@kensio/yulin 0.41.0 → 0.43.0

package/dist/service/secretsmanager/command/secret/sim-secrets-manager-secret-commands.js

@@ -26,7 +26,7 @@ export class SimSecretsManagerSecretCommands {
      * and all, so a policy allowing `secretsmanager:CreateSecret` on a bare name
      * fails here just as it would on real AWS.
      */
-    create(command, options) {
+    async create(command, options) {
         const { input } = command;
         const secret = this.secretFactory.make({
             name: input.Name,
@@ -36,15 +36,31 @@ export class SimSecretsManagerSecretCommands {
         });
         const value = SimSecretsManagerSecretValue.required(input);
         this.authorizer.authorizeSecret("secretsmanager:CreateSecret", secret, options?.caller);
-        this.secrets.requireNameAvailable(secret.name);
-        const version = this.versionWriter.write(secret, value, input);
-        this.secrets.add(secret);
-        return {
-            $metadata: {},
-            ARN: secret.arn.value,
-            Name: secret.name,
-            VersionId: version.versionId,
-        };
+        // The name is claimed for the whole of the create, because the first
+        // version is encrypted through KMS in between: another create of the same
+        // name is refused rather than overwriting this one. The secret itself is
+        // stored only once that version exists, so a create refused for a key it
+        // cannot use leaves nothing behind.
+        this.secrets.claimName(secret.name);
+        try {
+            const version = await this.versionWriter.write({
+                secret,
+                value,
+                input,
+                keyId: secret.kmsKeyId,
+                caller: options?.caller,
+            });
+            this.secrets.add(secret);
+            return {
+                $metadata: {},
+                ARN: secret.arn.value,
+                Name: secret.name,
+                VersionId: version.versionId,
+            };
+        }
+        finally {
+            this.secrets.releaseName(secret.name);
+        }
     }
     /**
      * Describe a secret's metadata, including the versions and their staging

package/dist/service/secretsmanager/command/secret/sim-secrets-manager-secret-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-secret-commands.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/secret/sim-secrets-manager-secret-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAGhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAmBvF;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IACzB,OAAO,CAA+B;IACtC,aAAa,CAAiC;IAC9C,aAAa,CAAiC;IAC9C,UAAU,CAA8B;IACxC,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAE9D,YAAY,UAAqD;QAC/D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA+B,EAC/B,OAAyC;QAEzC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACrC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3D,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,6BAA6B,EAC7B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEzB,OAAO;YACL,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CACN,OAAiC,EACjC,OAAyC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,+BAA+B,EAC/B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC5D,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager-secret-commands.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/secret/sim-secrets-manager-secret-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAGhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAmBvF;;;;;;GAMG;AACH,MAAM,OAAO,+BAA+B;IACzB,OAAO,CAA+B;IACtC,aAAa,CAAiC;IAC9C,aAAa,CAAiC;IAC9C,UAAU,CAA8B;IACxC,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAE9D,YAAY,UAAqD;QAC/D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,OAA+B,EAC/B,OAAyC;QAEzC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACrC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3D,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,6BAA6B,EAC7B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,oCAAoC;QACpC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;gBAC7C,MAAM;gBACN,KAAK;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,QAAQ;gBACtB,MAAM,EAAE,OAAO,EAAE,MAAM;aACxB,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEzB,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CACN,OAAiC,EACjC,OAAyC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,+BAA+B,EAC/B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC5D,CAAC;CACF"}

package/dist/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.d.ts

@@ -24,7 +24,7 @@ export declare class SimSecretsManagerUpdateSecret {
     private readonly secrets;
     private readonly versionWriter;
     private readonly authorizer;
-    private readonly clock;
+    private readonly metadata;
     constructor(properties: SimSecretsManagerUpdateSecretProperties);
     /**
      * Update a secret's metadata, its value, or both.
@@ -32,14 +32,14 @@ export declare class SimSecretsManagerUpdateSecret {
      * Supplying a value writes a new version and makes it current, the same as
      * PutSecretValue does.
      */
-    handle(command: SimUpdateSecretCommand, options?: SimSecretsManagerUpdateSecretOptions): SimUpdateSecretCommandOutput;
+    handle(command: SimUpdateSecretCommand, options?: SimSecretsManagerUpdateSecretOptions): Promise<SimUpdateSecretCommandOutput>;
     /**
-     * Apply the metadata fields an UpdateSecret request carries.
+     * Write the new version, if the request carried a value.
      *
-     * Omitting a field leaves it as it was, which is how real Secrets Manager
-     * treats an absent Description or KmsKeyId.
+     * A request changing the key and the value together encrypts the new version
+     * under the new key, as real AWS does. The versions already written keep the
+     * key they were made with, so they stay readable.
      */
-    private applyMetadata;
     private writtenVersionId;
 }
 export {};

package/dist/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-update-secret.d.ts","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAErG,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACzG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,KAAK,EACV,sBAAsB,EAEtB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;IAC/C,QAAQ,CAAC,aAAa,EAAE,8BAA8B,CAAC;IACvD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,uCAAuC,EAK9D;IAED;;;;;OAKG;IACH,MAAM,CACJ,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oCAAoC,GAC7C,4BAA4B,CA0B9B;IAED;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,gBAAgB;CAWzB"}
+{"version":3,"file":"sim-secrets-manager-update-secret.d.ts","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAErG,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACzG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAElG,OAAO,KAAK,EACV,sBAAsB,EAEtB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;IAC/C,QAAQ,CAAC,aAAa,EAAE,8BAA8B,CAAC;IACvD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D,YAAY,UAAU,EAAE,uCAAuC,EAO9D;IAED;;;;;OAKG;IACG,MAAM,CACV,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,4BAA4B,CAAC,CA+BvC;IAED;;;;;;OAMG;YACW,gBAAgB;CAoB/B"}

package/dist/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.js

@@ -1,4 +1,5 @@
 import { SimSecretsManagerSecretValue } from "../../secret/sim-secrets-manager-secret-value.js";
+import { SimSecretsManagerMetadataUpdate } from "./sim-secrets-manager-metadata-update.js";
 /**
  * The UpdateSecret command.
  *
@@ -10,12 +11,14 @@ export class SimSecretsManagerUpdateSecret {
     secrets;
     versionWriter;
     authorizer;
-    clock;
+    metadata;
     constructor(properties) {
         this.secrets = properties.secrets;
         this.versionWriter = properties.versionWriter;
         this.authorizer = properties.authorizer;
-        this.clock = properties.clock;
+        this.metadata = new SimSecretsManagerMetadataUpdate({
+            clock: properties.clock,
+        });
     }
     /**
      * Update a secret's metadata, its value, or both.
@@ -23,7 +26,7 @@ export class SimSecretsManagerUpdateSecret {
      * Supplying a value writes a new version and makes it current, the same as
      * PutSecretValue does.
      */
-    handle(command, options) {
+    async handle(command, options) {
         const { input } = command;
         const secret = this.secrets.require(input.SecretId);
         this.authorizer.authorizeSecret("secretsmanager:UpdateSecret", secret, options?.caller);
@@ -33,8 +36,8 @@ export class SimSecretsManagerUpdateSecret {
         // client request token already used for a different value. Applying the
         // metadata first would leave the secret half updated by a request that
         // then reported an error.
-        const versionId = this.writtenVersionId(secret, value, input);
-        this.applyMetadata(secret, input);
+        const versionId = await this.writtenVersionId(secret, value, input, options?.caller);
+        this.metadata.apply(secret, input);
         return {
             $metadata: {},
             ARN: secret.arn.value,
@@ -43,25 +46,24 @@ export class SimSecretsManagerUpdateSecret {
         };
     }
     /**
-     * Apply the metadata fields an UpdateSecret request carries.
+     * Write the new version, if the request carried a value.
      *
-     * Omitting a field leaves it as it was, which is how real Secrets Manager
-     * treats an absent Description or KmsKeyId.
+     * A request changing the key and the value together encrypts the new version
+     * under the new key, as real AWS does. The versions already written keep the
+     * key they were made with, so they stay readable.
      */
-    applyMetadata(secret, input) {
-        if (input.Description !== undefined) {
-            secret.description = input.Description;
-        }
-        if (input.KmsKeyId !== undefined) {
-            secret.kmsKeyId = input.KmsKeyId;
-        }
-        secret.lastChangedDate = this.clock.now();
-    }
-    writtenVersionId(secret, value, input) {
+    async writtenVersionId(secret, value, input, caller) {
         if (value === undefined) {
             return undefined;
         }
-        return this.versionWriter.write(secret, value, input).versionId;
+        const version = await this.versionWriter.write({
+            secret,
+            value,
+            input,
+            keyId: input.KmsKeyId ?? secret.kmsKeyId,
+            caller,
+        });
+        return version.versionId;
     }
 }
 //# sourceMappingURL=sim-secrets-manager-update-secret.js.map

package/dist/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-update-secret.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAoBhG;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,OAAO,CAA+B;IACtC,aAAa,CAAiC;IAC9C,UAAU,CAA8B;IACxC,KAAK,CAAW;IAEjC,YAAY,UAAmD;QAC7D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,OAA+B,EAC/B,OAA8C;QAE9C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,6BAA6B,EAC7B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,CAAC,8BAA8B,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3D,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAElC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,aAAa,CACnB,MAA+B,EAC/B,KAAkC;QAElC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACzC,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACnC,CAAC;QAED,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5C,CAAC;IAEO,gBAAgB,CACtB,MAA+B,EAC/B,KAA+C,EAC/C,KAAkC;QAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager-update-secret.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/secret/sim-secrets-manager-update-secret.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAGhG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAkB3F;;;;;;GAMG;AACH,MAAM,OAAO,6BAA6B;IACvB,OAAO,CAA+B;IACtC,aAAa,CAAiC;IAC9C,UAAU,CAA8B;IACxC,QAAQ,CAAkC;IAE3D,YAAY,UAAmD;QAC7D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,+BAA+B,CAAC;YAClD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,OAA+B,EAC/B,OAA8C;QAE9C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,6BAA6B,EAC7B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,CAAC,8BAA8B,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3D,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC3C,MAAM,EACN,KAAK,EACL,KAAK,EACL,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEnC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,MAA+B,EAC/B,KAA+C,EAC/C,KAAkC,EAClC,MAAgC;QAEhC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAC7C,MAAM;YACN,KAAK;YACL,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YACxC,MAAM;SACP,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;CACF"}

package/dist/service/secretsmanager/command/value/sim-secrets-manager-value-commands.d.ts

@@ -1,11 +1,13 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimSecretsManagerSecretStore } from "../../secret/sim-secrets-manager-secret-store.js";
+import type { SimSecretsManagerValueEncryption } from "../../secret/sim-secrets-manager-value-encryption.js";
 import type { SimSecretsManagerVersionWriter } from "../../secret/sim-secrets-manager-version-writer.js";
 import type { SimSecretsManagerAuthorizer } from "../authorize/sim-secrets-manager-authorizer.js";
 import type { SimGetSecretValueCommand, SimGetSecretValueCommandOutput, SimPutSecretValueCommand, SimPutSecretValueCommandOutput } from "./value.command.js";
 interface SimSecretsManagerValueCommandsProperties {
     readonly secrets: SimSecretsManagerSecretStore;
     readonly versionWriter: SimSecretsManagerVersionWriter;
+    readonly encryption: SimSecretsManagerValueEncryption;
     readonly authorizer: SimSecretsManagerAuthorizer;
 }
 interface SimSecretsManagerValueCommandOptions {
@@ -20,20 +22,26 @@ interface SimSecretsManagerValueCommandOptions {
 export declare class SimSecretsManagerValueCommands {
     private readonly secrets;
     private readonly versionWriter;
+    private readonly encryption;
     private readonly authorizer;
     private readonly versionSelector;
     constructor(properties: SimSecretsManagerValueCommandsProperties);
     /**
      * Read a secret's value, defaulting to the version labelled AWSCURRENT.
+     *
+     * Decryption goes to KMS as the caller, so a secret under a customer managed
+     * key needs `kms:Decrypt` on top of `secretsmanager:GetSecretValue`. There is
+     * no flag for reading a secret without decrypting it: GetSecretValue either
+     * returns the plaintext or fails.
      */
-    get(command: SimGetSecretValueCommand, options?: SimSecretsManagerValueCommandOptions): SimGetSecretValueCommandOutput;
+    get(command: SimGetSecretValueCommand, options?: SimSecretsManagerValueCommandOptions): Promise<SimGetSecretValueCommandOutput>;
     /**
      * Write a new version of a secret's value.
      *
      * The new version becomes AWSCURRENT unless VersionStages says otherwise,
      * and the version that was current becomes AWSPREVIOUS.
      */
-    put(command: SimPutSecretValueCommand, options?: SimSecretsManagerValueCommandOptions): SimPutSecretValueCommandOutput;
+    put(command: SimPutSecretValueCommand, options?: SimSecretsManagerValueCommandOptions): Promise<SimPutSecretValueCommandOutput>;
 }
 export {};
 //# sourceMappingURL=sim-secrets-manager-value-commands.d.ts.map

package/dist/service/secretsmanager/command/value/sim-secrets-manager-value-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-value-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/value/sim-secrets-manager-value-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAGrG,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACzG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,oBAAoB,CAAC;AAE5B,UAAU,wCAAwC;IAChD,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;IAC/C,QAAQ,CAAC,aAAa,EAAE,8BAA8B,CAAC;IACvD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;CAClD;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,YAAY,UAAU,EAAE,wCAAwC,EAI/D;IAED;;OAEG;IACH,GAAG,CACD,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,8BAA8B,CAuBhC;IAED;;;;;OAKG;IACH,GAAG,CACD,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,8BAA8B,CAqBhC;CACF"}
+{"version":3,"file":"sim-secrets-manager-value-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/value/sim-secrets-manager-value-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAGrG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AAC7G,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oDAAoD,CAAC;AACzG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,oBAAoB,CAAC;AAE5B,UAAU,wCAAwC;IAChD,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;IAC/C,QAAQ,CAAC,aAAa,EAAE,8BAA8B,CAAC;IACvD,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;CAClD;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,YAAY,UAAU,EAAE,wCAAwC,EAK/D;IAED;;;;;;;OAOG;IACG,GAAG,CACP,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,8BAA8B,CAAC,CA4BzC;IAED;;;;;OAKG;IACG,GAAG,CACP,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,8BAA8B,CAAC,CA2BzC;CACF"}

package/dist/service/secretsmanager/command/value/sim-secrets-manager-value-commands.js

@@ -9,29 +9,37 @@ import { SimSecretsManagerVersionSelector } from "../../secret/sim-secrets-manag
 export class SimSecretsManagerValueCommands {
     secrets;
     versionWriter;
+    encryption;
     authorizer;
     versionSelector = new SimSecretsManagerVersionSelector();
     constructor(properties) {
         this.secrets = properties.secrets;
         this.versionWriter = properties.versionWriter;
+        this.encryption = properties.encryption;
         this.authorizer = properties.authorizer;
     }
     /**
      * Read a secret's value, defaulting to the version labelled AWSCURRENT.
+     *
+     * Decryption goes to KMS as the caller, so a secret under a customer managed
+     * key needs `kms:Decrypt` on top of `secretsmanager:GetSecretValue`. There is
+     * no flag for reading a secret without decrypting it: GetSecretValue either
+     * returns the plaintext or fails.
      */
-    get(command, options) {
+    async get(command, options) {
         const { input } = command;
         const secret = this.secrets.require(input.SecretId);
         this.authorizer.authorizeSecret("secretsmanager:GetSecretValue", secret, options?.caller);
         secret.requireNotScheduledForDeletion();
         const version = this.versionSelector.select(secret, input);
+        const value = await this.encryption.decrypt({ secretArn: secret.arn.value, versionId: version.versionId }, version.value, options?.caller);
         return {
             $metadata: {},
             ARN: secret.arn.value,
             Name: secret.name,
             VersionId: version.versionId,
-            SecretString: version.value.secretString,
-            SecretBinary: version.value.secretBinary,
+            SecretString: value.secretString,
+            SecretBinary: value.secretBinary,
             VersionStages: version.stages,
             CreatedDate: version.createdDate,
         };
@@ -42,13 +50,19 @@ export class SimSecretsManagerValueCommands {
      * The new version becomes AWSCURRENT unless VersionStages says otherwise,
      * and the version that was current becomes AWSPREVIOUS.
      */
-    put(command, options) {
+    async put(command, options) {
         const { input } = command;
         const secret = this.secrets.require(input.SecretId);
         this.authorizer.authorizeSecret("secretsmanager:PutSecretValue", secret, options?.caller);
         secret.requireNotScheduledForDeletion();
         const value = SimSecretsManagerSecretValue.required(input);
-        const version = this.versionWriter.write(secret, value, input);
+        const version = await this.versionWriter.write({
+            secret,
+            value,
+            input,
+            keyId: secret.kmsKeyId,
+            caller: options?.caller,
+        });
         return {
             $metadata: {},
             ARN: secret.arn.value,

package/dist/service/secretsmanager/command/value/sim-secrets-manager-value-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager-value-commands.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/value/sim-secrets-manager-value-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AAoBxG;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACxB,OAAO,CAA+B;IACtC,aAAa,CAAiC;IAC9C,UAAU,CAA8B;IACxC,eAAe,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAE1E,YAAY,UAAoD;QAC9D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAAiC,EACjC,OAA8C;QAE9C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,+BAA+B,EAC/B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,CAAC,8BAA8B,EAAE,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE3D,OAAO;YACL,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;YACxC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;YACxC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,GAAG,CACD,OAAiC,EACjC,OAA8C;QAE9C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,+BAA+B,EAC/B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,CAAC,8BAA8B,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAE/D,OAAO;YACL,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,OAAO,CAAC,MAAM;SAC9B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager-value-commands.js","sourceRoot":"","sources":["../../../../../src/service/secretsmanager/command/value/sim-secrets-manager-value-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AAsBxG;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACxB,OAAO,CAA+B;IACtC,aAAa,CAAiC;IAC9C,UAAU,CAAmC;IAC7C,UAAU,CAA8B;IACxC,eAAe,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAE1E,YAAY,UAAoD;QAC9D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CACP,OAAiC,EACjC,OAA8C;QAE9C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,+BAA+B,EAC/B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,CAAC,8BAA8B,EAAE,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CACzC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAC7D,OAAO,CAAC,KAAK,EACb,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,OAAiC,EACjC,OAA8C;QAE9C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,+BAA+B,EAC/B,MAAM,EACN,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,CAAC,8BAA8B,EAAE,CAAC;QAExC,MAAM,KAAK,GAAG,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAC7C,MAAM;YACN,KAAK;YACL,KAAK;YACL,KAAK,EAAE,MAAM,CAAC,QAAQ;YACtB,MAAM,EAAE,OAAO,EAAE,MAAM;SACxB,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,OAAO,CAAC,MAAM;SAC9B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/secretsmanager/error/sim-secrets-manager.error.d.ts

@@ -41,6 +41,28 @@ export declare class SimSecretsManagerInvalidRequestException extends SimSecrets
     readonly name = "InvalidRequestException";
     constructor(message: string);
 }
+/**
+ * Simulated Secrets Manager EncryptionFailure error.
+ *
+ * Real Secrets Manager reports a KMS key it cannot encrypt a new version with
+ * this way, whether the key is missing, disabled or pending deletion. A
+ * caller not allowed to use the key is denied by KMS instead, and that denial
+ * passes through as itself.
+ */
+export declare class SimSecretsManagerEncryptionFailure extends SimSecretsManagerError {
+    readonly name = "EncryptionFailure";
+    constructor(message: string);
+}
+/**
+ * Simulated Secrets Manager DecryptionFailure error.
+ *
+ * The counterpart of EncryptionFailure, for a version whose key can no longer
+ * decrypt it.
+ */
+export declare class SimSecretsManagerDecryptionFailure extends SimSecretsManagerError {
+    readonly name = "DecryptionFailure";
+    constructor(message: string);
+}
 /**
  * Simulated Secrets Manager InvalidParameterException error.
  *

package/dist/service/secretsmanager/error/sim-secrets-manager.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager.error.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/error/sim-secrets-manager.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,SAAS,EAAE,8BAA8B;IAF3D,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,8BAAmC,EAG/D;CACF;AAED;;;;;GAKG;AACH,qBAAa,0CAA2C,SAAQ,sBAAsB;IACpF,SAAyB,IAAI,+BAA+B;IAE5D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,wCAAyC,SAAQ,sBAAsB;IAClF,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,wCAAyC,SAAQ,sBAAsB;IAClF,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,0CAA2C,SAAQ,sBAAsB;IACpF,SAAyB,IAAI,+BAA+B;IAE5D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}
+{"version":3,"file":"sim-secrets-manager.error.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/error/sim-secrets-manager.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,SAAS,EAAE,8BAA8B;IAF3D,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,8BAAmC,EAG/D;CACF;AAED;;;;;GAKG;AACH,qBAAa,0CAA2C,SAAQ,sBAAsB;IACpF,SAAyB,IAAI,+BAA+B;IAE5D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,wCAAyC,SAAQ,sBAAsB;IAClF,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,wCAAyC,SAAQ,sBAAsB;IAClF,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,kCAAmC,SAAQ,sBAAsB;IAC5E,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,sBAAsB;IAC5E,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,0CAA2C,SAAQ,sBAAsB;IACpF,SAAyB,IAAI,+BAA+B;IAE5D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/secretsmanager/error/sim-secrets-manager.error.js

@@ -44,6 +44,32 @@ export class SimSecretsManagerInvalidRequestException extends SimSecretsManagerE
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated Secrets Manager EncryptionFailure error.
+ *
+ * Real Secrets Manager reports a KMS key it cannot encrypt a new version with
+ * this way, whether the key is missing, disabled or pending deletion. A
+ * caller not allowed to use the key is denied by KMS instead, and that denial
+ * passes through as itself.
+ */
+export class SimSecretsManagerEncryptionFailure extends SimSecretsManagerError {
+    name = "EncryptionFailure";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated Secrets Manager DecryptionFailure error.
+ *
+ * The counterpart of EncryptionFailure, for a version whose key can no longer
+ * decrypt it.
+ */
+export class SimSecretsManagerDecryptionFailure extends SimSecretsManagerError {
+    name = "DecryptionFailure";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
 /**
  * Simulated Secrets Manager InvalidParameterException error.
  *

package/dist/service/secretsmanager/error/sim-secrets-manager.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-secrets-manager.error.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/error/sim-secrets-manager.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAmC,EAAE;QAE9D,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,0CAA2C,SAAQ,sBAAsB;IAC3D,IAAI,GAAG,2BAA2B,CAAC;IAE5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wCAAyC,SAAQ,sBAAsB;IACzD,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wCAAyC,SAAQ,sBAAsB;IACzD,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0CAA2C,SAAQ,sBAAsB;IAC3D,IAAI,GAAG,2BAA2B,CAAC;IAE5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-secrets-manager.error.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/error/sim-secrets-manager.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAmC,EAAE;QAE9D,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,0CAA2C,SAAQ,sBAAsB;IAC3D,IAAI,GAAG,2BAA2B,CAAC;IAE5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wCAAyC,SAAQ,sBAAsB;IACzD,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wCAAyC,SAAQ,sBAAsB;IACzD,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kCAAmC,SAAQ,sBAAsB;IACnD,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,kCAAmC,SAAQ,sBAAsB;IACnD,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0CAA2C,SAAQ,sBAAsB;IAC3D,IAAI,GAAG,2BAA2B,CAAC;IAE5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/secretsmanager/index.d.ts

@@ -1,7 +1,8 @@
 export { SimSecretsManager, type SimSecretsManagerRequestOptions, } from "./sim-secrets-manager.js";
 export { SimSecretsManagerSecret, type SimSecretsManagerTag, } from "./secret/sim-secrets-manager-secret.js";
 export { SimSecretsManagerSecretArn } from "./secret/sim-secrets-manager-secret-arn.js";
+export { SimSecretsManagerEncryptedValue } from "./secret/sim-secrets-manager-encrypted-value.js";
 export { SimSecretsManagerSecretValue } from "./secret/sim-secrets-manager-secret-value.js";
 export { SimSecretsManagerSecretVersion, SimSecretsManagerStagingLabel, } from "./secret/sim-secrets-manager-secret-version.js";
-export { SimSecretsManagerError, SimSecretsManagerInvalidParameterException, SimSecretsManagerInvalidRequestException, SimSecretsManagerResourceExistsException, SimSecretsManagerResourceNotFoundException, } from "./error/sim-secrets-manager.error.js";
+export { SimSecretsManagerDecryptionFailure, SimSecretsManagerEncryptionFailure, SimSecretsManagerError, SimSecretsManagerInvalidParameterException, SimSecretsManagerInvalidRequestException, SimSecretsManagerResourceExistsException, SimSecretsManagerResourceNotFoundException, } from "./error/sim-secrets-manager.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/secretsmanager/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/secretsmanager/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,+BAA+B,GACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,sBAAsB,EACtB,0CAA0C,EAC1C,wCAAwC,EACxC,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/secretsmanager/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,+BAA+B,GACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,sBAAsB,EACtB,0CAA0C,EAC1C,wCAAwC,EACxC,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,sCAAsC,CAAC"}

package/dist/service/secretsmanager/index.js

@@ -1,7 +1,8 @@
 export { SimSecretsManager, } from "./sim-secrets-manager.js";
 export { SimSecretsManagerSecret, } from "./secret/sim-secrets-manager-secret.js";
 export { SimSecretsManagerSecretArn } from "./secret/sim-secrets-manager-secret-arn.js";
+export { SimSecretsManagerEncryptedValue } from "./secret/sim-secrets-manager-encrypted-value.js";
 export { SimSecretsManagerSecretValue } from "./secret/sim-secrets-manager-secret-value.js";
 export { SimSecretsManagerSecretVersion, SimSecretsManagerStagingLabel, } from "./secret/sim-secrets-manager-secret-version.js";
-export { SimSecretsManagerError, SimSecretsManagerInvalidParameterException, SimSecretsManagerInvalidRequestException, SimSecretsManagerResourceExistsException, SimSecretsManagerResourceNotFoundException, } from "./error/sim-secrets-manager.error.js";
+export { SimSecretsManagerDecryptionFailure, SimSecretsManagerEncryptionFailure, SimSecretsManagerError, SimSecretsManagerInvalidParameterException, SimSecretsManagerInvalidRequestException, SimSecretsManagerResourceExistsException, SimSecretsManagerResourceNotFoundException, } from "./error/sim-secrets-manager.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/secretsmanager/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/secretsmanager/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,GAExB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,sBAAsB,EACtB,0CAA0C,EAC1C,wCAAwC,EACxC,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/secretsmanager/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,GAExB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,sBAAsB,EACtB,0CAA0C,EAC1C,wCAAwC,EACxC,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,sCAAsC,CAAC"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.d.ts

@@ -0,0 +1,35 @@
+import type { SimSecretsManagerSecretValue } from "./sim-secrets-manager-secret-value.js";
+interface SimSecretsManagerEncryptedValueProperties {
+    readonly dataKeyCiphertext: Uint8Array;
+    readonly iv: Uint8Array;
+    readonly authTag: Uint8Array;
+    readonly ciphertext: Uint8Array;
+    readonly digest: string;
+}
+/**
+ * The stored form of one secret version's value.
+ *
+ * This is what a version holds: the value's ciphertext, and beside it the
+ * encrypted copy of the data key that produced it. Nothing here can be read
+ * without a KMS call, which is the point. The encrypted data key names the KMS
+ * key it came from, so a version stays readable after the secret is pointed at
+ * a different key, as it does on real AWS.
+ */
+export declare class SimSecretsManagerEncryptedValue {
+    readonly dataKeyCiphertext: Uint8Array;
+    readonly iv: Uint8Array;
+    readonly authTag: Uint8Array;
+    readonly ciphertext: Uint8Array;
+    private readonly digest;
+    constructor(properties: SimSecretsManagerEncryptedValueProperties);
+    /**
+     * Whether this is the encrypted form of the given value.
+     *
+     * A write repeating a client request token is a no-op when it carries the
+     * same value and a failure when it does not, so the two have to be compared
+     * without the stored one being readable.
+     */
+    holds(value: SimSecretsManagerSecretValue): boolean;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-encrypted-value.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-encrypted-value.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAE1F,UAAU,yCAAyC;IACjD,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAC;IACvC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,+BAA+B;IAC1C,SAAgB,iBAAiB,EAAE,UAAU,CAAC;IAC9C,SAAgB,EAAE,EAAE,UAAU,CAAC;IAC/B,SAAgB,OAAO,EAAE,UAAU,CAAC;IACpC,SAAgB,UAAU,EAAE,UAAU,CAAC;IAEvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,UAAU,EAAE,yCAAyC,EAMhE;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAElD;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.js

@@ -0,0 +1,34 @@
+/**
+ * The stored form of one secret version's value.
+ *
+ * This is what a version holds: the value's ciphertext, and beside it the
+ * encrypted copy of the data key that produced it. Nothing here can be read
+ * without a KMS call, which is the point. The encrypted data key names the KMS
+ * key it came from, so a version stays readable after the secret is pointed at
+ * a different key, as it does on real AWS.
+ */
+export class SimSecretsManagerEncryptedValue {
+    dataKeyCiphertext;
+    iv;
+    authTag;
+    ciphertext;
+    digest;
+    constructor(properties) {
+        this.dataKeyCiphertext = properties.dataKeyCiphertext;
+        this.iv = properties.iv;
+        this.authTag = properties.authTag;
+        this.ciphertext = properties.ciphertext;
+        this.digest = properties.digest;
+    }
+    /**
+     * Whether this is the encrypted form of the given value.
+     *
+     * A write repeating a client request token is a no-op when it carries the
+     * same value and a failure when it does not, so the two have to be compared
+     * without the stored one being readable.
+     */
+    holds(value) {
+        return this.digest === value.digest;
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-encrypted-value.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-encrypted-value.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-encrypted-value.ts"],"names":[],"mappings":"AAUA;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IAC1B,iBAAiB,CAAa;IAC9B,EAAE,CAAa;IACf,OAAO,CAAa;IACpB,UAAU,CAAa;IAEtB,MAAM,CAAS;IAEhC,YAAY,UAAqD;QAC/D,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAmC;QACvC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;IACtC,CAAC;CACF"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.d.ts

@@ -0,0 +1,63 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The alias of the AWS managed key Secrets Manager encrypts with when a secret
+ * names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export declare const secretsManagerDefaultKeyAlias = "alias/aws/secretsmanager";
+/**
+ * The service Secrets Manager's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what keeps the common case as convenient here as it is on
+ * real AWS: the `aws/secretsmanager` key's policy admits the account's
+ * principals when the request reaches KMS through Secrets Manager, so a caller
+ * allowed only `secretsmanager:GetSecretValue` reads the secret.
+ */
+export declare const secretsManagerKmsViaService = "secretsmanager";
+/**
+ * The data key length Secrets Manager asks KMS for.
+ */
+export declare const secretsManagerDataKeySpec = "AES_256";
+interface SimSecretsManagerKmsOptions {
+    readonly caller?: SimAwsCaller | undefined;
+    readonly viaService?: string | undefined;
+}
+/**
+ * The narrow slice of simulated KMS that secret values need.
+ *
+ * Real Secrets Manager uses envelope encryption: it asks KMS for a data key
+ * per version, encrypts the value with the plaintext copy and keeps the
+ * encrypted copy beside the ciphertext. That is why a write needs
+ * `kms:GenerateDataKey` and a read needs `kms:Decrypt`, rather than both
+ * needing `kms:Encrypt` and `kms:Decrypt` as a direct encryption would.
+ *
+ * SimKms structurally implements this interface.
+ */
+export interface SimSecretsManagerKmsCrypto {
+    generateDataKey(command: {
+        input: {
+            KeyId?: string | undefined;
+            KeySpec?: string | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: SimSecretsManagerKmsOptions): Promise<{
+        Plaintext?: Uint8Array | undefined;
+        CiphertextBlob?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+    decrypt(command: {
+        input: {
+            CiphertextBlob?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: SimSecretsManagerKmsOptions): Promise<{
+        Plaintext?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-kms-crypto.d.ts.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-kms-crypto.d.ts","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,mBAAmB,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD,UAAU,2BAA2B;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,eAAe,CACb,OAAO,EAAE;QACP,KAAK,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC7B,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACnC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;IAEH,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACxC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;CACJ"}

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.js

@@ -0,0 +1,24 @@
+/**
+ * The alias of the AWS managed key Secrets Manager encrypts with when a secret
+ * names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export const secretsManagerDefaultKeyAlias = "alias/aws/secretsmanager";
+/**
+ * The service Secrets Manager's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what keeps the common case as convenient here as it is on
+ * real AWS: the `aws/secretsmanager` key's policy admits the account's
+ * principals when the request reaches KMS through Secrets Manager, so a caller
+ * allowed only `secretsmanager:GetSecretValue` reads the secret.
+ */
+export const secretsManagerKmsViaService = "secretsmanager";
+/**
+ * The data key length Secrets Manager asks KMS for.
+ */
+export const secretsManagerDataKeySpec = "AES_256";
+//# sourceMappingURL=sim-secrets-manager-kms-crypto.js.map

package/dist/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-kms-crypto.js","sourceRoot":"","sources":["../../../../src/service/secretsmanager/secret/sim-secrets-manager-kms-crypto.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,gBAAgB,CAAC;AAE5D;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC"}