@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/scheduler/delivery/sim-scheduler-delivery.d.ts

@@ -31,6 +31,17 @@ export interface SimSchedulerDeliveryTargets {
      * Invoke a schedule's target, refusing if its execution role may not.
      */
     deliver(request: SimSchedulerDeliveryRequest): Promise<void>;
+    /**
+     * Send an invocation Scheduler has stopped trying to its dead-letter queue.
+     */
+    deadLetter(request: SimSchedulerDeadLetterRequest): Promise<void>;
+}
+export type SimSchedulerExhaustedRetryCondition = "MaximumEventAgeInSeconds" | "MaximumRetryAttempts";
+export interface SimSchedulerDeadLetterRequest {
+    readonly delivery: SimSchedulerDeliveryRequest;
+    readonly error: unknown;
+    readonly retryAttempts: number;
+    readonly exhaustedCondition?: SimSchedulerExhaustedRetryCondition | undefined;
 }
 /**
  * What a target receives, as the JSON text a queue or a topic carries.

package/dist/service/scheduler/delivery/sim-scheduler-no-delivery-targets.d.ts

@@ -1,4 +1,4 @@
-import type { SimSchedulerDeliveryRequest, SimSchedulerDeliveryTargets } from "./sim-scheduler-delivery.js";
+import type { SimSchedulerDeadLetterRequest, SimSchedulerDeliveryRequest, SimSchedulerDeliveryTargets } from "./sim-scheduler-delivery.js";
 /**
  * The targets of a simulated Scheduler built on its own, which are none.
  *
@@ -13,4 +13,8 @@ export declare class SimSchedulerNoDeliveryTargets implements SimSchedulerDelive
      * Refuse the invocation, saying why there was nowhere to make it.
      */
     deliver(request: SimSchedulerDeliveryRequest): Promise<void>;
+    /**
+     * Refuse a dead-letter delivery for the same reason as a target delivery.
+     */
+    deadLetter(request: SimSchedulerDeadLetterRequest): Promise<void>;
 }

package/dist/service/scheduler/delivery/sim-scheduler-no-delivery-targets.js

@@ -17,4 +17,12 @@ export class SimSchedulerNoDeliveryTargets {
             `${request.schedule.target.arn.value} was not reached. Reach ` +
             `Scheduler through SimAws for a schedule that invokes.`));
     }
+    /**
+     * Refuse a dead-letter delivery for the same reason as a target delivery.
+     */
+    deadLetter(request) {
+        return Promise.reject(new SimSchedulerTargetNotFound(`This simulated Scheduler has no queues to dead-letter ` +
+            `${request.delivery.schedule.arn} to. Reach Scheduler through ` +
+            `SimAws for a schedule that invokes.`));
+    }
 }

package/dist/service/scheduler/delivery/sim-scheduler-target-delivery.d.ts

@@ -1,10 +1,12 @@
 import type { SimSchedulerDeliveryRequest, SimSchedulerDeliveryTargets } from "./sim-scheduler-delivery.js";
+import type { BackgroundScheduler } from "../../../util/background/background.js";
 import { type SimSchedulerDeliveryFailure } from "./sim-scheduler-delivery-failures.js";
 interface SimSchedulerTargetDeliveryProperties {
     readonly endpoints: SimSchedulerDeliveryTargets;
+    readonly background: BackgroundScheduler;
 }
 /**
- * Makes one invocation and keeps whatever went wrong.
+ * Runs one scheduled invocation through its attempts and keeps final failures.
  *
  * A failure is recorded rather than thrown, because these run as background
  * tasks and one left rejected would fail an unrelated
@@ -13,6 +15,7 @@ interface SimSchedulerTargetDeliveryProperties {
  */
 export declare class SimSchedulerTargetDelivery {
     private readonly endpoints;
+    private readonly background;
     private readonly failures;
     constructor(properties: SimSchedulerTargetDeliveryProperties);
     /**

package/dist/service/scheduler/delivery/sim-scheduler-target-delivery.js

@@ -1,6 +1,7 @@
+import { SimSchedulerDeliveryAttempt } from "./sim-scheduler-delivery-attempt.js";
 import { SimSchedulerDeliveryFailures, } from "./sim-scheduler-delivery-failures.js";
 /**
- * Makes one invocation and keeps whatever went wrong.
+ * Runs one scheduled invocation through its attempts and keeps final failures.
  *
  * A failure is recorded rather than thrown, because these run as background
  * tasks and one left rejected would fail an unrelated
@@ -9,9 +10,11 @@ import { SimSchedulerDeliveryFailures, } from "./sim-scheduler-delivery-failures
  */
 export class SimSchedulerTargetDelivery {
     endpoints;
+    background;
     failures = new SimSchedulerDeliveryFailures();
     constructor(properties) {
         this.endpoints = properties.endpoints;
+        this.background = properties.background;
     }
     /**
      * Every invocation that could not be made.
@@ -23,19 +26,21 @@ export class SimSchedulerTargetDelivery {
      * Invoke one schedule's target.
      */
     async deliver(request) {
-        try {
-            await this.endpoints.deliver(request);
-        }
-        catch (error) {
-            const schedule = request.schedule;
-            this.failures.record({
-                scheduleName: schedule.name.value,
-                scheduleArn: schedule.arn,
-                targetArn: schedule.target.arn.value,
-                roleArn: schedule.target.roleArn,
-                at: request.at,
-                error,
-            });
-        }
+        await new SimSchedulerDeliveryAttempt({
+            request,
+            endpoints: this.endpoints,
+            background: this.background,
+            record: (error) => {
+                const schedule = request.schedule;
+                this.failures.record({
+                    scheduleName: schedule.name.value,
+                    scheduleArn: schedule.arn,
+                    targetArn: schedule.target.arn.value,
+                    roleArn: schedule.target.roleArn,
+                    at: request.at,
+                    error,
+                });
+            },
+        }).start();
     }
 }

package/dist/service/scheduler/index.d.ts

@@ -9,7 +9,7 @@ export { SimSchedulerScheduleState } from "./schedule/sim-scheduler-schedule-sta
 export { schedulerScheduleDialect } from "./schedule/sim-scheduler-schedule-expression.js";
 export { SimSchedulerTarget } from "./target/sim-scheduler-target.js";
 export { simSchedulerTargetServices, SimSchedulerTargetArn, type SimSchedulerTargetService, } from "./target/sim-scheduler-target-arn.js";
-export { simSchedulerServicePrincipal, type SimSchedulerDeliveryTargets, } from "./delivery/sim-scheduler-delivery.js";
+export { simSchedulerServicePrincipal, type SimSchedulerDeadLetterRequest, type SimSchedulerDeliveryRequest, type SimSchedulerDeliveryTargets, type SimSchedulerExhaustedRetryCondition, } from "./delivery/sim-scheduler-delivery.js";
 export { SimSchedulerDeliveryFailure, type SimSchedulerDeliveryFailureJson, } from "./delivery/sim-scheduler-delivery-failures.js";
 export { SimSchedulerDeliveryNotPermitted, SimSchedulerTargetNotFound, } from "./error/sim-scheduler-delivery.error.js";
 export { SimSchedulerAccessDeniedException, SimSchedulerConflictException, SimSchedulerError, SimSchedulerResourceNotFoundException, SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "./error/sim-scheduler.error.js";

package/dist/service/scheduler/target/sim-scheduler-dead-letter-config.d.ts

@@ -0,0 +1,15 @@
+export interface SimSchedulerDeadLetterConfigInput {
+    readonly Arn?: string | undefined;
+}
+/**
+ * The standard SQS queue a target sends undelivered input to.
+ */
+export declare class SimSchedulerDeadLetterConfig {
+    readonly declared: SimSchedulerDeadLetterConfigInput;
+    readonly arn: string | undefined;
+    private constructor();
+    /**
+     * Read a dead-letter configuration, refusing anything but a standard queue.
+     */
+    static of(config: SimSchedulerDeadLetterConfigInput): SimSchedulerDeadLetterConfig;
+}

package/dist/service/scheduler/target/sim-scheduler-dead-letter-config.js

@@ -0,0 +1,24 @@
+import { parseSqsQueueArn } from "../../sqs/queue/sim-sqs-queue-arn.js";
+import { SimSchedulerValidationException } from "../error/sim-scheduler.error.js";
+/**
+ * The standard SQS queue a target sends undelivered input to.
+ */
+export class SimSchedulerDeadLetterConfig {
+    declared;
+    arn;
+    constructor(config) {
+        this.declared = { ...config };
+        this.arn = config.Arn;
+    }
+    /**
+     * Read a dead-letter configuration, refusing anything but a standard queue.
+     */
+    static of(config) {
+        const { Arn: arn } = config;
+        if (arn !== undefined && parseSqsQueueArn(arn) === undefined) {
+            throw new SimSchedulerValidationException(`Target DeadLetterConfig Arn ${arn} is not a standard SQS queue ARN. ` +
+                `One is arn:aws:sqs:<region>:<account-id>:<queue-name>.`);
+        }
+        return new this(config);
+    }
+}

package/dist/service/scheduler/target/sim-scheduler-retry-policy.d.ts

@@ -0,0 +1,20 @@
+export declare const defaultSchedulerMaximumEventAgeInSeconds = 86400;
+export declare const defaultSchedulerMaximumRetryAttempts = 185;
+export interface SimSchedulerRetryPolicyInput {
+    readonly MaximumEventAgeInSeconds?: number | undefined;
+    readonly MaximumRetryAttempts?: number | undefined;
+}
+/**
+ * The retry limits one target declares and the effective values they produce.
+ */
+export declare class SimSchedulerRetryPolicy {
+    readonly declared: SimSchedulerRetryPolicyInput;
+    readonly maximumEventAgeInSeconds: number;
+    readonly maximumRetryAttempts: number;
+    private constructor();
+    /**
+     * Read a retry policy, refusing values outside Scheduler's limits.
+     */
+    static of(policy: SimSchedulerRetryPolicyInput): SimSchedulerRetryPolicy;
+    private static requireWholeNumber;
+}

package/dist/service/scheduler/target/sim-scheduler-retry-policy.js

@@ -0,0 +1,37 @@
+import { SimSchedulerValidationException } from "../error/sim-scheduler.error.js";
+export const defaultSchedulerMaximumEventAgeInSeconds = 86_400;
+export const defaultSchedulerMaximumRetryAttempts = 185;
+const minimumEventAgeInSeconds = 60;
+/**
+ * The retry limits one target declares and the effective values they produce.
+ */
+export class SimSchedulerRetryPolicy {
+    declared;
+    maximumEventAgeInSeconds;
+    maximumRetryAttempts;
+    constructor(policy) {
+        this.declared = { ...policy };
+        this.maximumEventAgeInSeconds =
+            policy.MaximumEventAgeInSeconds ??
+                defaultSchedulerMaximumEventAgeInSeconds;
+        this.maximumRetryAttempts =
+            policy.MaximumRetryAttempts ?? defaultSchedulerMaximumRetryAttempts;
+    }
+    /**
+     * Read a retry policy, refusing values outside Scheduler's limits.
+     */
+    static of(policy) {
+        this.requireWholeNumber("MaximumEventAgeInSeconds", policy.MaximumEventAgeInSeconds, minimumEventAgeInSeconds, defaultSchedulerMaximumEventAgeInSeconds);
+        this.requireWholeNumber("MaximumRetryAttempts", policy.MaximumRetryAttempts, 0, defaultSchedulerMaximumRetryAttempts);
+        return new this(policy);
+    }
+    static requireWholeNumber(name, value, minimum, maximum) {
+        if (value === undefined) {
+            return;
+        }
+        if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+            throw new SimSchedulerValidationException(`Target RetryPolicy ${name} must be a whole number between ` +
+                `${minimum} and ${maximum}, and ${value} is not.`);
+        }
+    }
+}

package/dist/service/scheduler/target/sim-scheduler-target.d.ts

@@ -1,5 +1,7 @@
 import { SimEcsTargetTask } from "../../ecs/target/sim-ecs-target-task.js";
 import { SimSchedulerTargetArn } from "./sim-scheduler-target-arn.js";
+import { SimSchedulerDeadLetterConfig, type SimSchedulerDeadLetterConfigInput } from "./sim-scheduler-dead-letter-config.js";
+import { SimSchedulerRetryPolicy, type SimSchedulerRetryPolicyInput } from "./sim-scheduler-retry-policy.js";
 /**
  * What a target request says, of the parts a target reads.
  */
@@ -8,6 +10,8 @@ interface SimSchedulerRequestedTarget {
     readonly RoleArn?: string | undefined;
     readonly Input?: string | undefined;
     readonly EcsParameters?: unknown;
+    readonly DeadLetterConfig?: SimSchedulerDeadLetterConfigInput | undefined;
+    readonly RetryPolicy?: SimSchedulerRetryPolicyInput | undefined;
 }
 /**
  * What one schedule invokes, and who it invokes it as.
@@ -37,6 +41,8 @@ export declare class SimSchedulerTarget {
      * what the task overrides instead.
      */
     readonly task: SimEcsTargetTask | undefined;
+    readonly deadLetterConfig: SimSchedulerDeadLetterConfig | undefined;
+    readonly retryPolicy: SimSchedulerRetryPolicy | undefined;
     private constructor();
     /**
      * Read the target a request carries.

package/dist/service/scheduler/target/sim-scheduler-target.js

@@ -1,6 +1,8 @@
 import { SimEcsTargetTask } from "../../ecs/target/sim-ecs-target-task.js";
 import { SimSchedulerUnsimulatedInputException, SimSchedulerValidationException, } from "../error/sim-scheduler.error.js";
 import { SimSchedulerTargetArn } from "./sim-scheduler-target-arn.js";
+import { SimSchedulerDeadLetterConfig, } from "./sim-scheduler-dead-letter-config.js";
+import { SimSchedulerRetryPolicy, } from "./sim-scheduler-retry-policy.js";
 /**
  * The longest role ARN AWS takes, and the shape one has to be.
  */
@@ -39,11 +41,15 @@ export class SimSchedulerTarget {
      * what the task overrides instead.
      */
     task;
+    deadLetterConfig;
+    retryPolicy;
     constructor(properties) {
         this.arn = properties.arn;
         this.roleArn = properties.roleArn;
         this.input = properties.input;
         this.task = properties.task;
+        this.deadLetterConfig = properties.deadLetterConfig;
+        this.retryPolicy = properties.retryPolicy;
     }
     /**
      * Read the target a request carries.
@@ -58,6 +64,12 @@ export class SimSchedulerTarget {
             roleArn: this.roleArnIn(target.RoleArn),
             input: target.Input,
             task: this.taskIn(arn, target),
+            deadLetterConfig: target.DeadLetterConfig === undefined
+                ? undefined
+                : SimSchedulerDeadLetterConfig.of(target.DeadLetterConfig),
+            retryPolicy: target.RetryPolicy === undefined
+                ? undefined
+                : SimSchedulerRetryPolicy.of(target.RetryPolicy),
         });
     }
     /**

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-encryption-rules.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnSkippedPropertyValue } from "../../../cloudformation/resource/ignore/sim-cfn-skipped-property.type.js";
+/**
+ * The range real SQS accepts for `KmsDataKeyReusePeriodSeconds`.
+ *
+ * Encryption itself is not simulated. The property is recorded against the
+ * Resource and the queue is created without it, and no key is ever asked for.
+ * How long the value says to reuse one is still read, because a period outside
+ * this range is one real SQS answers with `InvalidAttributeValue`, and
+ * CloudFormation fails the stack on it at CreateQueue. A queue that deployed
+ * here would report a template AWS refuses as working.
+ *
+ * The bound is the one the SQS API documents, a minute at the short end and a
+ * day at the long one.
+ */
+export declare function validateSimCfnSqsKmsDataKeyReusePeriod(declared: SimCfnSkippedPropertyValue): void;

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-encryption-rules.js

@@ -0,0 +1,33 @@
+const minimumReuseSeconds = 60;
+const maximumReuseSeconds = 86_400;
+/**
+ * The range real SQS accepts for `KmsDataKeyReusePeriodSeconds`.
+ *
+ * Encryption itself is not simulated. The property is recorded against the
+ * Resource and the queue is created without it, and no key is ever asked for.
+ * How long the value says to reuse one is still read, because a period outside
+ * this range is one real SQS answers with `InvalidAttributeValue`, and
+ * CloudFormation fails the stack on it at CreateQueue. A queue that deployed
+ * here would report a template AWS refuses as working.
+ *
+ * The bound is the one the SQS API documents, a minute at the short end and a
+ * day at the long one.
+ */
+export function validateSimCfnSqsKmsDataKeyReusePeriod(declared) {
+    const stated = declared.value;
+    const seconds = typeof stated === "number" || typeof stated === "string"
+        ? Number(stated)
+        : NaN;
+    if (Number.isSafeInteger(seconds) &&
+        seconds >= minimumReuseSeconds &&
+        seconds <= maximumReuseSeconds) {
+        return;
+    }
+    declared.refuse(`KmsDataKeyReusePeriodSeconds ${stringified(stated)} is outside the ` +
+        `${String(minimumReuseSeconds)} to ${String(maximumReuseSeconds)} ` +
+        `seconds real SQS accepts`);
+}
+/** The value as a refusal names it, whatever shape the template gave it. */
+function stringified(value) {
+    return typeof value === "object" ? JSON.stringify(value) : String(value);
+}

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-properties.d.ts

@@ -30,6 +30,22 @@ export declare class SimCfnSqsQueueProperties {
      * takes them in.
      */
     attributes(): SimSqsQueueAttributeInput;
+    /**
+     * Read one property as the string the attribute of that name carries.
+     *
+     * Five of these properties are amounts and `RedrivePolicy` is a JSON
+     * document, so the two are read differently.
+     */
+    private attributeValue;
+    /**
+     * Read a JSON document property as the string an SQS attribute carries.
+     *
+     * CloudFormation carries the document as an object, and as a string when it
+     * came from a template Parameter or from a Terraform plan holding it as one.
+     * What the document has to say is left to SQS, which refuses a bad redrive
+     * policy in its own words.
+     */
+    private documentValue;
     /**
      * Read a numeric property as the string an SQS attribute carries.
      *

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-properties.js

@@ -1,3 +1,6 @@
+import { jsonStringify } from "../../../../util/type-guard/json.js";
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { simSqsJsonQueueAttributeNames } from "../../queue/sim-sqs-queue-attribute-specs.js";
 import { SimCfnSqsQueueName } from "./sim-cfn-sqs-queue-name.js";
 import { SimCfnSqsQueuePropertyRules, sqsQueuePropertyError, } from "./sim-cfn-sqs-queue-property-rules.js";
 /**
@@ -48,7 +51,36 @@ export class SimCfnSqsQueueProperties {
         this.rules.apply();
         return Object.fromEntries(Object.entries(this.properties)
             .filter(([name]) => this.rules.isAttributeProperty(name))
-            .map(([name, value]) => [name, this.numberValue(value, name)]));
+            .map(([name, value]) => [name, this.attributeValue(value, name)]));
+    }
+    /**
+     * Read one property as the string the attribute of that name carries.
+     *
+     * Five of these properties are amounts and `RedrivePolicy` is a JSON
+     * document, so the two are read differently.
+     */
+    attributeValue(value, name) {
+        if (simSqsJsonQueueAttributeNames.has(name)) {
+            return this.documentValue(value, name);
+        }
+        return this.numberValue(value, name);
+    }
+    /**
+     * Read a JSON document property as the string an SQS attribute carries.
+     *
+     * CloudFormation carries the document as an object, and as a string when it
+     * came from a template Parameter or from a Terraform plan holding it as one.
+     * What the document has to say is left to SQS, which refuses a bad redrive
+     * policy in its own words.
+     */
+    documentValue(value, name) {
+        if (typeof value === "string") {
+            return value;
+        }
+        if (isRecord(value)) {
+            return jsonStringify(value);
+        }
+        throw this.propertyError(`${name} must be a JSON document`);
     }
     /**
      * Read a numeric property as the string an SQS attribute carries.

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-property-names.d.ts

@@ -1,10 +1,14 @@
+import type { SimCfnSkippedPropertyRules } from "../../../cloudformation/resource/ignore/sim-cfn-skipped-property.type.js";
 import type { SimCfnTemplateValue } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 /**
  * The AWS::SQS::Queue properties carrying a queue attribute of the same name.
  *
  * CloudFormation names these exactly as the SQS API names the attributes, so
  * they are handed to CreateQueue rather than applied here. That leaves the
- * ranges and defaults in one place: the ones simulated SQS already validates.
+ * ranges and defaults in one place, the ones simulated SQS already validates.
+ *
+ * Five of them are amounts. `RedrivePolicy` is a JSON document, and
+ * CloudFormation carries it as an object where SQS carries it as a string.
  */
 export declare const attributePropertyNames: ReadonlySet<string>;
 /**
@@ -12,12 +16,14 @@ export declare const attributePropertyNames: ReadonlySet<string>;
  * each of them would have changed.
  *
  * The queue is created without them and each one is recorded against the
- * Resource. A queue deployed without its redrive policy looks like a queue with
- * a dead-letter queue to the template that wrote it and has none, so a test
- * expecting a failed message to end up somewhere needs to find out that it
- * never will.
+ * Resource. A test reads the record to find out what the queue it deployed
+ * behaves differently to AWS about.
+ *
+ * A property whose value real SQS answers with a 400 states what it has to
+ * satisfy here as well. Nothing acts on the value either way, and reading it
+ * this far is what keeps a template AWS refuses from deploying.
  */
-export declare const unsimulatedPropertyReasons: ReadonlyMap<string, string>;
+export declare const unsimulatedPropertyReasons: SimCfnSkippedPropertyRules;
 /**
  * The FifoQueue values that ask for a FIFO queue. CloudFormation carries a
  * boolean property as either, depending on where the value came from.

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-property-names.js

@@ -1,15 +1,20 @@
+import { validateSimCfnSqsKmsDataKeyReusePeriod } from "./sim-cfn-sqs-queue-encryption-rules.js";
 /**
  * The AWS::SQS::Queue properties carrying a queue attribute of the same name.
  *
  * CloudFormation names these exactly as the SQS API names the attributes, so
  * they are handed to CreateQueue rather than applied here. That leaves the
- * ranges and defaults in one place: the ones simulated SQS already validates.
+ * ranges and defaults in one place, the ones simulated SQS already validates.
+ *
+ * Five of them are amounts. `RedrivePolicy` is a JSON document, and
+ * CloudFormation carries it as an object where SQS carries it as a string.
  */
 export const attributePropertyNames = new Set([
     "DelaySeconds",
     "MaximumMessageSize",
     "MessageRetentionPeriod",
     "ReceiveMessageWaitTimeSeconds",
+    "RedrivePolicy",
     "VisibilityTimeout",
 ]);
 /**
@@ -17,10 +22,12 @@ export const attributePropertyNames = new Set([
  * each of them would have changed.
  *
  * The queue is created without them and each one is recorded against the
- * Resource. A queue deployed without its redrive policy looks like a queue with
- * a dead-letter queue to the template that wrote it and has none, so a test
- * expecting a failed message to end up somewhere needs to find out that it
- * never will.
+ * Resource. A test reads the record to find out what the queue it deployed
+ * behaves differently to AWS about.
+ *
+ * A property whose value real SQS answers with a 400 states what it has to
+ * satisfy here as well. Nothing acts on the value either way, and reading it
+ * this far is what keeps a template AWS refuses from deploying.
  */
 export const unsimulatedPropertyReasons = new Map([
     ["ContentBasedDeduplication", "only standard queues are simulated"],
@@ -28,18 +35,16 @@ export const unsimulatedPropertyReasons = new Map([
     ["FifoThroughputLimit", "only standard queues are simulated"],
     [
         "KmsDataKeyReusePeriodSeconds",
-        "simulated SQS does not encrypt message bodies",
+        {
+            reason: "simulated SQS does not encrypt message bodies",
+            constraint: validateSimCfnSqsKmsDataKeyReusePeriod,
+        },
     ],
     ["KmsMasterKeyId", "simulated SQS does not encrypt message bodies"],
     [
         "RedriveAllowPolicy",
-        "dead-letter queues are not simulated, so nothing enforces which queues " +
-            "may name this one as theirs",
-    ],
-    [
-        "RedrivePolicy",
-        "dead-letter queues are not simulated, so a message that is received " +
-            "past maxReceiveCount stays on this queue rather than moving",
+        "nothing enforces which queues may name this one as their dead-letter " +
+            "queue, and setting the attribute through the SQS API is refused",
     ],
     ["SqsManagedSseEnabled", "simulated SQS does not encrypt message bodies"],
     ["Tags", "no simulated service reads a queue tag"],

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-property-rules.d.ts

@@ -27,6 +27,7 @@ export declare class SimCfnSqsQueuePropertyRules {
     private readonly logicalId;
     private readonly properties;
     private readonly ignorer;
+    private readonly skipped;
     constructor(properties: SimCfnSqsQueuePropertyRulesProperties);
     /**
      * Whether a property carries a queue attribute of the same name.

package/dist/service/sqs/cfn/queue/sim-cfn-sqs-queue-property-rules.js

@@ -1,3 +1,4 @@
+import { SimCfnSkippedProperties } from "../../../cloudformation/resource/ignore/sim-cfn-skipped-properties.js";
 import { attributePropertyNames, fifoQueueValues, standardQueueValues, unsimulatedPropertyReasons, } from "./sim-cfn-sqs-queue-property-names.js";
 /**
  * Build the error a property of an AWS::SQS::Queue Resource is refused with.
@@ -23,10 +24,16 @@ export class SimCfnSqsQueuePropertyRules {
     logicalId;
     properties;
     ignorer;
+    skipped;
     constructor(properties) {
         this.logicalId = properties.logicalId;
         this.properties = properties.properties;
         this.ignorer = properties.ignorer;
+        this.skipped = new SimCfnSkippedProperties({
+            rules: unsimulatedPropertyReasons,
+            properties: this.properties,
+            error: (reason) => sqsQueuePropertyError(this.logicalId, reason),
+        });
     }
     /**
      * Whether a property carries a queue attribute of the same name.
@@ -39,6 +46,7 @@ export class SimCfnSqsQueuePropertyRules {
      */
     apply() {
         this.applyToFifoQueue();
+        this.skipped.assertConstraints();
         for (const name of Object.keys(this.properties)) {
             this.applyToProperty(name);
         }
@@ -71,7 +79,7 @@ export class SimCfnSqsQueuePropertyRules {
         throw sqsQueuePropertyError(this.logicalId, "FifoQueue must be true or false");
     }
     applyToProperty(name) {
-        const unsimulatedReason = unsimulatedPropertyReasons.get(name);
+        const unsimulatedReason = this.skipped.reasonFor(name);
         if (unsimulatedReason !== undefined) {
             this.ignorer.ignoreProperty(name, `${name} is a real AWS::SQS::Queue property simulated SQS does not ` +
                 `act on: ${unsimulatedReason}`);

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts

@@ -18,6 +18,10 @@ export declare const ssmDefaultKeyAlias = "alias/aws/ssm";
  * caller.
  */
 export declare const ssmKmsViaService = "ssm";
+interface SimSsmKmsOptions {
+    readonly caller?: SimAwsCaller | undefined;
+    readonly viaService?: string | undefined;
+}
 /**
  * The narrow slice of simulated KMS that SecureString parameters need.
  *
@@ -32,11 +36,7 @@ export interface SimSsmKmsCrypto {
             Plaintext?: Uint8Array | undefined;
             EncryptionContext?: Readonly<Record<string, string>> | undefined;
         };
-    }, options?: {
-        caller?: SimAwsCaller | undefined;
-        viaService?: string | undefined;
-        withCallerPermissions?: boolean | undefined;
-    }): Promise<{
+    }, options?: SimSsmKmsOptions): Promise<{
         CiphertextBlob?: Uint8Array | undefined;
         KeyId?: string | undefined;
     }>;
@@ -45,12 +45,9 @@ export interface SimSsmKmsCrypto {
             CiphertextBlob?: Uint8Array | undefined;
             EncryptionContext?: Readonly<Record<string, string>> | undefined;
         };
-    }, options?: {
-        caller?: SimAwsCaller | undefined;
-        viaService?: string | undefined;
-        withCallerPermissions?: boolean | undefined;
-    }): Promise<{
+    }, options?: SimSsmKmsOptions): Promise<{
         Plaintext?: Uint8Array | undefined;
         KeyId?: string | undefined;
     }>;
 }
+export {};

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts

@@ -18,15 +18,15 @@ interface SimSsmParameterKmsProperties {
  * and a decrypting read needs `kms:Decrypt`, each on top of the SSM permission
  * for the parameter itself.
  *
- * They are also made through the service, which is what reaches the `aws/ssm`
- * managed key at all. That key's policy admits the Account's principals when
- * `kms:ViaService` names Systems Manager, and Parameter Store is what supplies
- * it. Reaching the key is not the same as being allowed to use it, and a
- * decrypting read says so with `withCallerPermissions`, because that policy
- * admits whoever the request came from rather than the caller behind it. A
- * Role holding `ssm:GetParameter` and no `kms:Decrypt` reads the ciphertext
- * and not the value. A write under that key asks the caller for no KMS
- * permission here, where AWS documents `kms:Encrypt` for one.
+ * They are also made through the service, and passing through it is what
+ * reaches the `aws/ssm` managed key at all. That key's policy allows the
+ * cryptographic actions to a wildcard principal under `kms:ViaService` and
+ * `kms:CallerAccount` conditions, and Parameter Store supplies the first of
+ * them. A grant of that shape delegates nothing to IAM, and it admits the
+ * request by itself. A Role holding `ssm:GetParameter` and nothing on KMS
+ * reads the decrypted value, as it does in an account. A caller in another
+ * Account fails the `kms:CallerAccount` condition, and a caller reaching KMS
+ * directly carries no `kms:ViaService` for the policy to match.
  *
  * Standard tier Parameter Store encrypts under the key directly rather than
  * through a data key, so this is one Encrypt and one Decrypt and nothing more.
@@ -39,8 +39,7 @@ export declare class SimSsmParameterKms {
      */
     encrypt(parameterArn: string, plaintext: string, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmParameterCiphertext>;
     /**
-     * Decrypt a parameter value, which needs the same binding it was made with,
-     * and the caller's own permission to use the key.
+     * Decrypt a parameter value, which needs the same binding it was made with.
      */
     decrypt(parameterArn: string, ciphertext: string, caller: SimAwsCaller | undefined): Promise<string>;
     private contextFor;