@kensio/yulin 0.41.0 → 0.43.0

package/dist/service/ssm/error/sim-ssm.error.js

@@ -86,6 +86,19 @@ export class SimSsmUnsupportedParameterType extends SimSsmError {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated SSM InvalidKeyId error.
+ *
+ * Real Parameter Store reports every KMS key problem this way: a key that does
+ * not exist, one that is disabled, and one that is pending deletion all reach
+ * the caller as InvalidKeyId with the KMS message behind it.
+ */
+export class SimSsmInvalidKeyId extends SimSsmError {
+    name = "InvalidKeyId";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
 /**
  * Simulated SSM ValidationException error.
  *

package/dist/service/ssm/error/sim-ssm.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm.error.js","sourceRoot":"","sources":["../../../../src/service/ssm/error/sim-ssm.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uCAAwC,SAAQ,WAAW;IAC7C,IAAI,GAAG,mCAAmC,CAAC;IAEpE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0CAA2C,SAAQ,WAAW;IAChD,IAAI,GAAG,sCAAsC,CAAC;IAEvE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oCAAqC,SAAQ,WAAW;IAC1C,IAAI,GAAG,gCAAgC,CAAC;IAEjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-ssm.error.js","sourceRoot":"","sources":["../../../../src/service/ssm/error/sim-ssm.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uCAAwC,SAAQ,WAAW;IAC7C,IAAI,GAAG,mCAAmC,CAAC;IAEpE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0CAA2C,SAAQ,WAAW;IAChD,IAAI,GAAG,sCAAsC,CAAC;IAEvE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oCAAqC,SAAQ,WAAW;IAC1C,IAAI,GAAG,gCAAgC,CAAC;IAEjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACxB,IAAI,GAAG,cAAc,CAAC;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/ssm/index.d.ts

@@ -1,10 +1,12 @@
 export { SimSsm, type SimSsmRequestOptions } from "./sim-ssm.js";
 export { SimSsmParameter } from "./parameter/sim-ssm-parameter.js";
 export { SimSsmParameterArn } from "./parameter/sim-ssm-parameter-arn.js";
+export { SimSsmParameterEncryption } from "./parameter/sim-ssm-parameter-encryption.js";
+export { ssmDefaultKeyAlias, type SimSsmKmsCrypto, } from "./parameter/sim-ssm-kms-crypto.js";
 export { SimSsmParameterName } from "./parameter/sim-ssm-parameter-name.js";
 export { SimSsmParameterPath } from "./parameter/sim-ssm-parameter-path.js";
 export { SimSsmParameterType, type SimSsmParameterTypeName, } from "./parameter/sim-ssm-parameter-type.js";
 export { SimSsmParameterValue } from "./parameter/sim-ssm-parameter-value.js";
 export { SimSsmParameterVersion, ssmTextDataType, } from "./parameter/sim-ssm-parameter-version.js";
-export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
+export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmInvalidKeyId, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/ssm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/ssm/index.js

@@ -1,10 +1,12 @@
 export { SimSsm } from "./sim-ssm.js";
 export { SimSsmParameter } from "./parameter/sim-ssm-parameter.js";
 export { SimSsmParameterArn } from "./parameter/sim-ssm-parameter-arn.js";
+export { SimSsmParameterEncryption } from "./parameter/sim-ssm-parameter-encryption.js";
+export { ssmDefaultKeyAlias, } from "./parameter/sim-ssm-kms-crypto.js";
 export { SimSsmParameterName } from "./parameter/sim-ssm-parameter-name.js";
 export { SimSsmParameterPath } from "./parameter/sim-ssm-parameter-path.js";
 export { SimSsmParameterType, } from "./parameter/sim-ssm-parameter-type.js";
 export { SimSsmParameterValue } from "./parameter/sim-ssm-parameter-value.js";
 export { SimSsmParameterVersion, ssmTextDataType, } from "./parameter/sim-ssm-parameter-version.js";
-export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
+export { SimSsmError, SimSsmHierarchyLevelLimitExceededException, SimSsmHierarchyTypeMismatchException, SimSsmInvalidKeyId, SimSsmParameterAlreadyExists, SimSsmParameterNotFound, SimSsmParameterPatternMismatchException, SimSsmParameterVersionNotFound, SimSsmUnsupportedParameterType, SimSsmValidationException, } from "./error/sim-ssm.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/ssm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA6B,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,GAEpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/ssm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA6B,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,kBAAkB,GAEnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,mBAAmB,GAEpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,WAAW,EACX,0CAA0C,EAC1C,oCAAoC,EACpC,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,uCAAuC,EACvC,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts

@@ -0,0 +1,55 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+/**
+ * The alias of the AWS managed key Parameter Store encrypts with when a
+ * request names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export declare const ssmDefaultKeyAlias = "alias/aws/ssm";
+/**
+ * The service Parameter Store's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what lets a caller read a `SecureString` under the
+ * `aws/ssm` managed key with no KMS permission of its own: that key's policy
+ * admits the Account's principals only when the request reached KMS through
+ * Systems Manager.
+ */
+export declare const ssmKmsViaService = "ssm";
+/**
+ * The narrow slice of simulated KMS that SecureString parameters need.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so Encrypt and Decrypt are the whole of it.
+ * SimKms structurally implements this interface.
+ */
+export interface SimSsmKmsCrypto {
+    encrypt(command: {
+        input: {
+            KeyId?: string | undefined;
+            Plaintext?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: {
+        caller?: SimAwsCaller | undefined;
+        viaService?: string | undefined;
+    }): Promise<{
+        CiphertextBlob?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+    decrypt(command: {
+        input: {
+            CiphertextBlob?: Uint8Array | undefined;
+            EncryptionContext?: Readonly<Record<string, string>> | undefined;
+        };
+    }, options?: {
+        caller?: SimAwsCaller | undefined;
+        viaService?: string | undefined;
+    }): Promise<{
+        Plaintext?: Uint8Array | undefined;
+        KeyId?: string | undefined;
+    }>;
+}
+//# sourceMappingURL=sim-ssm-kms-crypto.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-crypto.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3B,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACnC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,GACA,OAAO,CAAC;QACT,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACxC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;IAEH,OAAO,CACL,OAAO,EAAE;QACP,KAAK,EAAE;YACL,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;YACxC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;SAClE,CAAC;KACH,EACD,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,GACA,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,CAAC,CAAC;CACJ"}

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js

@@ -0,0 +1,20 @@
+/**
+ * The alias of the AWS managed key Parameter Store encrypts with when a
+ * request names no key of its own.
+ *
+ * Simulated KMS creates the key behind a reserved `alias/aws/` name the first
+ * time something asks for it, which is how such a key comes into existence on
+ * real AWS too: nobody creates it, the service that needs it does.
+ */
+export const ssmDefaultKeyAlias = "alias/aws/ssm";
+/**
+ * The service Parameter Store's KMS calls are made through, as
+ * `kms:ViaService` names it.
+ *
+ * Supplying it is what lets a caller read a `SecureString` under the
+ * `aws/ssm` managed key with no KMS permission of its own: that key's policy
+ * admits the Account's principals only when the request reached KMS through
+ * Systems Manager.
+ */
+export const ssmKmsViaService = "ssm";
+//# sourceMappingURL=sim-ssm-kms-crypto.js.map

package/dist/service/ssm/parameter/sim-ssm-kms-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-crypto.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-crypto.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Run a KMS call, reporting a refusal about the key the way Parameter Store
+ * reports it.
+ *
+ * Every key problem KMS raises becomes InvalidKeyId carrying the KMS message,
+ * which is what real Parameter Store does for a key that is missing, disabled
+ * or pending deletion. An access denial is not a KMS error and passes through
+ * untouched, so a missing `kms:Decrypt` still reads as a denial rather than a
+ * bad key.
+ */
+export declare function reportingKeyProblems<TResult>(call: () => Promise<TResult>): Promise<TResult>;
+//# sourceMappingURL=sim-ssm-kms-key-problems.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-key-problems.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-key-problems.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAChD,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.js

@@ -0,0 +1,24 @@
+import { SimKmsError } from "../../kms/error/sim-kms.error.js";
+import { SimSsmInvalidKeyId } from "../error/sim-ssm.error.js";
+/**
+ * Run a KMS call, reporting a refusal about the key the way Parameter Store
+ * reports it.
+ *
+ * Every key problem KMS raises becomes InvalidKeyId carrying the KMS message,
+ * which is what real Parameter Store does for a key that is missing, disabled
+ * or pending deletion. An access denial is not a KMS error and passes through
+ * untouched, so a missing `kms:Decrypt` still reads as a denial rather than a
+ * bad key.
+ */
+export async function reportingKeyProblems(call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        if (error instanceof SimKmsError) {
+            throw new SimSsmInvalidKeyId(`The KMS key cannot be used for this parameter: ${error.message}`);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=sim-ssm-kms-key-problems.js.map

package/dist/service/ssm/parameter/sim-ssm-kms-key-problems.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-kms-key-problems.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-kms-key-problems.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA4B;IAE5B,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAC1B,kDAAkD,KAAK,CAAC,OAAO,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.d.ts

@@ -0,0 +1,42 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimSsmParameter } from "./sim-ssm-parameter.js";
+import type { SimSsmKmsCrypto } from "./sim-ssm-kms-crypto.js";
+import type { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+import { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
+import type { SimSsmParameterVersion } from "./sim-ssm-parameter-version.js";
+interface SimSsmParameterEncryptionProperties {
+    readonly kms: SimSsmKmsCrypto;
+}
+/**
+ * What a SecureString value is stored as, and which key protects it.
+ */
+export interface SimSsmEncryptedValue {
+    readonly value: SimSsmParameterValue;
+    readonly keyId: string | undefined;
+}
+/**
+ * Decides when a parameter value is encrypted and when it is decrypted.
+ *
+ * These rules are worth keeping apart from the KMS calls themselves, because
+ * they are what a caller actually trips over: a value stored in the clear
+ * because the type said so, and a read that gets a ciphertext back because it
+ * did not ask for decryption.
+ */
+export declare class SimSsmParameterEncryption {
+    private readonly kms;
+    constructor(properties: SimSsmParameterEncryptionProperties);
+    /**
+     * The stored form of a submitted value, encrypted if the type calls for it.
+     */
+    stored(type: SimSsmParameterType, parameterArn: string, submitted: SimSsmParameterValue, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmEncryptedValue>;
+    /**
+     * The value a read reports, decrypted only when it was asked for.
+     *
+     * `WithDecryption` on a parameter that is not encrypted is ignored rather
+     * than refused, as real Parameter Store ignores it.
+     */
+    reported(parameter: SimSsmParameter, version: SimSsmParameterVersion, withDecryption: boolean | undefined, caller: SimAwsCaller | undefined): Promise<string>;
+    private refuseKeyIdWithoutSecureString;
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-encryption.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-encryption.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,mBAAmB,EACzB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,oBAAoB,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;IAED;;;;;OAKG;IACG,QAAQ,CACZ,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,sBAAsB,EAC/B,cAAc,EAAE,OAAO,GAAG,SAAS,EACnC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,MAAM,CAAC,CAUjB;IAED,OAAO,CAAC,8BAA8B;CAcvC"}

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.js

@@ -0,0 +1,52 @@
+import { SimSsmValidationException } from "../error/sim-ssm.error.js";
+import { SimSsmParameterKms } from "./sim-ssm-parameter-kms.js";
+import { SimSsmParameterValue } from "./sim-ssm-parameter-value.js";
+/**
+ * Decides when a parameter value is encrypted and when it is decrypted.
+ *
+ * These rules are worth keeping apart from the KMS calls themselves, because
+ * they are what a caller actually trips over: a value stored in the clear
+ * because the type said so, and a read that gets a ciphertext back because it
+ * did not ask for decryption.
+ */
+export class SimSsmParameterEncryption {
+    kms;
+    constructor(properties) {
+        this.kms = new SimSsmParameterKms(properties);
+    }
+    /**
+     * The stored form of a submitted value, encrypted if the type calls for it.
+     */
+    async stored(type, parameterArn, submitted, keyId, caller) {
+        if (!type.isSecure) {
+            this.refuseKeyIdWithoutSecureString(type, keyId);
+            return { value: submitted, keyId: undefined };
+        }
+        const encrypted = await this.kms.encrypt(parameterArn, submitted.value, keyId, caller);
+        return {
+            value: SimSsmParameterValue.encrypted(encrypted.ciphertext),
+            keyId: encrypted.keyId,
+        };
+    }
+    /**
+     * The value a read reports, decrypted only when it was asked for.
+     *
+     * `WithDecryption` on a parameter that is not encrypted is ignored rather
+     * than refused, as real Parameter Store ignores it.
+     */
+    async reported(parameter, version, withDecryption, caller) {
+        if (!parameter.type.isSecure || withDecryption !== true) {
+            return version.value.value;
+        }
+        return await this.kms.decrypt(parameter.arn.value, version.value.value, caller);
+    }
+    refuseKeyIdWithoutSecureString(type, keyId) {
+        if (keyId === undefined) {
+            return;
+        }
+        throw new SimSsmValidationException(`KeyId applies to a SecureString parameter, and this one is a ` +
+            `${type.value} parameter. A value stored in the clear is not ` +
+            `encrypted with anything.`);
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-encryption.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-encryption.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-encryption.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAepE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,GAAG,CAAqB;IAEzC,YAAY,UAA+C;QACzD,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAyB,EACzB,YAAoB,EACpB,SAA+B,EAC/B,KAAyB,EACzB,MAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,8BAA8B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAEjD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACtC,YAAY,EACZ,SAAS,CAAC,KAAK,EACf,KAAK,EACL,MAAM,CACP,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3D,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,SAA0B,EAC1B,OAA+B,EAC/B,cAAmC,EACnC,MAAgC;QAEhC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAC3B,SAAS,CAAC,GAAG,CAAC,KAAK,EACnB,OAAO,CAAC,KAAK,CAAC,KAAK,EACnB,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,8BAA8B,CACpC,IAAyB,EACzB,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,+DAA+D;YAC7D,GAAG,IAAI,CAAC,KAAK,iDAAiD;YAC9D,0BAA0B,CAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts

@@ -0,0 +1,43 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import { type SimSsmKmsCrypto } from "./sim-ssm-kms-crypto.js";
+/**
+ * What KMS produced for one parameter value.
+ */
+export interface SimSsmParameterCiphertext {
+    readonly ciphertext: string;
+    readonly keyId: string | undefined;
+}
+interface SimSsmParameterKmsProperties {
+    readonly kms: SimSsmKmsCrypto;
+}
+/**
+ * The KMS calls a SecureString parameter makes.
+ *
+ * The calls are made as the caller rather than as the service, which is the
+ * point: under a customer managed key a standard tier write needs
+ * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
+ * top of the SSM permission for the parameter itself.
+ *
+ * They are also made through the service, which is why the `aws/ssm` managed
+ * key needs no KMS permission at all: its policy admits the Account's
+ * principals when `kms:ViaService` names Systems Manager, and Parameter Store
+ * is what supplies that.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so this is one Encrypt and one Decrypt and nothing more.
+ */
+export declare class SimSsmParameterKms {
+    private readonly kms;
+    constructor(properties: SimSsmParameterKmsProperties);
+    /**
+     * Encrypt a parameter value, bound to the ARN of the parameter holding it.
+     */
+    encrypt(parameterArn: string, plaintext: string, keyId: string | undefined, caller: SimAwsCaller | undefined): Promise<SimSsmParameterCiphertext>;
+    /**
+     * Decrypt a parameter value, which needs the same binding it was made with.
+     */
+    decrypt(parameterArn: string, ciphertext: string, caller: SimAwsCaller | undefined): Promise<string>;
+    private contextFor;
+}
+export {};
+//# sourceMappingURL=sim-ssm-parameter-kms.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-kms.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-kms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAYjC;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IAEtC,YAAY,UAAU,EAAE,4BAA4B,EAEnD;IAED;;OAEG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,yBAAyB,CAAC,CAwBpC;IAED;;OAEG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,OAAO,CAAC,MAAM,CAAC,CAoBjB;IAED,OAAO,CAAC,UAAU;CAGnB"}

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js

@@ -0,0 +1,68 @@
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { reportingKeyProblems } from "./sim-ssm-kms-key-problems.js";
+import { ssmDefaultKeyAlias, ssmKmsViaService, } from "./sim-ssm-kms-crypto.js";
+/**
+ * The encryption context key Parameter Store binds every SecureString value
+ * to, holding the ARN of the parameter being encrypted.
+ *
+ * Binding it means a ciphertext lifted out of one parameter cannot be
+ * decrypted as another, and it is what a `kms:EncryptionContext:PARAMETER_ARN`
+ * policy condition matches on real AWS.
+ */
+const parameterArnContextKey = "PARAMETER_ARN";
+/**
+ * The KMS calls a SecureString parameter makes.
+ *
+ * The calls are made as the caller rather than as the service, which is the
+ * point: under a customer managed key a standard tier write needs
+ * `kms:Encrypt` on the key and a decrypting read needs `kms:Decrypt`, each on
+ * top of the SSM permission for the parameter itself.
+ *
+ * They are also made through the service, which is why the `aws/ssm` managed
+ * key needs no KMS permission at all: its policy admits the Account's
+ * principals when `kms:ViaService` names Systems Manager, and Parameter Store
+ * is what supplies that.
+ *
+ * Standard tier Parameter Store encrypts under the key directly rather than
+ * through a data key, so this is one Encrypt and one Decrypt and nothing more.
+ */
+export class SimSsmParameterKms {
+    kms;
+    constructor(properties) {
+        this.kms = properties.kms;
+    }
+    /**
+     * Encrypt a parameter value, bound to the ARN of the parameter holding it.
+     */
+    async encrypt(parameterArn, plaintext, keyId, caller) {
+        const encrypted = await reportingKeyProblems(async () => await this.kms.encrypt({
+            input: {
+                KeyId: keyId ?? ssmDefaultKeyAlias,
+                Plaintext: Buffer.from(plaintext, "utf8"),
+                EncryptionContext: this.contextFor(parameterArn),
+            },
+        }, { caller, viaService: ssmKmsViaService }));
+        assertDefined(encrypted.CiphertextBlob, `Simulated KMS encrypted ${parameterArn} to nothing`);
+        return {
+            ciphertext: Buffer.from(encrypted.CiphertextBlob).toString("base64"),
+            keyId: encrypted.KeyId,
+        };
+    }
+    /**
+     * Decrypt a parameter value, which needs the same binding it was made with.
+     */
+    async decrypt(parameterArn, ciphertext, caller) {
+        const decrypted = await reportingKeyProblems(async () => await this.kms.decrypt({
+            input: {
+                CiphertextBlob: Buffer.from(ciphertext, "base64"),
+                EncryptionContext: this.contextFor(parameterArn),
+            },
+        }, { caller, viaService: ssmKmsViaService }));
+        assertDefined(decrypted.Plaintext, `Simulated KMS decrypted ${parameterArn} to nothing`);
+        return Buffer.from(decrypted.Plaintext).toString("utf8");
+    }
+    contextFor(parameterArn) {
+        return { [parameterArnContextKey]: parameterArn };
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-kms.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-kms.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-kms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAc/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAkB;IAEtC,YAAY,UAAwC;QAClD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,SAAiB,EACjB,KAAyB,EACzB,MAAgC;QAEhC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB;YACE,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK,IAAI,kBAAkB;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;gBACzC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;aACjD;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACzC,CACJ,CAAC;QAEF,aAAa,CACX,SAAS,CAAC,cAAc,EACxB,2BAA2B,YAAY,aAAa,CACrD,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACpE,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,UAAkB,EAClB,MAAgC;QAEhC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CACpB;YACE,KAAK,EAAE;gBACL,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACjD,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;aACjD;SACF,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACzC,CACJ,CAAC;QAEF,aAAa,CACX,SAAS,CAAC,SAAS,EACnB,2BAA2B,YAAY,aAAa,CACrD,CAAC;QAEF,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAEO,UAAU,CAAC,YAAoB;QACrC,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.d.ts

@@ -0,0 +1,34 @@
+import type { SimSsmParameter } from "./sim-ssm-parameter.js";
+import { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+/**
+ * What a write says about the type it wants and whether it may replace what
+ * is already there.
+ */
+export interface SimSsmParameterOverwriteRequest {
+    readonly type: string | undefined;
+    readonly overwrite: boolean | undefined;
+}
+/**
+ * The rules that only exist where a create and an overwrite meet.
+ *
+ * A name already in use and a type that cannot change are both about the
+ * relationship between a request and a stored parameter, rather than about
+ * either on its own, so they live together and away from the write itself.
+ */
+export declare class SimSsmParameterOverwrite {
+    /**
+     * The type the written version will belong to, refusing a request that may
+     * not replace the parameter it names.
+     */
+    typeFor(request: SimSsmParameterOverwriteRequest, existing: SimSsmParameter | undefined): SimSsmParameterType;
+    /**
+     * Refuse an overwrite that real Parameter Store refuses.
+     *
+     * A request that leaves out Overwrite is a create, so a name already in use
+     * fails rather than quietly replacing what is there. A request naming a
+     * different type fails too: Parameter Store has no way to convert a stored
+     * parameter, so the caller has to delete it and make a new one.
+     */
+    private requireAllowed;
+}
+//# sourceMappingURL=sim-ssm-parameter-overwrite.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-overwrite.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-overwrite.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC;;;OAGG;IACH,OAAO,CACL,OAAO,EAAE,+BAA+B,EACxC,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,mBAAmB,CAQrB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;CA4BvB"}

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.js

@@ -0,0 +1,48 @@
+import { SimSsmHierarchyTypeMismatchException, SimSsmParameterAlreadyExists, } from "../error/sim-ssm.error.js";
+import { SimSsmParameterType } from "./sim-ssm-parameter-type.js";
+/**
+ * The rules that only exist where a create and an overwrite meet.
+ *
+ * A name already in use and a type that cannot change are both about the
+ * relationship between a request and a stored parameter, rather than about
+ * either on its own, so they live together and away from the write itself.
+ */
+export class SimSsmParameterOverwrite {
+    /**
+     * The type the written version will belong to, refusing a request that may
+     * not replace the parameter it names.
+     */
+    typeFor(request, existing) {
+        if (existing === undefined) {
+            return SimSsmParameterType.forNewParameter(request.type);
+        }
+        this.requireAllowed(request, existing);
+        return existing.type;
+    }
+    /**
+     * Refuse an overwrite that real Parameter Store refuses.
+     *
+     * A request that leaves out Overwrite is a create, so a name already in use
+     * fails rather than quietly replacing what is there. A request naming a
+     * different type fails too: Parameter Store has no way to convert a stored
+     * parameter, so the caller has to delete it and make a new one.
+     */
+    requireAllowed(request, existing) {
+        if (request.overwrite !== true) {
+            throw new SimSsmParameterAlreadyExists(`The parameter '${existing.name.value}' already exists. To overwrite ` +
+                `this value, set the Overwrite option in the request to true.`);
+        }
+        if (request.type === undefined) {
+            return;
+        }
+        const requested = new SimSsmParameterType(request.type);
+        if (requested.value === existing.type.value) {
+            return;
+        }
+        throw new SimSsmHierarchyTypeMismatchException(`Parameter '${existing.name.value}' is a ${existing.type.value} ` +
+            `parameter and cannot be changed to ${requested.value}. Parameter ` +
+            `Store does not support changing a parameter type: create a new, ` +
+            `unique parameter instead.`);
+    }
+}
+//# sourceMappingURL=sim-ssm-parameter-overwrite.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-overwrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-ssm-parameter-overwrite.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAWlE;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;OAGG;IACH,OAAO,CACL,OAAwC,EACxC,QAAqC;QAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,cAAc,CACpB,OAAwC,EACxC,QAAyB;QAEzB,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,KAAK,iCAAiC;gBACpE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,oCAAoC,CAC5C,cAAc,QAAQ,CAAC,IAAI,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG;YAC/D,sCAAsC,SAAS,CAAC,KAAK,cAAc;YACnE,kEAAkE;YAClE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-type.d.ts

@@ -1,14 +1,14 @@
 /**
  * The parameter types this simulation stores.
  */
-export type SimSsmParameterTypeName = "String" | "StringList";
+export type SimSsmParameterTypeName = "String" | "StringList" | "SecureString";
 /**
  * The type of one simulated parameter.
  *
- * `SecureString` is refused rather than stored. Nothing in this simulation
- * would encrypt it, so accepting it would let a test pass while proving
- * nothing about the KMS key, the `kms:Decrypt` permission or the
- * `WithDecryption` flag a real deployment depends on.
+ * A `SecureString` is encrypted through simulated KMS rather than stored in
+ * the clear, so the two failures a real deployment hits are reproducible here:
+ * a caller that may read the parameter but may not decrypt with its key, and
+ * a read that forgets `WithDecryption` and gets a ciphertext back.
  */
 export declare class SimSsmParameterType {
     readonly value: SimSsmParameterTypeName;
@@ -21,5 +21,9 @@ export declare class SimSsmParameterType {
      */
     static forNewParameter(type: string | undefined): SimSsmParameterType;
     private static validated;
+    /**
+     * Whether values of this type are stored encrypted.
+     */
+    get isSecure(): boolean;
 }
 //# sourceMappingURL=sim-ssm-parameter-type.d.ts.map

package/dist/service/ssm/parameter/sim-ssm-parameter-type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-type.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAI9D;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQpE;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;CAmBzB"}
+{"version":3,"file":"sim-ssm-parameter-type.d.ts","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAQ/E;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQpE;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF"}

package/dist/service/ssm/parameter/sim-ssm-parameter-type.js

@@ -1,12 +1,16 @@
 import { SimSsmUnsupportedParameterType, SimSsmValidationException, } from "../error/sim-ssm.error.js";
-const simulatedTypes = new Set(["String", "StringList"]);
+const simulatedTypes = new Set([
+    "String",
+    "StringList",
+    "SecureString",
+]);
 /**
  * The type of one simulated parameter.
  *
- * `SecureString` is refused rather than stored. Nothing in this simulation
- * would encrypt it, so accepting it would let a test pass while proving
- * nothing about the KMS key, the `kms:Decrypt` permission or the
- * `WithDecryption` flag a real deployment depends on.
+ * A `SecureString` is encrypted through simulated KMS rather than stored in
+ * the clear, so the two failures a real deployment hits are reproducible here:
+ * a caller that may read the parameter but may not decrypt with its key, and
+ * a read that forgets `WithDecryption` and gets a ciphertext back.
  */
 export class SimSsmParameterType {
     value;
@@ -26,17 +30,17 @@ export class SimSsmParameterType {
         return new SimSsmParameterType(type);
     }
     static validated(type) {
-        if (type === "SecureString") {
-            throw new SimSsmUnsupportedParameterType("SecureString parameters are not simulated: nothing here would " +
-                "encrypt the value, so a passing test would say nothing about the " +
-                "KMS key or the kms:Decrypt permission the real parameter needs. " +
-                "Use String or StringList.");
-        }
         if (!simulatedTypes.has(type)) {
-            throw new SimSsmUnsupportedParameterType(`Parameter type '${type}' is not a Parameter Store type: use String ` +
-                `or StringList`);
+            throw new SimSsmUnsupportedParameterType(`Parameter type '${type}' is not a Parameter Store type: use String, ` +
+                `StringList or SecureString`);
         }
         return type;
     }
+    /**
+     * Whether values of this type are stored encrypted.
+     */
+    get isSecure() {
+        return this.value === "SecureString";
+    }
 }
 //# sourceMappingURL=sim-ssm-parameter-type.js.map

package/dist/service/ssm/parameter/sim-ssm-parameter-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-ssm-parameter-type.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAOnC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACd,KAAK,CAA0B;IAE/C,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAwB;QAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,IAAY;QACnC,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAA8B,CACtC,gEAAgE;gBAC9D,mEAAmE;gBACnE,kEAAkE;gBAClE,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,8BAA8B,CACtC,mBAAmB,IAAI,8CAA8C;gBACnE,eAAe,CAClB,CAAC;QACJ,CAAC;QAED,OAAO,IAA+B,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"sim-ssm-parameter-type.js","sourceRoot":"","sources":["../../../../src/service/ssm/parameter/sim-ssm-parameter-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAOnC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,QAAQ;IACR,YAAY;IACZ,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACd,KAAK,CAA0B;IAE/C,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,eAAe,CAAC,IAAwB;QAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,IAAY;QACnC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,8BAA8B,CACtC,mBAAmB,IAAI,+CAA+C;gBACpE,4BAA4B,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAA+B,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC;IACvC,CAAC;CACF"}