@kensio/yulin 0.41.0 → 0.42.0

package/dist/service/ssm/command/parameter/sim-ssm-parameter-view.js

@@ -16,15 +16,19 @@ export class SimSsmParameterView {
     /**
      * The parameter shape that carries a value.
      *
+     * The reported value is passed in rather than read off the version, because
+     * a SecureString reads back as its ciphertext or its plaintext depending on
+     * whether the request asked for decryption.
+     *
      * `Selector` is only reported when the request asked for a version or a
      * label, as real Parameter Store only reports it then.
      */
-    value(parameter, version, selector) {
+    value(parameter, version, reportedValue, selector) {
         return {
             ARN: parameter.arn.value,
             Name: parameter.name.value,
             Type: parameter.type.value,
-            Value: version.value.value,
+            Value: reportedValue,
             Version: version.version,
             DataType: version.dataType,
             LastModifiedDate: version.lastModifiedDate,
@@ -45,6 +49,7 @@ export class SimSsmParameterView {
             Version: version.version,
             DataType: version.dataType,
             Description: version.description,
+            KeyId: version.keyId,
             LastModifiedDate: version.lastModifiedDate,
             LastModifiedUser: version.lastModifiedUser,
             Policies: [],

package/dist/service/ssm/command/parameter/sim-ssm-parameter-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-view.js","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-parameter-view.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;;;;OAKG;IACH,KAAK,CACH,SAA0B,EAC1B,OAA+B,EAC/B,QAAiB;QAEjB,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAA0B;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC;QAEzC,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-parameter-view.js","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-parameter-view.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;;;;;;;;OASG;IACH,KAAK,CACH,SAA0B,EAC1B,OAA+B,EAC/B,aAAqB,EACrB,QAAiB;QAEjB,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAA0B;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC;QAEzC,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/command/parameter/sim-ssm-put-parameter.d.ts

@@ -28,7 +28,7 @@ export declare class SimSsmPutParameter {
     /**
      * Create or update a parameter.
      */
-    handle(command: SimPutParameterCommand, options?: SimSsmPutParameterOptions): SimPutParameterCommandOutput;
+    handle(command: SimPutParameterCommand, options?: SimSsmPutParameterOptions): Promise<SimPutParameterCommandOutput>;
 }
 export {};
 //# sourceMappingURL=sim-ssm-put-parameter.d.ts.map

package/dist/service/ssm/command/parameter/sim-ssm-put-parameter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-put-parameter.d.ts","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-put-parameter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAE7F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,wBAAwB,CAAC;AAIhC,UAAU,4BAA4B;IACpC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqC;IAExE,YAAY,UAAU,EAAE,4BAA4B,EAInD;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,yBAAyB,GAClC,4BAA4B,CA8B9B;CACF"}
+{"version":3,"file":"sim-ssm-put-parameter.d.ts","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-put-parameter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAE7F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,wBAAwB,CAAC;AAIhC,UAAU,4BAA4B;IACpC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqC;IAExE,YAAY,UAAU,EAAE,4BAA4B,EAInD;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAgCvC;CACF"}

package/dist/service/ssm/command/parameter/sim-ssm-put-parameter.js

@@ -22,7 +22,7 @@ export class SimSsmPutParameter {
     /**
      * Create or update a parameter.
      */
-    handle(command, options) {
+    async handle(command, options) {
         const { input } = command;
         this.unsimulatedOptions.refuseIn(input);
         const name = new SimSsmParameterName({
@@ -30,14 +30,16 @@ export class SimSsmPutParameter {
             accountRegionScope: this.accountRegionScope,
         });
         const caller = this.authorizer.authorizeParameterResource("ssm:PutParameter", name.resource, options?.caller);
-        const version = this.writer.write({
+        const version = await this.writer.write({
             name,
             value: input.Value,
             type: input.Type,
             overwrite: input.Overwrite,
             description: input.Description,
             dataType: input.DataType,
+            keyId: input.KeyId,
             lastModifiedUser: caller.arn,
+            caller: options?.caller,
         });
         return {
             $metadata: {},

package/dist/service/ssm/command/parameter/sim-ssm-put-parameter.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-put-parameter.js","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-put-parameter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAOhF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAYnF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAwB;IAC9B,UAAU,CAAmB;IAC7B,kBAAkB,CAA2B;IAC7C,kBAAkB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAExE,YAAY,UAAwC;QAClD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA+B,EAC/B,OAAmC;QAEnC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,0BAA0B,CACvD,kBAAkB,EAClB,IAAI,CAAC,QAAQ,EACb,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,MAAM,CAAC,GAAG;SAC7B,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-put-parameter.js","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-put-parameter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAOhF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAYnF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAwB;IAC9B,UAAU,CAAmB;IAC7B,kBAAkB,CAA2B;IAC7C,kBAAkB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAExE,YAAY,UAAwC;QAClD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA+B,EAC/B,OAAmC;QAEnC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,0BAA0B,CACvD,kBAAkB,EAClB,IAAI,CAAC,QAAQ,EACb,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACtC,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,gBAAgB,EAAE,MAAM,CAAC,GAAG;YAC5B,MAAM,EAAE,OAAO,EAAE,MAAM;SACxB,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/command/parameter/sim-ssm-unsimulated-put-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-unsimulated-put-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-unsimulated-put-options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAG1E;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAWjD;IAED,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,MAAM;CAUf"}
+{"version":3,"file":"sim-ssm-unsimulated-put-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-unsimulated-put-options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAG1E;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAMjD;IAED,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,MAAM;CAUf"}

package/dist/service/ssm/command/parameter/sim-ssm-unsimulated-put-options.js

@@ -19,7 +19,6 @@ export class SimSsmUnsimulatedPutOptions {
         this.refuse("AllowedPattern", input.AllowedPattern, "value validation");
         this.refuse("Policies", input.Policies, "parameter policies");
         this.refuse("Tags", input.Tags, "parameter tags");
-        this.refuse("KeyId", input.KeyId, "encryption, which only applies to SecureString parameters");
     }
     refuseTier(tier) {
         if (tier === undefined || tier === standardTier) {

package/dist/service/ssm/command/parameter/sim-ssm-unsimulated-put-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-unsimulated-put-options.js","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-unsimulated-put-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,QAAQ,CAAC,KAAkC;QACzC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CACT,OAAO,EACP,KAAK,CAAC,KAAK,EACX,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,IAAwB;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,IAAI,gCAAgC,YAAY,GAAG;YACpE,gEAAgE;YAChE,UAAU,CACb,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,QAA4B;QACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,uBAAuB,QAAQ,qCAAqC;YAClE,mEAAmE;YACnE,+BAA+B,eAAe,iBAAiB,CAClE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAc,EAAE,KAAc,EAAE,OAAe;QAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,gBAAgB,MAAM,sBAAsB,OAAO,oBAAoB;YACrE,8BAA8B,CACjC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-unsimulated-put-options.js","sourceRoot":"","sources":["../../../../../src/service/ssm/command/parameter/sim-ssm-unsimulated-put-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtC;;OAEG;IACH,QAAQ,CAAC,KAAkC;QACzC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAEO,UAAU,CAAC,IAAwB;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,IAAI,gCAAgC,YAAY,GAAG;YACpE,gEAAgE;YAChE,UAAU,CACb,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,QAA4B;QACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,uBAAuB,QAAQ,qCAAqC;YAClE,mEAAmE;YACnE,+BAA+B,eAAe,iBAAiB,CAClE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAc,EAAE,KAAc,EAAE,OAAe;QAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,gBAAgB,MAAM,sBAAsB,OAAO,oBAAoB;YACrE,8BAA8B,CACjC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/error/sim-ssm.error.d.ts

@@ -75,6 +75,17 @@ export declare class SimSsmUnsupportedParameterType extends SimSsmError {
     readonly name = "UnsupportedParameterType";
     constructor(message: string);
 }
+/**
+ * Simulated SSM InvalidKeyId error.
+ *
+ * Real Parameter Store reports every KMS key problem this way: a key that does
+ * not exist, one that is disabled, and one that is pending deletion all reach
+ * the caller as InvalidKeyId with the KMS message behind it.
+ */
+export declare class SimSsmInvalidKeyId extends SimSsmError {
+    readonly name = "InvalidKeyId";
+    constructor(message: string);
+}
 /**
  * Simulated SSM ValidationException error.
  *

package/dist/service/ssm/error/sim-ssm.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm.error.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/error/sim-ssm.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,uCAAwC,SAAQ,WAAW;IACtE,SAAyB,IAAI,uCAAuC;IAEpE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,0CAA2C,SAAQ,WAAW;IACzE,SAAyB,IAAI,0CAA0C;IAEvE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,oCAAqC,SAAQ,WAAW;IACnE,SAAyB,IAAI,oCAAoC;IAEjE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}
+{"version":3,"file":"sim-ssm.error.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/error/sim-ssm.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,uCAAwC,SAAQ,WAAW;IACtE,SAAyB,IAAI,uCAAuC;IAEpE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,0CAA2C,SAAQ,WAAW;IACzE,SAAyB,IAAI,0CAA0C;IAEvE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,oCAAqC,SAAQ,WAAW;IACnE,SAAyB,IAAI,oCAAoC;IAEjE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,SAAyB,IAAI,kBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/ssm/error/sim-ssm.error.js

@@ -86,6 +86,19 @@ export class SimSsmUnsupportedParameterType extends SimSsmError {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated SSM InvalidKeyId error.
+ *
+ * Real Parameter Store reports every KMS key problem this way: a key that does
+ * not exist, one that is disabled, and one that is pending deletion all reach
+ * the caller as InvalidKeyId with the KMS message behind it.
+ */
+export class SimSsmInvalidKeyId extends SimSsmError {
+    name = "InvalidKeyId";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
 /**
  * Simulated SSM ValidationException error.
  *

package/dist/service/ssm/error/sim-ssm.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm.error.js","sourceRoot":"","sources":["../../../../src/service/ssm/error/sim-ssm.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uCAAwC,SAAQ,WAAW;IAC7C,IAAI,GAAG,mCAAmC,CAAC;IAEpE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0CAA2C,SAAQ,WAAW;IAChD,IAAI,GAAG,sCAAsC,CAAC;IAEvE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oCAAqC,SAAQ,WAAW;IAC1C,IAAI,GAAG,gCAAgC,CAAC;IAEjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-ssm.error.js","sourceRoot":"","sources":["../../../../src/service/ssm/error/sim-ssm.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uCAAwC,SAAQ,WAAW;IAC7C,IAAI,GAAG,mCAAmC,CAAC;IAEpE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0CAA2C,SAAQ,WAAW;IAChD,IAAI,GAAG,sCAAsC,CAAC;IAEvE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oCAAqC,SAAQ,WAAW;IAC1C,IAAI,GAAG,gCAAgC,CAAC;IAEjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACxB,IAAI,GAAG,cAAc,CAAC;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/ssm/index.d.ts

@@ -1,10 +1,12 @@
 export { SimSsm, type SimSsmRequestOptions } from "./sim-ssm.js";
 export { SimSsmParameter } from "./parameter/sim-ssm-parameter.js";
 export { SimSsmParameterArn } from "./parameter/sim-ssm-parameter-arn.js";
+export { SimSsmParameterEncryption } from "./parameter/sim-ssm-parameter-encryption.js";
+export { ssmDefaultKeyAlias, type SimSsmKmsCrypto, } from "./parameter/sim-ssm-kms-crypto.js";
 export { SimSsmParameterName } from "./parameter/sim-ssm-parameter-name.js";
 export { SimSsmParameterPath } from "./parameter/sim-ssm-parameter-path.js";
 export { SimSsmParameterType, type SimSsmParameterTypeName, } from "./parameter/sim-ssm-parameter-type.js";
 export { SimSsmParameterValue } from "./parameter/sim-ssm-parameter-value.js";
 export { SimSsmParameterVersion, ssmTextDataType, } from "./parameter/sim-ssm-parameter-version.js";
-export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
+export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmInvalidKeyId, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/ssm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/ssm/index.js

@@ -1,10 +1,12 @@
 export { SimSsm } from "./sim-ssm.js";
 export { SimSsmParameter } from "./parameter/sim-ssm-parameter.js";
 export { SimSsmParameterArn } from "./parameter/sim-ssm-parameter-arn.js";
+export { SimSsmParameterEncryption } from "./parameter/sim-ssm-parameter-encryption.js";
+export { ssmDefaultKeyAlias, } from "./parameter/sim-ssm-kms-crypto.js";
 export { SimSsmParameterName } from "./parameter/sim-ssm-parameter-name.js";
 export { SimSsmParameterPath } from "./parameter/sim-ssm-parameter-path.js";
 export { SimSsmParameterType, } from "./parameter/sim-ssm-parameter-type.js";
 export { SimSsmParameterValue } from "./parameter/sim-ssm-parameter-value.js";
 export { SimSsmParameterVersion, ssmTextDataType, } from "./parameter/sim-ssm-parameter-version.js";
-export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
+export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmInvalidKeyId, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/ssm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA6B,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,GAEpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA6B,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,kBAAkB,GAEnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,GAEpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts

@@ -0,0 +1,55 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The alias of the AWS managed key Parameter Store encrypts with when a
+ * request names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export declare const ssmDefaultKeyAlias = "alias/aws/ssm";
+/**
+ * The service Parameter Store's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what lets a caller read a `SecureString` under the
+ * `aws/ssm` managed key with no KMS permission of its own: that key's policy
+ * admits the Account's principals only when the request reached KMS through
+ * Systems Manager.
+ */
+export declare const ssmKmsViaService = "ssm";
+/**
+ * The narrow slice of simulated KMS that SecureString parameters need.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so Encrypt and Decrypt are the whole of it.
+ * SimKms structurally implements this interface.
+ */
+export interface SimSsmKmsCrypto {
+    encrypt(command: {
+        input: {
+            KeyId?: string | undefined;
+            Plaintext?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: {
+        caller?: SimAwsCaller | undefined;
+        viaService?: string | undefined;
+    }): Promise<{
+        CiphertextBlob?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+    decrypt(command: {
+        input: {
+            CiphertextBlob?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: {
+        caller?: SimAwsCaller | undefined;
+        viaService?: string | undefined;
+    }): Promise<{
+        Plaintext?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+}
+//# sourceMappingURL=sim-ssm-kms-crypto.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-crypto.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3B,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACnC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,GACA,OAAO,CAAC;QACT,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;IAEH,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACxC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,GACA,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;CACJ"}

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js

@@ -0,0 +1,20 @@
+/**
+ * The alias of the AWS managed key Parameter Store encrypts with when a
+ * request names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export const ssmDefaultKeyAlias = "alias/aws/ssm";
+/**
+ * The service Parameter Store's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what lets a caller read a `SecureString` under the
+ * `aws/ssm` managed key with no KMS permission of its own: that key's policy
+ * admits the Account's principals only when the request reached KMS through
+ * Systems Manager.
+ */
+export const ssmKmsViaService = "ssm";
+//# sourceMappingURL=sim-ssm-kms-crypto.js.map

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-crypto.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-crypto.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Run a KMS call, reporting a refusal about the key the way Parameter Store
+ * reports it.
+ *
+ * Every key problem KMS raises becomes InvalidKeyId carrying the KMS message,
+ * which is what real Parameter Store does for a key that is missing, disabled
+ * or pending deletion. An access denial is not a KMS error and passes through
+ * untouched, so a missing `kms:Decrypt` still reads as a denial rather than a
+ * bad key.
+ */
+export declare function reportingKeyProblems<TResult>(call: () => Promise<TResult>): Promise<TResult>;
+//# sourceMappingURL=sim-ssm-kms-key-problems.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-key-problems.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-key-problems.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAChD,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.js

@@ -0,0 +1,24 @@
+import { SimKmsError } from "../../kms/error/sim-kms.error.js";
+import { SimSsmInvalidKeyId } from "../error/sim-ssm.error.js";
+/**
+ * Run a KMS call, reporting a refusal about the key the way Parameter Store
+ * reports it.
+ *
+ * Every key problem KMS raises becomes InvalidKeyId carrying the KMS message,
+ * which is what real Parameter Store does for a key that is missing, disabled
+ * or pending deletion. An access denial is not a KMS error and passes through
+ * untouched, so a missing `kms:Decrypt` still reads as a denial rather than a
+ * bad key.
+ */
+export async function reportingKeyProblems(call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        if (error instanceof SimKmsError) {
+            throw new SimSsmInvalidKeyId(`The KMS key cannot be used for this parameter: ${error.message}`);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=sim-ssm-kms-key-problems.js.map

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-key-problems.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-key-problems.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA4B;IAE5B,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAC1B,kDAAkD,KAAK,CAAC,OAAO,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimSsmParameter } from "./sim-ssm-parameter.js";
+import type { SimSsmKmsCrypto } from "./sim-ssm-kms-crypto.js";
+import type { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+import { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
+import type { SimSsmParameterVersion } from "./sim-ssm-parameter-version.js";
+interface SimSsmParameterEncryptionProperties {
+    readonly kms: SimSsmKmsCrypto;
+}
+/**
+ * What a SecureString value is stored as, and which key protects it.
+ */
+export interface SimSsmEncryptedValue {
+    readonly value: SimSsmParameterValue;
+    readonly keyId: string | undefined;
+}
+/**
+ * Decides when a parameter value is encrypted and when it is decrypted.
+ *
+ * These rules are worth keeping apart from the KMS calls themselves, because
+ * they are what a caller actually trips over: a value stored in the clear
+ * because the type said so, and a read that gets a ciphertext back because it
+ * did not ask for decryption.
+ */
+export declare class SimSsmParameterEncryption {
+    private readonly kms;
+    constructor(properties: SimSsmParameterEncryptionProperties);
+    /**
+     * The stored form of a submitted value, encrypted if the type calls for it.
+     */
+    stored(type: SimSsmParameterType, parameterArn: string, submitted: SimSsmParameterValue, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmEncryptedValue>;
+    /**
+     * The value a read reports, decrypted only when it was asked for.
+     *
+     * `WithDecryption` on a parameter that is not encrypted is ignored rather
+     * than refused, as real Parameter Store ignores it.
+     */
+    reported(parameter: SimSsmParameter, version: SimSsmParameterVersion, withDecryption: boolean | undefined, caller: SimAwsCaller | undefined): Promise<string>;
+    private refuseKeyIdWithoutSecureString;
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-encryption.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-encryption.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,mBAAmB,EACzB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,oBAAoB,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;IAED;;;;;OAKG;IACG,QAAQ,CACZ,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,sBAAsB,EAC/B,cAAc,EAAE,OAAO,GAAG,SAAS,EACnC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,MAAM,CAAC,CAUjB;IAED,OAAO,CAAC,8BAA8B;CAcvC"}

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.js

@@ -0,0 +1,52 @@
+import { SimSsmValidationException } from "../error/sim-ssm.error.js";
+import { SimSsmParameterKms } from "./sim-ssm-parameter-kms.js";
+import { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
+/**
+ * Decides when a parameter value is encrypted and when it is decrypted.
+ *
+ * These rules are worth keeping apart from the KMS calls themselves, because
+ * they are what a caller actually trips over: a value stored in the clear
+ * because the type said so, and a read that gets a ciphertext back because it
+ * did not ask for decryption.
+ */
+export class SimSsmParameterEncryption {
+    kms;
+    constructor(properties) {
+        this.kms = new SimSsmParameterKms(properties);
+    }
+    /**
+     * The stored form of a submitted value, encrypted if the type calls for it.
+     */
+    async stored(type, parameterArn, submitted, keyId, caller) {
+        if (!type.isSecure) {
+            this.refuseKeyIdWithoutSecureString(type, keyId);
+            return { value: submitted, keyId: undefined };
+        }
+        const encrypted = await this.kms.encrypt(parameterArn, submitted.value, keyId, caller);
+        return {
+            value: SimSsmParameterValue.encrypted(encrypted.ciphertext),
+            keyId: encrypted.keyId,
+        };
+    }
+    /**
+     * The value a read reports, decrypted only when it was asked for.
+     *
+     * `WithDecryption` on a parameter that is not encrypted is ignored rather
+     * than refused, as real Parameter Store ignores it.
+     */
+    async reported(parameter, version, withDecryption, caller) {
+        if (!parameter.type.isSecure || withDecryption !== true) {
+            return version.value.value;
+        }
+        return await this.kms.decrypt(parameter.arn.value, version.value.value, caller);
+    }
+    refuseKeyIdWithoutSecureString(type, keyId) {
+        if (keyId === undefined) {
+            return;
+        }
+        throw new SimSsmValidationException(`KeyId applies to a SecureString parameter, and this one is a ` +
+            `${type.value} parameter. A value stored in the clear is not ` +
+            `encrypted with anything.`);
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-encryption.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-encryption.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-encryption.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAepE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,GAAG,CAAqB;IAEzC,YAAY,UAA+C;QACzD,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAyB,EACzB,YAAoB,EACpB,SAA+B,EAC/B,KAAyB,EACzB,MAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAEjD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACtC,YAAY,EACZ,SAAS,CAAC,KAAK,EACf,KAAK,EACL,MAAM,CACP,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3D,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,SAA0B,EAC1B,OAA+B,EAC/B,cAAmC,EACnC,MAAgC;QAEhC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAC3B,SAAS,CAAC,GAAG,CAAC,KAAK,EACnB,OAAO,CAAC,KAAK,CAAC,KAAK,EACnB,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,8BAA8B,CACpC,IAAyB,EACzB,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,+DAA+D;YAC7D,GAAG,IAAI,CAAC,KAAK,iDAAiD;YAC9D,0BAA0B,CAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts

@@ -0,0 +1,43 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import { type SimSsmKmsCrypto } from "./sim-ssm-kms-crypto.js";
+/**
+ * What KMS produced for one parameter value.
+ */
+export interface SimSsmParameterCiphertext {
+    readonly ciphertext: string;
+    readonly keyId: string | undefined;
+}
+interface SimSsmParameterKmsProperties {
+    readonly kms: SimSsmKmsCrypto;
+}
+/**
+ * The KMS calls a SecureString parameter makes.
+ *
+ * The calls are made as the caller rather than as the service, which is the
+ * point: under a customer managed key a standard tier write needs
+ * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
+ * top of the SSM permission for the parameter itself.
+ *
+ * They are also made through the service, which is why the `aws/ssm` managed
+ * key needs no KMS permission at all: its policy admits the Account's
+ * principals when `kms:ViaService` names Systems Manager, and Parameter Store
+ * is what supplies that.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so this is one Encrypt and one Decrypt and nothing more.
+ */
+export declare class SimSsmParameterKms {
+    private readonly kms;
+    constructor(properties: SimSsmParameterKmsProperties);
+    /**
+     * Encrypt a parameter value, bound to the ARN of the parameter holding it.
+     */
+    encrypt(parameterArn: string, plaintext: string, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmParameterCiphertext>;
+    /**
+     * Decrypt a parameter value, which needs the same binding it was made with.
+     */
+    decrypt(parameterArn: string, ciphertext: string, caller: SimAwsCaller | undefined): Promise<string>;
+    private contextFor;
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-kms.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-kms.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-kms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAYjC;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IAEtC,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;OAEG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,yBAAyB,CAAC,CAwBpC;IAED;;OAEG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,MAAM,CAAC,CAoBjB;IAED,OAAO,CAAC,UAAU;CAGnB"}

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js

@@ -0,0 +1,68 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { reportingKeyProblems } from "./sim-ssm-kms-key-problems.js";
+import { ssmDefaultKeyAlias, ssmKmsViaService, } from "./sim-ssm-kms-crypto.js";
+/**
+ * The encryption context key Parameter Store binds every SecureString value
+ * to, holding the ARN of the parameter being encrypted.
+ *
+ * Binding it means a ciphertext lifted out of one parameter cannot be
+ * decrypted as another, and it is what a `kms:EncryptionContext:PARAMETER_ARN`
+ * policy condition matches on real AWS.
+ */
+const parameterArnContextKey = "PARAMETER_ARN";
+/**
+ * The KMS calls a SecureString parameter makes.
+ *
+ * The calls are made as the caller rather than as the service, which is the
+ * point: under a customer managed key a standard tier write needs
+ * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
+ * top of the SSM permission for the parameter itself.
+ *
+ * They are also made through the service, which is why the `aws/ssm` managed
+ * key needs no KMS permission at all: its policy admits the Account's
+ * principals when `kms:ViaService` names Systems Manager, and Parameter Store
+ * is what supplies that.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so this is one Encrypt and one Decrypt and nothing more.
+ */
+export class SimSsmParameterKms {
+    kms;
+    constructor(properties) {
+        this.kms = properties.kms;
+    }
+    /**
+     * Encrypt a parameter value, bound to the ARN of the parameter holding it.
+     */
+    async encrypt(parameterArn, plaintext, keyId, caller) {
+        const encrypted = await reportingKeyProblems(async () => await this.kms.encrypt({
+            input: {
+                KeyId: keyId ?? ssmDefaultKeyAlias,
+                Plaintext: Buffer.from(plaintext, "utf8"),
+                EncryptionContext: this.contextFor(parameterArn),
+            },
+        }, { caller, viaService: ssmKmsViaService }));
+        assertDefined(encrypted.CiphertextBlob, `Simulated KMS encrypted ${parameterArn} to nothing`);
+        return {
+            ciphertext: Buffer.from(encrypted.CiphertextBlob).toString("base64"),
+            keyId: encrypted.KeyId,
+        };
+    }
+    /**
+     * Decrypt a parameter value, which needs the same binding it was made with.
+     */
+    async decrypt(parameterArn, ciphertext, caller) {
+        const decrypted = await reportingKeyProblems(async () => await this.kms.decrypt({
+            input: {
+                CiphertextBlob: Buffer.from(ciphertext, "base64"),
+                EncryptionContext: this.contextFor(parameterArn),
+            },
+        }, { caller, viaService: ssmKmsViaService }));
+        assertDefined(decrypted.Plaintext, `Simulated KMS decrypted ${parameterArn} to nothing`);
+        return Buffer.from(decrypted.Plaintext).toString("utf8");
+    }
+    contextFor(parameterArn) {
+        return { [parameterArnContextKey]: parameterArn };
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-kms.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-kms.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-kms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAc/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAkB;IAEtC,YAAY,UAAwC;QAClD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,SAAiB,EACjB,KAAyB,EACzB,MAAgC;QAEhC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB;YACE,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK,IAAI,kBAAkB;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;gBACzC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;aACjD;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACzC,CACJ,CAAC;QAEF,aAAa,CACX,SAAS,CAAC,cAAc,EACxB,2BAA2B,YAAY,aAAa,CACrD,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACpE,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,UAAkB,EAClB,MAAgC;QAEhC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB;YACE,KAAK,EAAE;gBACL,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACjD,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;aACjD;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACzC,CACJ,CAAC;QAEF,aAAa,CACX,SAAS,CAAC,SAAS,EACnB,2BAA2B,YAAY,aAAa,CACrD,CAAC;QAEF,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAEO,UAAU,CAAC,YAAoB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.d.ts

@@ -0,0 +1,34 @@
+import type { SimSsmParameter } from "./sim-ssm-parameter.js";
+import { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+/**
+ * What a write says about the type it wants and whether it may replace what
+ * is already there.
+ */
+export interface SimSsmParameterOverwriteRequest {
+    readonly type: string | undefined;
+    readonly overwrite: boolean | undefined;
+}
+/**
+ * The rules that only exist where a create and an overwrite meet.
+ *
+ * A name already in use and a type that cannot change are both about the
+ * relationship between a request and a stored parameter, rather than about
+ * either on its own, so they live together and away from the write itself.
+ */
+export declare class SimSsmParameterOverwrite {
+    /**
+     * The type the written version will belong to, refusing a request that may
+     * not replace the parameter it names.
+     */
+    typeFor(request: SimSsmParameterOverwriteRequest, existing: SimSsmParameter | undefined): SimSsmParameterType;
+    /**
+     * Refuse an overwrite that real Parameter Store refuses.
+     *
+     * A request that leaves out Overwrite is a create, so a name already in use
+     * fails rather than quietly replacing what is there. A request naming a
+     * different type fails too: Parameter Store has no way to convert a stored
+     * parameter, so the caller has to delete it and make a new one.
+     */
+    private requireAllowed;
+}
+//# sourceMappingURL=sim-ssm-parameter-overwrite.d.ts.map