@kensio/yulin 1.12.1 → 1.14.0

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference-parse.js

@@ -0,0 +1,79 @@
+import { simEcsSecretArnPart, simEcsSecretArnPartGiven, simEcsSecretArnPartRequired, simEcsSecretArnScope, } from "./sim-ecs-secret-arn.js";
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * The prefix of the resource part of an SSM parameter ARN.
+ */
+const parameterResourcePrefix = "parameter/";
+/**
+ * A parameter named without a scope, resolved in the task's own.
+ */
+function parameterNamed(name) {
+    return {
+        store: "ssm",
+        accountId: undefined,
+        regionName: undefined,
+        identifier: name,
+        jsonKey: undefined,
+        versionStage: undefined,
+        versionId: undefined,
+    };
+}
+/**
+ * The parameter name an ARN's resource part stands for.
+ *
+ * A parameter ARN drops the leading slash of a hierarchical name, so it is put
+ * back here. Parameter Store reads a parameter by either form, but the name
+ * with its slash is the one a reason should quote back.
+ */
+function parameterNameIn(resource) {
+    if (resource.includes("/")) {
+        return `/${resource}`;
+    }
+    return resource;
+}
+function secretReference(valueFrom, parts) {
+    return {
+        store: "secretsmanager",
+        ...simEcsSecretArnScope(parts),
+        identifier: simEcsSecretArnPartRequired(parts[simEcsSecretArnPart.secretId], valueFrom),
+        jsonKey: simEcsSecretArnPartGiven(parts[simEcsSecretArnPart.jsonKey]),
+        versionStage: simEcsSecretArnPartGiven(parts[simEcsSecretArnPart.versionStage]),
+        versionId: simEcsSecretArnPartGiven(parts[simEcsSecretArnPart.versionId]),
+    };
+}
+function parameterReference(valueFrom, parts) {
+    const resource = simEcsSecretArnPartRequired(parts[simEcsSecretArnPart.resource], valueFrom);
+    if (!resource.startsWith(parameterResourcePrefix)) {
+        throw new SimEcsSecretResolutionError(`${valueFrom} is an SSM ARN that does not name a parameter, and only ` +
+            `Parameter Store is simulated in Systems Manager.`);
+    }
+    return {
+        ...parameterNamed(parameterNameIn(resource.slice(parameterResourcePrefix.length))),
+        ...simEcsSecretArnScope(parts),
+    };
+}
+/**
+ * Read a container secret's `valueFrom` into the store and identifier it names.
+ *
+ * A `valueFrom` that is not an ARN at all is an SSM parameter name, as it is on
+ * real ECS, where a parameter in the task's own Region may be named without its
+ * ARN. Anything else, including a store this simulation does not hold, is
+ * refused rather than guessed at: a secret resolved from the wrong place is
+ * worse than a task that says it could not resolve one.
+ */
+export function parseSimEcsSecretReference(valueFrom) {
+    if (!valueFrom.startsWith("arn:")) {
+        return parameterNamed(valueFrom);
+    }
+    const parts = valueFrom.split(":");
+    const service = parts[simEcsSecretArnPart.service];
+    if (service === "secretsmanager") {
+        return secretReference(valueFrom, parts);
+    }
+    if (service === "ssm") {
+        return parameterReference(valueFrom, parts);
+    }
+    throw new SimEcsSecretResolutionError(`${valueFrom} names ${String(service)}, and only Secrets Manager and SSM ` +
+        `Parameter Store are simulated as container secret stores.`);
+}
+//# sourceMappingURL=sim-ecs-secret-reference-parse.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-reference-parse.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-reference-parse.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE;;GAEG;AACH,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAE7C;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,SAAS;QACvB,SAAS,EAAE,SAAS;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CACtB,SAAiB,EACjB,KAAwB;IAExB,OAAO;QACL,KAAK,EAAE,gBAAgB;QACvB,GAAG,oBAAoB,CAAC,KAAK,CAAC;QAC9B,UAAU,EAAE,2BAA2B,CACrC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EACnC,SAAS,CACV;QACD,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrE,YAAY,EAAE,wBAAwB,CACpC,KAAK,CAAC,mBAAmB,CAAC,YAAY,CAAC,CACxC;QACD,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAiB,EACjB,KAAwB;IAExB,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EACnC,SAAS,CACV,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,2BAA2B,CACnC,GAAG,SAAS,0DAA0D;YACpE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,cAAc,CACf,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAChE;QACD,GAAG,oBAAoB,CAAC,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAiB;IAEjB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,2BAA2B,CACnC,GAAG,SAAS,UAAU,MAAM,CAAC,OAAO,CAAC,qCAAqC;QACxE,2DAA2D,CAC9D,CAAC;AACJ,CAAC"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference.d.ts

@@ -0,0 +1,27 @@
+import type { SimAwsAccountId } from "../../../../aws/sim-aws-account-id.js";
+import type { AwsRegionName } from "../../../../aws/sim-aws-region.js";
+/**
+ * The stores a container secret's `valueFrom` may name.
+ */
+export type SimEcsSecretStoreName = "secretsmanager" | "ssm";
+/**
+ * Where one container secret's value comes from.
+ *
+ * The Account and Region are absent where the reference did not name them,
+ * which is a bare SSM parameter name. Real ECS reads one of those in the task's
+ * own Region, so whoever resolves the reference supplies the scope rather than
+ * this deciding it.
+ */
+export interface SimEcsSecretReference {
+    readonly store: SimEcsSecretStoreName;
+    readonly accountId: SimAwsAccountId | undefined;
+    readonly regionName: AwsRegionName | undefined;
+    /**
+     * The secret id or parameter name the store is asked for.
+     */
+    readonly identifier: string;
+    readonly jsonKey: string | undefined;
+    readonly versionStage: string | undefined;
+    readonly versionId: string | undefined;
+}
+//# sourceMappingURL=sim-ecs-secret-reference.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-reference.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-reference.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAEvE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,KAAK,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG,SAAS,CAAC;IAC/C;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-ecs-secret-reference.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-reference.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-reference.ts"],"names":[],"mappings":""}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-stores.d.ts

@@ -0,0 +1,36 @@
+import type { SimAwsPrincipal } from "../../../../aws/caller/sim-aws-caller.js";
+import type { SimEcsSecretReference } from "./sim-ecs-secret-reference.js";
+/**
+ * One read of a container secret's value.
+ *
+ * The caller is the task execution Role rather than the task Role. That is the
+ * whole distinction: the execution Role is what the task agent pulls secrets
+ * with, before any container starts, and the task Role is what the container's
+ * own AWS calls are attributed to once it does.
+ */
+export interface SimEcsSecretRead {
+    readonly reference: SimEcsSecretReference;
+    readonly caller: SimAwsPrincipal;
+}
+/**
+ * Where a simulated ECS task's container secrets are read from.
+ *
+ * Reading goes through the store service's ordinary command path rather than
+ * its state, so simulated IAM decides it exactly as it decides a call an
+ * application makes. A denial is what makes a task fail to start.
+ */
+export interface SimEcsSecretStores {
+    read(request: SimEcsSecretRead): Promise<string>;
+}
+/**
+ * The secret stores a simulated ECS built on its own can reach, which is none.
+ *
+ * Simulated ECS is usually built through a SimAws instance, which hands it that
+ * simulation's Secrets Manager and Parameter Store. One built by itself has
+ * neither to reach, so a container declaring a secret says so rather than
+ * running without the variable it expects.
+ */
+export declare class SimEcsUnreachableSecretStores implements SimEcsSecretStores {
+    read(request: SimEcsSecretRead): Promise<string>;
+}
+//# sourceMappingURL=sim-ecs-secret-stores.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-stores.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAG3E;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,YAAW,kBAAkB;IAKhE,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrD;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret-stores.js

@@ -0,0 +1,22 @@
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * The secret stores a simulated ECS built on its own can reach, which is none.
+ *
+ * Simulated ECS is usually built through a SimAws instance, which hands it that
+ * simulation's Secrets Manager and Parameter Store. One built by itself has
+ * neither to reach, so a container declaring a secret says so rather than
+ * running without the variable it expects.
+ */
+export class SimEcsUnreachableSecretStores {
+    // Asynchronous so that it refuses the way the other implementation does,
+    // through a rejected promise rather than a throw the caller has to be
+    // holding a try around at the moment it calls.
+    // oxlint-disable-next-line require-await -- there is nothing here to await
+    async read(request) {
+        throw new SimEcsSecretResolutionError(`${request.reference.identifier} cannot be read, because this ` +
+            `simulated ECS reaches no simulated Secrets Manager or SSM Parameter ` +
+            `Store. Build it through a SimAws instance to resolve container ` +
+            `secrets.`);
+    }
+}
+//# sourceMappingURL=sim-ecs-secret-stores.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret-stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret-stores.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret-stores.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AA0BxE;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA6B;IACxC,yEAAyE;IACzE,sEAAsE;IACtE,+CAA+C;IAC/C,2EAA2E;IAC3E,KAAK,CAAC,IAAI,CAAC,OAAyB;QAClC,MAAM,IAAI,2BAA2B,CACnC,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,gCAAgC;YAC7D,sEAAsE;YACtE,iEAAiE;YACjE,UAAU,CACb,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret.error.d.ts

@@ -0,0 +1,21 @@
+/**
+ * A container secret that could not be turned into an environment variable.
+ *
+ * This never reaches an ECS caller. Real ECS resolves a task's secrets after
+ * `RunTask` has answered, so the only place it can report one it could not read
+ * is the stopped task, and that is what this becomes: the reason a task carries
+ * when it failed to start.
+ */
+export declare class SimEcsSecretResolutionError extends Error {
+    readonly name = "SimEcsSecretResolutionError";
+    /**
+     * What a failure says, for something a store threw that need not be an Error.
+     *
+     * A secret store is reached through its own service, so what comes back from
+     * a failed read is whatever that service raises. Nothing here requires it to
+     * be an Error, and a reason reading `[object Object]` would be worse than one
+     * reading the value out.
+     */
+    static reasonFor(error: unknown): string;
+}
+//# sourceMappingURL=sim-ecs-secret.error.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret.error.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret.error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,SAAyB,IAAI,iCAAiC;IAE9D;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMvC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-secret.error.js

@@ -0,0 +1,26 @@
+/**
+ * A container secret that could not be turned into an environment variable.
+ *
+ * This never reaches an ECS caller. Real ECS resolves a task's secrets after
+ * `RunTask` has answered, so the only place it can report one it could not read
+ * is the stopped task, and that is what this becomes: the reason a task carries
+ * when it failed to start.
+ */
+export class SimEcsSecretResolutionError extends Error {
+    name = "SimEcsSecretResolutionError";
+    /**
+     * What a failure says, for something a store threw that need not be an Error.
+     *
+     * A secret store is reached through its own service, so what comes back from
+     * a failed read is whatever that service raises. Nothing here requires it to
+     * be an Error, and a reason reading `[object Object]` would be worse than one
+     * reading the value out.
+     */
+    static reasonFor(error) {
+        if (error instanceof Error) {
+            return error.message;
+        }
+        return String(error);
+    }
+}
+//# sourceMappingURL=sim-ecs-secret.error.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-secret.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-secret.error.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-secret.error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3B,IAAI,GAAG,6BAA6B,CAAC;IAE9D;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,CAAC,KAAc;QAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-task-secrets.d.ts

@@ -0,0 +1,24 @@
+import type { SimEcsTaskDefinition } from "../../../task-definition/sim-ecs-task-definition.js";
+import { SimEcsResolvedSecrets } from "./sim-ecs-resolved-secrets.js";
+import type { SimEcsSecretStores } from "./sim-ecs-secret-stores.js";
+interface SimEcsTaskSecretsProperties {
+    readonly stores: SimEcsSecretStores;
+}
+/**
+ * Resolves the `secrets` every container of a task definition declares.
+ *
+ * This happens once, before the first container runs, because a real task
+ * agent pulls a task's secrets while the task is still provisioning. A secret
+ * it cannot read is a resource initialization error, which stops the task
+ * before anything of it has started.
+ */
+export declare class SimEcsTaskSecrets {
+    private readonly stores;
+    constructor(properties: SimEcsTaskSecretsProperties);
+    /**
+     * Resolve every container's secrets, or say why the task cannot start.
+     */
+    resolve(taskDefinition: SimEcsTaskDefinition): Promise<SimEcsResolvedSecrets>;
+}
+export {};
+//# sourceMappingURL=sim-ecs-task-secrets.d.ts.map

package/dist/service/ecs/task/run/secret/sim-ecs-task-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-secrets.d.ts","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-task-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAQrE,UAAU,2BAA2B;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,YAAY,UAAU,EAAE,2BAA2B,EAElD;IAED;;OAEG;IACG,OAAO,CACX,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAqBhC;CACF"}

package/dist/service/ecs/task/run/secret/sim-ecs-task-secrets.js

@@ -0,0 +1,43 @@
+import { SimEcsContainerSecrets } from "./sim-ecs-container-secrets.js";
+import { SimEcsResolvedSecrets } from "./sim-ecs-resolved-secrets.js";
+import { SimEcsSecretResolutionError } from "./sim-ecs-secret.error.js";
+/**
+ * What real ECS calls a task that could not be given what it needs to start.
+ */
+const resourceInitializationError = "ResourceInitializationError";
+/**
+ * Resolves the `secrets` every container of a task definition declares.
+ *
+ * This happens once, before the first container runs, because a real task
+ * agent pulls a task's secrets while the task is still provisioning. A secret
+ * it cannot read is a resource initialization error, which stops the task
+ * before anything of it has started.
+ */
+export class SimEcsTaskSecrets {
+    stores;
+    constructor(properties) {
+        this.stores = properties.stores;
+    }
+    /**
+     * Resolve every container's secrets, or say why the task cannot start.
+     */
+    async resolve(taskDefinition) {
+        const containerSecrets = new SimEcsContainerSecrets({
+            stores: this.stores,
+            executionRoleArn: taskDefinition.settings.executionRoleArn,
+        });
+        const byContainer = new Map();
+        try {
+            for (const declared of taskDefinition.containers.all()) {
+                // oxlint-disable-next-line no-await-in-loop -- in declaration order, so a failure names the first secret that could not be read
+                const resolved = await containerSecrets.resolve(declared);
+                byContainer.set(declared.name, resolved);
+            }
+        }
+        catch (error) {
+            return SimEcsResolvedSecrets.failed(`${resourceInitializationError}: ${SimEcsSecretResolutionError.reasonFor(error)}`);
+        }
+        return SimEcsResolvedSecrets.resolved(byContainer);
+    }
+}
+//# sourceMappingURL=sim-ecs-task-secrets.js.map

package/dist/service/ecs/task/run/secret/sim-ecs-task-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-secrets.js","sourceRoot":"","sources":["../../../../../../src/service/ecs/task/run/secret/sim-ecs-task-secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE;;GAEG;AACH,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAMlE;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAqB;IAE5C,YAAY,UAAuC;QACjD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,cAAoC;QAEpC,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC;YAClD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC,gBAAgB;SAC3D,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkC,CAAC;QAE9D,IAAI,CAAC;YACH,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvD,gIAAgI;gBAChI,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAE1D,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,qBAAqB,CAAC,MAAM,CACjC,GAAG,2BAA2B,KAAK,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAClF,CAAC;QACJ,CAAC;QAED,OAAO,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/service/ecs/task/run/sim-ecs-container-environment.d.ts

@@ -0,0 +1,69 @@
+import type { SimEcsKeyValuePair } from "../../task-definition/container/sim-ecs-container-parts.js";
+interface SimEcsContainerEnvironmentProperties {
+    readonly regionName: string;
+    readonly declared: readonly SimEcsKeyValuePair[];
+    readonly secrets: Record<string, string>;
+    readonly overridden: readonly SimEcsKeyValuePair[];
+}
+/**
+ * The environment one container of a simulated task runs with.
+ *
+ * It is the container definition's `environment`, with the values its `secrets`
+ * resolved to and then any `RunTask` container override applied over the top,
+ * and the Region variables a real task agent adds, so code that reads
+ * `AWS_REGION` to build a client finds one.
+ *
+ * A secret and a declared variable of the same name is not something real ECS
+ * documents an answer for. The secret wins here, since a plaintext variable of
+ * the same name is the thing a secret was introduced to replace, and a
+ * `RunTask` override wins over both, since an override is what a caller asked
+ * for at the moment the task was started.
+ *
+ * The variables are applied to `process.env` for the length of the run, in the
+ * same way a sim Lambda function's are: a bound handler is an ordinary closure
+ * with no sandbox of its own, so asynchronous context tracking is what gives
+ * it an environment. A container declaring nothing is left reading the host
+ * environment untouched.
+ */
+export declare class SimEcsContainerEnvironment {
+    #private;
+    private readonly regionName;
+    private readonly declared;
+    private readonly secrets;
+    private readonly overridden;
+    constructor(properties: SimEcsContainerEnvironmentProperties);
+    /**
+     * The pairs that named a variable, as process.env holds them.
+     *
+     * A pair with no name is left out rather than refused, since ECS takes the
+     * declaration as it comes and there is nothing to set without a name.
+     */
+    private static namedValues;
+    /**
+     * Whether this container has an environment of its own at all.
+     */
+    get hasVariables(): boolean;
+    /**
+     * Run a container's handler with this environment applied to process.env.
+     *
+     * A container with nothing of its own is left reading the host environment
+     * untouched, Region variables included. Giving it only the Region ones would
+     * take away everything the test process set, which is where an in-process
+     * handler's configuration usually comes from.
+     */
+    runWith<T>(run: () => Promise<T>): Promise<T>;
+    /**
+     * The complete process.env-shaped variables the container code sees.
+     */
+    variables(): Record<string, string>;
+    /**
+     * The variables a real task agent puts in every container.
+     *
+     * Only the Region ones. The metadata endpoint and the credentials URI a real
+     * agent also sets both name an address nothing here answers on, so setting
+     * them would send code that reads them somewhere that does not exist.
+     */
+    private regionVariables;
+}
+export {};
+//# sourceMappingURL=sim-ecs-container-environment.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-container-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-environment.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-environment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAErG,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,0BAA0B;;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAI3D,YAAY,UAAU,EAAE,oCAAoC,EAK3D;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAU1B;;OAEG;IACH,IAAI,YAAY,IAAI,OAAO,CAM1B;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMlD;IAED;;OAEG;IACH,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASlC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CASxB"}

package/dist/service/ecs/task/run/sim-ecs-container-environment.js

@@ -0,0 +1,97 @@
+import { simProcessEnvironment } from "../../../../util/process/sim-process-environment.js";
+/**
+ * The environment one container of a simulated task runs with.
+ *
+ * It is the container definition's `environment`, with the values its `secrets`
+ * resolved to and then any `RunTask` container override applied over the top,
+ * and the Region variables a real task agent adds, so code that reads
+ * `AWS_REGION` to build a client finds one.
+ *
+ * A secret and a declared variable of the same name is not something real ECS
+ * documents an answer for. The secret wins here, since a plaintext variable of
+ * the same name is the thing a secret was introduced to replace, and a
+ * `RunTask` override wins over both, since an override is what a caller asked
+ * for at the moment the task was started.
+ *
+ * The variables are applied to `process.env` for the length of the run, in the
+ * same way a sim Lambda function's are: a bound handler is an ordinary closure
+ * with no sandbox of its own, so asynchronous context tracking is what gives
+ * it an environment. A container declaring nothing is left reading the host
+ * environment untouched.
+ */
+export class SimEcsContainerEnvironment {
+    regionName;
+    declared;
+    secrets;
+    overridden;
+    #variables;
+    constructor(properties) {
+        this.regionName = properties.regionName;
+        this.declared = properties.declared;
+        this.secrets = properties.secrets;
+        this.overridden = properties.overridden;
+    }
+    /**
+     * The pairs that named a variable, as process.env holds them.
+     *
+     * A pair with no name is left out rather than refused, since ECS takes the
+     * declaration as it comes and there is nothing to set without a name.
+     */
+    static namedValues(pairs) {
+        const named = pairs
+            .filter((pair) => pair.name !== undefined && pair.name !== "")
+            .map((pair) => [pair.name ?? "", pair.value ?? ""]);
+        return Object.fromEntries(named);
+    }
+    /**
+     * Whether this container has an environment of its own at all.
+     */
+    get hasVariables() {
+        return (this.declared.length > 0 ||
+            this.overridden.length > 0 ||
+            Object.keys(this.secrets).length > 0);
+    }
+    /**
+     * Run a container's handler with this environment applied to process.env.
+     *
+     * A container with nothing of its own is left reading the host environment
+     * untouched, Region variables included. Giving it only the Region ones would
+     * take away everything the test process set, which is where an in-process
+     * handler's configuration usually comes from.
+     */
+    async runWith(run) {
+        if (!this.hasVariables) {
+            return await run();
+        }
+        return await simProcessEnvironment.run(this.variables(), run);
+    }
+    /**
+     * The complete process.env-shaped variables the container code sees.
+     */
+    variables() {
+        this.#variables ??= {
+            ...this.regionVariables(),
+            ...SimEcsContainerEnvironment.namedValues(this.declared),
+            ...this.secrets,
+            ...SimEcsContainerEnvironment.namedValues(this.overridden),
+        };
+        return this.#variables;
+    }
+    /**
+     * The variables a real task agent puts in every container.
+     *
+     * Only the Region ones. The metadata endpoint and the credentials URI a real
+     * agent also sets both name an address nothing here answers on, so setting
+     * them would send code that reads them somewhere that does not exist.
+     */
+    regionVariables() {
+        // Built from entries rather than an object literal because AWS environment
+        // variable names are not code identifier names, and the project's naming
+        // rules treat object literal keys as if they were.
+        return Object.fromEntries([
+            ["AWS_REGION", this.regionName],
+            ["AWS_DEFAULT_REGION", this.regionName],
+        ]);
+    }
+}
+//# sourceMappingURL=sim-ecs-container-environment.js.map

package/dist/service/ecs/task/run/sim-ecs-container-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-environment.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAU5F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,CAAS;IACnB,QAAQ,CAAgC;IACxC,OAAO,CAAyB;IAChC,UAAU,CAAgC;IAE3D,UAAU,CAAqC;IAE/C,YAAY,UAAgD;QAC1D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,WAAW,CACxB,KAAoC;QAEpC,MAAM,KAAK,GAAuB,KAAK;aACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAEtD,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CACrC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAI,GAAqB;QACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,MAAM,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IAAI,CAAC,UAAU,KAAK;YAClB,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxD,GAAG,IAAI,CAAC,OAAO;YACf,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;SAC3D,CAAC;QAEF,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACK,eAAe;QACrB,2EAA2E;QAC3E,yEAAyE;QACzE,mDAAmD;QACnD,OAAO,MAAM,CAAC,WAAW,CAAC;YACxB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC,oBAAoB,EAAE,IAAI,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/ecs/task/run/sim-ecs-container-environments.d.ts

@@ -0,0 +1,27 @@
+import type { SimEcsContainerDefinition } from "../../task-definition/container/sim-ecs-container-definition.js";
+import { SimEcsContainerEnvironment } from "./sim-ecs-container-environment.js";
+import type { SimEcsTaskOverrides } from "./sim-ecs-task-overrides.js";
+interface SimEcsContainerEnvironmentsProperties {
+    readonly regionName: string;
+    readonly overrides: SimEcsTaskOverrides;
+}
+/**
+ * The environments the containers of one task run with.
+ *
+ * The Region and the request's overrides belong to the task rather than to any
+ * one container, so they are held here and each container's environment is
+ * built from them, its own declaration and its own resolved secrets. That is
+ * the same answer for a container a task runs to completion and for one a
+ * service keeps polling a queue with, which is why it is given in one place.
+ */
+export declare class SimEcsContainerEnvironments {
+    private readonly regionName;
+    private readonly overrides;
+    constructor(properties: SimEcsContainerEnvironmentsProperties);
+    /**
+     * The environment one declared container runs with.
+     */
+    for(declared: SimEcsContainerDefinition, secrets: Record<string, string>): SimEcsContainerEnvironment;
+}
+export {};
+//# sourceMappingURL=sim-ecs-container-environments.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-container-environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-environments.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-environments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAEhD,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,GAAG,CACD,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,0BAA0B,CAO5B;CACF"}

package/dist/service/ecs/task/run/sim-ecs-container-environments.js

@@ -0,0 +1,30 @@
+import { SimEcsContainerEnvironment } from "./sim-ecs-container-environment.js";
+/**
+ * The environments the containers of one task run with.
+ *
+ * The Region and the request's overrides belong to the task rather than to any
+ * one container, so they are held here and each container's environment is
+ * built from them, its own declaration and its own resolved secrets. That is
+ * the same answer for a container a task runs to completion and for one a
+ * service keeps polling a queue with, which is why it is given in one place.
+ */
+export class SimEcsContainerEnvironments {
+    regionName;
+    overrides;
+    constructor(properties) {
+        this.regionName = properties.regionName;
+        this.overrides = properties.overrides;
+    }
+    /**
+     * The environment one declared container runs with.
+     */
+    for(declared, secrets) {
+        return new SimEcsContainerEnvironment({
+            regionName: this.regionName,
+            declared: declared.environment,
+            secrets,
+            overridden: this.overrides.environmentFor(declared.name),
+        });
+    }
+}
+//# sourceMappingURL=sim-ecs-container-environments.js.map

package/dist/service/ecs/task/run/sim-ecs-container-environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-environments.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-environments.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAQhF;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAAS;IACnB,SAAS,CAAsB;IAEhD,YAAY,UAAiD;QAC3D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,GAAG,CACD,QAAmC,EACnC,OAA+B;QAE/B,OAAO,IAAI,0BAA0B,CAAC;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,QAAQ,CAAC,WAAW;YAC9B,OAAO;YACP,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/ecs/task/run/sim-ecs-container-reason.d.ts

@@ -0,0 +1,32 @@
+/**
+ * What a container with no executable binding records instead of running.
+ *
+ * It is shared with the containers a service keeps running, because it is the
+ * same thing happening to them: nothing here matches the container, so nothing
+ * here runs it.
+ */
+export declare const simEcsNotSimulatedContainerReason: string;
+/**
+ * What a container consuming a queue records instead of running in a task.
+ *
+ * A consuming binding supplies the body of a polling loop rather than something
+ * that ends, and a run task has to end. Yulin drives that loop for a service,
+ * so a task started from the same definition says where the container does run
+ * rather than running it once and calling that a task.
+ */
+export declare const simEcsConsumingContainerReason: string;
+/**
+ * What a container serving requests records instead of running in a task.
+ *
+ * A serving binding answers a request rather than doing something that ends,
+ * and a run task has neither a request to send it nor an end to wait for. A
+ * service is what puts the container behind a load balancer, so a task started
+ * from the same definition says so rather than calling the handler with
+ * nothing.
+ */
+export declare const simEcsServingContainerReason: string;
+/**
+ * What a container reports as the reason it stopped.
+ */
+export declare function simEcsContainerFailureReason(error: unknown): string;
+//# sourceMappingURL=sim-ecs-container-reason.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-container-reason.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-reason.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-reason.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,QAE3B,CAAC;AAEpB;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,QAEiC,CAAC;AAE7E;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,QAGH,CAAC;AAEvC;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMnE"}