@kensio/yulin 1.21.31 → 1.21.33

package/dist/service/s3/command/copy-object/copy-object-precondition.d.ts

@@ -0,0 +1,23 @@
+import type { SimS3Object } from "../../object/s3-object.js";
+/**
+ * The conditions a copy can place on its source Object, as the
+ * `x-amz-copy-source-if-*` headers.
+ */
+export interface SimS3CopySourcePrecondition {
+    readonly CopySourceIfMatch?: string | undefined;
+    readonly CopySourceIfNoneMatch?: string | undefined;
+    readonly CopySourceIfModifiedSince?: Date | undefined;
+    readonly CopySourceIfUnmodifiedSince?: Date | undefined;
+}
+/**
+ * Refuse a copy whose source Object fails one of its conditions.
+ *
+ * Real S3 follows RFC 7232 here. An ETag condition takes precedence over the
+ * date condition paired with it, so a source that matches `if-match` is copied
+ * however recently it changed, and a source that fails `if-none-match` is
+ * refused however long ago it changed. HTTP dates carry whole seconds, and the
+ * Object's last-modified time is compared at that precision.
+ *
+ * https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html
+ */
+export declare function simS3RequireCopySourcePrecondition(source: SimS3Object, condition: SimS3CopySourcePrecondition): void;

package/dist/service/s3/command/copy-object/copy-object-precondition.js

@@ -0,0 +1,34 @@
+import { SimS3PreconditionFailed } from "../../error/sim-s3.error.js";
+import { simS3ETagMatches, simS3PreconditionMessage, } from "../object/sim-s3-write-precondition.js";
+/**
+ * Refuse a copy whose source Object fails one of its conditions.
+ *
+ * Real S3 follows RFC 7232 here. An ETag condition takes precedence over the
+ * date condition paired with it, so a source that matches `if-match` is copied
+ * however recently it changed, and a source that fails `if-none-match` is
+ * refused however long ago it changed. HTTP dates carry whole seconds, and the
+ * Object's last-modified time is compared at that precision.
+ *
+ * https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html
+ */
+export function simS3RequireCopySourcePrecondition(source, condition) {
+    if (!sourceConditionsHold(source, condition)) {
+        throw new SimS3PreconditionFailed(simS3PreconditionMessage);
+    }
+}
+function sourceConditionsHold(source, condition) {
+    const modified = wholeSeconds(source.lastModified);
+    const { CopySourceIfMatch: ifMatch, CopySourceIfNoneMatch: ifNoneMatch, CopySourceIfModifiedSince: ifModifiedSince, CopySourceIfUnmodifiedSince: ifUnmodifiedSince, } = condition;
+    const matchHolds = ifMatch === undefined
+        ? ifUnmodifiedSince === undefined ||
+            modified <= wholeSeconds(ifUnmodifiedSince)
+        : simS3ETagMatches(ifMatch, source.etag);
+    const noneMatchHolds = ifNoneMatch === undefined
+        ? ifModifiedSince === undefined ||
+            modified > wholeSeconds(ifModifiedSince)
+        : !simS3ETagMatches(ifNoneMatch, source.etag);
+    return matchHolds && noneMatchHolds;
+}
+function wholeSeconds(date) {
+    return Math.floor(date.getTime() / 1000);
+}

package/dist/service/s3/command/copy-object/copy-object.command.d.ts

@@ -2,6 +2,8 @@ import type { SimResponseMetadata } from "../../../aws/metadata/response-metadat
 import type { SimS3ObjectWriteMetadata } from "../../object/s3-write-metadata.js";
 import type { SimS3ObjectWriteStorage } from "../../object/s3-write-storage.js";
 import type { SimS3ObjectWriteTagging } from "../../object/s3-write-tagging.js";
+import type { SimS3WritePrecondition } from "../object/sim-s3-write-precondition.js";
+import type { SimS3CopySourcePrecondition } from "./copy-object-precondition.js";
 /**
  * Minimal structural sim S3 CopyObject command.
  */
@@ -15,7 +17,7 @@ export interface SimCopyObjectCommand {
  * apply to the destination Object under `MetadataDirective: REPLACE`. Under
  * the default `COPY` they are ignored, as real S3 ignores them.
  */
-export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging {
+export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging, SimS3WritePrecondition, SimS3CopySourcePrecondition {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
     /** The source Object, as `sourceBucket/sourceKey`, URL-encoded. */

package/dist/service/s3/command/copy-object/copy-object.handler.d.ts

@@ -36,6 +36,10 @@ export declare class CopyObjectCommandHandler implements CommandHandler<SimCopyO
      * decision. That keeps a malformed request and a missing Bucket answering
      * what real S3 answers. The source Object is read after authorization, which
      * leaves a refused caller knowing nothing about which keys exist.
+     *
+     * The conditions on the source are checked once it has been read, and the
+     * conditions on the destination after that. Either one failing refuses the
+     * copy before anything is written.
      */
     handle(command: SimCopyObjectCommand, options?: SimS3RequestOptions): Promise<SimCopyObjectCommandOutput>;
 }

package/dist/service/s3/command/copy-object/copy-object.handler.js

@@ -4,8 +4,10 @@ import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-servic
 import { simS3QuotedETag } from "../../object/s3-object-etag.js";
 import { GetObjectAuthorizer } from "../get-object/get-object-authorizer.js";
 import { PutObjectAuthorizer } from "../put-object/put-object-authorizer.js";
+import { simS3RequireWritePrecondition } from "../object/sim-s3-write-precondition.js";
 import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
 import { CopyObjectBuilder } from "./copy-object-builder.js";
+import { simS3RequireCopySourcePrecondition } from "./copy-object-precondition.js";
 import { simS3CopySource, simS3CopySourceObject, simS3RefuseUnchangedSelfCopy, } from "./copy-object-source.js";
 /**
  * Simulated S3 CopyObjectCommand handler.
@@ -40,6 +42,10 @@ export class CopyObjectCommandHandler {
      * decision. That keeps a malformed request and a missing Bucket answering
      * what real S3 answers. The source Object is read after authorization, which
      * leaves a refused caller knowing nothing about which keys exist.
+     *
+     * The conditions on the source are checked once it has been read, and the
+     * conditions on the destination after that. Either one failing refuses the
+     * copy before anything is written.
      */
     async handle(command, options) {
         assertDefined(command.input.Bucket, "CopyObjectCommand.input.Bucket");
@@ -56,8 +62,12 @@ export class CopyObjectCommandHandler {
         this.sourceAuthorizer.authorize(source, from.key, options);
         const caller = this.destinationAuthorizer.authorize(destination, key, options);
         const stored = await simS3CopySourceObject(source, from.key);
+        simS3RequireCopySourcePrecondition(stored, command.input);
         const object = this.objectBuilder.build(command.input, key, stored, destination.getEncryption().algorithm);
-        const version = await destination.putObject(object);
+        const version = await destination.writeKey(key, async () => {
+            await simS3RequireWritePrecondition(destination, key, command.input);
+            return await destination.putObject(object);
+        });
         this.notifications.objectCreated({
             bucket: destination,
             object,

package/dist/service/s3/command/object/sim-s3-write-precondition.d.ts

@@ -0,0 +1,34 @@
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+/**
+ * The conditions a write can place on the Object already under its key.
+ *
+ * PutObject, CopyObject and CompleteMultipartUpload all take these, as the
+ * `If-None-Match` and `If-Match` headers.
+ *
+ * https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-writes.html
+ */
+export interface SimS3WritePrecondition {
+    readonly IfMatch?: string | undefined;
+    readonly IfNoneMatch?: string | undefined;
+}
+/**
+ * The message real S3 gives with `PreconditionFailed`.
+ */
+export declare const simS3PreconditionMessage = "At least one of the pre-conditions you specified did not hold";
+/**
+ * Refuse a write whose condition does not hold against the key's current
+ * Object.
+ *
+ * `If-None-Match: *` fails when the key holds an Object. `If-Match` fails when
+ * the Object's ETag differs, and answers `NoSuchKey` when the key holds
+ * nothing. A delete marker counts as nothing, because a read of the key finds
+ * nothing behind it. Real S3 accepts only `*` for `If-None-Match` on a write.
+ */
+export declare function simS3RequireWritePrecondition(bucket: SimS3Bucket, key: string, condition: SimS3WritePrecondition): Promise<void>;
+/**
+ * Whether an entity tag a client sent names an Object's ETag.
+ *
+ * `*` names any Object. A client sends back the ETag it was given, quotes and
+ * all, so both forms are accepted.
+ */
+export declare function simS3ETagMatches(sent: string, etag: string): boolean;

package/dist/service/s3/command/object/sim-s3-write-precondition.js

@@ -0,0 +1,47 @@
+import { SimS3NoSuchKey, SimS3NotImplemented, SimS3PreconditionFailed, } from "../../error/sim-s3.error.js";
+import { simS3UnquotedETag } from "../../object/s3-object-etag.js";
+/**
+ * The message real S3 gives with `PreconditionFailed`.
+ */
+export const simS3PreconditionMessage = "At least one of the pre-conditions you specified did not hold";
+/**
+ * Refuse a write whose condition does not hold against the key's current
+ * Object.
+ *
+ * `If-None-Match: *` fails when the key holds an Object. `If-Match` fails when
+ * the Object's ETag differs, and answers `NoSuchKey` when the key holds
+ * nothing. A delete marker counts as nothing, because a read of the key finds
+ * nothing behind it. Real S3 accepts only `*` for `If-None-Match` on a write.
+ */
+export async function simS3RequireWritePrecondition(bucket, key, condition) {
+    const { IfMatch, IfNoneMatch } = condition;
+    if (IfMatch === undefined && IfNoneMatch === undefined) {
+        return;
+    }
+    if (IfNoneMatch !== undefined && IfNoneMatch !== "*") {
+        throw new SimS3NotImplemented(`A header you provided implies functionality that is not implemented. ` +
+            `If-None-Match on a write takes only *.`);
+    }
+    const current = await bucket.getObject(key);
+    if (IfNoneMatch !== undefined && current !== undefined) {
+        throw new SimS3PreconditionFailed(simS3PreconditionMessage);
+    }
+    if (IfMatch === undefined) {
+        return;
+    }
+    if (current === undefined) {
+        throw new SimS3NoSuchKey(`No S3 Object named ${key}`);
+    }
+    if (!simS3ETagMatches(IfMatch, current.etag)) {
+        throw new SimS3PreconditionFailed(simS3PreconditionMessage);
+    }
+}
+/**
+ * Whether an entity tag a client sent names an Object's ETag.
+ *
+ * `*` names any Object. A client sends back the ETag it was given, quotes and
+ * all, so both forms are accepted.
+ */
+export function simS3ETagMatches(sent, etag) {
+    return sent.trim() === "*" || simS3UnquotedETag(sent).trim() === etag;
+}

package/dist/service/s3/command/put-object/put-object.command.d.ts

@@ -3,6 +3,7 @@ import type { SimS3WriteBody } from "../../object/s3-write-body.js";
 import type { SimS3ObjectWriteMetadata } from "../../object/s3-write-metadata.js";
 import type { SimS3ObjectWriteStorage } from "../../object/s3-write-storage.js";
 import type { SimS3ObjectWriteTagging } from "../../object/s3-write-tagging.js";
+import type { SimS3WritePrecondition } from "../object/sim-s3-write-precondition.js";
 /**
  * Minimal structural sim S3 PutObject command.
  */
@@ -16,7 +17,7 @@ export interface SimPutObjectCommand {
  * Object carries, which is why they are declared once in
  * `SimS3ObjectWriteMetadata` and shared with `CreateMultipartUpload`.
  */
-export interface SimPutObjectCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging {
+export interface SimPutObjectCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging, SimS3WritePrecondition {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
     readonly Body?: SimPutObjectBody;

package/dist/service/s3/command/put-object/put-object.handler.js

@@ -5,6 +5,7 @@ import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
 import { PutObjectAuthorizer } from "./put-object-authorizer.js";
 import { PutObjectBuilder } from "./put-object-builder.js";
 import { simS3QuotedETag } from "../../object/s3-object-etag.js";
+import { simS3RequireWritePrecondition } from "../object/sim-s3-write-precondition.js";
 /**
  * Simulated S3 PutObjectCommand handler.
  *
@@ -45,7 +46,10 @@ export class PutObjectCommandHandler {
         await this.background.sequence();
         const caller = this.authorizer.authorize(bucket, Key, options);
         const object = this.objectBuilder.build(command, bucket.getEncryption().algorithm);
-        const version = await bucket.putObject(object);
+        const version = await bucket.writeKey(Key, async () => {
+            await simS3RequireWritePrecondition(bucket, Key, command.input);
+            return await bucket.putObject(object);
+        });
         const versionId = version?.versionId;
         // Every write path funnels through here, so this one call covers the SDK,
         // an intercepted SDK client and the REST endpoint alike.

package/dist/service/s3/error/sim-s3.error.d.ts

@@ -199,3 +199,13 @@ export declare class SimS3InvalidTag extends SimS3Error {
     readonly name = "InvalidTag";
     constructor(message: string);
 }
+/**
+ * Simulated S3 PreconditionFailed error.
+ *
+ * Real S3 answers this when a conditional request's condition does not hold.
+ * A write refused this way leaves the Object under its key as it was.
+ */
+export declare class SimS3PreconditionFailed extends SimS3Error {
+    readonly name = "PreconditionFailed";
+    constructor(message: string);
+}

package/dist/service/s3/error/sim-s3.error.js

@@ -234,3 +234,15 @@ export class SimS3InvalidTag extends SimS3Error {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated S3 PreconditionFailed error.
+ *
+ * Real S3 answers this when a conditional request's condition does not hold.
+ * A write refused this way leaves the Object under its key as it was.
+ */
+export class SimS3PreconditionFailed extends SimS3Error {
+    name = "PreconditionFailed";
+    constructor(message) {
+        super(message, { httpStatusCode: 412 });
+    }
+}

package/dist/service/s3/object/s3-object-listing.js

@@ -87,10 +87,11 @@ function listingEntries(request) {
             entries.push({ name: object.key, object });
             continue;
         }
-        if (commonPrefix !== rolledUp) {
-            rolledUp = commonPrefix;
-            entries.push({ name: commonPrefix });
+        if (commonPrefix === rolledUp) {
+            continue;
         }
+        rolledUp = commonPrefix;
+        entries.push({ name: commonPrefix });
     }
     return entries;
 }

package/dist/service/s3/serve/api/sim-s3-api-input.d.ts

@@ -31,6 +31,10 @@ export declare function listObjectsInput(request: SimS3ApiRequest): object;
  * an absent member and an empty one differently.
  */
 export declare function optional(name: string, value: string | null): Record<string, string>;
+/**
+ * The date form of the same, dropping a value that is not a date.
+ */
+export declare function optionalDate(name: string, value: string | null): Record<string, Date>;
 /**
  * The numeric form of the same, dropping a value that is not a number.
  */

package/dist/service/s3/serve/api/sim-s3-api-input.js

@@ -61,6 +61,16 @@ export function listObjectsInput(request) {
 export function optional(name, value) {
     return value === null ? {} : { [name]: value };
 }
+/**
+ * The date form of the same, dropping a value that is not a date.
+ */
+export function optionalDate(name, value) {
+    if (value === null) {
+        return {};
+    }
+    const parsed = new Date(value);
+    return Number.isNaN(parsed.getTime()) ? {} : { [name]: parsed };
+}
 /**
  * The numeric form of the same, dropping a value that is not a number.
  */

package/dist/service/s3/serve/api/sim-s3-api-multipart-input.js

@@ -1,4 +1,5 @@
 import { optional, optionalNumber } from "./sim-s3-api-input.js";
+import { writePreconditionInput } from "./sim-s3-api-object-input.js";
 import { readSimS3CompletedUpload } from "./sim-s3-api-xml-read.js";
 /**
  * Reading the multipart upload operations' inputs out of a request.
@@ -33,6 +34,7 @@ export function uploadPartInput(request) {
 export function completeMultipartUploadInput(request) {
     return {
         ...uploadInput(request),
+        ...writePreconditionInput(request),
         MultipartUpload: readSimS3CompletedUpload(request.body),
     };
 }

package/dist/service/s3/serve/api/sim-s3-api-object-input.d.ts

@@ -35,6 +35,12 @@ export declare function getObjectInput(request: SimS3ApiRequest): object;
  * them.
  */
 export declare function putObjectInput(request: SimS3ApiRequest): object;
+/**
+ * The conditions a write places on the Object already under its key, which
+ * PutObject, CopyObject and CompleteMultipartUpload all read from the same two
+ * headers.
+ */
+export declare function writePreconditionInput(request: SimS3ApiRequest): object;
 /**
  * The input of a copy, which names its source in a header and carries no bytes
  * of its own.

package/dist/service/s3/serve/api/sim-s3-api-object-input.js

@@ -1,5 +1,5 @@
 import { simS3WriteMetadataHeaders } from "../../object/s3-write-metadata.js";
-import { optional, utf8 } from "./sim-s3-api-input.js";
+import { optional, optionalDate, utf8 } from "./sim-s3-api-input.js";
 import { readSimS3Tagging } from "./sim-s3-api-tagging-read.js";
 /**
  * Reading the Object operations' inputs out of a request.
@@ -54,7 +54,22 @@ export function getObjectInput(request) {
  * them.
  */
 export function putObjectInput(request) {
-    return { ...createMultipartUploadInput(request), Body: request.body };
+    return {
+        ...createMultipartUploadInput(request),
+        ...writePreconditionInput(request),
+        Body: request.body,
+    };
+}
+/**
+ * The conditions a write places on the Object already under its key, which
+ * PutObject, CopyObject and CompleteMultipartUpload all read from the same two
+ * headers.
+ */
+export function writePreconditionInput(request) {
+    return {
+        ...optional("IfMatch", request.headers.get("if-match")),
+        ...optional("IfNoneMatch", request.headers.get("if-none-match")),
+    };
 }
 /**
  * The input of a copy, which names its source in a header and carries no bytes
@@ -67,11 +82,28 @@ export function putObjectInput(request) {
 export function copyObjectInput(request) {
     return {
         ...createMultipartUploadInput(request),
+        ...writePreconditionInput(request),
+        ...copySourcePreconditionInput(request),
         ...optional("CopySource", request.headers.get(simS3CopySourceHeader)),
         ...optional("MetadataDirective", request.headers.get("x-amz-metadata-directive")),
         ...optional("TaggingDirective", request.headers.get("x-amz-tagging-directive")),
     };
 }
+/**
+ * The conditions a copy places on its source Object.
+ *
+ * The two date headers are HTTP dates, which the SDK hands the operation as
+ * `Date` values.
+ */
+function copySourcePreconditionInput(request) {
+    const header = (name) => request.headers.get(`x-amz-copy-source-if-${name}`);
+    return {
+        ...optional("CopySourceIfMatch", header("match")),
+        ...optional("CopySourceIfNoneMatch", header("none-match")),
+        ...optionalDate("CopySourceIfModifiedSince", header("modified-since")),
+        ...optionalDate("CopySourceIfUnmodifiedSince", header("unmodified-since")),
+    };
+}
 /**
  * The input of a request that describes an Object without carrying its bytes,
  * which is what starting a multipart upload is.

package/dist/service/s3/storage/filesystem/s3-filesystem-object-keys.js

@@ -60,14 +60,15 @@ export class FilesystemS3ObjectKeys {
                 nestedKeyPromises.push(this.listInDirectory(entryPath));
                 continue;
             }
-            if (entry.isFile()) {
-                const key = path
-                    .relative(this.directoryPath, entryPath)
-                    .split(path.sep)
-                    .join("/");
-                if (this.safety.isAllowedObjectKeyExtension(key)) {
-                    keys.push(key);
-                }
+            if (!entry.isFile()) {
+                continue;
+            }
+            const key = path
+                .relative(this.directoryPath, entryPath)
+                .split(path.sep)
+                .join("/");
+            if (this.safety.isAllowedObjectKeyExtension(key)) {
+                keys.push(key);
             }
         }
         const nestedKeys = await Promise.all(nestedKeyPromises);

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-template.test-support.js

@@ -18,29 +18,21 @@ export function secretTemplate(properties = {}) {
 }
 function secretProperties(properties) {
     const { name, description, kmsKeyId, tags, secretString } = properties;
-    const declared = {};
-    if (name !== undefined) {
-        declared["Name"] = name;
-    }
-    if (description !== undefined) {
-        declared["Description"] = description;
-    }
-    if (kmsKeyId !== undefined) {
-        declared["KmsKeyId"] = kmsKeyId;
-    }
-    if (tags !== undefined) {
-        declared["Tags"] = [...tags];
-    }
-    if (secretString === undefined) {
-        declared["GenerateSecretString"] = {
-            SecretStringTemplate: "{}",
-            GenerateStringKey: "current",
-            PasswordLength: properties.passwordLength ?? 64,
-        };
-    }
-    else {
-        declared["SecretString"] = secretString;
-    }
+    const declared = {
+        ...(name !== undefined && { Name: name }),
+        ...(description !== undefined && { Description: description }),
+        ...(kmsKeyId !== undefined && { KmsKeyId: kmsKeyId }),
+        ...(tags !== undefined && { Tags: [...tags] }),
+        ...(secretString === undefined
+            ? {
+                GenerateSecretString: {
+                    SecretStringTemplate: "{}",
+                    GenerateStringKey: "current",
+                    PasswordLength: properties.passwordLength ?? 64,
+                },
+            }
+            : { SecretString: secretString }),
+    };
     return declared;
 }
 function readerResource() {

package/dist/service/sqs/message/sim-sqs-message.js

@@ -126,10 +126,10 @@ export class SimSqsMessage {
                 "ApproximateFirstReceiveTimestamp",
                 String(this.visibility.firstReceived.getTime()),
             ],
+            ...(this.deadLetterSourceArn === undefined
+                ? []
+                : [["DeadLetterQueueSourceArn", this.deadLetterSourceArn]]),
         ]);
-        if (this.deadLetterSourceArn !== undefined) {
-            values.set("DeadLetterQueueSourceArn", this.deadLetterSourceArn);
-        }
         return values;
     }
 }

package/dist/service/stepfunctions/machine/sim-state-machine.js

@@ -56,9 +56,10 @@ export class SimStateMachine {
      */
     update(changes) {
         this.#roleArn = changes.roleArn ?? this.#roleArn;
-        if (changes.definition !== undefined && changes.parsed !== undefined) {
-            this.#definition = changes.definition;
-            this.#parsed = changes.parsed;
+        if (changes.definition === undefined || changes.parsed === undefined) {
+            return;
         }
+        this.#definition = changes.definition;
+        this.#parsed = changes.parsed;
     }
 }

package/dist/util/process/sim-process-environment-reads.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Records the names code reads from the host process.env.
+ *
+ * SimLambdaEnvironmentConflicts warns that a module-scope read sees the host
+ * value of a variable instead of the function's own. Whether that matters
+ * depends on a read having happened at all, which configuration cannot tell.
+ * This keeps the evidence: the host environment is handed out behind a Proxy
+ * that notes each name read through it.
+ *
+ * Enumerating the whole environment is not counted as reading every name in
+ * it. Node.js copies process.env key by key when it spawns a child process,
+ * and so does any tool that snapshots it, and none of that is handler code
+ * capturing a value it later depends on. An enumeration is recognised by its
+ * shape: the property reads that follow a listing of the keys, in the order
+ * the listing gave them. Its reads are recorded as they happen and taken off
+ * the record again once every key has been read, so a listing that is not
+ * followed by a complete copy hides nothing. A module copying the environment
+ * with a spread at module scope is missed as a result.
+ */
+export declare class SimProcessEnvironmentReads {
+    private readonly names;
+    /**
+     * The environment objects each watching Proxy stands in front of, so that
+     * assigning one back to process.env does not stack a Proxy on a Proxy.
+     */
+    private readonly targets;
+    /**
+     * The keys of an enumeration in progress, and how far its reads have got.
+     */
+    private enumeration;
+    /**
+     * Whether code has read the name through a watched environment.
+     */
+    wasRead(name: string): boolean;
+    /**
+     * A view of the environment that records the names read through it.
+     *
+     * Writes and deletes go straight to the environment, so a value assigned
+     * through the view is coerced to a string as process.env would coerce it.
+     */
+    watch(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    /**
+     * The environment behind a watching view, or the environment itself when it
+     * is not one.
+     */
+    unwrap(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    /**
+     * Note a read, and take an enumeration's reads off the record once it has
+     * read every key.
+     */
+    private recordRead;
+}