `secrets` into environment variables.
+ *
+ * Every read is made as the task execution Role, which is the Role a real task
+ * agent pulls secrets with before a container starts. It is not the task Role:
+ * a Role allowed to read the secret is not thereby allowed to do what the
+ * container does, and a Role allowed what the container does is not thereby
+ * allowed to read the secret.
+ *
+ * A secret that cannot be read stops the whole task, so the reason names the
+ * variable rather than the secret alone. The variable is what the container
+ * code was going to read, and the name of a secret nobody could reach says
+ * less about which part of the definition is wrong.
+ */
+export class SimEcsContainerSecrets {
+    stores;
+    executionRoleArn;
+    constructor(properties) {
+        this.stores = properties.stores;
+        this.executionRoleArn = properties.executionRoleArn;
+    }
+    /**
+     * The variable a secret entry sets, which it has to name.
+     */
+    static variableName(secret) {
+        const { name } = secret;
+        if (name === undefined || name === "") {
+            throw new SimEcsSecretResolutionError(`unable to pull secrets: a secret naming ` +
+                `${secret.valueFrom ?? "nothing"} sets no environment variable, so ` +
+                `there is nothing for the container to read it as.`);
+        }
+        return name;
+    }
+    static requiredValueFrom(secret) {
+        const { valueFrom } = secret;
+        if (valueFrom === undefined || valueFrom === "") {
+            throw new SimEcsSecretResolutionError("it names no secret to read the value from.");
+        }
+        return valueFrom;
+    }
+    /**
+     * What this container's `secrets` become in its environment.
+     */
+    async resolve(declared) {
+        const resolved = [];
+        for (const secret of declared.secrets) {
+            const name = SimEcsContainerSecrets.variableName(secret);
+            // One secret at a time, so the first one that cannot be read is the one
+            // the task reports, as a real task agent reports the first failure.
+            // oxlint-disable-next-line no-await-in-loop
+            resolved.push([name, await this.value(name, secret)]);
+        }
+        return Object.fromEntries(resolved);
+    }
+    async value(name, secret) {
+        try {
+            return await this.read(secret);
+        }
+        catch (error) {
+            throw new SimEcsSecretResolutionError(`unable to pull secrets: ${name}: ${SimEcsSecretResolutionError.reasonFor(error)}`);
+        }
+    }
+    async read(secret) {
+        const reference = parseSimEcsSecretReference(SimEcsContainerSecrets.requiredValueFrom(secret));
+        const value = await this.stores.read({
+            reference,
+            caller: { kind: "arn", arn: this.requiredExecutionRoleArn() },
+        });
+        if (reference.jsonKey === undefined) {
+            return value;
+        }
+        return new SimEcsSecretJsonKey(reference.jsonKey).valueIn(value);
+    }
+    /**
+     * The Role the read is made as.
+     *
+     * A task definition declaring secrets and no `executionRoleArn` says so
+     * rather than being read anonymously and denied. Real ECS refuses the same
+     * thing, and forgetting the execution role is the ordinary way to get here.
+     */
+    requiredExecutionRoleArn() {
+        if (this.executionRoleArn === undefined || this.executionRoleArn === "") {
+            throw new SimEcsSecretResolutionError("the task definition declares no executionRoleArn, so there is no " +
+                "Role to read it as.");
+        }
+        return this.executionRoleArn;
+    }
+}
+//# sourceMappingURL=sim-ecs-container-secrets.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-container-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-secrets.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-container-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAOxE;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,sBAAsB;IAChB,MAAM,CAAqB;IAC3B,gBAAgB,CAAqB;IAEtD,YAAY,UAA4C;QACtD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,YAAY,CAAC,MAAoB;QAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAExB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,2BAA2B,CACnC,0CAA0C;gBACxC,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,oCAAoC;gBACpE,mDAAmD,CACtD,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,MAAoB;QACnD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAE7B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,2BAA2B,CACnC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,QAAmC;QAEnC,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAEzD,wEAAwE;YACxE,oEAAoE;YACpE,4CAA4C;YAC5C,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAoB;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,2BAA2B,CACnC,2BAA2B,IAAI,KAAK,2BAA2B,CAAC,SAAS,CACvE,KAAK,CACN,EAAE,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAoB;QACrC,MAAM,SAAS,GAAG,0BAA0B,CAC1C,sBAAsB,CAAC,iBAAiB,CAAC,MAAM,CAAC,CACjD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACnC,SAAS;YACT,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,wBAAwB,EAAE,EAAE;SAC9D,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB;QAC9B,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;YACxE,MAAM,IAAI,2BAA2B,CACnC,mEAAmE;gBACjE,qBAAqB,CACxB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-resolved-secrets.d.ts

@@ -0,0 +1,34 @@
+/**
+ * What a task's containers run with once their `secrets` have been resolved,
+ * or why the task cannot start.
+ *
+ * Every container of a task is resolved before any of them runs, because that
+ * is when a real task agent pulls them: a secret nobody can read stops the
+ * task rather than stopping the container that declared it, so an earlier
+ * container never runs on a task that was never going to work.
+ */
+export declare class SimEcsResolvedSecrets {
+    #private;
+    private constructor();
+    /**
+     * Every container's secrets, read as the task execution Role.
+     */
+    static resolved(byContainer: ReadonlyMap<string, Record<string, string>>): SimEcsResolvedSecrets;
+    /**
+     * A task that cannot start, because one of its secrets could not be read.
+     */
+    static failed(reason: string): SimEcsResolvedSecrets;
+    /**
+     * Whether the task's containers can go on to run.
+     */
+    get isResolved(): boolean;
+    /**
+     * Why the task failed to start, in the terms real ECS reports it.
+     */
+    get failureReason(): string;
+    /**
+     * The variables one container's secrets set, which may be none.
+     */
+    forContainer(containerName: string): Record<string, string>;
+}
+//# sourceMappingURL=sim-ecs-resolved-secrets.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-resolved-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-resolved-secrets.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-resolved-secrets.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;;IAIhC,OAAO,eAMN;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACvD,qBAAqB,CAEvB;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAEnD;IAED;;OAEG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;OAEG;IACH,IAAI,aAAa,IAAI,MAAM,CAQ1B;IAED;;OAEG;IACH,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE1D;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-resolved-secrets.js

@@ -0,0 +1,52 @@
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * What a task's containers run with once their `secrets` have been resolved,
+ * or why the task cannot start.
+ *
+ * Every container of a task is resolved before any of them runs, because that
+ * is when a real task agent pulls them: a secret nobody can read stops the
+ * task rather than stopping the container that declared it, so an earlier
+ * container never runs on a task that was never going to work.
+ */
+export class SimEcsResolvedSecrets {
+    #byContainer;
+    #failureReason;
+    constructor(byContainer, failureReason) {
+        this.#byContainer = byContainer;
+        this.#failureReason = failureReason;
+    }
+    /**
+     * Every container's secrets, read as the task execution Role.
+     */
+    static resolved(byContainer) {
+        return new SimEcsResolvedSecrets(byContainer, undefined);
+    }
+    /**
+     * A task that cannot start, because one of its secrets could not be read.
+     */
+    static failed(reason) {
+        return new SimEcsResolvedSecrets(new Map(), reason);
+    }
+    /**
+     * Whether the task's containers can go on to run.
+     */
+    get isResolved() {
+        return this.#failureReason === undefined;
+    }
+    /**
+     * Why the task failed to start, in the terms real ECS reports it.
+     */
+    get failureReason() {
+        if (this.#failureReason === undefined) {
+            throw new SimEcsSecretResolutionError("These secrets resolved, so there is no failure reason to report.");
+        }
+        return this.#failureReason;
+    }
+    /**
+     * The variables one container's secrets set, which may be none.
+     */
+    forContainer(containerName) {
+        return this.#byContainer.get(containerName) ?? {};
+    }
+}
+//# sourceMappingURL=sim-ecs-resolved-secrets.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-resolved-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-resolved-secrets.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-resolved-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IACvB,YAAY,CAA8C;IAC1D,cAAc,CAAqB;IAE5C,YACE,WAAwD,EACxD,aAAiC;QAEjC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,WAAwD;QAExD,OAAO,IAAI,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,MAAc;QAC1B,OAAO,IAAI,qBAAqB,CAAC,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,2BAA2B,CACnC,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,aAAqB;QAChC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-arn.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsAccountId } from "../../../../aws/sim-aws-account-id.js";
+import type { AwsRegionName } from "../../../../aws/sim-aws-region.js";
+/**
+ * Where each part of a container secret's `valueFrom` sits once it is split on
+ * colons.
+ *
+ * The extended form real ECS accepts for a secret is
+ * `arn:aws:secretsmanager:region:account:secret:id:json-key:stage:version`,
+ * and every part after the id may be empty to mean it was not given. A secret
+ * id cannot itself contain a colon, so splitting is unambiguous. A parameter
+ * ARN stops at its resource, which carries the name after `parameter/`.
+ */
+export declare const simEcsSecretArnPart: {
+    readonly service: 2;
+    readonly region: 3;
+    readonly account: 4;
+    readonly resource: 5;
+    readonly secretId: 6;
+    readonly jsonKey: 7;
+    readonly versionStage: 8;
+    readonly versionId: 9;
+};
+/**
+ * The Account and Region an ARN names.
+ */
+export interface SimEcsSecretArnScope {
+    readonly accountId: SimAwsAccountId | undefined;
+    readonly regionName: AwsRegionName | undefined;
+}
+/**
+ * One optional part of a reference, where empty means it was not given.
+ */
+export declare function simEcsSecretArnPartGiven(part: string | undefined): string | undefined;
+/**
+ * One part of a reference that has to be there for it to name anything.
+ */
+export declare function simEcsSecretArnPartRequired(part: string | undefined, valueFrom: string): string;
+/**
+ * The Account and Region the parts of an ARN name.
+ */
+export declare function simEcsSecretArnScope(parts: readonly string[]): SimEcsSecretArnScope;
+//# sourceMappingURL=sim-ecs-secret-arn.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-arn.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAGvE;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;aAC9B,OAAO,EAAE,CAAC;aACV,MAAM,EAAE,CAAC;aACT,OAAO,EAAE,CAAC;aACV,QAAQ,EAAE,CAAC;aACX,QAAQ,EAAE,CAAC;aACX,OAAO,EAAE,CAAC;aACV,YAAY,EAAE,CAAC;aACf,SAAS,EAAE,CAAC;CACJ,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG,SAAS,CAAC;CAChD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAMpB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,oBAAoB,CAStB"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-arn.js

@@ -0,0 +1,50 @@
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * Where each part of a container secret's `valueFrom` sits once it is split on
+ * colons.
+ *
+ * The extended form real ECS accepts for a secret is
+ * `arn:aws:secretsmanager:region:account:secret:id:json-key:stage:version`,
+ * and every part after the id may be empty to mean it was not given. A secret
+ * id cannot itself contain a colon, so splitting is unambiguous. A parameter
+ * ARN stops at its resource, which carries the name after `parameter/`.
+ */
+export const simEcsSecretArnPart = {
+    service: 2,
+    region: 3,
+    account: 4,
+    resource: 5,
+    secretId: 6,
+    jsonKey: 7,
+    versionStage: 8,
+    versionId: 9,
+};
+/**
+ * One optional part of a reference, where empty means it was not given.
+ */
+export function simEcsSecretArnPartGiven(part) {
+    if (part === undefined || part === "") {
+        return undefined;
+    }
+    return part;
+}
+/**
+ * One part of a reference that has to be there for it to name anything.
+ */
+export function simEcsSecretArnPartRequired(part, valueFrom) {
+    const value = simEcsSecretArnPartGiven(part);
+    if (value === undefined) {
+        throw new SimEcsSecretResolutionError(`${valueFrom} names no secret or parameter.`);
+    }
+    return value;
+}
+/**
+ * The Account and Region the parts of an ARN name.
+ */
+export function simEcsSecretArnScope(parts) {
+    return {
+        accountId: simEcsSecretArnPartGiven(parts[simEcsSecretArnPart.account]),
+        regionName: simEcsSecretArnPartGiven(parts[simEcsSecretArnPart.region]),
+    };
+}
+//# sourceMappingURL=sim-ecs-secret-arn.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-arn.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,CAAC;IACV,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,YAAY,EAAE,CAAC;IACf,SAAS,EAAE,CAAC;CACJ,CAAC;AAUX;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAwB;IAExB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAwB,EACxB,SAAiB;IAEjB,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,GAAG,SAAS,gCAAgC,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAwB;IAExB,OAAO;QACL,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAEzD;QACb,UAAU,EAAE,wBAAwB,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAEzD;KACd,CAAC;AACJ,CAAC"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-json-key.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The one key of a JSON secret a `valueFrom` selects.
+ *
+ * A Secrets Manager secret is very often a JSON object holding a whole set of
+ * connection details, and a container wants one field of it as one variable.
+ * Real ECS takes that key from the seventh part of the ARN, which is what CDK
+ * writes when a construct is given a field.
+ *
+ * A key whose value is not a string is refused rather than converted. An
+ * environment variable is text, and turning a nested object or a number into
+ * text here would be this simulation choosing a representation real ECS has
+ * not documented.
+ */
+export declare class SimEcsSecretJsonKey {
+    private readonly key;
+    constructor(key: string);
+    private static parsed;
+    /**
+     * The value this key holds in a secret stored as a JSON object.
+     */
+    valueIn(secretString: string): string;
+    private object;
+}
+//# sourceMappingURL=sim-ecs-secret-json-key.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-json-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-json-key.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-json-key.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,GAAG,EAAE,MAAM,EAEtB;IAED,OAAO,CAAC,MAAM,CAAC,MAAM;IAUrB;;OAEG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAqBpC;IAED,OAAO,CAAC,MAAM;CAef"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-json-key.js

@@ -0,0 +1,55 @@
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * The one key of a JSON secret a `valueFrom` selects.
+ *
+ * A Secrets Manager secret is very often a JSON object holding a whole set of
+ * connection details, and a container wants one field of it as one variable.
+ * Real ECS takes that key from the seventh part of the ARN, which is what CDK
+ * writes when a construct is given a field.
+ *
+ * A key whose value is not a string is refused rather than converted. An
+ * environment variable is text, and turning a nested object or a number into
+ * text here would be this simulation choosing a representation real ECS has
+ * not documented.
+ */
+export class SimEcsSecretJsonKey {
+    key;
+    constructor(key) {
+        this.key = key;
+    }
+    static parsed(secretString, key) {
+        try {
+            return JSON.parse(secretString);
+        }
+        catch {
+            throw new SimEcsSecretResolutionError(`the secret is not JSON, so it has no ${key} key.`);
+        }
+    }
+    /**
+     * The value this key holds in a secret stored as a JSON object.
+     */
+    valueIn(secretString) {
+        const object = this.object(secretString);
+        // An own property, so a key of `constructor` or `toString` is a key the
+        // secret has not got rather than something found on the prototype.
+        if (!Object.hasOwn(object, this.key)) {
+            throw new SimEcsSecretResolutionError(`the secret holds no ${this.key} key.`);
+        }
+        const value = object[this.key];
+        if (typeof value !== "string") {
+            throw new SimEcsSecretResolutionError(`the ${this.key} key holds a value of type ${typeof value} rather ` +
+                `than a string, and an environment variable can only be text.`);
+        }
+        return value;
+    }
+    object(secretString) {
+        const parsed = SimEcsSecretJsonKey.parsed(secretString, this.key);
+        if (parsed === null ||
+            typeof parsed !== "object" ||
+            Array.isArray(parsed)) {
+            throw new SimEcsSecretResolutionError(`the secret is not a JSON object, so it has no ${this.key} key.`);
+        }
+        return parsed;
+    }
+}
+//# sourceMappingURL=sim-ecs-secret-json-key.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-json-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-json-key.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-json-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mBAAmB;IACb,GAAG,CAAS;IAE7B,YAAY,GAAW;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,YAAoB,EAAE,GAAW;QACrD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,2BAA2B,CACnC,wCAAwC,GAAG,OAAO,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEzC,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,2BAA2B,CACnC,uBAAuB,IAAI,CAAC,GAAG,OAAO,CACvC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,GAAG,8BAA8B,OAAO,KAAK,UAAU;gBACjE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,YAAoB;QACjC,MAAM,MAAM,GAAY,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAE3E,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,2BAA2B,CACnC,iDAAiD,IAAI,CAAC,GAAG,OAAO,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,MAAiC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference-parse.d.ts

@@ -0,0 +1,12 @@
+import type { SimEcsSecretReference } from "./sim-ecs-secret-reference.js";
+/**
+ * Read a container secret's `valueFrom` into the store and identifier it names.
+ *
+ * A `valueFrom` that is not an ARN at all is an SSM parameter name, as it is on
+ * real ECS, where a parameter in the task's own Region may be named without its
+ * ARN. Anything else, including a store this simulation does not hold, is
+ * refused rather than guessed at: a secret resolved from the wrong place is
+ * worse than a task that says it could not resolve one.
+ */
+export declare function parseSimEcsSecretReference(valueFrom: string): SimEcsSecretReference;
+//# sourceMappingURL=sim-ecs-secret-reference-parse.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-reference-parse.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-reference-parse.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAiF3E;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,GAChB,qBAAqB,CAoBvB"}