@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/scheduler/group/sim-scheduler-schedule-group.js

@@ -0,0 +1,32 @@
+import { schedulerScheduleGroupArn } from "./sim-scheduler-schedule-group-arn.js";
+/**
+ * The state a schedule group is in.
+ *
+ * Real Scheduler also has `DELETING`, which a group sits in while the schedules
+ * it holds are being removed. No group here is ever in it. Deleting a group
+ * removes its schedules in the same call, and a group is `ACTIVE` or gone.
+ */
+const activeState = "ACTIVE";
+/**
+ * One simulated EventBridge Scheduler schedule group.
+ *
+ * A group is a namespace and a tagging handle. It carries no settings, and a
+ * schedule in it behaves exactly as one in `default` would. What it changes is
+ * identity. A schedule's name is unique within its group rather than within the
+ * Account, and the group is in the schedule's ARN. Two deployments of the same
+ * construct into one Account and Region collide on schedule names unless each
+ * one has its own group.
+ */
+export class SimSchedulerScheduleGroup {
+    name;
+    arn;
+    creationDate;
+    lastModificationDate;
+    state = activeState;
+    constructor(properties) {
+        this.name = properties.name;
+        this.arn = schedulerScheduleGroupArn(properties.name, properties.accountRegionScope);
+        this.creationDate = properties.createdAt;
+        this.lastModificationDate = properties.createdAt;
+    }
+}

package/dist/service/scheduler/index.d.ts

@@ -2,12 +2,14 @@ export { SimScheduler } from "./sim-scheduler.js";
 export type { SimSchedulerRequestOptions } from "./command/sim-scheduler-request-options.js";
 export { SimSchedulerSchedule, type SimSchedulerActionAfterCompletion, } from "./schedule/sim-scheduler-schedule.js";
 export { schedulerScheduleArn } from "./schedule/sim-scheduler-schedule-arn.js";
+export { SimSchedulerScheduleGroup } from "./group/sim-scheduler-schedule-group.js";
+export { schedulerScheduleGroupArn } from "./group/sim-scheduler-schedule-group-arn.js";
 export { defaultScheduleGroupName, SimSchedulerScheduleName, } from "./schedule/sim-scheduler-schedule-name.js";
 export { SimSchedulerScheduleState } from "./schedule/sim-scheduler-schedule-state.js";
 export { schedulerScheduleDialect } from "./schedule/sim-scheduler-schedule-expression.js";
 export { SimSchedulerTarget } from "./target/sim-scheduler-target.js";
 export { simSchedulerTargetServices, SimSchedulerTargetArn, type SimSchedulerTargetService, } from "./target/sim-scheduler-target-arn.js";
 export { simSchedulerServicePrincipal, type SimSchedulerDeliveryTargets, } from "./delivery/sim-scheduler-delivery.js";
-export { SimSchedulerDeliveryFailure } from "./delivery/sim-scheduler-delivery-failures.js";
+export { SimSchedulerDeliveryFailure, type SimSchedulerDeliveryFailureJson, } from "./delivery/sim-scheduler-delivery-failures.js";
 export { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "./error/sim-scheduler-delivery.error.js";
 export { SimSchedulerAccessDeniedException, SimSchedulerConflictException, SimSchedulerError, SimSchedulerResourceNotFoundException, SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "./error/sim-scheduler.error.js";

package/dist/service/scheduler/index.js

@@ -1,12 +1,14 @@
 export { SimScheduler } from "./sim-scheduler.js";
 export { SimSchedulerSchedule, } from "./schedule/sim-scheduler-schedule.js";
 export { schedulerScheduleArn } from "./schedule/sim-scheduler-schedule-arn.js";
+export { SimSchedulerScheduleGroup } from "./group/sim-scheduler-schedule-group.js";
+export { schedulerScheduleGroupArn } from "./group/sim-scheduler-schedule-group-arn.js";
 export { defaultScheduleGroupName, SimSchedulerScheduleName, } from "./schedule/sim-scheduler-schedule-name.js";
 export { SimSchedulerScheduleState } from "./schedule/sim-scheduler-schedule-state.js";
 export { schedulerScheduleDialect } from "./schedule/sim-scheduler-schedule-expression.js";
 export { SimSchedulerTarget } from "./target/sim-scheduler-target.js";
 export { simSchedulerTargetServices, SimSchedulerTargetArn, } from "./target/sim-scheduler-target-arn.js";
 export { simSchedulerServicePrincipal, } from "./delivery/sim-scheduler-delivery.js";
-export { SimSchedulerDeliveryFailure } from "./delivery/sim-scheduler-delivery-failures.js";
+export { SimSchedulerDeliveryFailure, } from "./delivery/sim-scheduler-delivery-failures.js";
 export { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "./error/sim-scheduler-delivery.error.js";
 export { SimSchedulerAccessDeniedException, SimSchedulerConflictException, SimSchedulerError, SimSchedulerResourceNotFoundException, SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "./error/sim-scheduler.error.js";

package/dist/service/scheduler/schedule/sim-scheduler-schedule-name.d.ts

@@ -1,11 +1,9 @@
 /**
- * The one schedule group this simulation has.
+ * The schedule group a request naming none goes to.
  *
- * Every Account has a `default` group without one being created, and named
- * groups are a resource of their own with their own commands. Nothing here
- * creates one, so a schedule asking for another group is refused rather than
- * quietly put in `default`, where it would have the wrong ARN and be found by
- * a listing that should not see it.
+ * Every Account has a `default` group without one being created, which is why
+ * this is a name every scope already has rather than one the first request
+ * makes up.
  */
 export declare const defaultScheduleGroupName = "default";
 /**
@@ -22,8 +20,12 @@ export declare class SimSchedulerScheduleName {
 /**
  * The name of the schedule group a request names.
  *
- * A request naming no group gets `default`, as AWS does. One naming any other
- * group is refused: schedule groups are not simulated, and a schedule quietly
- * moved into `default` would carry an ARN naming a group it is not in.
+ * A request naming no group gets `default`, as AWS does. Whether the group is
+ * there is a separate question, asked once the caller has been authorized, so
+ * nothing here reaches a store.
  */
 export declare function requestedScheduleGroupName(value: string | undefined): string;
+/**
+ * The name of the schedule group a group command names, which is required.
+ */
+export declare function requiredScheduleGroupName(value: string | undefined): string;

package/dist/service/scheduler/schedule/sim-scheduler-schedule-name.js

@@ -1,4 +1,4 @@
-import { SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "../error/sim-scheduler.error.js";
+import { SimSchedulerValidationException } from "../error/sim-scheduler.error.js";
 const maximumNameLength = 64;
 /**
  * The characters AWS takes in a schedule name, and in a group name: letters,
@@ -6,13 +6,11 @@ const maximumNameLength = 64;
  */
 const allowedName = /^[0-9a-zA-Z\-_.]+$/u;
 /**
- * The one schedule group this simulation has.
+ * The schedule group a request naming none goes to.
  *
- * Every Account has a `default` group without one being created, and named
- * groups are a resource of their own with their own commands. Nothing here
- * creates one, so a schedule asking for another group is refused rather than
- * quietly put in `default`, where it would have the wrong ARN and be found by
- * a listing that should not see it.
+ * Every Account has a `default` group without one being created, which is why
+ * this is a name every scope already has rather than one the first request
+ * makes up.
  */
 export const defaultScheduleGroupName = "default";
 /**
@@ -51,20 +49,19 @@ export class SimSchedulerScheduleName {
 /**
  * The name of the schedule group a request names.
  *
- * A request naming no group gets `default`, as AWS does. One naming any other
- * group is refused: schedule groups are not simulated, and a schedule quietly
- * moved into `default` would carry an ARN naming a group it is not in.
+ * A request naming no group gets `default`, as AWS does. Whether the group is
+ * there is a separate question, asked once the caller has been authorized, so
+ * nothing here reaches a store.
  */
 export function requestedScheduleGroupName(value) {
     if (value === undefined) {
         return defaultScheduleGroupName;
     }
-    const groupName = readName("GroupName", value);
-    if (groupName !== defaultScheduleGroupName) {
-        throw new SimSchedulerUnsimulatedInputException(`Schedule groups are not simulated, so a schedule goes in the ` +
-            `${defaultScheduleGroupName} group. GroupName '${groupName}' is ` +
-            `refused rather than put in ${defaultScheduleGroupName}, where its ` +
-            `ARN would name a group it is not in.`);
-    }
-    return groupName;
+    return readName("GroupName", value);
+}
+/**
+ * The name of the schedule group a group command names, which is required.
+ */
+export function requiredScheduleGroupName(value) {
+    return readName("Name", value);
 }

package/dist/service/scheduler/schedule/sim-scheduler-schedule-store.d.ts

@@ -23,6 +23,13 @@ export declare class SimSchedulerScheduleStore {
      * Resolve a schedule by group and name, or refuse.
      */
     require(groupName: string, scheduleName: string): SimSchedulerSchedule;
+    /**
+     * Forget every schedule of one group.
+     *
+     * Deleting a group takes its schedules with it, as it does on AWS, and how
+     * to find them is this store's own business rather than the command's.
+     */
+    removeGroup(groupName: string): void;
     /**
      * Forget a deleted schedule.
      */

package/dist/service/scheduler/schedule/sim-scheduler-schedule-store.js

@@ -44,6 +44,19 @@ export class SimSchedulerScheduleStore {
         }
         return found;
     }
+    /**
+     * Forget every schedule of one group.
+     *
+     * Deleting a group takes its schedules with it, as it does on AWS, and how
+     * to find them is this store's own business rather than the command's.
+     */
+    removeGroup(groupName) {
+        for (const schedule of this.all) {
+            if (schedule.groupName === groupName) {
+                this.remove(schedule);
+            }
+        }
+    }
     /**
      * Forget a deleted schedule.
      */

package/dist/service/scheduler/schedule/sim-scheduler-schedule.d.ts

@@ -35,6 +35,19 @@ export declare class SimSchedulerSchedule {
     readonly name: SimSchedulerScheduleName;
     readonly groupName: string;
     readonly arn: string;
+    /**
+     * The ARN of the group this schedule is in.
+     *
+     * Kept beside the schedule's own ARN because it is a different resource path
+     * and the two are easy to confuse. This is the one AWS recommends as the
+     * `aws:SourceArn` of an execution role's trust policy.
+     */
+    readonly groupArn: string;
+    /**
+     * The Account this schedule is in, supplied as `aws:SourceAccount` when its
+     * execution role is assumed.
+     */
+    readonly accountId: string;
     readonly target: SimSchedulerTarget;
     readonly actionAfterCompletion: SimSchedulerActionAfterCompletion;
     readonly description: string | undefined;

package/dist/service/scheduler/schedule/sim-scheduler-schedule.js

@@ -1,3 +1,4 @@
+import { schedulerScheduleGroupArn } from "../group/sim-scheduler-schedule-group-arn.js";
 import { schedulerScheduleArn } from "./sim-scheduler-schedule-arn.js";
 /**
  * One simulated EventBridge Scheduler schedule.
@@ -11,6 +12,19 @@ export class SimSchedulerSchedule {
     name;
     groupName;
     arn;
+    /**
+     * The ARN of the group this schedule is in.
+     *
+     * Kept beside the schedule's own ARN because it is a different resource path
+     * and the two are easy to confuse. This is the one AWS recommends as the
+     * `aws:SourceArn` of an execution role's trust policy.
+     */
+    groupArn;
+    /**
+     * The Account this schedule is in, supplied as `aws:SourceAccount` when its
+     * execution role is assumed.
+     */
+    accountId;
     target;
     actionAfterCompletion;
     description;
@@ -25,6 +39,8 @@ export class SimSchedulerSchedule {
         this.name = properties.name;
         this.groupName = properties.groupName;
         this.arn = schedulerScheduleArn(properties.groupName, properties.name.value, properties.accountRegionScope);
+        this.groupArn = schedulerScheduleGroupArn(properties.groupName, properties.accountRegionScope);
+        this.accountId = properties.accountRegionScope.accountId;
         this.schedule = properties.schedule;
         this.target = properties.target;
         this.actionAfterCompletion = properties.actionAfterCompletion;

package/dist/service/scheduler/sdk/sim-scheduler-sdk-command-router.js

@@ -26,6 +26,22 @@ export class SimSchedulerSdkCommandRouter {
                 "ListSchedulesCommand",
                 async (command, context) => await simScheduler.listSchedules(command, simSdkCallerOptions(context)),
             ],
+            [
+                "CreateScheduleGroupCommand",
+                async (command, context) => await simScheduler.createScheduleGroup(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetScheduleGroupCommand",
+                async (command, context) => await simScheduler.getScheduleGroup(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteScheduleGroupCommand",
+                async (command, context) => await simScheduler.deleteScheduleGroup(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListScheduleGroupsCommand",
+                async (command, context) => await simScheduler.listScheduleGroups(command, simSdkCallerOptions(context)),
+            ],
         ]);
     }
     /**

package/dist/service/scheduler/sim-scheduler-inspection.d.ts

@@ -1,3 +1,5 @@
+import type { SimSchedulerScheduleGroup } from "./group/sim-scheduler-schedule-group.js";
+import type { SimSchedulerScheduleGroupStore } from "./group/sim-scheduler-schedule-group-store.js";
 import type { SimSchedulerSchedule } from "./schedule/sim-scheduler-schedule.js";
 import type { SimSchedulerScheduleStore } from "./schedule/sim-scheduler-schedule-store.js";
 /**
@@ -11,6 +13,7 @@ import type { SimSchedulerScheduleStore } from "./schedule/sim-scheduler-schedul
  */
 export declare abstract class SimSchedulerInspection {
     protected abstract readonly scheduleStore: SimSchedulerScheduleStore;
+    protected abstract readonly groupStore: SimSchedulerScheduleGroupStore;
     /**
      * Find a schedule by name, in a group.
      *
@@ -22,4 +25,15 @@ export declare abstract class SimSchedulerInspection {
      * Every schedule this scope holds, in creation order.
      */
     get allSchedules(): readonly SimSchedulerSchedule[];
+    /**
+     * Find a schedule group by name.
+     */
+    findScheduleGroup(groupName: string): SimSchedulerScheduleGroup | undefined;
+    /**
+     * Every schedule group this scope holds, in creation order.
+     *
+     * `default` is always the first of them, since every Account has it without
+     * anyone creating one.
+     */
+    get allScheduleGroups(): readonly SimSchedulerScheduleGroup[];
 }

package/dist/service/scheduler/sim-scheduler-inspection.js

@@ -24,4 +24,19 @@ export class SimSchedulerInspection {
     get allSchedules() {
         return this.scheduleStore.all;
     }
+    /**
+     * Find a schedule group by name.
+     */
+    findScheduleGroup(groupName) {
+        return this.groupStore.find(groupName);
+    }
+    /**
+     * Every schedule group this scope holds, in creation order.
+     *
+     * `default` is always the first of them, since every Account has it without
+     * anyone creating one.
+     */
+    get allScheduleGroups() {
+        return this.groupStore.all;
+    }
 }

package/dist/service/scheduler/sim-scheduler.d.ts

@@ -1,11 +1,12 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simSchedulerCommands from "./command/sim-scheduler-command.types.js";
 import type { SimSchedulerDeliveryTargets } from "./delivery/sim-scheduler-delivery.js";
 import type { SimSchedulerDeliveryFailure } from "./delivery/sim-scheduler-delivery-failures.js";
 import type { SimSchedulerRequestOptions } from "./command/sim-scheduler-request-options.js";
+import { SimSchedulerScheduleGroupStore } from "./group/sim-scheduler-schedule-group-store.js";
 import { SimSchedulerScheduleStore } from "./schedule/sim-scheduler-schedule-store.js";
 import { SimSchedulerCfnResourceFactory } from "./cfn/sim-scheduler-cfn-resource-factory.js";
 import { SimSchedulerInspection } from "./sim-scheduler-inspection.js";
@@ -35,6 +36,7 @@ interface SimSchedulerProperties {
  */
 export declare class SimScheduler extends SimSchedulerInspection {
     protected readonly scheduleStore: SimSchedulerScheduleStore;
+    protected readonly groupStore: SimSchedulerScheduleGroupStore;
     private readonly commands;
     private readonly background;
     private readonly sdkRouter;
@@ -67,6 +69,22 @@ export declare class SimScheduler extends SimSchedulerInspection {
      * Handle a ListSchedules Command from the SDK.
      */
     listSchedules(command: simSchedulerCommands.SimListSchedulesCommand, options?: SimSchedulerRequestOptions): Promise<simSchedulerCommands.SimListSchedulesCommandOutput>;
+    /**
+     * Handle a CreateScheduleGroup Command from the SDK.
+     */
+    createScheduleGroup(command: simSchedulerCommands.SimCreateScheduleGroupCommand, options?: SimSchedulerRequestOptions): Promise<simSchedulerCommands.SimCreateScheduleGroupCommandOutput>;
+    /**
+     * Handle a GetScheduleGroup Command from the SDK.
+     */
+    getScheduleGroup(command: simSchedulerCommands.SimGetScheduleGroupCommand, options?: SimSchedulerRequestOptions): Promise<simSchedulerCommands.SimGetScheduleGroupCommandOutput>;
+    /**
+     * Handle a DeleteScheduleGroup Command from the SDK.
+     */
+    deleteScheduleGroup(command: simSchedulerCommands.SimDeleteScheduleGroupCommand, options?: SimSchedulerRequestOptions): Promise<simSchedulerCommands.SimDeleteScheduleGroupCommandOutput>;
+    /**
+     * Handle a ListScheduleGroups Command from the SDK.
+     */
+    listScheduleGroups(command: simSchedulerCommands.SimListScheduleGroupsCommand, options?: SimSchedulerRequestOptions): Promise<simSchedulerCommands.SimListScheduleGroupsCommandOutput>;
     /**
      * Get this service's SDK Command router for SDK client interception.
      */

package/dist/service/scheduler/sim-scheduler.js

@@ -1,7 +1,8 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimSchedulerCommands } from "./command/sim-scheduler-commands.js";
+import { SimSchedulerScheduleGroupStore } from "./group/sim-scheduler-schedule-group-store.js";
 import { SimSchedulerScheduleStore } from "./schedule/sim-scheduler-schedule-store.js";
 import { SimSchedulerCfnResourceFactory } from "./cfn/sim-scheduler-cfn-resource-factory.js";
 import { SimSchedulerSdkCommandRouter } from "./sdk/sim-scheduler-sdk-command-router.js";
@@ -20,6 +21,7 @@ import { SimSchedulerInspection } from "./sim-scheduler-inspection.js";
  */
 export class SimScheduler extends SimSchedulerInspection {
     scheduleStore = new SimSchedulerScheduleStore();
+    groupStore;
     commands;
     background;
     sdkRouter = new SimSchedulerSdkCommandRouter(this);
@@ -28,10 +30,16 @@ export class SimScheduler extends SimSchedulerInspection {
     });
     constructor(properties = {}) {
         super();
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         this.background = background;
+        this.groupStore = new SimSchedulerScheduleGroupStore({
+            accountRegionScope,
+            clock: background,
+        });
         this.commands = new SimSchedulerCommands({
             schedules: this.scheduleStore,
+            groups: this.groupStore,
             iam,
             background,
             deliveryTargets: properties.deliveryTargets,
@@ -82,6 +90,34 @@ export class SimScheduler extends SimSchedulerInspection {
         await this.background.sequence();
         return this.commands.schedules.listSchedules(command, options);
     }
+    /**
+     * Handle a CreateScheduleGroup Command from the SDK.
+     */
+    async createScheduleGroup(command, options) {
+        await this.background.sequence();
+        return this.commands.groups.createScheduleGroup(command, options);
+    }
+    /**
+     * Handle a GetScheduleGroup Command from the SDK.
+     */
+    async getScheduleGroup(command, options) {
+        await this.background.sequence();
+        return this.commands.groups.getScheduleGroup(command, options);
+    }
+    /**
+     * Handle a DeleteScheduleGroup Command from the SDK.
+     */
+    async deleteScheduleGroup(command, options) {
+        await this.background.sequence();
+        return this.commands.groups.deleteScheduleGroup(command, options);
+    }
+    /**
+     * Handle a ListScheduleGroups Command from the SDK.
+     */
+    async listScheduleGroups(command, options) {
+        await this.background.sequence();
+        return this.commands.groups.listScheduleGroups(command, options);
+    }
     /**
      * Get this service's SDK Command router for SDK client interception.
      */

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-dynamic-reference-resolver.d.ts

@@ -1,3 +1,4 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSecretsManager } from "../../sim-secrets-manager.js";
@@ -6,16 +7,19 @@ interface SimCfnSecretsManagerDynamicReferenceResolverProperties {
     readonly secretsManager: SimSecretsManager;
     /** Secrets Manager for another Account and Region, which a full ARN names. */
     readonly secretsManagerIn: (scope: SimAwsAccountRegionScope) => SimSecretsManager;
+    /** The principal the deployment runs as, which the secret is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:secretsmanager:...}}` references from simulated Secrets
  * Manager.
  *
- * The secret is read as the caller deploying the Stack would read it, at the
- * point the Resource holding the reference is created. Real CloudFormation
- * makes no dependency out of a dynamic reference, so a secret another Resource
- * of the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The secret is read as the principal the deployment names, at the point the
+ * Resource holding the reference is created. A deployment naming none reads as
+ * the Account root, which is Secrets Manager's own default. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a secret
+ * another Resource of the same Stack creates is only there in time if the
+ * template says `DependsOn`.
  *
  * Reading goes through the ordinary GetSecretValue command, which decrypts the
  * version through simulated KMS, so the answer comes back as a promise. That
@@ -29,22 +33,16 @@ interface SimCfnSecretsManagerDynamicReferenceResolverProperties {
 export declare class SimCfnSecretsManagerDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly secretsManager;
     private readonly secretsManagerIn;
+    private readonly callerOptions;
     constructor(properties: SimCfnSecretsManagerDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the secret value it names.
      */
     resolve(reference: SimCfnDynamicReference): Promise<SimCfnDynamicReferenceResolution>;
     /**
-     * Read the version the reference selects, or the current one.
+     * The Secrets Manager a reference reads from: the Stack's own, or the one a
+     * full secret ARN names.
      */
-    private read;
-    /**
-     * The value a reference Secrets Manager could not answer resolves to.
-     *
-     * The shape follows the `ssm` references beside it, and CDK before them,
-     * which fills an unresolved context lookup with `dummy-value-for-<name>`. A
-     * test reading one back sees where it came from.
-     */
-    private standIn;
+    private secretsManagerFor;
 }
 export {};

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-dynamic-reference-resolver.js

@@ -1,15 +1,18 @@
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimSecretsManagerError } from "../../error/sim-secrets-manager.error.js";
-import { simCfnSecretsManagerJsonKeyValue } from "./sim-cfn-secrets-manager-json-key.js";
+import { simCfnSecretsManagerReferenceStandIn } from "./sim-cfn-secrets-manager-reference-stand-in.js";
+import { simCfnSecretsManagerReferenceValue } from "./sim-cfn-secrets-manager-reference-value.js";
 import { parseSimCfnSecretsManagerReference, SimCfnSecretsManagerReferenceProblem, } from "./sim-cfn-secrets-manager-reference-body.js";
 /**
  * Answers `{{resolve:secretsmanager:...}}` references from simulated Secrets
  * Manager.
  *
- * The secret is read as the caller deploying the Stack would read it, at the
- * point the Resource holding the reference is created. Real CloudFormation
- * makes no dependency out of a dynamic reference, so a secret another Resource
- * of the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The secret is read as the principal the deployment names, at the point the
+ * Resource holding the reference is created. A deployment naming none reads as
+ * the Account root, which is Secrets Manager's own default. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a secret
+ * another Resource of the same Stack creates is only there in time if the
+ * template says `DependsOn`.
  *
  * Reading goes through the ordinary GetSecretValue command, which decrypts the
  * version through simulated KMS, so the answer comes back as a promise. That
@@ -23,9 +26,11 @@ import { parseSimCfnSecretsManagerReference, SimCfnSecretsManagerReferenceProble
 export class SimCfnSecretsManagerDynamicReferenceResolver {
     secretsManager;
     secretsManagerIn;
+    callerOptions;
     constructor(properties) {
         this.secretsManager = properties.secretsManager;
         this.secretsManagerIn = properties.secretsManagerIn;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the secret value it names.
@@ -35,54 +40,28 @@ export class SimCfnSecretsManagerDynamicReferenceResolver {
         try {
             const parsed = parseSimCfnSecretsManagerReference(reference.body);
             secretId = parsed.secretId;
-            return { value: await this.read(parsed) };
+            return {
+                value: await simCfnSecretsManagerReferenceValue(this.secretsManagerFor(parsed.scope), parsed, this.callerOptions),
+            };
         }
         catch (error) {
             if (error instanceof SimCfnSecretsManagerReferenceProblem) {
-                return this.standIn(reference, secretId, error.message);
+                return simCfnSecretsManagerReferenceStandIn(reference, secretId, error.message);
             }
             /* v8 ignore next 3 -- defensive: only Secrets Manager reaches here */
             if (!(error instanceof SimSecretsManagerError)) {
                 throw error;
             }
-            return this.standIn(reference, secretId, `and simulated Secrets Manager could not read it (${error.message})`);
+            return simCfnSecretsManagerReferenceStandIn(reference, secretId, `and simulated Secrets Manager could not read it (${error.message})`);
         }
     }
     /**
-     * Read the version the reference selects, or the current one.
+     * The Secrets Manager a reference reads from: the Stack's own, or the one a
+     * full secret ARN names.
      */
-    async read(reference) {
-        const { secretId, scope, jsonKey, versionStage, versionId } = reference;
-        const secretsManager = scope === undefined ? this.secretsManager : this.secretsManagerIn(scope);
-        const read = await secretsManager.getSecretValue({
-            input: {
-                SecretId: secretId,
-                VersionStage: versionStage,
-                VersionId: versionId,
-            },
-        });
-        const secretString = read.SecretString;
-        if (secretString === undefined) {
-            throw new SimCfnSecretsManagerReferenceProblem(`and '${secretId}' holds a binary value, which a dynamic reference ` +
-                `cannot read`);
-        }
-        if (jsonKey === undefined) {
-            return secretString;
-        }
-        return simCfnSecretsManagerJsonKeyValue(secretString, secretId, jsonKey);
-    }
-    /**
-     * The value a reference Secrets Manager could not answer resolves to.
-     *
-     * The shape follows the `ssm` references beside it, and CDK before them,
-     * which fills an unresolved context lookup with `dummy-value-for-<name>`. A
-     * test reading one back sees where it came from.
-     */
-    standIn(reference, secretId, reason) {
-        return {
-            value: `dummy-value-for-${secretId}`,
-            reason: `holds ${reference.text}, ${reason}, so the Resource is created ` +
-                `with a stand-in value`,
-        };
+    secretsManagerFor(scope) {
+        return scope === undefined
+            ? this.secretsManager
+            : this.secretsManagerIn(scope);
     }
 }

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-stand-in.d.ts

@@ -0,0 +1,9 @@
+import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
+/**
+ * The value a reference Secrets Manager could not answer resolves to.
+ *
+ * The shape follows the `ssm` references beside it, and CDK before them, which
+ * fills an unresolved context lookup with `dummy-value-for-<name>`. A test
+ * reading one back sees where it came from.
+ */
+export declare function simCfnSecretsManagerReferenceStandIn(reference: SimCfnDynamicReference, secretId: string, reason: string): SimCfnDynamicReferenceResolution;

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-stand-in.js

@@ -0,0 +1,14 @@
+/**
+ * The value a reference Secrets Manager could not answer resolves to.
+ *
+ * The shape follows the `ssm` references beside it, and CDK before them, which
+ * fills an unresolved context lookup with `dummy-value-for-<name>`. A test
+ * reading one back sees where it came from.
+ */
+export function simCfnSecretsManagerReferenceStandIn(reference, secretId, reason) {
+    return {
+        value: `dummy-value-for-${secretId}`,
+        reason: `holds ${reference.text}, ${reason}, so the Resource is created ` +
+            `with a stand-in value`,
+    };
+}

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-value.d.ts

@@ -0,0 +1,12 @@
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimSecretsManager } from "../../sim-secrets-manager.js";
+import { type SimCfnSecretsManagerReference } from "./sim-cfn-secrets-manager-reference-body.js";
+/**
+ * The secret value one parsed reference names.
+ *
+ * The version the reference selects, or the current one, read through the
+ * ordinary GetSecretValue command as the principal the deployment named. That
+ * decrypts the version through simulated KMS, which is why reading a secret
+ * has to be waited on.
+ */
+export declare function simCfnSecretsManagerReferenceValue(secretsManager: SimSecretsManager, reference: SimCfnSecretsManagerReference, callerOptions: SimCfnResourceCallerOptions): Promise<string>;