@gugananuvem/aws-local-simulator 1.0.11 → 1.0.14

package/src/services/lambda/simulator.js

@@ -2,128 +2,85 @@
  * Lambda Simulator - Simula execução de funções Lambda
  */
 
-const HandlerLoader = require('./handler-loader');
-const RouteRegistry = require('./route-registry');
-const logger = require('../../utils/logger');
+const HandlerLoader = require("./handler-loader");
+const logger = require("../../utils/logger");
+const { CloudTrailAudit } = require("../../utils/cloudtrail-audit");
 
 class LambdaSimulator {
   constructor(config) {
     this.config = config;
-    this.routeRegistry = new RouteRegistry();
-    this.lambdas = new Map();
+    this.lambdas = new Map(); // functionName -> { handler, env, config }
     this.environment = { ...process.env };
+    this.audit = new CloudTrailAudit("lambda.amazonaws.com");
   }
 
   async initialize() {
-    logger.debug('Inicializando Lambda Simulator...');
-    
+    logger.debug("Inicializando Lambda Simulator...");
+
     if (this.config.lambdas && this.config.lambdas.length > 0) {
       for (const lambdaConfig of this.config.lambdas) {
         await this.registerLambda(lambdaConfig);
       }
     }
-    
+
     logger.debug(`✅ ${this.lambdas.size} Lambdas registradas`);
   }
 
   async registerLambda(lambdaConfig) {
     try {
-      const { path, handler: handlerPath, env = {}, type = 'auto' } = lambdaConfig;
-      
-      // Carrega o handler
+      const { name, handler: handlerPath, env = {}, type = "auto" } = lambdaConfig;
+
+      if (!name) {
+        logger.warn(`Lambda sem nome ignorada: ${JSON.stringify(lambdaConfig)}`);
+        return;
+      }
+
       const handler = await HandlerLoader.load(handlerPath, type);
-      
-      // Registra no route registry
-      this.routeRegistry.register(path, handler, env);
-      
-      // Armazena metadata
-      this.lambdas.set(path, {
-        path,
-        handler,
-        handlerPath,
-        handlerName: handler.name || 'anonymous',
-        env,
-        type,
-        registeredAt: new Date().toISOString()
-      });
-      
-      logger.debug(`✅ Lambda registrada: ${path} -> ${handler.name || 'anonymous'}`);
-      
-    } catch (error) {
-      logger.error(`❌ Erro ao registrar Lambda ${lambdaConfig.path}:`, error);
-      throw error;
+      if (handler != undefined) {
+        this.lambdas.set(name, {
+          name,
+          handler,
+          handlerPath,
+          handlerName: handler.name || "anonymous",
+          env,
+          type,
+          registeredAt: new Date().toISOString(),
+        });
+      }
+      logger.debug(`✅ Lambda registrada: ${name} -> ${handlerPath}`);
+    } catch (error) {     
+      if (error.message.indexOf("Handler não encontrado") == -1){
+        logger.error(`Erro ao registrar Lambda ${lambdaConfig.name}:`, error);
+        throw error;
+      }else{
+        logger.error(`Erro ao registrar Lambda ${lambdaConfig.name}:`);
+      }
     }
   }
 
-  async handleRequest(req, res) {
-    const matchedRoute = this.routeRegistry.find(req.path);
-    
-    if (!matchedRoute) {
-      return {
-        error: {
-          statusCode: 404,
-          message: `Route not found: ${req.path}`,
-          availableRoutes: this.listRoutes()
-        },
-        status: 404
-      };
+  async invoke(functionName, event, invocationType = "RequestResponse") {
+    const lambda = this.lambdas.get(functionName);
+
+    if (!lambda) {
+      throw new Error(`Function not found: ${functionName}`);
     }
-    
-    // Aplica variáveis de ambiente específicas da rota
-    this.applyEnvironment(matchedRoute.env);
-    
-    // Prepara evento Lambda
-    const event = this.toLambdaEvent(req, matchedRoute.params);
-    
-    logger.debug(`🎯 Executando: ${matchedRoute.path} -> ${matchedRoute.handler.name || 'anonymous'}`);
-    
-    // Executa middlewares
-    const middlewares = this.routeRegistry.getMiddlewares(matchedRoute);
-    let handled = false;
-    let result = null;
-    
-    const runMiddlewares = async (index) => {
-      if (index >= middlewares.length) {
-        // Executa handler
 
-        result = await this.executeHandler(matchedRoute.handler, event);
-        handled = true;
-      
-        console.log(`✅ Resposta: ${result.statusCode}`);
-        res
-          .status(result.statusCode || 200)
-          .set(result.headers || {})
-          .send(result.body ? JSON.parse(result.body) : null);
-        return;
-      }
-      
-      const middleware = middlewares[index];
-      await new Promise((resolve, reject) => {
-        middleware(event, {
-          status: (code) => ({ json: (data) => {
-            result = { statusCode: code, body: data };
-            handled = true;
-            resolve();
-          }}),
-          send: (data) => {
-            result = { statusCode: 200, body: data };
-            handled = true;
-            resolve();
-          },
-          next: () => {
-            runMiddlewares(index + 1).then(resolve).catch(reject);
-          }
-        });
-      });
-    };
-    
-    await runMiddlewares(0);
-    
-    if (!handled && result) {
-      return this.formatResponse(result);
+    this.applyEnvironment(lambda.env);
+    logger.debug(`🎯 Invocando Lambda: ${functionName}`);
+
+    if (invocationType === "Event") {
+      this.executeHandler(lambda.handler, event).catch((err) => logger.error(`❌ Async Lambda error (${functionName}):`, err));
+      return { StatusCode: 202 };
     }
 
-    return null;
+    const result = await this.executeHandler(lambda.handler, event);
+    this.audit.record({
+      eventName: "Invoke",
+      readOnly: false,
+      resources: [{ ARN: `arn:aws:lambda:local:000000000000:function:${functionName}`, type: "AWS::Lambda::Function" }],
+      requestParameters: { functionName, invocationType },
+    });
+    return { StatusCode: result.statusCode || 200, Payload: result };
   }
 
   async executeHandler(handler, event) {
@@ -132,67 +89,27 @@ class LambdaSimulator {
       const result = await handler(event, context);
       return result;
     } catch (error) {
-      logger.error('❌ Erro no handler:', error);
+      logger.error("❌ Erro no handler:", error);
       return {
         statusCode: 500,
-        body: {
-          error: 'Internal Server Error',
-          message: error.message,
-          stack: process.env.NODE_ENV === 'development' ? error.stack : undefined
-        }
+        body: JSON.stringify({ error: "Internal Server Error", message: error.message }),
       };
     }
   }
 
-  toLambdaEvent(req, params = {}) {
-    return {
-      httpMethod: req.method,
-      path: req.path,
-      headers: req.headers,
-      queryStringParameters: req.query,
-      pathParameters: params,
-      body: req.body ? (typeof req.body === 'string' ? req.body : JSON.stringify(req.body)) : null,
-      isBase64Encoded: false,
-      requestContext: {
-        path: req.path,
-        stage: process.env.STAGE_NAME || 'dev',
-        requestId: Math.random().toString(36).substring(7),
-        identity: {
-          sourceIp: req.ip,
-          userAgent: req.headers['user-agent']
-        }
-      },
-      stageVariables: {},
-      resource: req.path
-    };
-  }
-
-  formatResponse(result) {
-    const statusCode = result.statusCode || 200;
-    const body = result.body;
-    const headers = result.headers || { 'Content-Type': 'application/json' };
-    
-    return {
-      statusCode,
-      headers,
-      body: typeof body === 'string' ? body : JSON.stringify(body),
-      isBase64Encoded: false
-    };
-  }
-
   createContext() {
     return {
       awsRequestId: Math.random().toString(36).substring(7),
-      functionName: 'local-lambda',
-      functionVersion: '$LATEST',
-      invokedFunctionArn: 'arn:aws:lambda:local:function',
-      memoryLimitInMB: '1024',
-      logGroupName: '/aws/lambda/local-lambda',
-      logStreamName: 'local-stream',
+      functionName: "local-lambda",
+      functionVersion: "$LATEST",
+      invokedFunctionArn: "arn:aws:lambda:local:000000000000:function:local-lambda",
+      memoryLimitInMB: "1024",
+      logGroupName: "/aws/lambda/local-lambda",
+      logStreamName: "local-stream",
       getRemainingTimeInMillis: () => 30000,
       callbackWaitsForEmptyEventLoop: true,
       identity: null,
-      clientContext: null
+      clientContext: null,
     };
   }
 
@@ -213,22 +130,18 @@ class LambdaSimulator {
   }
 
   listLambdas() {
-    return Array.from(this.lambdas.values()).map(l => ({
-      path: l.path,
+    return Array.from(this.lambdas.values()).map((l) => ({
+      name: l.name,
       handlerName: l.handlerName,
       handlerPath: l.handlerPath,
       type: l.type,
       env: l.env,
-      registeredAt: l.registeredAt
+      registeredAt: l.registeredAt,
     }));
   }
 
-  getLambda(path) {
-    return this.lambdas.get(path);
-  }
-
-  listRoutes() {
-    return this.routeRegistry.list();
+  getLambda(name) {
+    return this.lambdas.get(name);
   }
 
   getLambdasCount() {
@@ -236,50 +149,34 @@ class LambdaSimulator {
   }
 
   async reloadLambdas() {
-    logger.info('🔄 Recarregando Lambdas...');
-    
-    for (const [path, lambda] of this.lambdas.entries()) {
+    logger.info("🔄 Recarregando Lambdas...");
+
+    for (const [name, lambda] of this.lambdas.entries()) {
       try {
         const newHandler = await HandlerLoader.reload(lambda.handlerPath, lambda.type);
-        this.routeRegistry.register(path, newHandler, lambda.env);
         lambda.handler = newHandler;
-        lambda.handlerName = newHandler.name || 'anonymous';
-        logger.debug(`✅ Lambda recarregada: ${path}`);
+        lambda.handlerName = newHandler.name || "anonymous";
+        logger.debug(`✅ Lambda recarregada: ${name}`);
       } catch (error) {
-        logger.error(`❌ Erro ao recarregar Lambda ${path}:`, error);
+        logger.error(`❌ Erro ao recarregar Lambda ${name}:`, error);
       }
     }
-    
+
     logger.info(`✅ ${this.lambdas.size} Lambdas recarregadas`);
   }
 
   getStats() {
-    const lambdas = this.listLambdas();
     return {
-      totalLambdas: lambdas.length,
-      lambdas: lambdas.map(l => ({
-        path: l.path,
-        handler: l.handlerName
-      })),
-      routes: this.routeRegistry.getStats(),
-      environment: Object.keys(this.environment).length
+      totalLambdas: this.lambdas.size,
+      lambdas: this.listLambdas().map((l) => ({ name: l.name, handler: l.handlerName })),
     };
   }
 
   async reset() {
-    // Recarrega Lambdas
     await this.reloadLambdas();
-    
-    // Limpa variáveis de ambiente customizadas
-    for (const key of Object.keys(this.environment)) {
-      if (!process.env.hasOwnProperty(key) || key.startsWith('AWS_LOCAL_SIMULATOR_')) {
-        delete process.env[key];
-      }
-    }
-    
     this.environment = { ...process.env };
-    logger.debug('Lambda: Estado resetado');
+    logger.debug("Lambda: Estado resetado");
   }
 }
 
-module.exports = LambdaSimulator;
+module.exports = LambdaSimulator;

package/src/services/parameter-store/index.js

@@ -0,0 +1,80 @@
+'use strict';
+
+/**
+ * @fileoverview Parameter Store Service
+ * Porta padrão: 4002
+ */
+
+const http = require('http');
+const path = require('path');
+const { ParameterStoreSimulator } = require('./simulator');
+const { ParameterStoreServer } = require('./server');
+const LocalStore = require('../../utils/local-store');
+
+class ParameterStoreService {
+  constructor(config) {
+    this.config = config;
+    this.logger = require('../../utils/logger');
+    this.name = 'parameter-store';
+    this.port = config?.ports?.parameterStore || config?.services?.parameterStore?.port || 4002;
+    this.store = null;
+    this.simulator = null;
+    this.httpServer = null;
+    this.isRunning = false;
+  }
+
+  async initialize() {
+    this.logger.debug(`Inicializando Parameter Store Service na porta ${this.port}...`);
+    const dataDir = process.env.AWS_LOCAL_SIMULATOR_DATA_DIR;
+    this.store = new LocalStore(path.join(dataDir, 'parameter-store'));
+    this.simulator = new ParameterStoreSimulator(this.store, this.logger, this.config);
+    await this.simulator.initialize();
+    this.app = new ParameterStoreServer(this.simulator, this.logger, this.config).getApp();
+    this.logger.debug('Parameter Store Service inicializado');
+  }
+
+  injectDependencies(server) {
+    const ct = server.getService('cloudtrail');
+    if (ct?.simulator) this.simulator.audit.setTrail(ct.simulator);
+  }
+
+  async start() {
+    if (this.isRunning) return;
+    return new Promise((resolve, reject) => {
+      this.httpServer = http.createServer(this.app);
+      this.httpServer.listen(this.port, () => {
+        this.isRunning = true;
+        this.logger.debug(`Parameter Store rodando na porta ${this.port}`);
+        resolve();
+      });
+      this.httpServer.on('error', reject);
+    });
+  }
+
+  async stop() {
+    if (!this.isRunning || !this.httpServer) return;
+    return new Promise((resolve) => {
+      this.httpServer.close(() => {
+        this.isRunning = false;
+        resolve();
+      });
+    });
+  }
+
+  async reset() {
+    await this.simulator.reset();
+  }
+
+  getStatus() {
+    return {
+      running: this.isRunning,
+      port: this.port,
+      endpoint: `http://localhost:${this.port}`,
+      parameters: this.simulator?.parameters.size || 0,
+    };
+  }
+
+  getSimulator() { return this.simulator; }
+}
+
+module.exports = { ParameterStoreService };

package/src/services/parameter-store/server.js

@@ -0,0 +1,50 @@
+'use strict';
+
+const express = require('express');
+const cors = require('cors');
+
+class ParameterStoreServer {
+  constructor(simulator, logger, config) {
+    this.simulator = simulator; this.logger = logger; this.config = config;
+    this.app = express();
+    this._setupMiddleware(); this._setupRoutes();
+  }
+  _setupMiddleware() {
+    if (this.config.cors?.enabled !== false) this.app.use(cors({ origin: this.config.cors?.origin || '*' }));
+    this.app.use(express.json({ limit: '5mb', type: ['application/json', 'application/x-amz-json-1.1'] }));
+  }
+  _getOperation(target) {
+    const map = {
+      'AmazonSSM.PutParameter': 'putParameter',
+      'AmazonSSM.GetParameter': 'getParameter',
+      'AmazonSSM.GetParameters': 'getParameters',
+      'AmazonSSM.GetParametersByPath': 'getParametersByPath',
+      'AmazonSSM.DeleteParameter': 'deleteParameter',
+      'AmazonSSM.DeleteParameters': 'deleteParameters',
+      'AmazonSSM.DescribeParameters': 'describeParameters',
+      'AmazonSSM.GetParameterHistory': 'getParameterHistory',
+      'AmazonSSM.AddTagsToResource': 'addTagsToResource',
+      'AmazonSSM.RemoveTagsFromResource': 'removeTagsFromResource',
+    };
+    return map[target];
+  }
+  _setupRoutes() {
+    this.app.get('/__admin/health', (req, res) => res.json({ status: 'healthy', service: 'parameter-store', timestamp: new Date().toISOString() }));
+    this.app.post('/', async (req, res) => {
+      const target = req.headers['x-amz-target'];
+      const operation = this._getOperation(target);
+      if (!operation) return res.status(400).json({ __type: 'InvalidAction', message: `Unknown: ${target}` });
+      try {
+        const result = await this.simulator[operation](req.body || {});
+        res.json(result || {});
+      } catch (err) {
+        this.logger.error(`ParameterStore ${target}: ${err.message}`, 'parameter-store');
+        const statusCodes = { ParameterNotFound: 400, ParameterAlreadyExists: 400, ParameterPatternMismatch: 400 };
+        res.status(statusCodes[err.code] || 500).json({ __type: err.code || 'InternalServerError', message: err.message });
+      }
+    });
+  }
+  getApp() { return this.app; }
+}
+
+module.exports = { ParameterStoreServer };

package/src/services/parameter-store/simulator.js

@@ -0,0 +1,201 @@
+'use strict';
+
+const crypto = require('crypto');
+const { v4: uuidv4 } = require('uuid');
+const { CloudTrailAudit } = require('../../utils/cloudtrail-audit');
+
+/**
+ * Parameter Store (SSM) Simulator
+ */
+class ParameterStoreSimulator {
+  constructor(store, logger, config) {
+    this.store = store; this.logger = logger; this.config = config;
+    this.parameters = new Map();
+    this.history = new Map();
+    this.audit = new CloudTrailAudit('ssm.amazonaws.com');
+  }
+
+  async initialize() {
+    try {
+      const params = await this.store.read('parameter-store/parameters');
+      if (Array.isArray(params)) for (const p of params) this.parameters.set(p.Name, p);
+      const history = await this.store.read('parameter-store/history');
+      if (Array.isArray(history)) for (const h of history) this.history.set(h.name, h.versions);
+      this.logger.info('ParameterStore: dados carregados', 'parameter-store');
+    } catch { this.logger.debug('ParameterStore: sem dados anteriores', 'parameter-store'); }
+  }
+
+  async _persist() {
+    await this.store.write('parameter-store/parameters', null, Array.from(this.parameters.values()));
+    const histArr = Array.from(this.history.entries()).map(([name, versions]) => ({ name, versions }));
+    await this.store.write('parameter-store/history', null, histArr);
+  }
+
+  _require(name) {
+    const p = this.parameters.get(name);
+    if (!p) { const err = new Error(`Parameter not found: ${name}`); err.code = 'ParameterNotFound'; throw err; }
+    return p;
+  }
+
+  async putParameter(params) {
+    const { Name, Value, Type = 'String', Description, Overwrite, Tags = [], KeyId, AllowedPattern, DataType = 'text' } = params;
+    if (this.parameters.has(Name) && !Overwrite) {
+      const err = new Error(`Parameter already exists: ${Name}`); err.code = 'ParameterAlreadyExists'; throw err;
+    }
+    if (AllowedPattern && !new RegExp(AllowedPattern).test(Value)) {
+      const err = new Error(`Value doesn't match pattern: ${AllowedPattern}`); err.code = 'ParameterPatternMismatch'; throw err;
+    }
+    const existing = this.parameters.get(Name);
+    const version = existing ? existing.Version + 1 : 1;
+    const storedValue = Type === 'SecureString' ? this._encrypt(Value) : Value;
+    const param = {
+      Name, Value: storedValue, Type, Description: Description || '', Version: version,
+      LastModifiedDate: new Date().toISOString(),
+      LastModifiedUser: 'local',
+      ARN: `arn:aws:ssm:local:000000000000:parameter${Name}`,
+      DataType, Tags: Tags || [], KeyId: Type === 'SecureString' ? (KeyId || 'aws/ssm') : undefined
+    };
+    this.parameters.set(Name, param);
+    // History
+    if (!this.history.has(Name)) this.history.set(Name, []);
+    this.history.get(Name).push({ ...param, Value });
+    await this._persist();
+    this.logger.info(`ParameterStore: parâmetro definido: ${Name}`, 'parameter-store');
+    this.audit.record({ eventName: 'PutParameter', readOnly: false, isDataEvent: true, resources: [{ ARN: param.ARN, type: 'AWS::SSM::Parameter' }], requestParameters: { name: Name, type: Type } });
+    return { Version: version, Tier: 'Standard' };
+  }
+
+  async getParameter(params) {
+    const { Name, WithDecryption } = params;
+    const param = this._require(Name);
+    const value = (WithDecryption && param.Type === 'SecureString') ? this._decrypt(param.Value) : param.Value;
+    this.audit.record({ eventName: 'GetParameter', readOnly: true, isDataEvent: true, resources: [{ ARN: param.ARN, type: 'AWS::SSM::Parameter' }], requestParameters: { name: Name } });
+    return { Parameter: { ...param, Value: value } };
+  }
+
+  async getParameters(params) {
+    const { Names, WithDecryption } = params;
+    const found = []; const invalid = [];
+    for (const name of Names) {
+      try {
+        const param = this._require(name);
+        const value = (WithDecryption && param.Type === 'SecureString') ? this._decrypt(param.Value) : param.Value;
+        found.push({ ...param, Value: value });
+      } catch { invalid.push(name); }
+    }
+    return { Parameters: found, InvalidParameters: invalid };
+  }
+
+  async getParametersByPath(params) {
+    const { Path, Recursive, WithDecryption, MaxResults = 10, NextToken, ParameterFilters = [] } = params;
+    let results = Array.from(this.parameters.values()).filter(p => {
+      if (Recursive) return p.Name.startsWith(Path);
+      const rest = p.Name.slice(Path.length);
+      return p.Name.startsWith(Path) && !rest.includes('/');
+    });
+    for (const filter of ParameterFilters) {
+      if (filter.Key === 'Type') results = results.filter(p => filter.Values.includes(p.Type));
+    }
+    let startIdx = 0;
+    if (NextToken) startIdx = parseInt(NextToken);
+    const slice = results.slice(startIdx, startIdx + MaxResults);
+    return {
+      Parameters: slice.map(p => ({
+        ...p, Value: (WithDecryption && p.Type === 'SecureString') ? this._decrypt(p.Value) : p.Value
+      })),
+      NextToken: results.length > startIdx + MaxResults ? String(startIdx + MaxResults) : undefined
+    };
+  }
+
+  async deleteParameter(params) {
+    const p = this._require(params.Name);
+    this.parameters.delete(params.Name);
+    await this._persist();
+    this.audit.record({ eventName: 'DeleteParameter', readOnly: false, resources: [{ ARN: p.ARN, type: 'AWS::SSM::Parameter' }], requestParameters: { name: params.Name } });
+    return {};
+  }
+
+  async deleteParameters(params) {
+    const { Names } = params;
+    const deleted = []; const invalid = [];
+    for (const name of Names) {
+      if (this.parameters.has(name)) { this.parameters.delete(name); deleted.push(name); }
+      else invalid.push(name);
+    }
+    await this._persist();
+    return { DeletedParameters: deleted, InvalidParameters: invalid };
+  }
+
+  async describeParameters(params) {
+    const { Filters = [], ParameterFilters = [], MaxResults = 50, NextToken } = params || {};
+    let results = Array.from(this.parameters.values());
+    for (const f of Filters) {
+      if (f.Key === 'Name') results = results.filter(p => f.Values.some(v => p.Name.includes(v)));
+      if (f.Key === 'Type') results = results.filter(p => f.Values.includes(p.Type));
+    }
+    let startIdx = 0;
+    if (NextToken) startIdx = parseInt(NextToken);
+    const slice = results.slice(startIdx, startIdx + MaxResults);
+    return {
+      Parameters: slice.map(({ Value, ...p }) => p),
+      NextToken: results.length > startIdx + MaxResults ? String(startIdx + MaxResults) : undefined
+    };
+  }
+
+  async getParameterHistory(params) {
+    const { Name, MaxResults = 50, NextToken } = params;
+    this._require(Name);
+    const history = this.history.get(Name) || [];
+    let startIdx = 0;
+    if (NextToken) startIdx = parseInt(NextToken);
+    const slice = history.slice(startIdx, startIdx + MaxResults);
+    return {
+      Parameters: slice,
+      NextToken: history.length > startIdx + MaxResults ? String(startIdx + MaxResults) : undefined
+    };
+  }
+
+  async addTagsToResource(params) {
+    const { ResourceType, ResourceId, Tags } = params;
+    if (ResourceType === 'Parameter') {
+      const param = this._require(ResourceId);
+      for (const tag of Tags) { const idx = param.Tags.findIndex(t => t.Key === tag.Key); if (idx >= 0) param.Tags[idx] = tag; else param.Tags.push(tag); }
+      await this._persist();
+    }
+    return {};
+  }
+
+  async removeTagsFromResource(params) {
+    const { ResourceType, ResourceId, TagKeys } = params;
+    if (ResourceType === 'Parameter') {
+      const param = this._require(ResourceId);
+      param.Tags = param.Tags.filter(t => !TagKeys.includes(t.Key));
+      await this._persist();
+    }
+    return {};
+  }
+
+  _encrypt(value) {
+    const key = crypto.createHash('sha256').update('local-ssm-key').digest();
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const enc = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString('base64');
+  }
+
+  _decrypt(encrypted) {
+    try {
+      const key = crypto.createHash('sha256').update('local-ssm-key').digest();
+      const buf = Buffer.from(encrypted, 'base64');
+      const iv = buf.slice(0, 12); const tag = buf.slice(12, 28); const enc = buf.slice(28);
+      const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+      decipher.setAuthTag(tag);
+      return Buffer.concat([decipher.update(enc), decipher.final()]).toString('utf8');
+    } catch { return encrypted; }
+  }
+
+  async reset() { this.parameters.clear(); this.history.clear(); await this.store.clear('parameter-store'); }
+}
+
+module.exports = { ParameterStoreSimulator };