@kensio/yulin 0.40.0 → 0.42.0

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-cipher.js

@@ -0,0 +1,53 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { SimSecretsManagerEncryptedValue } from "./sim-secrets-manager-encrypted-value.js";
+import { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+/**
+ * The cipher a data key encrypts a secret value with.
+ *
+ * This is the half of envelope encryption that does not happen inside KMS.
+ * KMS produces and later recovers the data key; the value itself is encrypted
+ * out here with AES-256-GCM, which is what the AWS Encryption SDK does with a
+ * data key too.
+ */
+const algorithm = "aes-256-gcm";
+const ivLength = 12;
+/**
+ * Encrypts and decrypts a secret value under a plaintext data key.
+ *
+ * The encryption context is not bound in here. KMS binds it to the data key,
+ * so a decryption naming a different secret or version fails at the KMS call
+ * rather than at this cipher, which is where real Secrets Manager fails too.
+ */
+export class SimSecretsManagerValueCipher {
+    /**
+     * Encrypt a value under a data key.
+     */
+    seal(value, dataKey, dataKeyCiphertext) {
+        const iv = randomBytes(ivLength);
+        const cipher = createCipheriv(algorithm, dataKey, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(value.bytes),
+            cipher.final(),
+        ]);
+        return new SimSecretsManagerEncryptedValue({
+            dataKeyCiphertext,
+            iv: Uint8Array.from(iv),
+            authTag: Uint8Array.from(cipher.getAuthTag()),
+            ciphertext: Uint8Array.from(ciphertext),
+            digest: value.digest,
+        });
+    }
+    /**
+     * Decrypt a value with the data key KMS recovered for it.
+     */
+    open(encrypted, dataKey) {
+        const decipher = createDecipheriv(algorithm, dataKey, encrypted.iv);
+        decipher.setAuthTag(encrypted.authTag);
+        const plaintext = Buffer.concat([
+            decipher.update(encrypted.ciphertext),
+            decipher.final(),
+        ]);
+        return SimSecretsManagerSecretValue.fromBytes(Uint8Array.from(plaintext));
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-value-cipher.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-value-cipher.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-value-cipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACvC;;OAEG;IACH,IAAI,CACF,KAAmC,EACnC,OAAmB,EACnB,iBAA6B;QAE7B,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,OAAO,IAAI,+BAA+B,CAAC;YACzC,iBAAiB;YACjB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7C,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,CACF,SAA0C,EAC1C,OAAmB;QAEnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;YACrC,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,4BAA4B,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-encryption.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimSecretsManagerEncryptedValue } from "./sim-secrets-manager-encrypted-value.js";
+import { type SimSecretsManagerKmsCrypto } from "./sim-secrets-manager-kms-crypto.js";
+import type { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+/**
+ * What a secret version's encryption is bound to.
+ *
+ * Real Secrets Manager binds both the secret and the version, so a ciphertext
+ * lifted out of one version cannot be decrypted as another, and a
+ * `kms:EncryptionContext:SecretARN` policy condition matches on the secret it
+ * belongs to.
+ */
+export interface SimSecretsManagerEncryptionBinding {
+    readonly secretArn: string;
+    readonly versionId: string;
+}
+interface SimSecretsManagerValueEncryptionProperties {
+    readonly kms: SimSecretsManagerKmsCrypto;
+}
+/**
+ * The KMS calls a secret version's value makes.
+ *
+ * The calls are made as the caller rather than as the service, which is what
+ * puts a customer managed key's permissions in the way: a write needs the
+ * caller's own `kms:GenerateDataKey` and a read needs `kms:Decrypt`, each on
+ * top of the Secrets Manager permission for the secret itself. They are made
+ * through the service as well, so the `aws/secretsmanager` managed key needs
+ * no KMS permission at all, as on real AWS.
+ */
+export declare class SimSecretsManagerValueEncryption {
+    private readonly kms;
+    private readonly cipher;
+    constructor(properties: SimSecretsManagerValueEncryptionProperties);
+    /**
+     * Encrypt a value as a new version, under the secret's key.
+     */
+    encrypt(binding: SimSecretsManagerEncryptionBinding, value: SimSecretsManagerSecretValue, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSecretsManagerEncryptedValue>;
+    /**
+     * Decrypt a stored version, which needs the same binding it was made with.
+     */
+    decrypt(binding: SimSecretsManagerEncryptionBinding, encrypted: SimSecretsManagerEncryptedValue, caller: SimAwsCaller | undefined): Promise<SimSecretsManagerSecretValue>;
+    private contextFor;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-value-encryption.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-value-encryption.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-value-encryption.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAChG,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAG1F;;;;;;;GAOG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,0CAA0C;IAClD,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA6B;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,kCAAkC,EAC3C,KAAK,EAAE,4BAA4B,EACnC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,+BAA+B,CAAC,CA0B1C;IAED;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,kCAAkC,EAC3C,SAAS,EAAE,+BAA+B,EAC1C,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,4BAA4B,CAAC,CAqBvC;IAED,OAAO,CAAC,UAAU;CAQnB"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-encryption.js

@@ -0,0 +1,56 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { secretsManagerDataKeySpec, secretsManagerDefaultKeyAlias, secretsManagerKmsViaService, } from "./sim-secrets-manager-kms-crypto.js";
+import { reportingKeyProblems } from "./sim-secrets-manager-kms-key-problems.js";
+import { SimSecretsManagerValueCipher } from "./sim-secrets-manager-value-cipher.js";
+/**
+ * The KMS calls a secret version's value makes.
+ *
+ * The calls are made as the caller rather than as the service, which is what
+ * puts a customer managed key's permissions in the way: a write needs the
+ * caller's own `kms:GenerateDataKey` and a read needs `kms:Decrypt`, each on
+ * top of the Secrets Manager permission for the secret itself. They are made
+ * through the service as well, so the `aws/secretsmanager` managed key needs
+ * no KMS permission at all, as on real AWS.
+ */
+export class SimSecretsManagerValueEncryption {
+    kms;
+    cipher = new SimSecretsManagerValueCipher();
+    constructor(properties) {
+        this.kms = properties.kms;
+    }
+    /**
+     * Encrypt a value as a new version, under the secret's key.
+     */
+    async encrypt(binding, value, keyId, caller) {
+        const dataKey = await reportingKeyProblems("encrypting", async () => await this.kms.generateDataKey({
+            input: {
+                KeyId: keyId ?? secretsManagerDefaultKeyAlias,
+                KeySpec: secretsManagerDataKeySpec,
+                EncryptionContext: this.contextFor(binding),
+            },
+        }, { caller, viaService: secretsManagerKmsViaService }));
+        assertDefined(dataKey.Plaintext, `Simulated KMS generated no data key for ${binding.secretArn}`);
+        assertDefined(dataKey.CiphertextBlob, `Simulated KMS encrypted no data key for ${binding.secretArn}`);
+        return this.cipher.seal(value, dataKey.Plaintext, dataKey.CiphertextBlob);
+    }
+    /**
+     * Decrypt a stored version, which needs the same binding it was made with.
+     */
+    async decrypt(binding, encrypted, caller) {
+        const dataKey = await reportingKeyProblems("decrypting", async () => await this.kms.decrypt({
+            input: {
+                CiphertextBlob: encrypted.dataKeyCiphertext,
+                EncryptionContext: this.contextFor(binding),
+            },
+        }, { caller, viaService: secretsManagerKmsViaService }));
+        assertDefined(dataKey.Plaintext, `Simulated KMS recovered no data key for ${binding.secretArn}`);
+        return this.cipher.open(encrypted, dataKey.Plaintext);
+    }
+    contextFor(binding) {
+        return {
+            SecretARN: binding.secretArn,
+            SecretVersionId: binding.versionId,
+        };
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-value-encryption.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-value-encryption.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-value-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,GAE5B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAmBrF;;;;;;;;;GASG;AACH,MAAM,OAAO,gCAAgC;IAC1B,GAAG,CAA6B;IAChC,MAAM,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAE7D,YAAY,UAAsD;QAChE,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,OAA2C,EAC3C,KAAmC,EACnC,KAAyB,EACzB,MAAgC;QAEhC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,YAAY,EACZ,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAC5B;YACE,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK,IAAI,6BAA6B;gBAC7C,OAAO,EAAE,yBAAyB;gBAClC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;aAC5C;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,CACpD,CACJ,CAAC;QAEF,aAAa,CACX,OAAO,CAAC,SAAS,EACjB,2CAA2C,OAAO,CAAC,SAAS,EAAE,CAC/D,CAAC;QACF,aAAa,CACX,OAAO,CAAC,cAAc,EACtB,2CAA2C,OAAO,CAAC,SAAS,EAAE,CAC/D,CAAC;QAEF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,OAA2C,EAC3C,SAA0C,EAC1C,MAAgC;QAEhC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,YAAY,EACZ,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB;YACE,KAAK,EAAE;gBACL,cAAc,EAAE,SAAS,CAAC,iBAAiB;gBAC3C,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;aAC5C;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,CACpD,CACJ,CAAC;QAEF,aAAa,CACX,OAAO,CAAC,SAAS,EACjB,2CAA2C,OAAO,CAAC,SAAS,EAAE,CAC/D,CAAC;QAEF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAEO,UAAU,CAChB,OAA2C;QAE3C,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,OAAO,CAAC,SAAS;SACnC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-write.d.ts

@@ -0,0 +1,37 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimSecretsManagerSecret } from "./sim-secrets-manager-secret.js";
+import type { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+/**
+ * The version-shaping fields a write request can carry.
+ */
+export interface SimSecretsManagerVersionWriteInput {
+    readonly ClientRequestToken?: string | undefined;
+    readonly VersionStages?: readonly string[] | undefined;
+}
+/**
+ * One write of a secret version, as the three writing commands describe it.
+ *
+ * CreateSecret, PutSecretValue and UpdateSecret differ in what they do around
+ * the write and agree on the write itself, so what they have to say about it
+ * is one shape rather than three argument lists.
+ */
+export interface SimSecretsManagerVersionWrite {
+    readonly secret: SimSecretsManagerSecret;
+    readonly value: SimSecretsManagerSecretValue;
+    readonly input: SimSecretsManagerVersionWriteInput;
+    /**
+     * The key the new version is encrypted under, in any form KMS accepts.
+     * Undefined leaves Secrets Manager to use its own AWS managed key.
+     *
+     * It is passed rather than read off the secret because UpdateSecret can
+     * change the key and the value in one request, and the new version belongs
+     * to the new key.
+     */
+    readonly keyId: string | undefined;
+    /**
+     * The caller the KMS call is made as, so that writing a version needs the
+     * caller's own `kms:GenerateDataKey` on a customer managed key.
+     */
+    readonly caller: SimAwsCaller | undefined;
+}
+//# sourceMappingURL=sim-secrets-manager-version-write.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-version-write.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC;IAEnD;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC;CAC3C"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-write.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-secrets-manager-version-write.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-version-write.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-write.ts"],"names":[],"mappings":""}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.d.ts

@@ -1,27 +1,23 @@
 import type { SimClock } from "../../../util/clock/sim-clock.js";
-import type { SimSecretsManagerSecret } from "./sim-secrets-manager-secret.js";
 import { SimSecretsManagerSecretVersion } from "./sim-secrets-manager-secret-version.js";
-import type { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
-/**
- * The version-shaping fields a write request can carry.
- */
-export interface SimSecretsManagerVersionWriteInput {
-    readonly ClientRequestToken?: string | undefined;
-    readonly VersionStages?: readonly string[] | undefined;
-}
+import type { SimSecretsManagerValueEncryption } from "./sim-secrets-manager-value-encryption.js";
+import type { SimSecretsManagerVersionWrite } from "./sim-secrets-manager-version-write.js";
 interface SimSecretsManagerVersionWriterProperties {
     readonly clock: SimClock;
+    readonly encryption: SimSecretsManagerValueEncryption;
 }
 /**
  * Writes a new version of a secret, the way every Secrets Manager write does.
  *
- * CreateSecret, PutSecretValue and UpdateSecret all end in the same place:
- * a new version carrying the value, labelled AWSCURRENT unless told otherwise.
- * Keeping that in one collaborator is what stops the three commands drifting
- * apart on staging labels or on request-token idempotency.
+ * CreateSecret, PutSecretValue and UpdateSecret all end in the same place: a
+ * new version carrying the encrypted value, labelled AWSCURRENT unless told
+ * otherwise. Keeping that in one collaborator is what stops the three commands
+ * drifting apart on staging labels, on request-token idempotency or on which
+ * key the value is encrypted under.
  */
 export declare class SimSecretsManagerVersionWriter {
     private readonly clock;
+    private readonly encryption;
     constructor(properties: SimSecretsManagerVersionWriterProperties);
     /**
      * Write a value as a new version of a secret.
@@ -30,8 +26,11 @@ export declare class SimSecretsManagerVersionWriter {
      * repeat of the same token with the same value is ignored, which is what
      * makes a retried write safe; the same token with a different value is
      * refused, because a version's value never changes once written.
+     *
+     * The value is encrypted before anything is stored, so a write refused for
+     * a key the caller may not use leaves no version behind.
      */
-    write(secret: SimSecretsManagerSecret, value: SimSecretsManagerSecretValue, input: SimSecretsManagerVersionWriteInput): SimSecretsManagerSecretVersion;
+    write(request: SimSecretsManagerVersionWrite): Promise<SimSecretsManagerSecretVersion>;
     /**
      * Resolve the staging labels a new version is written with.
      */

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-version-writer.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-writer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAKjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,8BAA8B,EAE/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACxD;AAED,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;;;;;OAOG;IACH,KAAK,CACH,MAAM,EAAE,uBAAuB,EAC/B,KAAK,EAAE,4BAA4B,EACnC,KAAK,EAAE,kCAAkC,GACxC,8BAA8B,CAkBhC;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,aAAa;CAatB"}
+{"version":3,"file":"sim-secrets-manager-version-writer.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-writer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAKjE,OAAO,EACL,8BAA8B,EAE/B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,wCAAwC;IAChD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAE9D,YAAY,UAAU,EAAE,wCAAwC,EAG/D;IAED;;;;;;;;;;OAUG;IACG,KAAK,CACT,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,8BAA8B,CAAC,CAwBzC;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,aAAa;CAatB"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.js

@@ -4,15 +4,18 @@ import { SimSecretsManagerSecretVersion, SimSecretsManagerStagingLabel, } from "
 /**
  * Writes a new version of a secret, the way every Secrets Manager write does.
  *
- * CreateSecret, PutSecretValue and UpdateSecret all end in the same place:
- * a new version carrying the value, labelled AWSCURRENT unless told otherwise.
- * Keeping that in one collaborator is what stops the three commands drifting
- * apart on staging labels or on request-token idempotency.
+ * CreateSecret, PutSecretValue and UpdateSecret all end in the same place: a
+ * new version carrying the encrypted value, labelled AWSCURRENT unless told
+ * otherwise. Keeping that in one collaborator is what stops the three commands
+ * drifting apart on staging labels, on request-token idempotency or on which
+ * key the value is encrypted under.
  */
 export class SimSecretsManagerVersionWriter {
     clock;
+    encryption;
     constructor(properties) {
         this.clock = properties.clock;
+        this.encryption = properties.encryption;
     }
     /**
      * Write a value as a new version of a secret.
@@ -21,8 +24,12 @@ export class SimSecretsManagerVersionWriter {
      * repeat of the same token with the same value is ignored, which is what
      * makes a retried write safe; the same token with a different value is
      * refused, because a version's value never changes once written.
+     *
+     * The value is encrypted before anything is stored, so a write refused for
+     * a key the caller may not use leaves no version behind.
      */
-    write(secret, value, input) {
+    async write(request) {
+        const { secret, value, input } = request;
         const versionId = input.ClientRequestToken ?? randomUUID();
         const existing = secret.versions.byId(versionId);
         if (existing !== undefined) {
@@ -30,7 +37,7 @@ export class SimSecretsManagerVersionWriter {
         }
         const version = new SimSecretsManagerSecretVersion({
             versionId,
-            value,
+            value: await this.encryption.encrypt({ secretArn: secret.arn.value, versionId }, value, request.keyId, request.caller),
             createdDate: this.clock.now(),
         });
         secret.versions.add(version, this.stages(input.VersionStages));
@@ -50,7 +57,7 @@ export class SimSecretsManagerVersionWriter {
         return requested;
     }
     repeatedWrite(existing, value) {
-        if (existing.value.equals(value)) {
+        if (existing.value.holds(value)) {
             return existing;
         }
         throw new SimSecretsManagerResourceExistsException(`Version ${existing.versionId} already exists with a different value. ` +

package/dist/service/secretsmanager/secret/sim-secrets-manager-version-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-version-writer.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAejD;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CACH,MAA+B,EAC/B,KAAmC,EACnC,KAAyC;QAEzC,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,IAAI,UAAU,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAAC;YACjD,SAAS;YACT,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,SAAwC;QACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,0CAA0C,CAClD,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,aAAa,CACnB,QAAwC,EACxC,KAAmC;QAEnC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,wCAAwC,CAChD,WAAW,QAAQ,CAAC,SAAS,0CAA0C;YACrE,mDAAmD,CACtD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager-version-writer.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-version-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0CAA0C,EAC1C,wCAAwC,GACzC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAUjD;;;;;;;;GAQG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAChB,UAAU,CAAmC;IAE9D,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,OAAsC;QAEtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,IAAI,UAAU,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAAC;YACjD,SAAS;YACT,KAAK,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAClC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAC1C,KAAK,EACL,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,MAAM,CACf;YACD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,SAAwC;QACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,0CAA0C,CAClD,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,aAAa,CACnB,QAAwC,EACxC,KAAmC;QAEnC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,wCAAwC,CAChD,WAAW,QAAQ,CAAC,SAAS,0CAA0C;YACrE,mDAAmD,CACtD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/sim-secrets-manager.d.ts

@@ -6,6 +6,7 @@ import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-ser
 import { SimSecretsManagerCfnResourceFactory } from "./cfn/sim-cfn-secrets-manager-resource-factory.js";
 import type * as simSecretsManagerCommands from "./command/sim-secrets-manager-command.types.js";
 import type { SimSecretsManagerSecret } from "./secret/sim-secrets-manager-secret.js";
+import type { SimSecretsManagerKmsCrypto } from "./secret/sim-secrets-manager-kms-crypto.js";
 export interface SimSecretsManagerRequestOptions {
     readonly caller?: SimAwsCaller;
 }
@@ -13,6 +14,12 @@ interface SimSecretsManagerProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
+    /**
+     * The simulated KMS that secret values are encrypted through. One is created
+     * for this scope when none is supplied, so a standalone SimSecretsManager
+     * still encrypts rather than quietly storing secrets in the clear.
+     */
+    readonly kms?: SimSecretsManagerKmsCrypto;
 }
 /**
  * Simulated Secrets Manager. Handles SDK commands. Emulates AWS behaviour and

package/dist/service/secretsmanager/sim-secrets-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/service/secretsmanager/sim-secrets-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AAMxG,OAAO,KAAK,KAAK,yBAAyB,MAAM,gDAAgD,CAAC;AAEjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAOtF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IACjE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA+B;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+C;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,UAAU,GAAE,2BAAgC,EA+CvD;IAED;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,yBAAyB,CAAC,qBAAqB,EACxD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAGhE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,yBAAyB,CAAC,uBAAuB,EAC1D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,6BAA6B,CAAC,CAGlE;IAED;;;OAGG;IACH,kBAAkB,IAAI,mCAAmC,CAExD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/service/secretsmanager/sim-secrets-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AAMxG,OAAO,KAAK,KAAK,yBAAyB,MAAM,gDAAgD,CAAC;AAEjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAItF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAK7F,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IACjE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA+B;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+C;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,UAAU,GAAE,2BAAgC,EAqDvD;IAED;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,yBAAyB,CAAC,qBAAqB,EACxD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAGhE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,yBAAyB,CAAC,wBAAwB,EAC3D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAGnE;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,yBAAyB,CAAC,sBAAsB,EACzD,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAGjE;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,yBAAyB,CAAC,uBAAuB,EAC1D,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC,6BAA6B,CAAC,CAGlE;IAED;;;OAGG;IACH,kBAAkB,IAAI,mCAAmC,CAExD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/secretsmanager/sim-secrets-manager.js

@@ -1,6 +1,7 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimKms } from "../kms/index.js";
 import { SimSecretsManagerCfnResourceFactory } from "./cfn/sim-cfn-secrets-manager-resource-factory.js";
 import { SimSecretsManagerAuthorizer } from "./command/authorize/sim-secrets-manager-authorizer.js";
 import { SimSecretsManagerLifecycleCommands } from "./command/secret/sim-secrets-manager-lifecycle-commands.js";
@@ -11,6 +12,7 @@ import { SimSecretsManagerValueCommands } from "./command/value/sim-secrets-mana
 import { SimSecretsManagerSecretExpiry } from "./secret/sim-secrets-manager-secret-expiry.js";
 import { SimSecretsManagerSecretFactory } from "./secret/sim-secrets-manager-secret-factory.js";
 import { SimSecretsManagerSecretStore } from "./secret/sim-secrets-manager-secret-store.js";
+import { SimSecretsManagerValueEncryption } from "./secret/sim-secrets-manager-value-encryption.js";
 import { SimSecretsManagerVersionWriter } from "./secret/sim-secrets-manager-version-writer.js";
 import { SimSecretsManagerSdkCommandRouter } from "./sdk/sim-secrets-manager-sdk-command-router.js";
 /**
@@ -34,9 +36,12 @@ export class SimSecretsManager {
     });
     constructor(properties = {}) {
         const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { kms = new SimKms({ accountRegionScope, iam, background }) } = properties;
         const authorizer = new SimSecretsManagerAuthorizer({ iam });
+        const encryption = new SimSecretsManagerValueEncryption({ kms });
         const versionWriter = new SimSecretsManagerVersionWriter({
             clock: background,
+            encryption,
         });
         this.background = background;
         this.secrets = new SimSecretsManagerSecretStore({ accountRegionScope });
@@ -71,6 +76,7 @@ export class SimSecretsManager {
         this.valueCommands = new SimSecretsManagerValueCommands({
             secrets: this.secrets,
             versionWriter,
+            encryption,
             authorizer,
         });
     }
@@ -88,7 +94,7 @@ export class SimSecretsManager {
      */
     async createSecret(command, options) {
         await this.background.sequence();
-        return this.secretCommands.create(command, options);
+        return await this.secretCommands.create(command, options);
     }
     /**
      * Handle a DescribeSecret Command from the SDK.
@@ -102,7 +108,7 @@ export class SimSecretsManager {
      */
     async updateSecret(command, options) {
         await this.background.sequence();
-        return this.updateSecretCommand.handle(command, options);
+        return await this.updateSecretCommand.handle(command, options);
     }
     /**
      * Handle a ListSecrets Command from the SDK.
@@ -116,14 +122,14 @@ export class SimSecretsManager {
      */
     async getSecretValue(command, options) {
         await this.background.sequence();
-        return this.valueCommands.get(command, options);
+        return await this.valueCommands.get(command, options);
     }
     /**
      * Handle a PutSecretValue Command from the SDK.
      */
     async putSecretValue(command, options) {
         await this.background.sequence();
-        return this.valueCommands.put(command, options);
+        return await this.valueCommands.put(command, options);
     }
     /**
      * Handle a DeleteSecret Command from the SDK.

package/dist/service/secretsmanager/sim-secrets-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager.js","sourceRoot":"","sources":["../../../src/service/secretsmanager/sim-secrets-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,4DAA4D,CAAC;AAChH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAEtG,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAEvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EAAE,iCAAiC,EAAE,MAAM,iDAAiD,CAAC;AAYpG;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,OAAO,CAA+B;IACtC,cAAc,CAAkC;IAChD,mBAAmB,CAAgC;IACnD,iBAAiB,CAAqC;IACtD,kBAAkB,CAA+B;IACjD,aAAa,CAAiC;IAC9C,UAAU,CAAsB;IAChC,SAAS,GAAG,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC;IACxD,UAAU,GAAG,IAAI,mCAAmC,CAAC;QACpE,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,YAAY,UAAU,GAAgC,EAAE;QACtD,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,MAAM,UAAU,GAAG,IAAI,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;YACvD,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,4BAA4B,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc,GAAG,IAAI,+BAA+B,CAAC;YACxD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,8BAA8B,CAAC;gBAChD,kBAAkB;gBAClB,KAAK,EAAE,UAAU;aAClB,CAAC;YACF,aAAa;YACb,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,GAAG,IAAI,6BAA6B,CAAC;YAC3D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa;YACb,UAAU;YACV,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,kCAAkC,CAAC;YAC9D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,6BAA6B,CAAC;gBACxC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU;aACX,CAAC;YACF,UAAU;YACV,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;YACzD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,8BAA8B,CAAC;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa;YACb,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAAyD,EACzD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAA2D,EAC3D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAAyD,EACzD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,OAAwD,EACxD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAA2D,EAC3D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAA2D,EAC3D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAAyD,EACzD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAA0D,EAC1D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager.js","sourceRoot":"","sources":["../../../src/service/secretsmanager/sim-secrets-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,mCAAmC,EAAE,MAAM,mDAAmD,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAC;AACpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,4DAA4D,CAAC;AAChH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,EAAE,+BAA+B,EAAE,MAAM,yDAAyD,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AAEtG,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAEvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EAAE,iCAAiC,EAAE,MAAM,iDAAiD,CAAC;AAmBpG;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,OAAO,CAA+B;IACtC,cAAc,CAAkC;IAChD,mBAAmB,CAAgC;IACnD,iBAAiB,CAAqC;IACtD,kBAAkB,CAA+B;IACjD,aAAa,CAAiC;IAC9C,UAAU,CAAsB;IAChC,SAAS,GAAG,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC;IACxD,UAAU,GAAG,IAAI,mCAAmC,CAAC;QACpE,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,YAAY,UAAU,GAAgC,EAAE;QACtD,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,MAAM,EAAE,GAAG,GAAG,IAAI,MAAM,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,GACjE,UAAU,CAAC;QAEb,MAAM,UAAU,GAAG,IAAI,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;YACvD,KAAK,EAAE,UAAU;YACjB,UAAU;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,4BAA4B,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc,GAAG,IAAI,+BAA+B,CAAC;YACxD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,8BAA8B,CAAC;gBAChD,kBAAkB;gBAClB,KAAK,EAAE,UAAU;aAClB,CAAC;YACF,aAAa;YACb,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,GAAG,IAAI,6BAA6B,CAAC;YAC3D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa;YACb,UAAU;YACV,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,kCAAkC,CAAC;YAC9D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,6BAA6B,CAAC;gBACxC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU;aACX,CAAC;YACF,UAAU;YACV,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;YACzD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,8BAA8B,CAAC;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa;YACb,UAAU;YACV,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAAyD,EACzD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAA2D,EAC3D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAAyD,EACzD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,OAAwD,EACxD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAA2D,EAC3D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAA2D,EAC3D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAAyD,EACzD,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAA0D,EAC1D,OAAyC;QAEzC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.d.ts

@@ -0,0 +1,30 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimSsmParameter } from "../../parameter/sim-ssm-parameter.js";
+import type { SimSsm } from "../../sim-ssm.js";
+interface SimCfnSsmParameterCreatorProperties {
+    readonly ssm: SimSsm;
+}
+/**
+ * Creates simulated parameters from AWS::SSM::Parameter Resources.
+ *
+ * The parameter is written through the ordinary PutParameter command rather
+ * than constructed directly, so a parameter a template deployed is the same
+ * thing an SDK caller would have got: the same name validation, the same ARN,
+ * the same refusals for the options this simulation does not model.
+ *
+ * The write is a create rather than an overwrite. Sim CloudFormation has no
+ * UpdateStack, so every deployment is a create, and a name already in use
+ * fails here as a second stack claiming the same parameter name fails on real
+ * CloudFormation.
+ */
+export declare class SimCfnSsmParameterCreator {
+    private readonly ssm;
+    constructor(properties: SimCfnSsmParameterCreatorProperties);
+    /**
+     * Create a parameter from an AWS::SSM::Parameter Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimSsmParameter>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-ssm-parameter-creator.d.ts.map

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ssm-parameter-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,eAAe,CAAC,CA4B1B;CACF"}

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.js

@@ -0,0 +1,48 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnSsmParameterProperties } from "./sim-cfn-ssm-parameter-properties.js";
+/**
+ * Creates simulated parameters from AWS::SSM::Parameter Resources.
+ *
+ * The parameter is written through the ordinary PutParameter command rather
+ * than constructed directly, so a parameter a template deployed is the same
+ * thing an SDK caller would have got: the same name validation, the same ARN,
+ * the same refusals for the options this simulation does not model.
+ *
+ * The write is a create rather than an overwrite. Sim CloudFormation has no
+ * UpdateStack, so every deployment is a create, and a name already in use
+ * fails here as a second stack claiming the same parameter name fails on real
+ * CloudFormation.
+ */
+export class SimCfnSsmParameterCreator {
+    ssm;
+    constructor(properties) {
+        this.ssm = properties.ssm;
+    }
+    /**
+     * Create a parameter from an AWS::SSM::Parameter Resource.
+     */
+    async create(resource, properties) {
+        const parameterProperties = new SimCfnSsmParameterProperties({
+            resource,
+            properties,
+        });
+        const name = parameterProperties.name();
+        await this.ssm.putParameter({
+            input: {
+                Name: name,
+                Type: parameterProperties.type(),
+                Value: parameterProperties.value(),
+                Description: parameterProperties.description(),
+                Tier: parameterProperties.tier(),
+                AllowedPattern: parameterProperties.allowedPattern(),
+                DataType: parameterProperties.dataType(),
+                Policies: parameterProperties.policies(),
+                Tags: parameterProperties.tags(),
+            },
+        });
+        const parameter = this.ssm.findParameter(name);
+        assertDefined(parameter, `sim SSM parameter ${name} after CloudFormation creation`);
+        return parameter;
+    }
+}
+//# sourceMappingURL=sim-cfn-ssm-parameter-creator.js.map

package/dist/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ssm-parameter-creator.js","sourceRoot":"","sources":["../../../../../src/service/ssm/cfn/parameter/sim-cfn-ssm-parameter-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAMrF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,yBAAyB;IACnB,GAAG,CAAS;IAE7B,YAAY,UAA+C;QACzD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,mBAAmB,GAAG,IAAI,4BAA4B,CAAC;YAC3D,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YAC1B,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE;gBAChC,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE;gBAClC,WAAW,EAAE,mBAAmB,CAAC,WAAW,EAAE;gBAC9C,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE;gBAChC,cAAc,EAAE,mBAAmB,CAAC,cAAc,EAAE;gBACpD,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACxC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACxC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/C,aAAa,CACX,SAAS,EACT,qBAAqB,IAAI,gCAAgC,CAC1D,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}