@kensio/yulin 0.41.0 → 0.42.0

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-overwrite.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-overwrite.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC;;;OAGG;IACH,OAAO,CACL,OAAO,EAAE,+BAA+B,EACxC,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,mBAAmB,CAQrB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;CA4BvB"}

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.js

@@ -0,0 +1,48 @@
+import { SimSsmHierarchyTypeMismatchException, SimSsmParameterAlreadyExists, } from "../error/sim-ssm.error.js";
+import { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+/**
+ * The rules that only exist where a create and an overwrite meet.
+ *
+ * A name already in use and a type that cannot change are both about the
+ * relationship between a request and a stored parameter, rather than about
+ * either on its own, so they live together and away from the write itself.
+ */
+export class SimSsmParameterOverwrite {
+    /**
+     * The type the written version will belong to, refusing a request that may
+     * not replace the parameter it names.
+     */
+    typeFor(request, existing) {
+        if (existing === undefined) {
+            return SimSsmParameterType.forNewParameter(request.type);
+        }
+        this.requireAllowed(request, existing);
+        return existing.type;
+    }
+    /**
+     * Refuse an overwrite that real Parameter Store refuses.
+     *
+     * A request that leaves out Overwrite is a create, so a name already in use
+     * fails rather than quietly replacing what is there. A request naming a
+     * different type fails too: Parameter Store has no way to convert a stored
+     * parameter, so the caller has to delete it and make a new one.
+     */
+    requireAllowed(request, existing) {
+        if (request.overwrite !== true) {
+            throw new SimSsmParameterAlreadyExists(`The parameter '${existing.name.value}' already exists. To overwrite ` +
+                `this value, set the Overwrite option in the request to true.`);
+        }
+        if (request.type === undefined) {
+            return;
+        }
+        const requested = new SimSsmParameterType(request.type);
+        if (requested.value === existing.type.value) {
+            return;
+        }
+        throw new SimSsmHierarchyTypeMismatchException(`Parameter '${existing.name.value}' is a ${existing.type.value} ` +
+            `parameter and cannot be changed to ${requested.value}. Parameter ` +
+            `Store does not support changing a parameter type: create a new, ` +
+            `unique parameter instead.`);
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-overwrite.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-overwrite.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAWlE;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;OAGG;IACH,OAAO,CACL,OAAwC,EACxC,QAAqC;QAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,cAAc,CACpB,OAAwC,EACxC,QAAyB;QAEzB,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,KAAK,iCAAiC;gBACpE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,oCAAoC,CAC5C,cAAc,QAAQ,CAAC,IAAI,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG;YAC/D,sCAAsC,SAAS,CAAC,KAAK,cAAc;YACnE,kEAAkE;YAClE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-type.d.ts

@@ -1,14 +1,14 @@
 /**
  * The parameter types this simulation stores.
  */
-export type SimSsmParameterTypeName = "String" | "StringList";
+export type SimSsmParameterTypeName = "String" | "StringList" | "SecureString";
 /**
  * The type of one simulated parameter.
  *
- * `SecureString` is refused rather than stored. Nothing in this simulation
- * would encrypt it, so accepting it would let a test pass while proving
- * nothing about the KMS key, the `kms:Decrypt` permission or the
- * `WithDecryption` flag a real deployment depends on.
+ * A `SecureString` is encrypted through simulated KMS rather than stored in
+ * the clear, so the two failures a real deployment hits are reproducible here:
+ * a caller that may read the parameter but may not decrypt with its key, and
+ * a read that forgets `WithDecryption` and gets a ciphertext back.
  */
 export declare class SimSsmParameterType {
     readonly value: SimSsmParameterTypeName;
@@ -21,5 +21,9 @@ export declare class SimSsmParameterType {
      */
     static forNewParameter(type: string | undefined): SimSsmParameterType;
     private static validated;
+    /**
+     * Whether values of this type are stored encrypted.
+     */
+    get isSecure(): boolean;
 }
 //# sourceMappingURL=sim-ssm-parameter-type.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-type.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAI9D;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQpE;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;CAmBzB"}
+{"version":3,"file":"sim-ssm-parameter-type.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAQ/E;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQpE;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-type.js

@@ -1,12 +1,16 @@
 import { SimSsmUnsupportedParameterType, SimSsmValidationException, } from "../error/sim-ssm.error.js";
-const simulatedTypes = new Set(["String", "StringList"]);
+const simulatedTypes = new Set([
+    "String",
+    "StringList",
+    "SecureString",
+]);
 /**
  * The type of one simulated parameter.
  *
- * `SecureString` is refused rather than stored. Nothing in this simulation
- * would encrypt it, so accepting it would let a test pass while proving
- * nothing about the KMS key, the `kms:Decrypt` permission or the
- * `WithDecryption` flag a real deployment depends on.
+ * A `SecureString` is encrypted through simulated KMS rather than stored in
+ * the clear, so the two failures a real deployment hits are reproducible here:
+ * a caller that may read the parameter but may not decrypt with its key, and
+ * a read that forgets `WithDecryption` and gets a ciphertext back.
  */
 export class SimSsmParameterType {
     value;
@@ -26,17 +30,17 @@ export class SimSsmParameterType {
         return new SimSsmParameterType(type);
     }
     static validated(type) {
-        if (type === "SecureString") {
-            throw new SimSsmUnsupportedParameterType("SecureString parameters are not simulated: nothing here would " +
-                "encrypt the value, so a passing test would say nothing about the " +
-                "KMS key or the kms:Decrypt permission the real parameter needs. " +
-                "Use String or StringList.");
-        }
         if (!simulatedTypes.has(type)) {
-            throw new SimSsmUnsupportedParameterType(`Parameter type '${type}' is not a Parameter Store type: use String ` +
-                `or StringList`);
+            throw new SimSsmUnsupportedParameterType(`Parameter type '${type}' is not a Parameter Store type: use String, ` +
+                `StringList or SecureString`);
         }
         return type;
     }
+    /**
+     * Whether values of this type are stored encrypted.
+     */
+    get isSecure() {
+        return this.value === "SecureString";
+    }
 }
 //# sourceMappingURL=sim-ssm-parameter-type.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-type.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAOnC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACd,KAAK,CAA0B;IAE/C,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAwB;QAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,IAAY;QACnC,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAA8B,CACtC,gEAAgE;gBAC9D,mEAAmE;gBACnE,kEAAkE;gBAClE,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,8BAA8B,CACtC,mBAAmB,IAAI,8CAA8C;gBACnE,eAAe,CAClB,CAAC;QACJ,CAAC;QAED,OAAO,IAA+B,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-parameter-type.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAOnC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,QAAQ;IACR,YAAY;IACZ,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACd,KAAK,CAA0B;IAE/C,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAwB;QAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,IAAY;QACnC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,8BAA8B,CACtC,mBAAmB,IAAI,+CAA+C;gBACpE,4BAA4B,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAA+B,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC;IACvC,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-value.d.ts

@@ -1,14 +1,30 @@
 /**
- * The value held by one version of a simulated parameter.
+ * The value held by one version of a simulated parameter, as it is stored.
  *
  * A `StringList` value is a single comma-separated string here, as it is on
  * real Parameter Store. It is stored and returned that way rather than split
  * into an array, so handler code that splits it on commas is exercising the
  * same shape it would get from AWS.
+ *
+ * A `SecureString` value is stored as the base64 ciphertext KMS produced,
+ * which is what a read without `WithDecryption` returns. The 4KB limit applies
+ * to the plaintext a request submitted rather than to that ciphertext, so the
+ * two ways of making one of these are separate.
  */
 export declare class SimSsmParameterValue {
     readonly value: string;
-    constructor(value: string | undefined);
-    private static validated;
+    private constructor();
+    /**
+     * The value a request submitted, checked against the standard tier limit.
+     */
+    static submitted(value: string | undefined): SimSsmParameterValue;
+    /**
+     * The stored form of an encrypted value.
+     *
+     * This is longer than the plaintext it came from and is not subject to the
+     * limit that plaintext was checked against, because Parameter Store measures
+     * the request rather than what it keeps.
+     */
+    static encrypted(ciphertext: string): SimSsmParameterValue;
 }
 //# sourceMappingURL=sim-ssm-parameter-value.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-value.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-value.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-value.ts"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,KAAK,EAAE,MAAM,GAAG,SAAS,EAEpC;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;CAmBzB"}
+{"version":3,"file":"sim-ssm-parameter-value.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-value.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;GAYG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,OAAO,eAEN;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAkBhE;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,CAEzD;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-value.js

@@ -8,19 +8,27 @@ import { SimSsmValidationException } from "../error/sim-ssm.error.js";
  */
 const maxValueBytes = 4096;
 /**
- * The value held by one version of a simulated parameter.
+ * The value held by one version of a simulated parameter, as it is stored.
  *
  * A `StringList` value is a single comma-separated string here, as it is on
  * real Parameter Store. It is stored and returned that way rather than split
  * into an array, so handler code that splits it on commas is exercising the
  * same shape it would get from AWS.
+ *
+ * A `SecureString` value is stored as the base64 ciphertext KMS produced,
+ * which is what a read without `WithDecryption` returns. The 4KB limit applies
+ * to the plaintext a request submitted rather than to that ciphertext, so the
+ * two ways of making one of these are separate.
  */
 export class SimSsmParameterValue {
     value;
     constructor(value) {
-        this.value = SimSsmParameterValue.validated(value);
+        this.value = value;
     }
-    static validated(value) {
+    /**
+     * The value a request submitted, checked against the standard tier limit.
+     */
+    static submitted(value) {
         if (value === undefined || value === "") {
             throw new SimSsmValidationException("A parameter Value is required and cannot be empty");
         }
@@ -30,7 +38,17 @@ export class SimSsmParameterValue {
                 `parameter holds at most ${String(maxValueBytes)} bytes. The ` +
                 `advanced tier is not simulated.`);
         }
-        return value;
+        return new SimSsmParameterValue(value);
+    }
+    /**
+     * The stored form of an encrypted value.
+     *
+     * This is longer than the plaintext it came from and is not subject to the
+     * limit that plaintext was checked against, because Parameter Store measures
+     * the request rather than what it keeps.
+     */
+    static encrypted(ciphertext) {
+        return new SimSsmParameterValue(ciphertext);
     }
 }
 //# sourceMappingURL=sim-ssm-parameter-value.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-value.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-value.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IACf,KAAK,CAAS;IAE9B,YAAY,KAAyB;QACnC,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,KAAyB;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEpD,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,MAAM,CAAC,UAAU,CAAC,0BAA0B;gBAChE,2BAA2B,MAAM,CAAC,aAAa,CAAC,cAAc;gBAC9D,iCAAiC,CACpC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-parameter-value.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oBAAoB;IACf,KAAK,CAAS;IAE9B,YAAoB,KAAa;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAyB;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEpD,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,MAAM,CAAC,UAAU,CAAC,0BAA0B;gBAChE,2BAA2B,MAAM,CAAC,aAAa,CAAC,cAAc;gBAC9D,iCAAiC,CACpC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,UAAkB;QACjC,OAAO,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-version.d.ts

@@ -8,12 +8,17 @@ import type { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
  */
 export declare const ssmTextDataType = "text";
 /**
- * The details one write of a parameter carries, beyond its value.
+ * The details one stored version of a parameter records, beyond its value.
  */
 export interface SimSsmParameterVersionDetails {
     readonly description?: string | undefined;
     readonly dataType?: string | undefined;
     readonly lastModifiedUser?: string | undefined;
+    /**
+     * The ARN of the KMS key a SecureString value was encrypted under, and
+     * undefined for the types that are stored in the clear.
+     */
+    readonly keyId?: string | undefined;
 }
 interface SimSsmParameterVersionProperties extends SimSsmParameterVersionDetails {
     readonly version: number;
@@ -33,6 +38,7 @@ export declare class SimSsmParameterVersion {
     readonly lastModifiedDate: Date;
     readonly lastModifiedUser: string | undefined;
     readonly description: string | undefined;
+    readonly keyId: string | undefined;
     readonly dataType: string;
     constructor(properties: SimSsmParameterVersionProperties);
 }

package/dist/service/ssm/parameter/sim-ssm-parameter-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-version.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SAAS,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,UAAU,gCAAiC,SAAQ,6BAA6B;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC;CACjC;AAED;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,KAAK,EAAE,oBAAoB,CAAC;IAC5C,SAAgB,gBAAgB,EAAE,IAAI,CAAC;IACvC,SAAgB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,YAAY,UAAU,EAAE,gCAAgC,EAOvD;CACF"}
+{"version":3,"file":"sim-ssm-parameter-version.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SAAS,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,UAAU,gCAAiC,SAAQ,6BAA6B;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC;CACjC;AAED;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,KAAK,EAAE,oBAAoB,CAAC;IAC5C,SAAgB,gBAAgB,EAAE,IAAI,CAAC;IACvC,SAAgB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,YAAY,UAAU,EAAE,gCAAgC,EAQvD;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-version.js

@@ -19,6 +19,7 @@ export class SimSsmParameterVersion {
     lastModifiedDate;
     lastModifiedUser;
     description;
+    keyId;
     dataType;
     constructor(properties) {
         this.version = properties.version;
@@ -26,6 +27,7 @@ export class SimSsmParameterVersion {
         this.lastModifiedDate = properties.lastModifiedDate;
         this.lastModifiedUser = properties.lastModifiedUser;
         this.description = properties.description;
+        this.keyId = properties.keyId;
         this.dataType = properties.dataType ?? ssmTextDataType;
     }
 }

package/dist/service/ssm/parameter/sim-ssm-parameter-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-version.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-version.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAiBtC;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACjB,OAAO,CAAS;IAChB,KAAK,CAAuB;IAC5B,gBAAgB,CAAO;IACvB,gBAAgB,CAAqB;IACrC,WAAW,CAAqB;IAChC,QAAQ,CAAS;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,eAAe,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-parameter-version.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-version.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAuBtC;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACjB,OAAO,CAAS;IAChB,KAAK,CAAuB;IAC5B,gBAAgB,CAAO;IACvB,gBAAgB,CAAqB;IACrC,WAAW,CAAqB;IAChC,KAAK,CAAqB;IAC1B,QAAQ,CAAS;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,eAAe,CAAC;IACzD,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-writer.d.ts

@@ -1,19 +1,40 @@
 import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimSsmParameterEncryption } from "./sim-ssm-parameter-encryption.js";
 import type { SimSsmParameterName } from "./sim-ssm-parameter-name.js";
 import type { SimSsmParameterStore } from "./sim-ssm-parameter-store.js";
-import type { SimSsmParameterVersion, SimSsmParameterVersionDetails } from "./sim-ssm-parameter-version.js";
+import type { SimSsmParameterVersion } from "./sim-ssm-parameter-version.js";
 /**
  * One write of a parameter, as PutParameter describes it.
+ *
+ * This is the request rather than what gets stored, which is why it does not
+ * share the version's details: the two differ on the key. Here it is whatever
+ * the request asked for, and on the version it is the ARN that answered.
  */
-export interface SimSsmParameterWrite extends SimSsmParameterVersionDetails {
+export interface SimSsmParameterWrite {
     readonly name: SimSsmParameterName;
     readonly value: string | undefined;
     readonly type: string | undefined;
     readonly overwrite: boolean | undefined;
+    readonly description: string | undefined;
+    readonly dataType: string | undefined;
+    readonly lastModifiedUser: string | undefined;
+    /**
+     * The key the request asked to encrypt with, in any form KMS accepts: an
+     * alias such as `alias/aws/ssm`, a key ID, or a key ARN. Undefined leaves
+     * Parameter Store to pick its own AWS managed key.
+     */
+    readonly keyId: string | undefined;
+    /**
+     * The caller the KMS call for a SecureString is made as, so that encrypting
+     * needs the caller's own `kms:Encrypt` permission on the key.
+     */
+    readonly caller: SimAwsCaller | undefined;
 }
 interface SimSsmParameterWriterProperties {
     readonly parameters: SimSsmParameterStore;
+    readonly encryption: SimSsmParameterEncryption;
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly clock: SimClock;
 }
@@ -21,32 +42,31 @@ interface SimSsmParameterWriterProperties {
  * The single path by which a simulated parameter is created or updated.
  *
  * Keeping creation and overwrite in one collaborator is what stops the two
- * drifting apart on the rules that only show up when they meet: a name that is
- * already taken, and a type that cannot change once the parameter exists.
+ * drifting apart on the rules that only show up when they meet.
  */
 export declare class SimSsmParameterWriter {
     private readonly parameters;
+    private readonly encryption;
     private readonly accountRegionScope;
     private readonly clock;
+    private readonly overwrite;
     constructor(properties: SimSsmParameterWriterProperties);
     /**
      * Write a new version of a parameter, creating it if it is new.
      *
-     * Everything is validated before anything is stored, so a request refused
-     * for its value leaves no half-made parameter behind.
+     * Everything is validated and encrypted before anything is stored, so a
+     * request refused for its value, or for a key the caller may not encrypt
+     * with, leaves no half-made parameter behind.
      */
-    write(request: SimSsmParameterWrite): SimSsmParameterVersion;
-    private parameterFor;
-    private created;
+    write(request: SimSsmParameterWrite): Promise<SimSsmParameterVersion>;
     /**
-     * Refuse an overwrite that real Parameter Store refuses.
+     * The ARN the parameter has or is about to have.
      *
-     * A request that leaves out Overwrite is a create, so a name already in use
-     * fails rather than quietly replacing what is there. A request naming a
-     * different type fails too: Parameter Store has no way to convert a stored
-     * parameter, so the caller has to delete it and make a new one.
+     * It is needed before the parameter exists, because it is the encryption
+     * context a SecureString value is bound to.
      */
-    private requireOverwriteAllowed;
+    private arnFor;
+    private created;
 }
 export {};
 //# sourceMappingURL=sim-ssm-parameter-writer.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-writer.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAM1F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC9B,MAAM,gCAAgC,CAAC;AAExC;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,6BAA6B;IACzE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,+BAA+B,EAItD;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,sBAAsB,CAS3D;IAED,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,OAAO;IAYf;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;CA4BhC"}
+{"version":3,"file":"sim-ssm-parameter-writer.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAG1F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC;CAC3C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAC/C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAE5D,YAAY,UAAU,EAAE,+BAA+B,EAKtD;IAED;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAoB1E;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,OAAO;CAchB"}

package/dist/service/ssm/parameter/sim-ssm-parameter-writer.js

@@ -1,79 +1,65 @@
-import { SimSsmHierarchyTypeMismatchException, SimSsmParameterAlreadyExists, } from "../error/sim-ssm.error.js";
 import { SimSsmParameter } from "./sim-ssm-parameter.js";
-import { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+import { SimSsmParameterArn } from "./sim-ssm-parameter-arn.js";
+import { SimSsmParameterOverwrite } from "./sim-ssm-parameter-overwrite.js";
 import { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
 /**
  * The single path by which a simulated parameter is created or updated.
  *
  * Keeping creation and overwrite in one collaborator is what stops the two
- * drifting apart on the rules that only show up when they meet: a name that is
- * already taken, and a type that cannot change once the parameter exists.
+ * drifting apart on the rules that only show up when they meet.
  */
 export class SimSsmParameterWriter {
     parameters;
+    encryption;
     accountRegionScope;
     clock;
+    overwrite = new SimSsmParameterOverwrite();
     constructor(properties) {
         this.parameters = properties.parameters;
+        this.encryption = properties.encryption;
         this.accountRegionScope = properties.accountRegionScope;
         this.clock = properties.clock;
     }
     /**
      * Write a new version of a parameter, creating it if it is new.
      *
-     * Everything is validated before anything is stored, so a request refused
-     * for its value leaves no half-made parameter behind.
+     * Everything is validated and encrypted before anything is stored, so a
+     * request refused for its value, or for a key the caller may not encrypt
+     * with, leaves no half-made parameter behind.
      */
-    write(request) {
-        const value = new SimSsmParameterValue(request.value);
-        const parameter = this.parameterFor(request);
-        return parameter.addVersion(value, this.clock.now(), {
+    async write(request) {
+        const submitted = SimSsmParameterValue.submitted(request.value);
+        const existing = this.parameters.find(request.name.value);
+        const type = this.overwrite.typeFor(request, existing);
+        const stored = await this.encryption.stored(type, this.arnFor(request.name), submitted, request.keyId, request.caller);
+        const parameter = existing ?? this.created(request.name, type);
+        return parameter.addVersion(stored.value, this.clock.now(), {
             description: request.description,
             dataType: request.dataType,
             lastModifiedUser: request.lastModifiedUser,
+            keyId: stored.keyId,
         });
     }
-    parameterFor(request) {
-        const existing = this.parameters.find(request.name.value);
-        if (existing === undefined) {
-            return this.created(request);
-        }
-        this.requireOverwriteAllowed(request, existing);
-        return existing;
+    /**
+     * The ARN the parameter has or is about to have.
+     *
+     * It is needed before the parameter exists, because it is the encryption
+     * context a SecureString value is bound to.
+     */
+    arnFor(name) {
+        return new SimSsmParameterArn({
+            resource: name.resource,
+            accountRegionScope: this.accountRegionScope,
+        }).value;
     }
-    created(request) {
+    created(name, type) {
         const parameter = new SimSsmParameter({
-            name: request.name,
-            type: SimSsmParameterType.forNewParameter(request.type),
+            name,
+            type,
             accountRegionScope: this.accountRegionScope,
         });
         this.parameters.add(parameter);
         return parameter;
     }
-    /**
-     * Refuse an overwrite that real Parameter Store refuses.
-     *
-     * A request that leaves out Overwrite is a create, so a name already in use
-     * fails rather than quietly replacing what is there. A request naming a
-     * different type fails too: Parameter Store has no way to convert a stored
-     * parameter, so the caller has to delete it and make a new one.
-     */
-    requireOverwriteAllowed(request, existing) {
-        if (request.overwrite !== true) {
-            throw new SimSsmParameterAlreadyExists(`The parameter '${existing.name.value}' already exists. To overwrite ` +
-                `this value, set the Overwrite option in the request to true.`);
-        }
-        if (request.type === undefined) {
-            return;
-        }
-        const requested = new SimSsmParameterType(request.type);
-        if (requested.value === existing.type.value) {
-            return;
-        }
-        throw new SimSsmHierarchyTypeMismatchException(`Parameter '${existing.name.value}' is a ${existing.type.value} ` +
-            `parameter and cannot be changed to ${requested.value}. Parameter ` +
-            `Store does not support changing a parameter type: create a new, ` +
-            `unique parameter instead.`);
-    }
 }
 //# sourceMappingURL=sim-ssm-parameter-writer.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-writer.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-writer.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAsBpE;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAuB;IACjC,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAEjC,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAA6B;QACjC,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE;YACnD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,OAA6B;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEhD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,OAAO,CAAC,OAA6B;QAC3C,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;YACvD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACK,uBAAuB,CAC7B,OAA6B,EAC7B,QAAyB;QAEzB,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,KAAK,iCAAiC;gBACpE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,oCAAoC,CAC5C,cAAc,QAAQ,CAAC,IAAI,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG;YAC/D,sCAAsC,SAAS,CAAC,KAAK,cAAc;YACnE,kEAAkE;YAClE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-parameter-writer.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-writer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAG5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAwCpE;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAuB;IACjC,UAAU,CAA4B;IACtC,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAChB,SAAS,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAE5D,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CACzC,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EACzB,SAAS,EACT,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE/D,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE;YAC1D,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,IAAyB;QACtC,OAAO,IAAI,kBAAkB,CAAC;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC,KAAK,CAAC;IACX,CAAC;IAEO,OAAO,CACb,IAAyB,EACzB,IAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC;YACpC,IAAI;YACJ,IAAI;YACJ,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/B,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/service/ssm/sim-ssm.d.ts

@@ -4,7 +4,9 @@ import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simSsmCommands from "./command/sim-ssm-command.types.js";
+import { SimSsmCfnResourceFactory } from "./cfn/sim-cfn-ssm-resource-factory.js";
 import type { SimSsmParameter } from "./parameter/sim-ssm-parameter.js";
+import type { SimSsmKmsCrypto } from "./parameter/sim-ssm-kms-crypto.js";
 export interface SimSsmRequestOptions {
     readonly caller?: SimAwsCaller;
 }
@@ -12,6 +14,12 @@ interface SimSsmProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
+    /**
+     * The simulated KMS that SecureString values are encrypted through. One is
+     * created for this scope when none is supplied, so a standalone SimSsm still
+     * encrypts rather than quietly storing secrets in the clear.
+     */
+    readonly kms?: SimSsmKmsCrypto;
 }
 /**
  * Simulated SSM Parameter Store. Handles SDK commands. Emulates AWS behaviour
@@ -32,6 +40,7 @@ export declare class SimSsm {
     private readonly describeParametersCommand;
     private readonly background;
     private readonly sdkRouter;
+    private readonly cfnFactory;
     constructor(properties?: SimSsmProperties);
     /**
      * Find a parameter by name, with or without its leading slash.
@@ -68,6 +77,10 @@ export declare class SimSsm {
      * Handle a DescribeParameters Command from the SDK.
      */
     describeParameters(command: simSsmCommands.SimDescribeParametersCommand, options?: SimSsmRequestOptions): Promise<simSsmCommands.SimDescribeParametersCommandOutput>;
+    /**
+     * Get the CloudFormation Resource factory for AWS::SSM::* Resources.
+     */
+    cfnResourceFactory(): SimSsmCfnResourceFactory;
     /**
      * Get this service's SDK Command router for SDK client interception.
      */

package/dist/service/ssm/sim-ssm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm.d.ts","sourceRoot":"","sources":["../../../src/service/ssm/sim-ssm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAO1D,OAAO,KAAK,KAAK,cAAc,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAKxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgC;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAE9D,YAAY,UAAU,GAAE,gBAAqB,EAqC5C;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEvD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,cAAc,CAAC,uBAAuB,EAC/C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAGvD;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,cAAc,CAAC,6BAA6B,EACrD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,mCAAmC,CAAC,CAG7D;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,cAAc,CAAC,yBAAyB,EACjD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAGzD;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,cAAc,CAAC,0BAA0B,EAClD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,gCAAgC,CAAC,CAG1D;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,cAAc,CAAC,4BAA4B,EACpD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAG5D;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-ssm.d.ts","sourceRoot":"","sources":["../../../src/service/ssm/sim-ssm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAQ1D,OAAO,KAAK,KAAK,cAAc,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAKzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgC;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+C;IAE1E,YAAY,UAAU,GAAE,gBAAqB,EA4C5C;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEvD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,cAAc,CAAC,sBAAsB,EAC9C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAGtD;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,cAAc,CAAC,uBAAuB,EAC/C,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAGvD;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,cAAc,CAAC,6BAA6B,EACrD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,mCAAmC,CAAC,CAG7D;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,cAAc,CAAC,yBAAyB,EACjD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAGzD;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,cAAc,CAAC,0BAA0B,EAClD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,gCAAgC,CAAC,CAG1D;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,cAAc,CAAC,4BAA4B,EACpD,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAG5D;IAED;;OAEG;IACH,kBAAkB,IAAI,wBAAwB,CAE7C;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}