@kensio/yulin 0.41.0 → 0.42.0

package/dist/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.js

@@ -0,0 +1,34 @@
+/**
+ * The stored form of one secret version's value.
+ *
+ * This is what a version holds: the value's ciphertext, and beside it the
+ * encrypted copy of the data key that produced it. Nothing here can be read
+ * without a KMS call, which is the point. The encrypted data key names the KMS
+ * key it came from, so a version stays readable after the secret is pointed at
+ * a different key, as it does on real AWS.
+ */
+export class SimSecretsManagerEncryptedValue {
+    dataKeyCiphertext;
+    iv;
+    authTag;
+    ciphertext;
+    digest;
+    constructor(properties) {
+        this.dataKeyCiphertext = properties.dataKeyCiphertext;
+        this.iv = properties.iv;
+        this.authTag = properties.authTag;
+        this.ciphertext = properties.ciphertext;
+        this.digest = properties.digest;
+    }
+    /**
+     * Whether this is the encrypted form of the given value.
+     *
+     * A write repeating a client request token is a no-op when it carries the
+     * same value and a failure when it does not, so the two have to be compared
+     * without the stored one being readable.
+     */
+    holds(value) {
+        return this.digest === value.digest;
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-encrypted-value.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-encrypted-value.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.ts"],"names":[],"mappings":"AAUA;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IAC1B,iBAAiB,CAAa;IAC9B,EAAE,CAAa;IACf,OAAO,CAAa;IACpB,UAAU,CAAa;IAEtB,MAAM,CAAS;IAEhC,YAAY,UAAqD;QAC/D,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAmC;QACvC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;IACtC,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.d.ts

@@ -0,0 +1,63 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The alias of the AWS managed key Secrets Manager encrypts with when a secret
+ * names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export declare const secretsManagerDefaultKeyAlias = "alias/aws/secretsmanager";
+/**
+ * The service Secrets Manager's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what keeps the common case as convenient here as it is on
+ * real AWS: the `aws/secretsmanager` key's policy admits the account's
+ * principals when the request reaches KMS through Secrets Manager, so a caller
+ * allowed only `secretsmanager:GetSecretValue` reads the secret.
+ */
+export declare const secretsManagerKmsViaService = "secretsmanager";
+/**
+ * The data key length Secrets Manager asks KMS for.
+ */
+export declare const secretsManagerDataKeySpec = "AES_256";
+interface SimSecretsManagerKmsOptions {
+    readonly caller?: SimAwsCaller | undefined;
+    readonly viaService?: string | undefined;
+}
+/**
+ * The narrow slice of simulated KMS that secret values need.
+ *
+ * Real Secrets Manager uses envelope encryption: it asks KMS for a data key
+ * per version, encrypts the value with the plaintext copy and keeps the
+ * encrypted copy beside the ciphertext. That is why a write needs
+ * `kms:GenerateDataKey` and a read needs `kms:Decrypt`, rather than both
+ * needing `kms:Encrypt` and `kms:Decrypt` as a direct encryption would.
+ *
+ * SimKms structurally implements this interface.
+ */
+export interface SimSecretsManagerKmsCrypto {
+    generateDataKey(command: {
+        input: {
+            KeyId?: string | undefined;
+            KeySpec?: string | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: SimSecretsManagerKmsOptions): Promise<{
+        Plaintext?: Uint8Array | undefined;
+        CiphertextBlob?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+    decrypt(command: {
+        input: {
+            CiphertextBlob?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: SimSecretsManagerKmsOptions): Promise<{
+        Plaintext?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-kms-crypto.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-kms-crypto.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,mBAAmB,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD,UAAU,2BAA2B;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,eAAe,CACb,OAAO,EAAE;QACP,KAAK,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC7B,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACnC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;IAEH,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACxC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;CACJ"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.js

@@ -0,0 +1,24 @@
+/**
+ * The alias of the AWS managed key Secrets Manager encrypts with when a secret
+ * names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export const secretsManagerDefaultKeyAlias = "alias/aws/secretsmanager";
+/**
+ * The service Secrets Manager's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what keeps the common case as convenient here as it is on
+ * real AWS: the `aws/secretsmanager` key's policy admits the account's
+ * principals when the request reaches KMS through Secrets Manager, so a caller
+ * allowed only `secretsmanager:GetSecretValue` reads the secret.
+ */
+export const secretsManagerKmsViaService = "secretsmanager";
+/**
+ * The data key length Secrets Manager asks KMS for.
+ */
+export const secretsManagerDataKeySpec = "AES_256";
+//# sourceMappingURL=sim-secrets-manager-kms-crypto.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-kms-crypto.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,gBAAgB,CAAC;AAE5D;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-key-problems.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Which way round a KMS call went wrong, since Secrets Manager has an error
+ * for each.
+ */
+export type SimSecretsManagerKeyFailure = "encrypting" | "decrypting";
+/**
+ * Run a KMS call, reporting a refusal about the key the way Secrets Manager
+ * reports it.
+ *
+ * Every key problem KMS raises becomes EncryptionFailure or DecryptionFailure
+ * carrying the KMS message, which is what real Secrets Manager does for a key
+ * that is missing, disabled or pending deletion. An access denial is not a KMS
+ * error and passes through untouched, so a missing `kms:Decrypt` still reads
+ * as a denial rather than a broken key.
+ */
+export declare function reportingKeyProblems<TResult>(failure: SimSecretsManagerKeyFailure, call: () => Promise<TResult>): Promise<TResult>;
+//# sourceMappingURL=sim-secrets-manager-kms-key-problems.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-key-problems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-kms-key-problems.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-kms-key-problems.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG,YAAY,GAAG,YAAY,CAAC;AAEtE;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAChD,OAAO,EAAE,2BAA2B,EACpC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAUlB"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-key-problems.js

@@ -0,0 +1,30 @@
+import { SimKmsError } from "../../kms/error/sim-kms.error.js";
+import { SimSecretsManagerDecryptionFailure, SimSecretsManagerEncryptionFailure, } from "../error/sim-secrets-manager.error.js";
+/**
+ * Run a KMS call, reporting a refusal about the key the way Secrets Manager
+ * reports it.
+ *
+ * Every key problem KMS raises becomes EncryptionFailure or DecryptionFailure
+ * carrying the KMS message, which is what real Secrets Manager does for a key
+ * that is missing, disabled or pending deletion. An access denial is not a KMS
+ * error and passes through untouched, so a missing `kms:Decrypt` still reads
+ * as a denial rather than a broken key.
+ */
+export async function reportingKeyProblems(failure, call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        if (error instanceof SimKmsError) {
+            throw keyFailure(failure, error.message);
+        }
+        throw error;
+    }
+}
+function keyFailure(failure, message) {
+    if (failure === "encrypting") {
+        return new SimSecretsManagerEncryptionFailure(`Secrets Manager cannot encrypt the secret value with its KMS key: ${message}`);
+    }
+    return new SimSecretsManagerDecryptionFailure(`Secrets Manager cannot decrypt the secret value with its KMS key: ${message}`);
+}
+//# sourceMappingURL=sim-secrets-manager-kms-key-problems.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-key-problems.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-kms-key-problems.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-kms-key-problems.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EACL,kCAAkC,EAClC,kCAAkC,GAEnC,MAAM,uCAAuC,CAAC;AAQ/C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC,EACpC,IAA4B;IAE5B,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,OAAoC,EACpC,OAAe;IAEf,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,IAAI,kCAAkC,CAC3C,qEAAqE,OAAO,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,kCAAkC,CAC3C,qEAAqE,OAAO,EAAE,CAC/E,CAAC;AACJ,CAAC"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-store.d.ts

@@ -13,6 +13,10 @@ interface SimSecretsManagerSecretStoreProperties {
  */
 export declare class SimSecretsManagerSecretStore {
     private readonly secrets;
+    /**
+     * The names of secrets being created, which are taken but not yet stored.
+     */
+    private readonly claimedNames;
     private readonly accountRegionScope;
     private readonly secretIds;
     constructor(properties: SimSecretsManagerSecretStoreProperties);
@@ -40,6 +44,23 @@ export declare class SimSecretsManagerSecretStore {
      * Resolve a SecretId in any of the forms real Secrets Manager accepts.
      */
     find(secretId: string): SimSecretsManagerSecret | undefined;
+    /**
+     * Take a name for a secret being created, refusing one already taken.
+     *
+     * The name is held from here rather than from when the secret is stored,
+     * because creating one is not instant: its first version is encrypted
+     * through KMS in between. Two creates racing for the same name would
+     * otherwise both get past the check and the second would overwrite the
+     * first, where real Secrets Manager refuses it.
+     */
+    claimName(name: string): void;
+    /**
+     * Give up a claimed name.
+     *
+     * A create that failed leaves the name free again, and one that succeeded
+     * has the stored secret holding it from then on.
+     */
+    releaseName(name: string): void;
     /**
      * Refuse a name that is already taken, saying which way it is taken.
      *

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-secret-store.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAO1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG/E,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAE5D,YAAY,UAAU,EAAE,sCAAsC,EAK7D;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,uBAAuB,EAAE,CAE5C;IAED;;OAEG;IACH,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAEzC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAE5C;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,uBAAuB,CAmB7D;IAED;;OAEG;IACH,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAU1D;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAoBvC;CACF"}
+{"version":3,"file":"sim-secrets-manager-secret-store.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAO1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG/E,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAEtE;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAElD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAE5D,YAAY,UAAU,EAAE,sCAAsC,EAK7D;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,uBAAuB,EAAE,CAE5C;IAED;;OAEG;IACH,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAEzC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAE5C;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,uBAAuB,CAmB7D;IAED;;OAEG;IACH,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAU1D;IAED;;;;;;;;OAQG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG5B;IAED;;;;;OAKG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE9B;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA0BvC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-store.js

@@ -10,6 +10,10 @@ import { SimSecretsManagerSecretIdParser } from "./sim-secrets-manager-secret-id
  */
 export class SimSecretsManagerSecretStore {
     secrets = new Map();
+    /**
+     * The names of secrets being created, which are taken but not yet stored.
+     */
+    claimedNames = new Set();
     accountRegionScope;
     secretIds;
     constructor(properties) {
@@ -67,6 +71,28 @@ export class SimSecretsManagerSecretStore {
             .values()
             .find((secret) => secret.arn.matchesResource(resource));
     }
+    /**
+     * Take a name for a secret being created, refusing one already taken.
+     *
+     * The name is held from here rather than from when the secret is stored,
+     * because creating one is not instant: its first version is encrypted
+     * through KMS in between. Two creates racing for the same name would
+     * otherwise both get past the check and the second would overwrite the
+     * first, where real Secrets Manager refuses it.
+     */
+    claimName(name) {
+        this.requireNameAvailable(name);
+        this.claimedNames.add(name);
+    }
+    /**
+     * Give up a claimed name.
+     *
+     * A create that failed leaves the name free again, and one that succeeded
+     * has the stored secret holding it from then on.
+     */
+    releaseName(name) {
+        this.claimedNames.delete(name);
+    }
     /**
      * Refuse a name that is already taken, saying which way it is taken.
      *
@@ -75,6 +101,9 @@ export class SimSecretsManagerSecretStore {
      * telling apart from a name held by a live secret.
      */
     requireNameAvailable(name) {
+        if (this.claimedNames.has(name)) {
+            throw new SimSecretsManagerResourceExistsException(`The secret '${name}' already exists`);
+        }
         const existing = this.secrets
             .values()
             .find((secret) => secret.name === name);

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-secret-store.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0CAA0C,EAC1C,wCAAwC,EACxC,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AAMrF;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IACrD,kBAAkB,CAA2B;IAC7C,SAAS,CAAkC;IAE5D,YAAY,UAAkD;QAC5D,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,+BAA+B,CAAC;YACnD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,MAA+B;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAA+B;QACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAA4B;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,0CAA0C,CAClD,sBAAsB,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;YAE1D,MAAM,IAAI,0CAA0C,CAClD,oDAAoD,QAAQ,OAAO;gBACjE,WAAW,SAAS,WAAW,UAAU,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,QAAgB;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,OAAO;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAY;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAE1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YACpC,MAAM,IAAI,wCAAwC,CAChD,2BAA2B,IAAI,+BAA+B;gBAC5D,6DAA6D;gBAC7D,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,wCAAwC,CAChD,eAAe,IAAI,kBAAkB,CACtC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager-secret-store.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0CAA0C,EAC1C,wCAAwC,EACxC,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AAMrF;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEtE;;OAEG;IACc,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,kBAAkB,CAA2B;IAC7C,SAAS,CAAkC;IAE5D,YAAY,UAAkD;QAC5D,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,+BAA+B,CAAC;YACnD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,MAA+B;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAA+B;QACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAA4B;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,0CAA0C,CAClD,sBAAsB,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;YAE1D,MAAM,IAAI,0CAA0C,CAClD,oDAAoD,QAAQ,OAAO;gBACjE,WAAW,SAAS,WAAW,UAAU,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,QAAgB;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,OAAO;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CAAC,IAAY;QACpB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAY;QAC/B,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,wCAAwC,CAChD,eAAe,IAAI,kBAAkB,CACtC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAE1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YACpC,MAAM,IAAI,wCAAwC,CAChD,2BAA2B,IAAI,+BAA+B;gBAC5D,6DAA6D;gBAC7D,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,wCAAwC,CAChD,eAAe,IAAI,kBAAkB,CACtC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-value.d.ts

@@ -24,7 +24,10 @@ export declare class SimSecretsManagerSecretValue {
      * Read a value from request input where supplying one is optional.
      */
     static optional(input: SimSecretsManagerSecretValueInput): SimSecretsManagerSecretValue | undefined;
-    private static bytesEqual;
+    /**
+     * Read a value back from the bytes it was encrypted as.
+     */
+    static fromBytes(bytes: Uint8Array): SimSecretsManagerSecretValue;
     /**
      * The text value, if this version holds text.
      */
@@ -37,11 +40,20 @@ export declare class SimSecretsManagerSecretValue {
      */
     get secretBinary(): Uint8Array | undefined;
     /**
-     * Whether another value holds exactly the same content.
+     * The value as the bytes it is encrypted as, marked with its kind.
+     */
+    get bytes(): Uint8Array;
+    /**
+     * A digest of the value, standing in for the value itself where two of them
+     * have to be compared.
      *
      * This is what makes a retried write with the same client request token a
-     * no-op rather than a failure, as it is on real AWS.
+     * no-op rather than a failure, as it is on real AWS. Real Secrets Manager
+     * compares the two values; a stored version here holds only ciphertext, and
+     * decrypting it would need a `kms:Decrypt` that real AWS does not ask a
+     * writer for.
      */
-    equals(other: SimSecretsManagerSecretValue): boolean;
+    get digest(): string;
+    private markedBytes;
 }
 //# sourceMappingURL=sim-secrets-manager-secret-value.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-value.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-secret-value.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-value.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAE9C,OAAO,eAEN;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAK,EAAE,iCAAiC,GACvC,4BAA4B,CAU9B;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAK,EAAE,iCAAiC,GACvC,4BAA4B,GAAG,SAAS,CAkB1C;IAED,OAAO,CAAC,MAAM,CAAC,UAAU;IAQzB;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAMrC;IAED;;;;;OAKG;IACH,IAAI,YAAY,IAAI,UAAU,GAAG,SAAS,CAMzC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAMnD;CACF"}
+{"version":3,"file":"sim-secrets-manager-secret-value.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-value.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAChD;AAaD;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAE9C,OAAO,eAEN;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAK,EAAE,iCAAiC,GACvC,4BAA4B,CAU9B;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAK,EAAE,iCAAiC,GACvC,4BAA4B,GAAG,SAAS,CAkB1C;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,4BAA4B,CAShE;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAMrC;IAED;;;;;OAKG;IACH,IAAI,YAAY,IAAI,UAAU,GAAG,SAAS,CAMzC;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,UAAU,CAMtB;IAED;;;;;;;;;OASG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,WAAW;CAGpB"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-value.js

@@ -1,4 +1,15 @@
+import { createHash } from "node:crypto";
 import { SimSecretsManagerInvalidParameterException } from "../error/sim-secrets-manager.error.js";
+/**
+ * The markers that tell the two kinds of value apart once a value is bytes.
+ *
+ * A value is encrypted as bytes, and what comes back out has to say which of
+ * SecretString and SecretBinary it was, since the two are different fields on
+ * the way out and a caller storing UTF-8 bytes as binary must not get text
+ * back.
+ */
+const textMarker = 0;
+const binaryMarker = 1;
 /**
  * The value held by one version of a simulated secret.
  *
@@ -38,11 +49,16 @@ export class SimSecretsManagerSecretValue {
         }
         return undefined;
     }
-    static bytesEqual(mine, theirs) {
-        if (mine.length !== theirs.length) {
-            return false;
+    /**
+     * Read a value back from the bytes it was encrypted as.
+     */
+    static fromBytes(bytes) {
+        const buffer = Buffer.from(bytes);
+        const content = buffer.subarray(1);
+        if (buffer.at(0) === textMarker) {
+            return new SimSecretsManagerSecretValue(content.toString("utf8"));
         }
-        return mine.every((byte, index) => byte === theirs.at(index));
+        return new SimSecretsManagerSecretValue(Uint8Array.from(content));
     }
     /**
      * The text value, if this version holds text.
@@ -66,16 +82,29 @@ export class SimSecretsManagerSecretValue {
         return Uint8Array.from(this.content);
     }
     /**
-     * Whether another value holds exactly the same content.
+     * The value as the bytes it is encrypted as, marked with its kind.
+     */
+    get bytes() {
+        if (typeof this.content === "string") {
+            return this.markedBytes(textMarker, Buffer.from(this.content, "utf8"));
+        }
+        return this.markedBytes(binaryMarker, Buffer.from(this.content));
+    }
+    /**
+     * A digest of the value, standing in for the value itself where two of them
+     * have to be compared.
      *
      * This is what makes a retried write with the same client request token a
-     * no-op rather than a failure, as it is on real AWS.
+     * no-op rather than a failure, as it is on real AWS. Real Secrets Manager
+     * compares the two values; a stored version here holds only ciphertext, and
+     * decrypting it would need a `kms:Decrypt` that real AWS does not ask a
+     * writer for.
      */
-    equals(other) {
-        if (typeof this.content === "string" || typeof other.content === "string") {
-            return this.content === other.content;
-        }
-        return SimSecretsManagerSecretValue.bytesEqual(this.content, other.content);
+    get digest() {
+        return createHash("sha256").update(this.bytes).digest("hex");
+    }
+    markedBytes(marker, content) {
+        return Uint8Array.from(Buffer.concat([Buffer.of(marker), content]));
     }
 }
 //# sourceMappingURL=sim-secrets-manager-secret-value.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-value.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-secret-value.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0CAA0C,EAAE,MAAM,uCAAuC,CAAC;AAUnG;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,OAAO,CAAsB;IAE9C,YAAoB,OAA4B;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAwC;QAExC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,0CAA0C,CAClD,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAwC;QAExC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE1D,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,0CAA0C,CAClD,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,4BAA4B,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,IAAgB,EAAE,MAAkB;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,IAAI,YAAY;QACd,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAmC;QACxC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;QACxC,CAAC;QAED,OAAO,4BAA4B,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager-secret-value.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0CAA0C,EAAE,MAAM,uCAAuC,CAAC;AAUnG;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,OAAO,CAAsB;IAE9C,YAAoB,OAA4B;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAwC;QAExC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,0CAA0C,CAClD,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,KAAwC;QAExC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE1D,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,0CAA0C,CAClD,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,4BAA4B,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEnC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,4BAA4B,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,IAAI,YAAY;QACd,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,MAAM;QACR,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAEO,WAAW,CAAC,MAAc,EAAE,OAAe;QACjD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-version.d.ts

@@ -1,4 +1,4 @@
-import type { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+import type { SimSecretsManagerEncryptedValue } from "./sim-secrets-manager-encrypted-value.js";
 /**
  * The staging labels Secrets Manager gives a meaning of its own.
  *
@@ -12,7 +12,7 @@ export declare const SimSecretsManagerStagingLabel: {
 export type SimSecretsManagerStagingLabel = (typeof SimSecretsManagerStagingLabel)[keyof typeof SimSecretsManagerStagingLabel];
 interface SimSecretsManagerSecretVersionProperties {
     readonly versionId: string;
-    readonly value: SimSecretsManagerSecretValue;
+    readonly value: SimSecretsManagerEncryptedValue;
     readonly createdDate: Date;
 }
 /**
@@ -24,7 +24,11 @@ interface SimSecretsManagerSecretVersionProperties {
  */
 export declare class SimSecretsManagerSecretVersion {
     readonly versionId: string;
-    readonly value: SimSecretsManagerSecretValue;
+    /**
+     * The version's value, as it is stored: encrypted under a data key of the
+     * secret's KMS key. Reading it back is a KMS call.
+     */
+    readonly value: SimSecretsManagerEncryptedValue;
     readonly createdDate: Date;
     private readonly labels;
     constructor(properties: SimSecretsManagerSecretVersionProperties);

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-secret-version.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;aACxC,OAAO,EAAE,YAAY;aACrB,QAAQ,EAAE,aAAa;CACf,CAAC;AAEX,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,OAAO,6BAA6B,CAAC,CAAC;AAErF,UAAU,wCAAwC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,8BAA8B;IACzC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,KAAK,EAAE,4BAA4B,CAAC;IACpD,SAAgB,WAAW,EAAE,IAAI,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,YAAY,UAAU,EAAE,wCAAwC,EAI/D;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,SAAS,MAAM,EAAE,CAE9B;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/B;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5B;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE/B;CACF"}
+{"version":3,"file":"sim-secrets-manager-secret-version.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAEhG;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;aACxC,OAAO,EAAE,YAAY;aACrB,QAAQ,EAAE,aAAa;CACf,CAAC;AAEX,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,OAAO,6BAA6B,CAAC,CAAC;AAErF,UAAU,wCAAwC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,8BAA8B;IACzC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC;;;OAGG;IACH,SAAgB,KAAK,EAAE,+BAA+B,CAAC;IAEvD,SAAgB,WAAW,EAAE,IAAI,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,YAAY,UAAU,EAAE,wCAAwC,EAI/D;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,SAAS,MAAM,EAAE,CAE9B;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/B;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5B;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE/B;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-version.js

@@ -17,6 +17,10 @@ export const SimSecretsManagerStagingLabel = {
  */
 export class SimSecretsManagerSecretVersion {
     versionId;
+    /**
+     * The version's value, as it is stored: encrypted under a data key of the
+     * secret's KMS key. Reading it back is a KMS call.
+     */
     value;
     createdDate;
     labels = new Set();

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-secret-version.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-version.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,aAAa;CACf,CAAC;AAWX;;;;;;GAMG;AACH,MAAM,OAAO,8BAA8B;IACzB,SAAS,CAAS;IAClB,KAAK,CAA+B;IACpC,WAAW,CAAO;IAEjB,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,YAAY,UAAoD;QAC9D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager-secret-version.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-secret-version.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,aAAa;CACf,CAAC;AAWX;;;;;;GAMG;AACH,MAAM,OAAO,8BAA8B;IACzB,SAAS,CAAS;IAElC;;;OAGG;IACa,KAAK,CAAkC;IAEvC,WAAW,CAAO;IAEjB,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,YAAY,UAAoD;QAC9D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret.d.ts

@@ -27,12 +27,12 @@ export declare class SimSecretsManagerSecret {
     readonly versions: SimSecretsManagerSecretVersions;
     description: string | undefined;
     /**
-     * The KMS key the secret says it is encrypted under.
+     * The KMS key new versions of the secret are encrypted under, in any form
+     * KMS accepts. Undefined means the `aws/secretsmanager` managed key.
      *
-     * Nothing is actually encrypted with it and no kms:Decrypt check happens, so
-     * this is looser than real AWS. Simulated KMS is not wired into this service
-     * yet; the value is stored and reported so that code reading it behaves the
-     * same, and the divergence is documented.
+     * Changing it applies to versions written afterwards. The versions already
+     * written keep the key they were made with, as they do on real AWS, so they
+     * stay readable.
      */
     kmsKeyId: string | undefined;
     tags: readonly SimSecretsManagerTag[];

package/dist/service/secretsmanager/secret/sim-secrets-manager-secret.js

@@ -13,12 +13,12 @@ export class SimSecretsManagerSecret {
     versions = new SimSecretsManagerSecretVersions();
     description;
     /**
-     * The KMS key the secret says it is encrypted under.
+     * The KMS key new versions of the secret are encrypted under, in any form
+     * KMS accepts. Undefined means the `aws/secretsmanager` managed key.
      *
-     * Nothing is actually encrypted with it and no kms:Decrypt check happens, so
-     * this is looser than real AWS. Simulated KMS is not wired into this service
-     * yet; the value is stored and reported so that code reading it behaves the
-     * same, and the divergence is documented.
+     * Changing it applies to versions written afterwards. The versions already
+     * written keep the key they were made with, as they do on real AWS, so they
+     * stay readable.
      */
     kmsKeyId;
     tags;

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-cipher.d.ts

@@ -0,0 +1,20 @@
+import { SimSecretsManagerEncryptedValue } from "./sim-secrets-manager-encrypted-value.js";
+import { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+/**
+ * Encrypts and decrypts a secret value under a plaintext data key.
+ *
+ * The encryption context is not bound in here. KMS binds it to the data key,
+ * so a decryption naming a different secret or version fails at the KMS call
+ * rather than at this cipher, which is where real Secrets Manager fails too.
+ */
+export declare class SimSecretsManagerValueCipher {
+    /**
+     * Encrypt a value under a data key.
+     */
+    seal(value: SimSecretsManagerSecretValue, dataKey: Uint8Array, dataKeyCiphertext: Uint8Array): SimSecretsManagerEncryptedValue;
+    /**
+     * Decrypt a value with the data key KMS recovered for it.
+     */
+    open(encrypted: SimSecretsManagerEncryptedValue, dataKey: Uint8Array): SimSecretsManagerSecretValue;
+}
+//# sourceMappingURL=sim-secrets-manager-value-cipher.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-value-cipher.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-value-cipher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAarF;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC;;OAEG;IACH,IAAI,CACF,KAAK,EAAE,4BAA4B,EACnC,OAAO,EAAE,UAAU,EACnB,iBAAiB,EAAE,UAAU,GAC5B,+BAA+B,CAgBjC;IAED;;OAEG;IACH,IAAI,CACF,SAAS,EAAE,+BAA+B,EAC1C,OAAO,EAAE,UAAU,GAClB,4BAA4B,CAU9B;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-cipher.js

@@ -0,0 +1,53 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { SimSecretsManagerEncryptedValue } from "./sim-secrets-manager-encrypted-value.js";
+import { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+/**
+ * The cipher a data key encrypts a secret value with.
+ *
+ * This is the half of envelope encryption that does not happen inside KMS.
+ * KMS produces and later recovers the data key; the value itself is encrypted
+ * out here with AES-256-GCM, which is what the AWS Encryption SDK does with a
+ * data key too.
+ */
+const algorithm = "aes-256-gcm";
+const ivLength = 12;
+/**
+ * Encrypts and decrypts a secret value under a plaintext data key.
+ *
+ * The encryption context is not bound in here. KMS binds it to the data key,
+ * so a decryption naming a different secret or version fails at the KMS call
+ * rather than at this cipher, which is where real Secrets Manager fails too.
+ */
+export class SimSecretsManagerValueCipher {
+    /**
+     * Encrypt a value under a data key.
+     */
+    seal(value, dataKey, dataKeyCiphertext) {
+        const iv = randomBytes(ivLength);
+        const cipher = createCipheriv(algorithm, dataKey, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(value.bytes),
+            cipher.final(),
+        ]);
+        return new SimSecretsManagerEncryptedValue({
+            dataKeyCiphertext,
+            iv: Uint8Array.from(iv),
+            authTag: Uint8Array.from(cipher.getAuthTag()),
+            ciphertext: Uint8Array.from(ciphertext),
+            digest: value.digest,
+        });
+    }
+    /**
+     * Decrypt a value with the data key KMS recovered for it.
+     */
+    open(encrypted, dataKey) {
+        const decipher = createDecipheriv(algorithm, dataKey, encrypted.iv);
+        decipher.setAuthTag(encrypted.authTag);
+        const plaintext = Buffer.concat([
+            decipher.update(encrypted.ciphertext),
+            decipher.final(),
+        ]);
+        return SimSecretsManagerSecretValue.fromBytes(Uint8Array.from(plaintext));
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-value-cipher.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-value-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-value-cipher.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-value-cipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACvC;;OAEG;IACH,IAAI,CACF,KAAmC,EACnC,OAAmB,EACnB,iBAA6B;QAE7B,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,OAAO,IAAI,+BAA+B,CAAC;YACzC,iBAAiB;YACjB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7C,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,CACF,SAA0C,EAC1C,OAAmB;QAEnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;YACrC,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,4BAA4B,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;CACF"}