@kensio/yulin 1.21.15 → 1.21.17

package/dist/service/dynamodb/document/sim-dynamodb-document-path.js

@@ -1,10 +1,23 @@
 import { isRecord } from "../../../util/type-guard/record.js";
 /**
- * One attribute value, converted where it stands.
+ * Every attribute value of an item, a key or a set of expression values.
+ *
+ * An attribute whose value is undefined is left out rather than converted, and
+ * that happens whatever the document client was built with. The real client
+ * drops it in the same place: `removeUndefinedValues` governs the values
+ * inside an attribute, and an item is not itself one of them.
  */
-class SimDynamoDbDocumentValuePath {
+class SimDynamoDbDocumentValuesPath {
     convert(value, conversion, path) {
-        return conversion(value, path);
+        if (Array.isArray(value)) {
+            return value.map((member, index) => conversion(member, `${path}[${index.toString()}]`));
+        }
+        if (!isRecord(value)) {
+            return value;
+        }
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, member]) => member !== undefined)
+            .map(([name, member]) => [name, conversion(member, `${path}.${name}`)]));
     }
 }
 /**
@@ -55,18 +68,12 @@ class SimDynamoDbDocumentFieldsPath {
         return converted;
     }
 }
-/**
- * A path to one attribute value.
- */
-export function simDynamoDbDocumentValue() {
-    return new SimDynamoDbDocumentValuePath();
-}
 /**
  * A path to a record or list whose every member is one attribute value, which
  * is what an Item, a Key and a set of expression values are.
  */
 export function simDynamoDbDocumentValues() {
-    return simDynamoDbDocumentEach(simDynamoDbDocumentValue());
+    return new SimDynamoDbDocumentValuesPath();
 }
 /**
  * A path through every member of a record or list.

package/dist/service/dynamodb/document/sim-dynamodb-document-route.js

@@ -1,4 +1,5 @@
 import { simSdkCallerOptions, } from "../../../sdk/index.js";
+import { simDynamoDbDocumentMarshallOptions } from "./sim-dynamodb-document-marshall-options.js";
 import { simDynamoDbDocumentAttributeValue } from "./sim-dynamodb-document-marshall.js";
 import { simDynamoDbDocumentNativeValue } from "./sim-dynamodb-document-unmarshall.js";
 /**
@@ -23,7 +24,10 @@ export class SimDynamoDbDocumentRoute {
      */
     route() {
         return async (command, context) => {
-            const input = this.input.convert(command.input, (value, path) => simDynamoDbDocumentAttributeValue(value, path), "input");
+            // Read per send, as the real middleware reads it, so the same route
+            // serves document clients built with different options.
+            const options = simDynamoDbDocumentMarshallOptions(context.client);
+            const input = this.input.convert(command.input, (value, path) => simDynamoDbDocumentAttributeValue(value, path, options), "input");
             const output = await this.send(input, simSdkCallerOptions(context));
             return this.output.convert(output, (value, path) => simDynamoDbDocumentNativeValue(value, path), "output");
         };

package/dist/service/dynamodb/document/sim-dynamodb-document-scalar.d.ts

@@ -0,0 +1,13 @@
+import type { SimDynamoDbAttributeValue } from "../command/item/item.types.js";
+import type { SimDynamoDbDocumentMarshallOptions } from "./sim-dynamodb-document-marshall-options.js";
+/**
+ * Read a value that stands for one attribute on its own.
+ *
+ * The kinds are tried in the order the real conversion tries them. A value
+ * that is none of them answers with nothing, and what happens to it next is
+ * for the caller to decide.
+ *
+ * An empty string and a binary value holding no bytes are written as NULL when
+ * the client was built with `convertEmptyValues`, and as themselves otherwise.
+ */
+export declare function simDynamoDbDocumentScalarAttribute(value: unknown, path: string, options: SimDynamoDbDocumentMarshallOptions): SimDynamoDbAttributeValue | undefined;

package/dist/service/dynamodb/document/sim-dynamodb-document-scalar.js

@@ -0,0 +1,46 @@
+import { isSimDynamoDbDocumentBinary } from "./sim-dynamodb-document-binary.js";
+import { isSimDynamoDbDocumentNumberValue, simDynamoDbDocumentNumberAttribute, } from "./sim-dynamodb-document-number.js";
+/**
+ * Read a value that stands for one attribute on its own.
+ *
+ * The kinds are tried in the order the real conversion tries them. A value
+ * that is none of them answers with nothing, and what happens to it next is
+ * for the caller to decide.
+ *
+ * An empty string and a binary value holding no bytes are written as NULL when
+ * the client was built with `convertEmptyValues`, and as themselves otherwise.
+ */
+export function simDynamoDbDocumentScalarAttribute(value, path, options) {
+    if (isSimDynamoDbDocumentBinary(value)) {
+        return isEmptyLength(value) && options.convertEmptyValues
+            ? { NULL: true }
+            : { B: value };
+    }
+    if (typeof value === "boolean") {
+        return { BOOL: value };
+    }
+    if (typeof value === "number") {
+        return simDynamoDbDocumentNumberAttribute(value, path, options);
+    }
+    if (isSimDynamoDbDocumentNumberValue(value)) {
+        return { N: value.toAttributeValue().N };
+    }
+    if (typeof value === "bigint") {
+        return { N: value.toString() };
+    }
+    if (typeof value === "string") {
+        return value.length === 0 && options.convertEmptyValues
+            ? { NULL: true }
+            : { S: value };
+    }
+    return undefined;
+}
+/**
+ * Whether a value holds nothing, by the length the real conversion reads.
+ *
+ * An ArrayBuffer reports `byteLength` rather than `length`, so an empty one is
+ * not empty by this measure, and the real conversion leaves it alone too.
+ */
+function isEmptyLength(value) {
+    return value.length === 0;
+}

package/dist/service/dynamodb/document/sim-dynamodb-document-set.d.ts

@@ -1,4 +1,5 @@
 import type { SimDynamoDbAttributeValue } from "../command/item/item.types.js";
+import type { SimDynamoDbDocumentMarshallOptions } from "./sim-dynamodb-document-marshall-options.js";
 /**
  * Read a JavaScript Set as one of DynamoDB's three set attributes.
  *
@@ -8,7 +9,11 @@ import type { SimDynamoDbAttributeValue } from "../command/item/item.types.js";
  * further down, where the table reads the value. That is what the real one
  * does, so a set written this way behaves the same either side.
  *
- * DynamoDB has no empty set, so an empty one is refused rather than written as
- * something else.
+ * An undefined member is dropped when the client was built with
+ * `removeUndefinedValues`, and refused otherwise. DynamoDB has no empty set, so
+ * a set with nothing left in it is written as NULL when the client was built
+ * with `convertEmptyValues`, and refused otherwise. The two are read in that
+ * order, so a set holding nothing but undefined is an empty set by the time its
+ * size is looked at, which is where the real conversion looks at it too.
  */
-export declare function simDynamoDbDocumentSetAttribute(set: ReadonlySet<unknown>, path: string): SimDynamoDbAttributeValue;
+export declare function simDynamoDbDocumentSetAttribute(set: ReadonlySet<unknown>, path: string, options: SimDynamoDbDocumentMarshallOptions): SimDynamoDbAttributeValue;

package/dist/service/dynamodb/document/sim-dynamodb-document-set.js

@@ -10,31 +10,38 @@ import { isSimDynamoDbDocumentNumberValue, simDynamoDbDocumentNumberAttribute, }
  * further down, where the table reads the value. That is what the real one
  * does, so a set written this way behaves the same either side.
  *
- * DynamoDB has no empty set, so an empty one is refused rather than written as
- * something else.
+ * An undefined member is dropped when the client was built with
+ * `removeUndefinedValues`, and refused otherwise. DynamoDB has no empty set, so
+ * a set with nothing left in it is written as NULL when the client was built
+ * with `convertEmptyValues`, and refused otherwise. The two are read in that
+ * order, so a set holding nothing but undefined is an empty set by the time its
+ * size is looked at, which is where the real conversion looks at it too.
  */
-export function simDynamoDbDocumentSetAttribute(set, path) {
-    if (set.size === 0) {
-        throw new SimDynamoDbDocumentValueError(`${path} is an empty Set, and DynamoDB has no empty set`);
+export function simDynamoDbDocumentSetAttribute(set, path, options) {
+    const members = [...set].filter((member) => !(member === undefined && options.removeUndefinedValues));
+    if (!options.removeUndefinedValues && set.has(undefined)) {
+        throw new SimDynamoDbDocumentValueError(`${path} is a Set holding undefined. Build the document client with ` +
+            `removeUndefinedValues to drop it, which is what the real one asks for`);
     }
-    if (set.has(undefined)) {
-        throw new SimDynamoDbDocumentValueError(`${path} is a Set holding undefined. The real document client drops it ` +
-            `only when it was built with removeUndefinedValues, which simulated ` +
-            `DynamoDB does not read yet`);
+    if (members.length === 0) {
+        if (options.convertEmptyValues) {
+            return { NULL: true };
+        }
+        throw new SimDynamoDbDocumentValueError(`${path} is an empty Set, and DynamoDB has no empty set`);
     }
-    return membersAttribute([...set], path);
+    return membersAttribute(members, path, options);
 }
 /**
  * Read the members of a set that is known to hold something.
  */
-function membersAttribute(members, path) {
+function membersAttribute(members, path, options) {
     const first = members[0];
     if (typeof first === "string") {
         return { SS: members.map(String) };
     }
     if (isNumberMember(first)) {
         return {
-            NS: members.map((member, index) => numberText(member, path, index)),
+            NS: members.map((member, index) => numberText(member, path, index, options)),
         };
     }
     if (isSimDynamoDbDocumentBinary(first)) {
@@ -57,14 +64,14 @@ function isNumberMember(member) {
 /**
  * The digits one member of a number set is written with.
  */
-function numberText(member, path, index) {
+function numberText(member, path, index, options) {
     if (typeof member === "bigint") {
         return member.toString();
     }
     if (isSimDynamoDbDocumentNumberValue(member)) {
         return member.toAttributeValue().N;
     }
-    const attribute = simDynamoDbDocumentNumberAttribute(Number(member), `${path}[${index.toString()}]`);
+    const attribute = simDynamoDbDocumentNumberAttribute(Number(member), `${path}[${index.toString()}]`, options);
     // A number attribute is the only thing that function answers with.
     return attribute.N ?? "";
 }

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-change.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * Whether the change between two definitions of a secret replaces it.
+ *
+ * `Name` is the only property real CloudFormation replaces a secret for. It is
+ * read as the template writes it, before intrinsic resolution, which is all the
+ * update plan has to go on. Two different expressions resolving to the same
+ * name replace the secret, which is the safe way round to be wrong.
+ */
+export declare function simCfnSecretsManagerSecretReplaced(current: SimCfnResource, updated: SimCfnResource): boolean;
+/**
+ * Whether the new template asks the secret to hold a different value.
+ *
+ * A secret takes its value from `SecretString` or `GenerateSecretString`, so a
+ * change to either is a new version. A change to anything else leaves the
+ * versions alone, which is what keeps a generated password across an update.
+ */
+export declare function simCfnSecretsManagerSecretValueChanged(currentProperties: SimCfnTemplateValueRecord, updatedProperties: SimCfnTemplateValueRecord): boolean;

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-change.js

@@ -0,0 +1,39 @@
+import { simCfnTemplateSignature } from "../../../cloudformation/stack/update/sim-cfn-template-signature.js";
+/**
+ * Whether the change between two definitions of a secret replaces it.
+ *
+ * `Name` is the only property real CloudFormation replaces a secret for. It is
+ * read as the template writes it, before intrinsic resolution, which is all the
+ * update plan has to go on. Two different expressions resolving to the same
+ * name replace the secret, which is the safe way round to be wrong.
+ */
+export function simCfnSecretsManagerSecretReplaced(current, updated) {
+    return nameSignature(current) !== nameSignature(updated);
+}
+/**
+ * Whether the new template asks the secret to hold a different value.
+ *
+ * A secret takes its value from `SecretString` or `GenerateSecretString`, so a
+ * change to either is a new version. A change to anything else leaves the
+ * versions alone, which is what keeps a generated password across an update.
+ */
+export function simCfnSecretsManagerSecretValueChanged(currentProperties, updatedProperties) {
+    return (valueSignature(currentProperties) !== valueSignature(updatedProperties));
+}
+/**
+ * A stable string for the two properties a secret's value comes from.
+ *
+ * A property the template leaves out signs as null, which no declared value can
+ * collide with. `SecretString` is a string and `GenerateSecretString` is an
+ * object.
+ */
+function valueSignature(properties) {
+    return simCfnTemplateSignature([
+        properties["SecretString"] ?? null,
+        properties["GenerateSecretString"] ?? null,
+    ]);
+}
+function nameSignature(resource) {
+    const name = resource.properties["Name"];
+    return name === undefined ? "" : simCfnTemplateSignature(name);
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-deleter.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import type { SimSecretsManager } from "../../sim-secrets-manager.js";
+interface SimCfnSecretsManagerSecretDeleterProperties {
+    readonly secretsManager: SimSecretsManager;
+}
+/**
+ * Removes the secret an AWS::SecretsManager::Secret Resource deployed.
+ *
+ * DeleteSecret schedules the deletion rather than carrying it out, so a torn
+ * down Stack leaves a secret waiting out its recovery window. That is what
+ * CloudFormation does, and the point of the window is that the secret is
+ * recoverable afterwards.
+ */
+export declare class SimCfnSecretsManagerSecretDeleter {
+    private readonly secretsManager;
+    constructor(properties: SimCfnSecretsManagerSecretDeleterProperties);
+    /**
+     * Schedule the deployed secret's deletion.
+     */
+    delete(resource: SimCfnResource, options?: SimCfnResourceCallerOptions): Promise<void>;
+}
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-deleter.js

@@ -0,0 +1,23 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+/**
+ * Removes the secret an AWS::SecretsManager::Secret Resource deployed.
+ *
+ * DeleteSecret schedules the deletion rather than carrying it out, so a torn
+ * down Stack leaves a secret waiting out its recovery window. That is what
+ * CloudFormation does, and the point of the window is that the secret is
+ * recoverable afterwards.
+ */
+export class SimCfnSecretsManagerSecretDeleter {
+    secretsManager;
+    constructor(properties) {
+        this.secretsManager = properties.secretsManager;
+    }
+    /**
+     * Schedule the deployed secret's deletion.
+     */
+    async delete(resource, options) {
+        const secret = resource.simResource;
+        assertDefined(secret, `sim Secrets Manager secret for CloudFormation Resource ${resource.logicalId}`);
+        await this.secretsManager.deleteSecret({ input: { SecretId: secret.arn.value } }, options);
+    }
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-template.test-support.d.ts

@@ -0,0 +1,21 @@
+import type { CfnTemplateBodyRecord } from "../../../cloudformation/template/sim-cfn-template.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SecretTemplateProperties {
+    readonly name?: string;
+    readonly description?: string;
+    readonly kmsKeyId?: string;
+    readonly tags?: readonly SimCfnTemplateValueRecord[];
+    readonly secretString?: string;
+    readonly passwordLength?: number;
+    /** A second Resource reading the secret through a dynamic reference. */
+    readonly reader?: boolean;
+}
+/**
+ * A template holding one secret, and optionally a parameter reading it.
+ *
+ * The parameter stands in for anything taking a copy of the value when the
+ * Stack deploys, such as a CloudFront origin custom header. It reads the secret
+ * through the `Fn::Join` shape CDK emits for a secret in the same Stack.
+ */
+export declare function secretTemplate(properties?: SecretTemplateProperties): CfnTemplateBodyRecord;
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-template.test-support.js

@@ -0,0 +1,64 @@
+/**
+ * A template holding one secret, and optionally a parameter reading it.
+ *
+ * The parameter stands in for anything taking a copy of the value when the
+ * Stack deploys, such as a CloudFront origin custom header. It reads the secret
+ * through the `Fn::Join` shape CDK emits for a secret in the same Stack.
+ */
+export function secretTemplate(properties = {}) {
+    const secret = {
+        Type: "AWS::SecretsManager::Secret",
+        Properties: secretProperties(properties),
+    };
+    return {
+        Resources: properties.reader === true
+            ? { EdgeCredential: secret, Reader: readerResource() }
+            : { EdgeCredential: secret },
+    };
+}
+function secretProperties(properties) {
+    const { name, description, kmsKeyId, tags, secretString } = properties;
+    const declared = {};
+    if (name !== undefined) {
+        declared["Name"] = name;
+    }
+    if (description !== undefined) {
+        declared["Description"] = description;
+    }
+    if (kmsKeyId !== undefined) {
+        declared["KmsKeyId"] = kmsKeyId;
+    }
+    if (tags !== undefined) {
+        declared["Tags"] = [...tags];
+    }
+    if (secretString === undefined) {
+        declared["GenerateSecretString"] = {
+            SecretStringTemplate: "{}",
+            GenerateStringKey: "current",
+            PasswordLength: properties.passwordLength ?? 64,
+        };
+    }
+    else {
+        declared["SecretString"] = secretString;
+    }
+    return declared;
+}
+function readerResource() {
+    return {
+        Type: "AWS::SSM::Parameter",
+        Properties: {
+            Name: "edge-credential-copy",
+            Type: "String",
+            Value: {
+                "Fn::Join": [
+                    "",
+                    [
+                        "{{resolve:secretsmanager:",
+                        { Ref: "EdgeCredential" },
+                        ":SecretString:current::}}",
+                    ],
+                ],
+            },
+        },
+    };
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-update.test-support.d.ts

@@ -0,0 +1,18 @@
+import { SimAws } from "../../../aws/sim-aws.js";
+import type { CfnTemplateBodyRecord } from "../../../cloudformation/template/sim-cfn-template.js";
+/**
+ * A simulated AWS in one account and region, for a secret update test.
+ */
+export declare function secretUpdateSimAws(): SimAws;
+/**
+ * Deploy a template and wait for its Resources.
+ */
+export declare function deploySecretStack(simAws: SimAws, stackName: string, template: CfnTemplateBodyRecord): Promise<void>;
+/**
+ * Apply a template to a deployed stack and wait for the update.
+ */
+export declare function updateSecretStack(simAws: SimAws, stackName: string, template: CfnTemplateBodyRecord): Promise<void>;
+/**
+ * The ARN of the secret a deployed stack holds.
+ */
+export declare function deployedSecretArn(simAws: SimAws, stackName: string): string;

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-update.test-support.js

@@ -0,0 +1,39 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimAws } from "../../../aws/sim-aws.js";
+import { jsonStringify } from "../../../../util/type-guard/json.js";
+/**
+ * A simulated AWS in one account and region, for a secret update test.
+ */
+export function secretUpdateSimAws() {
+    return new SimAws({
+        defaultAccountId: "111111111111",
+        defaultRegionName: "eu-west-2",
+    });
+}
+/**
+ * Deploy a template and wait for its Resources.
+ */
+export async function deploySecretStack(simAws, stackName, template) {
+    const stack = await simAws
+        .cloudFormation()
+        .deployTemplate({ stackName, template });
+    await stack.waitForDeployComplete();
+}
+/**
+ * Apply a template to a deployed stack and wait for the update.
+ */
+export async function updateSecretStack(simAws, stackName, template) {
+    await simAws.cloudFormation().updateStack({
+        input: { StackName: stackName, TemplateBody: jsonStringify(template) },
+    });
+    await simAws.cloudFormation().waitForStackUpdateComplete(stackName);
+}
+/**
+ * The ARN of the secret a deployed stack holds.
+ */
+export function deployedSecretArn(simAws, stackName) {
+    const stack = simAws.cloudFormation().getStackByName(stackName);
+    const secret = stack?.getResource("EdgeCredential")?.simResource;
+    assertDefined(secret, `deployed EdgeCredential secret in Stack ${stackName}`);
+    return secret.arn.value;
+}

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-updater.d.ts

@@ -0,0 +1,37 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCloudFormationResourceInPlaceUpdateContext } from "../../../cloudformation/resource/sim-cfn-resource.type.js";
+import type { SimSecretsManagerSecret } from "../../secret/sim-secrets-manager-secret.js";
+import type { SimSecretsManager } from "../../sim-secrets-manager.js";
+interface SimCfnSecretsManagerSecretUpdaterProperties {
+    readonly secretsManager: SimSecretsManager;
+}
+/**
+ * Applies a changed AWS::SecretsManager::Secret Resource to the deployed
+ * secret.
+ *
+ * Every property but `Name` is applied with no interruption, as real
+ * CloudFormation applies it. That matters most for the value. A secret keeps
+ * its versions across a description or a tag change, and the things holding a
+ * copy of the value stay in step with it.
+ *
+ * Replacing instead would also fail. DeleteSecret schedules the deletion and
+ * leaves the name held for the recovery window. The secret taking its place
+ * would then ask for a name the deleted one still has.
+ */
+export declare class SimCfnSecretsManagerSecretUpdater {
+    private readonly secretsManager;
+    constructor(properties: SimCfnSecretsManagerSecretUpdaterProperties);
+    /**
+     * Apply the new Resource definition to the deployed secret.
+     */
+    update(current: SimCfnResource, updated: SimCfnResource, context: SimCloudFormationResourceInPlaceUpdateContext): Promise<SimSecretsManagerSecret>;
+    /**
+     * The value to write, where the new template asks for a different one.
+     *
+     * Nothing is written for an unchanged value. Regenerating a password for a
+     * description change would leave every copy of it taken at deployment
+     * holding the old one.
+     */
+    private changedValue;
+}
+export {};

package/dist/service/secretsmanager/cfn/secret/sim-cfn-secrets-manager-secret-updater.js

@@ -0,0 +1,66 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
+import { simCfnSecretsManagerSecretValueChanged } from "./sim-cfn-secrets-manager-secret-change.js";
+import { SimCfnSecretsManagerSecretProperties } from "./sim-cfn-secrets-manager-secret-properties.js";
+/**
+ * Applies a changed AWS::SecretsManager::Secret Resource to the deployed
+ * secret.
+ *
+ * Every property but `Name` is applied with no interruption, as real
+ * CloudFormation applies it. That matters most for the value. A secret keeps
+ * its versions across a description or a tag change, and the things holding a
+ * copy of the value stay in step with it.
+ *
+ * Replacing instead would also fail. DeleteSecret schedules the deletion and
+ * leaves the name held for the recovery window. The secret taking its place
+ * would then ask for a name the deleted one still has.
+ */
+export class SimCfnSecretsManagerSecretUpdater {
+    secretsManager;
+    constructor(properties) {
+        this.secretsManager = properties.secretsManager;
+    }
+    /**
+     * Apply the new Resource definition to the deployed secret.
+     */
+    async update(current, updated, context) {
+        const secret = current.simResource;
+        assertDefined(secret, `sim Secrets Manager secret for CloudFormation Resource ${current.logicalId}`);
+        const properties = new SimCfnSecretsManagerSecretProperties({
+            resource: updated,
+            properties: context.updatedResolvedProperties,
+        });
+        const kmsKeyId = properties.kmsKeyId();
+        await this.secretsManager.updateSecret({
+            input: {
+                SecretId: secret.arn.value,
+                // CloudFormation applies the template as the desired state, so a
+                // Description the new template leaves out is cleared rather than
+                // left as it was. An empty one is how UpdateSecret clears it.
+                Description: properties.description() ?? "",
+                KmsKeyId: kmsKeyId,
+                SecretString: this.changedValue(properties, context),
+            },
+        }, simCfnResourceCallerOptions(context.caller));
+        // The parts UpdateSecret has no way to ask for. Real Secrets Manager
+        // changes tags with TagResource and UntagResource, which are not
+        // simulated, and UpdateSecret cannot put a secret back on the
+        // aws/secretsmanager key.
+        if (kmsKeyId === undefined) {
+            secret.kmsKeyId = undefined;
+        }
+        secret.tags = properties.tags() ?? [];
+        return secret;
+    }
+    /**
+     * The value to write, where the new template asks for a different one.
+     *
+     * Nothing is written for an unchanged value. Regenerating a password for a
+     * description change would leave every copy of it taken at deployment
+     * holding the old one.
+     */
+    changedValue(properties, context) {
+        const changed = simCfnSecretsManagerSecretValueChanged(context.currentResolvedProperties, context.updatedResolvedProperties);
+        return changed ? properties.secretString() : undefined;
+    }
+}

package/dist/service/secretsmanager/cfn/sim-cfn-secrets-manager-resource-factory.d.ts

@@ -1,33 +1,43 @@
 import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCloudFormationResourceInPlaceUpdateContext } from "../../cloudformation/resource/sim-cfn-resource.type.js";
 import type { SimSecretsManager } from "../sim-secrets-manager.js";
 interface SimSecretsManagerCfnResourceFactoryProperties {
     readonly secretsManager: SimSecretsManager;
 }
 /**
  * CloudFormation Resource factory for simulated Secrets Manager resources.
+ *
+ * Only `Secret` is deployed. Rotation, resource policies and target
+ * attachments are not simulated, so their Resource types are reported as
+ * unsupported and skipped rather than quietly treated as deployed.
  */
 export declare class SimSecretsManagerCfnResourceFactory implements SimCfnServiceResourceFactory {
-    private readonly secretsManager;
     private readonly secretCreator;
+    private readonly secretUpdater;
+    private readonly secretDeleter;
     constructor(properties: SimSecretsManagerCfnResourceFactoryProperties);
     /**
      * Create a simulated Secrets Manager resource from a CloudFormation
      * Resource.
-     *
-     * Rotation, resource policies and target attachments are not simulated, so
-     * their Resource types are reported as unsupported and skipped rather than
-     * quietly treated as deployed.
      */
     create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+    /**
+     * Whether a changed secret can be applied to the deployed one.
+     *
+     * Name is the only property real CloudFormation replaces a secret for.
+     * Everything else is applied with no interruption, which is what keeps a
+     * generated value across a change to the secret's description or tags.
+     */
+    updatesInPlace(resourceTypeName: string, current: SimCfnResource, updated: SimCfnResource): boolean;
+    /**
+     * Apply a changed AWS::SecretsManager::Secret Resource to the deployed
+     * secret.
+     */
+    updateInPlace(resourceTypeName: string, current: SimCfnResource, updated: SimCfnResource, context: SimCloudFormationResourceInPlaceUpdateContext): Promise<object | undefined>;
     /**
      * Delete a simulated Secrets Manager resource created from a CloudFormation
      * Resource.
-     *
-     * DeleteSecret schedules the deletion rather than carrying it out, so a torn
-     * down Stack leaves a secret waiting out its recovery window. That is what
-     * CloudFormation does: the secret is recoverable afterwards, which is the
-     * point of the window.
      */
     delete(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceDeleteContext): Promise<void>;
 }