@kensio/yulin 1.20.14 → 1.20.16

package/dist/service/lambda/function/code/vm/sdk/sim-lambda-provided-sdk-module.js

@@ -0,0 +1,78 @@
+import { assertDefined } from "../../../../../../util/type-guard/defined.js";
+import { SimLambdaVmModuleResolver } from "../sim-lambda-vm-module-resolver.js";
+import { SimLambdaSdkPackagesNotInstalledError } from "./sim-lambda-sdk-packages-not-installed.error.js";
+/**
+ * The archive entries worth reading specifiers out of.
+ */
+const javaScriptFilePattern = /\.[cm]?js$/;
+/**
+ * A quoted `@aws-sdk/*` specifier, however a file asks for it. A `require`
+ * call, a dynamic `import`, and a static import's `from` clause all match.
+ */
+const awsSdkImportPattern = /(?:\b(?:require|import)\s*\(|\b(?:from|import)\b)\s*["'](@aws-sdk\/[^"']+)["']/g;
+/**
+ * The module the runtime provides for a specifier the archive does not
+ * bundle, or undefined for a specifier the provider does not serve.
+ *
+ * A package the project has not installed is refused here naming every other
+ * AWS SDK package the function code imports and the project is missing too.
+ */
+export function provideSdkModule(specifier, context) {
+    try {
+        return context.sdkModuleProvider.provideModule(specifier);
+    }
+    catch (error) {
+        throw everyMissingSdkPackage(error, context);
+    }
+}
+/**
+ * The refusal to raise for a package the project has not installed, naming
+ * every other AWS SDK package the function code imports and the project is
+ * missing too. Any other error stands as it is.
+ *
+ * The runtime provides a package when the code requires it, so on its own a
+ * refusal only ever names the one the code reached. A function importing two
+ * absent packages would then cost two runs and two installs, and the archive
+ * is the only place to read what a third-party function imports. So the
+ * archive is read here, once a package has already turned out to be missing,
+ * and one install covers the set. An archive that runs is never read.
+ */
+function everyMissingSdkPackage(error, context) {
+    if (!(error instanceof SimLambdaSdkPackagesNotInstalledError)) {
+        return error;
+    }
+    const resolver = new SimLambdaVmModuleResolver(context.archive);
+    const candidates = archiveAwsSdkImports(context.archive).filter((specifier) => !error.specifiers.includes(specifier) &&
+        !resolver.bundlesPackage(specifier));
+    const missing = context.sdkModuleProvider.unresolvedModules?.(candidates) ?? [];
+    if (missing.length === 0) {
+        return error;
+    }
+    return new SimLambdaSdkPackagesNotInstalledError([...error.specifiers, ...missing], { cause: error.cause });
+}
+/**
+ * The AWS SDK packages a function code archive's own files import, in the
+ * order they appear.
+ *
+ * Bundled dependencies are left out. What a package under `node_modules/`
+ * imports is that package's own business, resolved from the bundle beside it,
+ * and reading a vendored tree to name one more install is a poor trade.
+ */
+function archiveAwsSdkImports(archive) {
+    const specifiers = new Set();
+    for (const filePath of archive.filePaths()) {
+        if (!isFunctionCodeFile(filePath)) {
+            continue;
+        }
+        const source = archive.file(filePath).toString();
+        for (const match of source.matchAll(awsSdkImportPattern)) {
+            const specifier = match[1];
+            assertDefined(specifier, "Matched import has no specifier");
+            specifiers.add(specifier);
+        }
+    }
+    return specifiers.values().toArray();
+}
+function isFunctionCodeFile(filePath) {
+    return (javaScriptFilePattern.test(filePath) && !filePath.includes("node_modules/"));
+}

package/dist/service/lambda/function/code/vm/sdk/sim-lambda-sdk-packages-not-installed.error.d.ts

@@ -0,0 +1,15 @@
+/**
+ * AWS SDK packages the sim Lambda runtime was asked to provide and the
+ * consuming project has not installed.
+ *
+ * The real Lambda runtime provides these packages from the execution
+ * environment rather than from the deployment package, so the simulated
+ * runtime provides them from the host project. The fix is the same for every
+ * one of them, which is why they are named together: install them, or bundle
+ * them into the function code archive.
+ */
+export declare class SimLambdaSdkPackagesNotInstalledError extends Error {
+    readonly specifiers: readonly string[];
+    readonly name = "SimLambdaSdkPackagesNotInstalledError";
+    constructor(specifiers: readonly string[], options?: ErrorOptions);
+}

package/dist/service/lambda/function/code/vm/sdk/sim-lambda-sdk-packages-not-installed.error.js

@@ -0,0 +1,27 @@
+/**
+ * AWS SDK packages the sim Lambda runtime was asked to provide and the
+ * consuming project has not installed.
+ *
+ * The real Lambda runtime provides these packages from the execution
+ * environment rather than from the deployment package, so the simulated
+ * runtime provides them from the host project. The fix is the same for every
+ * one of them, which is why they are named together: install them, or bundle
+ * them into the function code archive.
+ */
+export class SimLambdaSdkPackagesNotInstalledError extends Error {
+    specifiers;
+    name = "SimLambdaSdkPackagesNotInstalledError";
+    constructor(specifiers, options) {
+        super(notInstalledMessage(specifiers), options);
+        this.specifiers = specifiers;
+    }
+}
+function notInstalledMessage(specifiers) {
+    const [subject, object] = specifiers.length > 1
+        ? ["the packages are", "them"]
+        : ["the package is", "it"];
+    return (`Cannot provide ${specifiers.join(", ")} to sim Lambda function code: ` +
+        `${subject} not installed. Install ${object} in your project, as the ` +
+        `real Lambda runtime provides ${object}, or bundle ${object} into the ` +
+        "function code archive.");
+}

package/dist/service/lambda/function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.d.ts

@@ -16,6 +16,15 @@ export declare const awsSdkPackagePrefix = "@aws-sdk/";
  */
 export interface SimLambdaVmSdkModuleProvider {
     provideModule(specifier: string): unknown;
+    /**
+     * Which of the given specifiers this provider serves and cannot resolve.
+     *
+     * The module system asks once a package has turned out to be missing. The
+     * refusal then names every package the project has to install, where on
+     * its own it would name only the one the function code reached first. A
+     * provider that does not answer is asked for one specifier at a time.
+     */
+    unresolvedModules?(specifiers: readonly string[]): readonly string[];
 }
 /**
  * Module provider used when no simulated AWS environment is wired up, such

package/dist/service/lambda/function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.d.ts

@@ -46,6 +46,16 @@ export declare class SimSdkLambdaVmModuleProvider implements SimLambdaVmSdkModul
      * undefined for other specifiers.
      */
     provideModule(specifier: string): unknown;
+    /**
+     * Which of the given specifiers this provider serves and the host cannot
+     * resolve.
+     *
+     * Resolution only. A package that resolves and then throws while it
+     * initializes is installed, and that error belongs to the function code
+     * requiring it rather than to a report of what is missing.
+     */
+    unresolvedModules(specifiers: readonly string[]): readonly string[];
+    private resolves;
     private hostModuleExports;
 }
 export {};

package/dist/service/lambda/function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.js

@@ -1,11 +1,10 @@
-import { createRequire } from "node:module";
-import path from "node:path";
 import { SimSdkModuleClientInterceptor } from "../../../../../../sdk/module/sim-sdk-module-client-interceptor.js";
 import { SimSdkCommandDispatcher } from "../../../../../../sdk/sim-sdk-command-dispatcher.js";
 import { SimLambdaAwsApiOutbound } from "../../../outbound/sim-lambda-aws-api-outbound.js";
 import { isSimLambdaHttpModuleSpecifier, makeSimLambdaHttpModule, simLambdaHttpModuleScheme, } from "../../../outbound/sim-lambda-http-module.js";
+import { isModuleNotFoundError, requireHostModule, } from "../sim-lambda-host-modules.js";
+import { SimLambdaSdkPackagesNotInstalledError } from "./sim-lambda-sdk-packages-not-installed.error.js";
 import { awsSdkPackagePrefix, } from "./sim-lambda-vm-sdk-module-provider.js";
-const hostRequire = createRequire(import.meta.url);
 /**
  * Provides host-installed AWS SDK v3 packages to sim Lambda vm function
  * code, with client classes intercepted into the owning simulated AWS
@@ -61,6 +60,29 @@ export class SimSdkLambdaVmModuleProvider {
         this.providedModules.set(specifier, module);
         return module;
     }
+    /**
+     * Which of the given specifiers this provider serves and the host cannot
+     * resolve.
+     *
+     * Resolution only. A package that resolves and then throws while it
+     * initializes is installed, and that error belongs to the function code
+     * requiring it rather than to a report of what is missing.
+     */
+    unresolvedModules(specifiers) {
+        return specifiers.filter((specifier) => specifier.startsWith(awsSdkPackagePrefix) && !this.resolves(specifier));
+    }
+    resolves(specifier) {
+        if (this.providedModules.has(specifier)) {
+            return true;
+        }
+        try {
+            this.requireModule(specifier);
+            return true;
+        }
+        catch (error) {
+            return !isModuleNotFoundError(error);
+        }
+    }
     hostModuleExports(specifier) {
         let moduleExports;
         try {
@@ -72,10 +94,9 @@ export class SimSdkLambdaVmModuleProvider {
             if (!isModuleNotFoundError(error)) {
                 throw error;
             }
-            throw new Error(`Cannot provide ${specifier} to sim Lambda function code: the ` +
-                "package is not installed. Install it in your project, as the " +
-                "real Lambda runtime provides it, or bundle it into the function " +
-                "code archive.", { cause: error });
+            throw new SimLambdaSdkPackagesNotInstalledError([specifier], {
+                cause: error,
+            });
         }
         if (typeof moduleExports !== "object" || moduleExports === null) {
             throw new Error(`Cannot provide ${specifier} to sim Lambda function code: the host ` +
@@ -84,30 +105,3 @@ export class SimSdkLambdaVmModuleProvider {
         return moduleExports;
     }
 }
-/**
- * Require an AWS SDK package from the host.
- *
- * The packages are installed by the consuming project, as they are provided
- * by the real Lambda runtime rather than by this package. Requiring from
- * this module's context covers hoisted installs; the working-directory
- * fallback covers stricter package layouts.
- */
-function requireHostModule(specifier) {
-    try {
-        return hostRequire(specifier);
-    }
-    catch {
-        /* v8 ignore next 4 -- only reachable in consumer package layouts where
-           this package's own require context cannot see the SDK packages. */
-        return createRequire(path.join(process.cwd(), "package.json"))(specifier);
-    }
-}
-/**
- * Whether an error is a Node.js module resolution failure, as opposed to an
- * error thrown while a resolved module initializes.
- */
-function isModuleNotFoundError(error) {
-    return (error instanceof Error &&
-        "code" in error &&
-        (error.code === "MODULE_NOT_FOUND" || error.code === "ERR_MODULE_NOT_FOUND"));
-}

package/dist/service/lambda/function/code/vm/sim-lambda-host-modules.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Require from the host a module the real Lambda runtime provides without it
+ * being bundled: a Node.js built-in, or an AWS SDK package.
+ *
+ * The SDK packages are installed by the consuming project, as the real
+ * runtime provides them rather than this package. Requiring from this
+ * module's context covers hoisted installs; the working-directory fallback
+ * covers stricter package layouts.
+ */
+export declare function requireHostModule(specifier: string): unknown;
+/**
+ * Whether an error is a Node.js module resolution failure, as opposed to an
+ * error thrown while a resolved module initializes.
+ */
+export declare function isModuleNotFoundError(error: unknown): boolean;

package/dist/service/lambda/function/code/vm/sim-lambda-host-modules.js

@@ -0,0 +1,31 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+const hostRequire = createRequire(import.meta.url);
+/**
+ * Require from the host a module the real Lambda runtime provides without it
+ * being bundled: a Node.js built-in, or an AWS SDK package.
+ *
+ * The SDK packages are installed by the consuming project, as the real
+ * runtime provides them rather than this package. Requiring from this
+ * module's context covers hoisted installs; the working-directory fallback
+ * covers stricter package layouts.
+ */
+export function requireHostModule(specifier) {
+    try {
+        return hostRequire(specifier);
+    }
+    catch {
+        /* v8 ignore next 4 -- only reachable in consumer package layouts where
+           this package's own require context cannot see the SDK packages. */
+        return createRequire(path.join(process.cwd(), "package.json"))(specifier);
+    }
+}
+/**
+ * Whether an error is a Node.js module resolution failure, as opposed to an
+ * error thrown while a resolved module initializes.
+ */
+export function isModuleNotFoundError(error) {
+    return (error instanceof Error &&
+        "code" in error &&
+        (error.code === "MODULE_NOT_FOUND" || error.code === "ERR_MODULE_NOT_FOUND"));
+}

package/dist/service/lambda/function/code/vm/sim-lambda-vm-module-resolver.d.ts

@@ -14,6 +14,13 @@ export declare class SimLambdaVmModuleResolver {
      * Resolve a require specifier to an archive file path.
      */
     resolveFilePath(specifier: string, fromDirectory: string): string;
+    /**
+     * Whether the archive bundles a bare specifier itself.
+     *
+     * The archive takes precedence over anything the runtime provides, so a
+     * specifier it resolves is never asked of the module provider.
+     */
+    bundlesPackage(specifier: string): boolean;
     private resolveCandidates;
     /**
      * Resolve a bare specifier against node_modules bundled in the archive.

package/dist/service/lambda/function/code/vm/sim-lambda-vm-module-resolver.js

@@ -22,6 +22,21 @@ export class SimLambdaVmModuleResolver {
         }
         return this.resolvePackage(specifier);
     }
+    /**
+     * Whether the archive bundles a bare specifier itself.
+     *
+     * The archive takes precedence over anything the runtime provides, so a
+     * specifier it resolves is never asked of the module provider.
+     */
+    bundlesPackage(specifier) {
+        try {
+            this.resolvePackage(specifier);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     resolveCandidates(basePath, specifier) {
         const candidates = [
             basePath,

package/dist/service/lambda/function/code/vm/sim-lambda-vm-modules.js

@@ -1,6 +1,8 @@
-import { createRequire, isBuiltin } from "node:module";
+import { isBuiltin } from "node:module";
 import path from "node:path";
 import vm from "node:vm";
+import { requireHostModule } from "./sim-lambda-host-modules.js";
+import { provideSdkModule } from "./sdk/sim-lambda-provided-sdk-module.js";
 import { loadJsonModule } from "./sim-lambda-vm-json-module.js";
 import { SimLambdaVmModuleResolver } from "./sim-lambda-vm-module-resolver.js";
 import { userCodeSyntaxError } from "./sim-lambda-vm-syntax-error.js";
@@ -9,7 +11,6 @@ import { userCodeSyntaxError } from "./sim-lambda-vm-syntax-error.js";
  * bounded like real Lambda bounds its init phase.
  */
 const moduleEvaluationTimeoutMs = 5000;
-const hostRequire = createRequire(import.meta.url);
 /**
  * A CommonJS module system over a sim Lambda function code zip archive.
  *
@@ -35,7 +36,7 @@ export class SimLambdaVmModules {
         // those too. Anything it declines is the host built-in itself.
         if (isBuiltin(specifier)) {
             return (this.properties.sdkModuleProvider.provideModule(specifier) ??
-                hostRequire(specifier));
+                requireHostModule(specifier));
         }
         let filePath;
         try {
@@ -59,7 +60,7 @@ export class SimLambdaVmModules {
      * original archive resolution error is reported.
      */
     provideModule(specifier, archiveError) {
-        const provided = this.properties.sdkModuleProvider.provideModule(specifier);
+        const provided = provideSdkModule(specifier, this.properties);
         if (provided === undefined) {
             throw archiveError;
         }

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js

@@ -28,7 +28,10 @@ export class PutBucketPolicyCommandHandler {
     async handle(command, options) {
         assertDefined(command.input.Bucket, "PutBucketPolicyCommand.input.Bucket");
         assertDefined(command.input.Policy, "PutBucketPolicyCommand.input.Policy");
-        this.policyValidator.validateRequired(command.input.Policy);
+        this.policyValidator.validateRequired(command.input.Policy, {
+            attachedTo: "Bucket",
+            name: command.input.Bucket,
+        });
         const bucketName = command.input.Bucket;
         const bucket = requireSimS3Bucket(this.buckets, bucketName);
         await this.background.sequence();

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.d.ts

@@ -6,6 +6,13 @@ interface SimSchedulerDeliveryFailureProperties {
     readonly at: Date;
     readonly error: unknown;
 }
+/**
+ * A failed invocation as it serialises. Every property the failure holds, plus
+ * the message the getter reads off the error.
+ */
+export interface SimSchedulerDeliveryFailureJson extends SimSchedulerDeliveryFailureProperties {
+    readonly message: string;
+}
 /**
  * One invocation a schedule could not make.
  */
@@ -28,6 +35,15 @@ export declare class SimSchedulerDeliveryFailure {
      * What went wrong, as a message.
      */
     get message(): string;
+    /**
+     * The failure as JSON.stringify renders it, message included.
+     *
+     * Serialising a failure is the first thing to reach for when a schedule did
+     * not do what a test expected. The message is a getter on the prototype and
+     * would be left out. An Error keeps its own message on a non-enumerable
+     * property and prints as `{}`.
+     */
+    toJSON(): SimSchedulerDeliveryFailureJson;
 }
 /**
  * Every invocation one simulated Scheduler scope could not make.

package/dist/service/scheduler/delivery/sim-scheduler-delivery-failures.js

@@ -32,6 +32,25 @@ export class SimSchedulerDeliveryFailure {
         }
         return String(this.error);
     }
+    /**
+     * The failure as JSON.stringify renders it, message included.
+     *
+     * Serialising a failure is the first thing to reach for when a schedule did
+     * not do what a test expected. The message is a getter on the prototype and
+     * would be left out. An Error keeps its own message on a non-enumerable
+     * property and prints as `{}`.
+     */
+    toJSON() {
+        return {
+            scheduleName: this.scheduleName,
+            scheduleArn: this.scheduleArn,
+            targetArn: this.targetArn,
+            roleArn: this.roleArn,
+            at: this.at,
+            message: this.message,
+            error: this.error,
+        };
+    }
 }
 /**
  * Every invocation one simulated Scheduler scope could not make.

package/dist/service/scheduler/index.d.ts

@@ -10,6 +10,6 @@ export { schedulerScheduleDialect } from "./schedule/sim-scheduler-schedule-expr
 export { SimSchedulerTarget } from "./target/sim-scheduler-target.js";
 export { simSchedulerTargetServices, SimSchedulerTargetArn, type SimSchedulerTargetService, } from "./target/sim-scheduler-target-arn.js";
 export { simSchedulerServicePrincipal, type SimSchedulerDeliveryTargets, } from "./delivery/sim-scheduler-delivery.js";
-export { SimSchedulerDeliveryFailure } from "./delivery/sim-scheduler-delivery-failures.js";
+export { SimSchedulerDeliveryFailure, type SimSchedulerDeliveryFailureJson, } from "./delivery/sim-scheduler-delivery-failures.js";
 export { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "./error/sim-scheduler-delivery.error.js";
 export { SimSchedulerAccessDeniedException, SimSchedulerConflictException, SimSchedulerError, SimSchedulerResourceNotFoundException, SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "./error/sim-scheduler.error.js";

package/dist/service/scheduler/index.js

@@ -9,6 +9,6 @@ export { schedulerScheduleDialect } from "./schedule/sim-scheduler-schedule-expr
 export { SimSchedulerTarget } from "./target/sim-scheduler-target.js";
 export { simSchedulerTargetServices, SimSchedulerTargetArn, } from "./target/sim-scheduler-target-arn.js";
 export { simSchedulerServicePrincipal, } from "./delivery/sim-scheduler-delivery.js";
-export { SimSchedulerDeliveryFailure } from "./delivery/sim-scheduler-delivery-failures.js";
+export { SimSchedulerDeliveryFailure, } from "./delivery/sim-scheduler-delivery-failures.js";
 export { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "./error/sim-scheduler-delivery.error.js";
 export { SimSchedulerAccessDeniedException, SimSchedulerConflictException, SimSchedulerError, SimSchedulerResourceNotFoundException, SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "./error/sim-scheduler.error.js";

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-dynamic-reference-resolver.d.ts

@@ -1,3 +1,4 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution, SimCfnDynamicReferenceResolver } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
 import type { SimSecretsManager } from "../../sim-secrets-manager.js";
@@ -6,16 +7,19 @@ interface SimCfnSecretsManagerDynamicReferenceResolverProperties {
     readonly secretsManager: SimSecretsManager;
     /** Secrets Manager for another Account and Region, which a full ARN names. */
     readonly secretsManagerIn: (scope: SimAwsAccountRegionScope) => SimSecretsManager;
+    /** The principal the deployment runs as, which the secret is read as. */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Answers `{{resolve:secretsmanager:...}}` references from simulated Secrets
  * Manager.
  *
- * The secret is read as the caller deploying the Stack would read it, at the
- * point the Resource holding the reference is created. Real CloudFormation
- * makes no dependency out of a dynamic reference, so a secret another Resource
- * of the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The secret is read as the principal the deployment names, at the point the
+ * Resource holding the reference is created. A deployment naming none reads as
+ * the Account root, which is Secrets Manager's own default. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a secret
+ * another Resource of the same Stack creates is only there in time if the
+ * template says `DependsOn`.
  *
  * Reading goes through the ordinary GetSecretValue command, which decrypts the
  * version through simulated KMS, so the answer comes back as a promise. That
@@ -29,22 +33,16 @@ interface SimCfnSecretsManagerDynamicReferenceResolverProperties {
 export declare class SimCfnSecretsManagerDynamicReferenceResolver implements SimCfnDynamicReferenceResolver {
     private readonly secretsManager;
     private readonly secretsManagerIn;
+    private readonly callerOptions;
     constructor(properties: SimCfnSecretsManagerDynamicReferenceResolverProperties);
     /**
      * Resolve one reference to the secret value it names.
      */
     resolve(reference: SimCfnDynamicReference): Promise<SimCfnDynamicReferenceResolution>;
     /**
-     * Read the version the reference selects, or the current one.
+     * The Secrets Manager a reference reads from: the Stack's own, or the one a
+     * full secret ARN names.
      */
-    private read;
-    /**
-     * The value a reference Secrets Manager could not answer resolves to.
-     *
-     * The shape follows the `ssm` references beside it, and CDK before them,
-     * which fills an unresolved context lookup with `dummy-value-for-<name>`. A
-     * test reading one back sees where it came from.
-     */
-    private standIn;
+    private secretsManagerFor;
 }
 export {};

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-dynamic-reference-resolver.js

@@ -1,15 +1,18 @@
+import { simCfnResourceCallerOptions, } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 import { SimSecretsManagerError } from "../../error/sim-secrets-manager.error.js";
-import { simCfnSecretsManagerJsonKeyValue } from "./sim-cfn-secrets-manager-json-key.js";
+import { simCfnSecretsManagerReferenceStandIn } from "./sim-cfn-secrets-manager-reference-stand-in.js";
+import { simCfnSecretsManagerReferenceValue } from "./sim-cfn-secrets-manager-reference-value.js";
 import { parseSimCfnSecretsManagerReference, SimCfnSecretsManagerReferenceProblem, } from "./sim-cfn-secrets-manager-reference-body.js";
 /**
  * Answers `{{resolve:secretsmanager:...}}` references from simulated Secrets
  * Manager.
  *
- * The secret is read as the caller deploying the Stack would read it, at the
- * point the Resource holding the reference is created. Real CloudFormation
- * makes no dependency out of a dynamic reference, so a secret another Resource
- * of the same Stack creates is only there in time if the template says
- * `DependsOn`.
+ * The secret is read as the principal the deployment names, at the point the
+ * Resource holding the reference is created. A deployment naming none reads as
+ * the Account root, which is Secrets Manager's own default. Real
+ * CloudFormation makes no dependency out of a dynamic reference, so a secret
+ * another Resource of the same Stack creates is only there in time if the
+ * template says `DependsOn`.
  *
  * Reading goes through the ordinary GetSecretValue command, which decrypts the
  * version through simulated KMS, so the answer comes back as a promise. That
@@ -23,9 +26,11 @@ import { parseSimCfnSecretsManagerReference, SimCfnSecretsManagerReferenceProble
 export class SimCfnSecretsManagerDynamicReferenceResolver {
     secretsManager;
     secretsManagerIn;
+    callerOptions;
     constructor(properties) {
         this.secretsManager = properties.secretsManager;
         this.secretsManagerIn = properties.secretsManagerIn;
+        this.callerOptions = simCfnResourceCallerOptions(properties.caller);
     }
     /**
      * Resolve one reference to the secret value it names.
@@ -35,54 +40,28 @@ export class SimCfnSecretsManagerDynamicReferenceResolver {
         try {
             const parsed = parseSimCfnSecretsManagerReference(reference.body);
             secretId = parsed.secretId;
-            return { value: await this.read(parsed) };
+            return {
+                value: await simCfnSecretsManagerReferenceValue(this.secretsManagerFor(parsed.scope), parsed, this.callerOptions),
+            };
         }
         catch (error) {
             if (error instanceof SimCfnSecretsManagerReferenceProblem) {
-                return this.standIn(reference, secretId, error.message);
+                return simCfnSecretsManagerReferenceStandIn(reference, secretId, error.message);
             }
             /* v8 ignore next 3 -- defensive: only Secrets Manager reaches here */
             if (!(error instanceof SimSecretsManagerError)) {
                 throw error;
             }
-            return this.standIn(reference, secretId, `and simulated Secrets Manager could not read it (${error.message})`);
+            return simCfnSecretsManagerReferenceStandIn(reference, secretId, `and simulated Secrets Manager could not read it (${error.message})`);
         }
     }
     /**
-     * Read the version the reference selects, or the current one.
+     * The Secrets Manager a reference reads from: the Stack's own, or the one a
+     * full secret ARN names.
      */
-    async read(reference) {
-        const { secretId, scope, jsonKey, versionStage, versionId } = reference;
-        const secretsManager = scope === undefined ? this.secretsManager : this.secretsManagerIn(scope);
-        const read = await secretsManager.getSecretValue({
-            input: {
-                SecretId: secretId,
-                VersionStage: versionStage,
-                VersionId: versionId,
-            },
-        });
-        const secretString = read.SecretString;
-        if (secretString === undefined) {
-            throw new SimCfnSecretsManagerReferenceProblem(`and '${secretId}' holds a binary value, which a dynamic reference ` +
-                `cannot read`);
-        }
-        if (jsonKey === undefined) {
-            return secretString;
-        }
-        return simCfnSecretsManagerJsonKeyValue(secretString, secretId, jsonKey);
-    }
-    /**
-     * The value a reference Secrets Manager could not answer resolves to.
-     *
-     * The shape follows the `ssm` references beside it, and CDK before them,
-     * which fills an unresolved context lookup with `dummy-value-for-<name>`. A
-     * test reading one back sees where it came from.
-     */
-    standIn(reference, secretId, reason) {
-        return {
-            value: `dummy-value-for-${secretId}`,
-            reason: `holds ${reference.text}, ${reason}, so the Resource is created ` +
-                `with a stand-in value`,
-        };
+    secretsManagerFor(scope) {
+        return scope === undefined
+            ? this.secretsManager
+            : this.secretsManagerIn(scope);
     }
 }

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-stand-in.d.ts

@@ -0,0 +1,9 @@
+import type { SimCfnDynamicReference, SimCfnDynamicReferenceResolution } from "../../../cloudformation/template/dynamic/sim-cfn-dynamic-reference.type.js";
+/**
+ * The value a reference Secrets Manager could not answer resolves to.
+ *
+ * The shape follows the `ssm` references beside it, and CDK before them, which
+ * fills an unresolved context lookup with `dummy-value-for-<name>`. A test
+ * reading one back sees where it came from.
+ */
+export declare function simCfnSecretsManagerReferenceStandIn(reference: SimCfnDynamicReference, secretId: string, reason: string): SimCfnDynamicReferenceResolution;

package/dist/service/secretsmanager/cfn/dynamic/sim-cfn-secrets-manager-reference-stand-in.js

@@ -0,0 +1,14 @@
+/**
+ * The value a reference Secrets Manager could not answer resolves to.
+ *
+ * The shape follows the `ssm` references beside it, and CDK before them, which
+ * fills an unresolved context lookup with `dummy-value-for-<name>`. A test
+ * reading one back sees where it came from.
+ */
+export function simCfnSecretsManagerReferenceStandIn(reference, secretId, reason) {
+    return {
+        value: `dummy-value-for-${secretId}`,
+        reason: `holds ${reference.text}, ${reason}, so the Resource is created ` +
+            `with a stand-in value`,
+    };
+}