@kensio/yulin 1.13.0 → 1.14.0

package/dist/service/ecs/task/run/sim-ecs-container-reason.js

@@ -0,0 +1,41 @@
+/**
+ * What a container with no executable binding records instead of running.
+ *
+ * It is shared with the containers a service keeps running, because it is the
+ * same thing happening to them: nothing here matches the container, so nothing
+ * here runs it.
+ */
+export const simEcsNotSimulatedContainerReason = "Not simulated: no executable binding matches this container, so Yulin " +
+    "did not run it.";
+/**
+ * What a container consuming a queue records instead of running in a task.
+ *
+ * A consuming binding supplies the body of a polling loop rather than something
+ * that ends, and a run task has to end. Yulin drives that loop for a service,
+ * so a task started from the same definition says where the container does run
+ * rather than running it once and calling that a task.
+ */
+export const simEcsConsumingContainerReason = "Not simulated in a run task: this container consumes a queue, which Yulin " +
+    "polls for a running service. Create a service from this task definition.";
+/**
+ * What a container serving requests records instead of running in a task.
+ *
+ * A serving binding answers a request rather than doing something that ends,
+ * and a run task has neither a request to send it nor an end to wait for. A
+ * service is what puts the container behind a load balancer, so a task started
+ * from the same definition says so rather than calling the handler with
+ * nothing.
+ */
+export const simEcsServingContainerReason = "Not simulated in a run task: this container answers HTTP requests, which " +
+    "reach it through a load balancer while a service is running it. Create a " +
+    "service from this task definition.";
+/**
+ * What a container reports as the reason it stopped.
+ */
+export function simEcsContainerFailureReason(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error);
+}
+//# sourceMappingURL=sim-ecs-container-reason.js.map

package/dist/service/ecs/task/run/sim-ecs-container-reason.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-reason.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-reason.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,wEAAwE;IACxE,iBAAiB,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,4EAA4E;IAC5E,0EAA0E,CAAC;AAE7E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,2EAA2E;IAC3E,2EAA2E;IAC3E,oCAAoC,CAAC;AAEvC;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/service/ecs/task/run/sim-ecs-container-runner.d.ts

@@ -0,0 +1,58 @@
+import type { SimAwsRunAsOwner } from "../../../aws/caller/sim-aws-run-as-context.js";
+import type { SimEcsContainerBindings } from "../../bind/sim-ecs-container-bindings.js";
+import type { SimEcsContainerDefinition } from "../../task-definition/container/sim-ecs-container-definition.js";
+import type { SimEcsTask } from "../sim-ecs-task.js";
+import type { SimEcsTaskOverrides } from "./sim-ecs-task-overrides.js";
+interface SimEcsContainerRunnerProperties {
+    readonly bindings: SimEcsContainerBindings;
+    readonly overrides: SimEcsTaskOverrides;
+    readonly runAsOwner: SimAwsRunAsOwner;
+    readonly taskRoleArn: string | undefined;
+    readonly regionName: string;
+}
+/**
+ * Runs one container of a simulated task, if anything is bound to it.
+ *
+ * While the handler runs, the task Role is the ambient simulated caller for
+ * the owning SimAws instance, so simulated AWS operations the handler performs
+ * are authorized as the task Role. That is what a real task does with the
+ * credentials its agent hands the container, and it is the same thing a sim
+ * Lambda function does with its execution Role.
+ *
+ * A task definition declaring no task Role runs anonymously. A real task
+ * without one has no credentials of its own, and taking the identity of
+ * whoever called `RunTask` would let a container through with permissions the
+ * deployed one would not have.
+ *
+ * A handler that throws stops its container with a non-zero exit code and the
+ * message as its reason, rather than failing the request that started the
+ * task. Nothing is watching a `RunTask` call by the time a container fails on
+ * real ECS either.
+ *
+ * A container's secrets arrive here already resolved. They were read as the
+ * task execution Role before any container of the task started, so nothing in
+ * this class reads a secret store, and by the time it runs there is nothing
+ * left that could fail on one.
+ */
+export declare class SimEcsContainerRunner {
+    private readonly bindings;
+    private readonly runAsOwner;
+    private readonly taskRoleArn;
+    private readonly environments;
+    constructor(properties: SimEcsContainerRunnerProperties);
+    /**
+     * Run one declared container of a task, recording how it ended.
+     */
+    run(task: SimEcsTask, declared: SimEcsContainerDefinition, secrets: Record<string, string>): Promise<void>;
+    /**
+     * Run a container's handler as the task Role.
+     *
+     * The `RunTask` caller's ambient principal is still set while the background
+     * work that runs the containers happens, so a task definition with no task
+     * Role runs anonymously rather than inheriting it: a test would otherwise
+     * pass on permissions the deployed task has no credentials for.
+     */
+    private asTaskRole;
+}
+export {};
+//# sourceMappingURL=sim-ecs-container-runner.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-container-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-runner.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAEtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AACjH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAQrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA8B;IAE3D,YAAY,UAAU,EAAE,+BAA+B,EAKtD;IAED;;OAEG;IACG,GAAG,CACP,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Bf;IAED;;;;;;;OAOG;YACW,UAAU;CAOzB"}

package/dist/service/ecs/task/run/sim-ecs-container-runner.js

@@ -0,0 +1,83 @@
+import { simAwsRunAsContext } from "../../../aws/caller/sim-aws-run-as-context.js";
+import { SimEcsContainerEnvironments } from "./sim-ecs-container-environments.js";
+import { simEcsConsumingContainerReason, simEcsContainerFailureReason, simEcsNotSimulatedContainerReason, simEcsServingContainerReason, } from "./sim-ecs-container-reason.js";
+import { simEcsTaskPrincipal } from "./sim-ecs-task-principal.js";
+/**
+ * Runs one container of a simulated task, if anything is bound to it.
+ *
+ * While the handler runs, the task Role is the ambient simulated caller for
+ * the owning SimAws instance, so simulated AWS operations the handler performs
+ * are authorized as the task Role. That is what a real task does with the
+ * credentials its agent hands the container, and it is the same thing a sim
+ * Lambda function does with its execution Role.
+ *
+ * A task definition declaring no task Role runs anonymously. A real task
+ * without one has no credentials of its own, and taking the identity of
+ * whoever called `RunTask` would let a container through with permissions the
+ * deployed one would not have.
+ *
+ * A handler that throws stops its container with a non-zero exit code and the
+ * message as its reason, rather than failing the request that started the
+ * task. Nothing is watching a `RunTask` call by the time a container fails on
+ * real ECS either.
+ *
+ * A container's secrets arrive here already resolved. They were read as the
+ * task execution Role before any container of the task started, so nothing in
+ * this class reads a secret store, and by the time it runs there is nothing
+ * left that could fail on one.
+ */
+export class SimEcsContainerRunner {
+    bindings;
+    runAsOwner;
+    taskRoleArn;
+    environments;
+    constructor(properties) {
+        this.bindings = properties.bindings;
+        this.runAsOwner = properties.runAsOwner;
+        this.taskRoleArn = properties.taskRoleArn;
+        this.environments = new SimEcsContainerEnvironments(properties);
+    }
+    /**
+     * Run one declared container of a task, recording how it ended.
+     */
+    async run(task, declared, secrets) {
+        const container = task.container(declared.name);
+        const bound = this.bindings.find(task.family, declared);
+        if (bound === undefined) {
+            container.neverStarted(simEcsNotSimulatedContainerReason);
+            return;
+        }
+        if (bound.consumes !== undefined) {
+            container.neverStarted(simEcsConsumingContainerReason);
+            return;
+        }
+        if (bound.serves !== undefined) {
+            container.neverStarted(simEcsServingContainerReason);
+            return;
+        }
+        container.start();
+        try {
+            await this.asTaskRole(async () => {
+                await this.environments.for(declared, secrets).runWith(async () => {
+                    await bound.runHandler();
+                });
+            });
+            container.exited();
+        }
+        catch (error) {
+            container.failedWith(simEcsContainerFailureReason(error));
+        }
+    }
+    /**
+     * Run a container's handler as the task Role.
+     *
+     * The `RunTask` caller's ambient principal is still set while the background
+     * work that runs the containers happens, so a task definition with no task
+     * Role runs anonymously rather than inheriting it: a test would otherwise
+     * pass on permissions the deployed task has no credentials for.
+     */
+    async asTaskRole(run) {
+        return await simAwsRunAsContext.run(this.runAsOwner, simEcsTaskPrincipal(this.taskRoleArn), run);
+    }
+}
+//# sourceMappingURL=sim-ecs-container-runner.js.map

package/dist/service/ecs/task/run/sim-ecs-container-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-container-runner.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-container-runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAInF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAUlE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,qBAAqB;IACf,QAAQ,CAA0B;IAClC,UAAU,CAAmB;IAC7B,WAAW,CAAqB;IAChC,YAAY,CAA8B;IAE3D,YAAY,UAA2C;QACrD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,IAAgB,EAChB,QAAmC,EACnC,OAA+B;QAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAExD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS,CAAC,YAAY,CAAC,iCAAiC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,SAAS,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,SAAS,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,SAAS,CAAC,KAAK,EAAE,CAAC;QAElB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAChE,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,CAAC,UAAU,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,UAAU,CAAI,GAAqB;QAC/C,OAAO,MAAM,kBAAkB,CAAC,GAAG,CACjC,IAAI,CAAC,UAAU,EACf,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,GAAG,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ecs/task/run/sim-ecs-task-overrides.d.ts

@@ -0,0 +1,43 @@
+import type { SimEcsContainerDefinitions } from "../../task-definition/container/sim-ecs-container-definitions.js";
+import type { SimEcsKeyValuePair } from "../../task-definition/container/sim-ecs-container-parts.js";
+/**
+ * Minimal structural sim ECS container override.
+ *
+ * https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerOverride.html
+ */
+export interface SimEcsContainerOverrideType {
+    readonly name?: string | undefined;
+    readonly environment?: readonly SimEcsKeyValuePair[] | undefined;
+}
+/**
+ * Minimal structural sim ECS task override.
+ *
+ * https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskOverride.html
+ */
+export interface SimEcsTaskOverrideType {
+    readonly taskRoleArn?: string | undefined;
+    readonly containerOverrides?: readonly SimEcsContainerOverrideType[] | undefined;
+}
+/**
+ * The overrides one `RunTask` request made.
+ *
+ * A container override names the container it applies to, so an override
+ * naming a container the task definition does not declare is refused. Real ECS
+ * refuses it too, and it is worth refusing: the usual cause is a container
+ * renamed in the definition and not in the test, where the override silently
+ * doing nothing is the wrong answer.
+ */
+export declare class SimEcsTaskOverrides {
+    readonly taskRoleArn: string | undefined;
+    private readonly containerOverrides;
+    constructor(declared: SimEcsTaskOverrideType | undefined);
+    /**
+     * Refuse an override naming a container this task definition has not got.
+     */
+    refuseUnknownContainers(containers: SimEcsContainerDefinitions): void;
+    /**
+     * The environment variables overridden for one container.
+     */
+    environmentFor(containerName: string): readonly SimEcsKeyValuePair[];
+}
+//# sourceMappingURL=sim-ecs-task-overrides.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-task-overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-overrides.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-overrides.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAErG;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EACxB,SAAS,2BAA2B,EAAE,GACtC,SAAS,CAAC;CACf;AAkBD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyC;IAE5E,YAAY,QAAQ,EAAE,sBAAsB,GAAG,SAAS,EAiBvD;IAED;;OAEG;IACH,uBAAuB,CAAC,UAAU,EAAE,0BAA0B,GAAG,IAAI,CASpE;IAED;;OAEG;IACH,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,kBAAkB,EAAE,CAMnE;CACF"}

package/dist/service/ecs/task/run/sim-ecs-task-overrides.js

@@ -0,0 +1,59 @@
+import { SimEcsUnsimulatedInput } from "../../command/sim-ecs-unsimulated-input.js";
+import { SimEcsInvalidParameterException } from "../../error/sim-ecs.error.js";
+/**
+ * What a `RunTask` request may override.
+ *
+ * The task Role is here because it is the identity the containers' AWS calls
+ * are attributed to, and the container environment because it is what the
+ * running code reads. Anything else a real override carries is about resources
+ * or the command an image runs, neither of which exists here, so it is refused
+ * rather than accepted and ignored.
+ */
+const acceptedOverrides = [
+    "taskRoleArn",
+    "containerOverrides",
+];
+const acceptedContainerOverrides = ["name", "environment"];
+/**
+ * The overrides one `RunTask` request made.
+ *
+ * A container override names the container it applies to, so an override
+ * naming a container the task definition does not declare is refused. Real ECS
+ * refuses it too, and it is worth refusing: the usual cause is a container
+ * renamed in the definition and not in the test, where the override silently
+ * doing nothing is the wrong answer.
+ */
+export class SimEcsTaskOverrides {
+    taskRoleArn;
+    containerOverrides;
+    constructor(declared) {
+        const unsimulated = new SimEcsUnsimulatedInput("RunTask overrides");
+        unsimulated.refuseUnaccepted(declared ?? {}, acceptedOverrides);
+        this.taskRoleArn = declared?.taskRoleArn;
+        // Copied rather than held by reference, since the caller owns what it
+        // passed in and the containers read it later, on background work.
+        this.containerOverrides = structuredClone(declared?.containerOverrides ?? []);
+        for (const override of this.containerOverrides) {
+            new SimEcsUnsimulatedInput("RunTask containerOverrides").refuseUnaccepted(override, acceptedContainerOverrides);
+        }
+    }
+    /**
+     * Refuse an override naming a container this task definition has not got.
+     */
+    refuseUnknownContainers(containers) {
+        for (const override of this.containerOverrides) {
+            if (override.name !== undefined && !containers.has(override.name)) {
+                throw new SimEcsInvalidParameterException(`The container override for ${override.name} does not name a ` +
+                    `container this task definition declares.`);
+            }
+        }
+    }
+    /**
+     * The environment variables overridden for one container.
+     */
+    environmentFor(containerName) {
+        const override = this.containerOverrides.find((candidate) => candidate.name === containerName);
+        return override?.environment ?? [];
+    }
+}
+//# sourceMappingURL=sim-ecs-task-overrides.js.map

package/dist/service/ecs/task/run/sim-ecs-task-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-overrides.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AA0B/E;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAsB;IAC3C,aAAa;IACb,oBAAoB;CACrB,CAAC;AAEF,MAAM,0BAA0B,GAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACd,WAAW,CAAqB;IAE/B,kBAAkB,CAAyC;IAE5E,YAAY,QAA4C;QACtD,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;QACpE,WAAW,CAAC,gBAAgB,CAAC,QAAQ,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAEhE,IAAI,CAAC,WAAW,GAAG,QAAQ,EAAE,WAAW,CAAC;QACzC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,CAAC,kBAAkB,GAAG,eAAe,CACvC,QAAQ,EAAE,kBAAkB,IAAI,EAAE,CACnC,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,4BAA4B,CAAC,CAAC,gBAAgB,CACvE,QAAQ,EACR,0BAA0B,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,UAAsC;QAC5D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,+BAA+B,CACvC,8BAA8B,QAAQ,CAAC,IAAI,mBAAmB;oBAC5D,0CAA0C,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,aAAqB;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,CAChD,CAAC;QAEF,OAAO,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;IACrC,CAAC;CACF"}

package/dist/service/ecs/task/run/sim-ecs-task-principal.d.ts

@@ -0,0 +1,13 @@
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+/**
+ * The principal a task's containers make their AWS calls as.
+ *
+ * A task definition with no task Role runs anonymously rather than as whoever
+ * asked for the task. A real task without one has no credentials of its own,
+ * and taking the identity of the caller would let a container through with
+ * permissions the deployed one would not have. It is the same answer for a
+ * container a task runs and for one a service keeps polling, so it is given
+ * once here.
+ */
+export declare function simEcsTaskPrincipal(taskRoleArn: string | undefined): SimAwsPrincipal;
+//# sourceMappingURL=sim-ecs-task-principal.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-task-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-principal.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,eAAe,CAMjB"}

package/dist/service/ecs/task/run/sim-ecs-task-principal.js

@@ -0,0 +1,17 @@
+/**
+ * The principal a task's containers make their AWS calls as.
+ *
+ * A task definition with no task Role runs anonymously rather than as whoever
+ * asked for the task. A real task without one has no credentials of its own,
+ * and taking the identity of the caller would let a container through with
+ * permissions the deployed one would not have. It is the same answer for a
+ * container a task runs and for one a service keeps polling, so it is given
+ * once here.
+ */
+export function simEcsTaskPrincipal(taskRoleArn) {
+    if (taskRoleArn === undefined) {
+        return { kind: "anonymous" };
+    }
+    return { kind: "arn", arn: taskRoleArn };
+}
+//# sourceMappingURL=sim-ecs-task-principal.js.map

package/dist/service/ecs/task/run/sim-ecs-task-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-principal.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-principal.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA+B;IAE/B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC"}

package/dist/service/ecs/task/run/sim-ecs-task-run.type.d.ts

@@ -0,0 +1,17 @@
+import type { SimEcsTaskDefinition } from "../../task-definition/sim-ecs-task-definition.js";
+import type { SimEcsTask } from "../sim-ecs-task.js";
+import type { SimEcsTaskOverrides } from "./sim-ecs-task-overrides.js";
+/**
+ * One run of one simulated ECS task.
+ *
+ * The revision is carried alongside the task rather than looked up from it,
+ * because a task holds the family and revision it came from as text: the run
+ * needs the containers and the Roles that revision declared, and resolving
+ * them again part way through a run could find a different answer.
+ */
+export interface SimEcsTaskRun {
+    readonly task: SimEcsTask;
+    readonly taskDefinition: SimEcsTaskDefinition;
+    readonly overrides: SimEcsTaskOverrides;
+}
+//# sourceMappingURL=sim-ecs-task-run.type.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-task-run.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-run.type.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-run.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/ecs/task/run/sim-ecs-task-run.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-ecs-task-run.type.js.map

package/dist/service/ecs/task/run/sim-ecs-task-run.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-run.type.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-run.type.ts"],"names":[],"mappings":""}

package/dist/service/ecs/task/run/sim-ecs-task-runner.d.ts

@@ -0,0 +1,54 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsRunAsOwner } from "../../../aws/caller/sim-aws-run-as-context.js";
+import type { SimEcsContainerBindings } from "../../bind/sim-ecs-container-bindings.js";
+import type { SimEcsSecretStores } from "./secret/sim-ecs-secret-stores.js";
+import type { SimEcsTaskRun } from "./sim-ecs-task-run.type.js";
+interface SimEcsTaskRunnerProperties {
+    readonly bindings: SimEcsContainerBindings;
+    readonly background: BackgroundScheduler;
+    readonly runAsOwner: SimAwsRunAsOwner;
+    readonly regionName: string;
+    readonly secretStores: SimEcsSecretStores;
+}
+/**
+ * Runs a simulated ECS task's containers in the background.
+ *
+ * `RunTask` answers before any of this happens, as real ECS answers with a
+ * task that has not started yet, so a test reads what ran once the simulator's
+ * background work is complete.
+ *
+ * Containers run one after another in the order the task definition declares
+ * them. Real containers of a task run alongside each other, and `dependsOn` is
+ * what orders them there; running them in order here keeps what a test sees
+ * deterministic, and nothing in this process gains from overlapping in-process
+ * handlers.
+ *
+ * The task's container secrets are resolved before any of that, while the task
+ * is still provisioning, which is when a real task agent pulls them. A secret
+ * it cannot read stops the task before it ever reaches `RUNNING`, so no bound
+ * handler runs on a task that was never going to have what it declared.
+ */
+export declare class SimEcsTaskRunner {
+    private readonly bindings;
+    private readonly background;
+    private readonly runAsOwner;
+    private readonly regionName;
+    private readonly secrets;
+    constructor(properties: SimEcsTaskRunnerProperties);
+    /**
+     * Schedule a task's containers to run, and the task to stop after them.
+     */
+    start(properties: SimEcsTaskRun): void;
+    private run;
+    private runContainers;
+    /**
+     * What runs this task's containers, built once for the whole run.
+     *
+     * The task Role comes from the `RunTask` override where the request made
+     * one, and from the task definition otherwise, which is the order real ECS
+     * applies them in.
+     */
+    private containerRunner;
+}
+export {};
+//# sourceMappingURL=sim-ecs-task-runner.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-task-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-runner.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAG5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGhE,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C,YAAY,UAAU,EAAE,0BAA0B,EAMjD;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,EAAE,aAAa,GAAG,IAAI,CAIrC;YAEa,GAAG;YAcH,aAAa;IAuB3B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAWxB"}

package/dist/service/ecs/task/run/sim-ecs-task-runner.js

@@ -0,0 +1,85 @@
+import { SimEcsTaskSecrets } from "./secret/sim-ecs-task-secrets.js";
+import { SimEcsContainerRunner } from "./sim-ecs-container-runner.js";
+import { simEcsTaskStopOutcome } from "./sim-ecs-task-stop-outcome.js";
+/**
+ * Runs a simulated ECS task's containers in the background.
+ *
+ * `RunTask` answers before any of this happens, as real ECS answers with a
+ * task that has not started yet, so a test reads what ran once the simulator's
+ * background work is complete.
+ *
+ * Containers run one after another in the order the task definition declares
+ * them. Real containers of a task run alongside each other, and `dependsOn` is
+ * what orders them there; running them in order here keeps what a test sees
+ * deterministic, and nothing in this process gains from overlapping in-process
+ * handlers.
+ *
+ * The task's container secrets are resolved before any of that, while the task
+ * is still provisioning, which is when a real task agent pulls them. A secret
+ * it cannot read stops the task before it ever reaches `RUNNING`, so no bound
+ * handler runs on a task that was never going to have what it declared.
+ */
+export class SimEcsTaskRunner {
+    bindings;
+    background;
+    runAsOwner;
+    regionName;
+    secrets;
+    constructor(properties) {
+        this.bindings = properties.bindings;
+        this.background = properties.background;
+        this.runAsOwner = properties.runAsOwner;
+        this.regionName = properties.regionName;
+        this.secrets = new SimEcsTaskSecrets({ stores: properties.secretStores });
+    }
+    /**
+     * Schedule a task's containers to run, and the task to stop after them.
+     */
+    start(properties) {
+        this.background.schedule(async () => {
+            await this.run(properties);
+        });
+    }
+    async run(properties) {
+        const { task, taskDefinition } = properties;
+        const secrets = await this.secrets.resolve(taskDefinition);
+        if (!secrets.isResolved) {
+            task.failToStart(this.background.now(), secrets.failureReason);
+            return;
+        }
+        task.start(this.background.now());
+        await this.runContainers(properties, secrets);
+        task.stop({ at: this.background.now(), ...simEcsTaskStopOutcome(task) });
+    }
+    async runContainers(properties, secrets) {
+        const { task, taskDefinition } = properties;
+        const containerRunner = this.containerRunner(properties);
+        for (const declared of taskDefinition.containers.all()) {
+            if (task.isStopRequested) {
+                break;
+            }
+            // Containers run in declaration order, so this awaits inside the loop
+            // rather than starting them all at once.
+            // oxlint-disable-next-line no-await-in-loop
+            await containerRunner.run(task, declared, secrets.forContainer(declared.name));
+        }
+    }
+    /**
+     * What runs this task's containers, built once for the whole run.
+     *
+     * The task Role comes from the `RunTask` override where the request made
+     * one, and from the task definition otherwise, which is the order real ECS
+     * applies them in.
+     */
+    containerRunner(properties) {
+        const { taskDefinition, overrides } = properties;
+        return new SimEcsContainerRunner({
+            bindings: this.bindings,
+            overrides,
+            runAsOwner: this.runAsOwner,
+            taskRoleArn: overrides.taskRoleArn ?? taskDefinition.settings.taskRoleArn,
+            regionName: this.regionName,
+        });
+    }
+}
+//# sourceMappingURL=sim-ecs-task-runner.js.map

package/dist/service/ecs/task/run/sim-ecs-task-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-runner.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-runner.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAUvE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAA0B;IAClC,UAAU,CAAsB;IAChC,UAAU,CAAmB;IAC7B,UAAU,CAAS;IACnB,OAAO,CAAoB;IAE5C,YAAY,UAAsC;QAChD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAyB;QAC7B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,UAAyB;QACzC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,UAAyB,EACzB,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEzD,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YAED,sEAAsE;YACtE,yCAAyC;YACzC,4CAA4C;YAC5C,MAAM,eAAe,CAAC,GAAG,CACvB,IAAI,EACJ,QAAQ,EACR,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,UAAyB;QAC/C,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;QAEjD,OAAO,IAAI,qBAAqB,CAAC;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,cAAc,CAAC,QAAQ,CAAC,WAAW;YACzE,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/ecs/task/run/sim-ecs-task-stop-outcome.d.ts

@@ -0,0 +1,19 @@
+import type { SimEcsTaskStopCode } from "../sim-ecs-task-detail.js";
+import type { SimEcsTask } from "../sim-ecs-task.js";
+/**
+ * How a finished run says the task stopped.
+ */
+export interface SimEcsTaskStopOutcome {
+    readonly stopCode: SimEcsTaskStopCode;
+    readonly reason: string;
+}
+/**
+ * Why a task stopped, in the terms real ECS reports.
+ *
+ * A task that ran nothing did not really start, so it says so rather than
+ * reporting containers exiting. That is the answer a task definition with no
+ * binding gives, and it is worth being loud about: the usual cause is a binding
+ * that names a container the definition does not declare.
+ */
+export declare function simEcsTaskStopOutcome(task: SimEcsTask): SimEcsTaskStopOutcome;
+//# sourceMappingURL=sim-ecs-task-stop-outcome.d.ts.map

package/dist/service/ecs/task/run/sim-ecs-task-stop-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-stop-outcome.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-stop-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAcrD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,qBAAqB,CAS7E"}

package/dist/service/ecs/task/run/sim-ecs-task-stop-outcome.js

@@ -0,0 +1,27 @@
+/**
+ * Why a task whose containers all finished stopped.
+ */
+const containersExitedReason = "Essential container in task exited";
+/**
+ * Why a task that ran nothing at all stopped.
+ */
+const nothingBoundReason = "No container in this task definition is bound to a simulated handler, so " +
+    "nothing ran.";
+/**
+ * Why a task stopped, in the terms real ECS reports.
+ *
+ * A task that ran nothing did not really start, so it says so rather than
+ * reporting containers exiting. That is the answer a task definition with no
+ * binding gives, and it is worth being loud about: the usual cause is a binding
+ * that names a container the definition does not declare.
+ */
+export function simEcsTaskStopOutcome(task) {
+    if (task.containers.some((container) => container.ran)) {
+        return {
+            stopCode: "EssentialContainerExited",
+            reason: containersExitedReason,
+        };
+    }
+    return { stopCode: "TaskFailedToStart", reason: nothingBoundReason };
+}
+//# sourceMappingURL=sim-ecs-task-stop-outcome.js.map

package/dist/service/ecs/task/run/sim-ecs-task-stop-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ecs-task-stop-outcome.js","sourceRoot":"","sources":["../../../../../src/service/ecs/task/run/sim-ecs-task-stop-outcome.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAEpE;;GAEG;AACH,MAAM,kBAAkB,GACtB,2EAA2E;IAC3E,cAAc,CAAC;AAUjB;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAgB;IACpD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,QAAQ,EAAE,0BAA0B;YACpC,MAAM,EAAE,sBAAsB;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AACvE,CAAC"}