@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.d.ts

@@ -0,0 +1,48 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimCancelKeyDeletionCommand, SimCancelKeyDeletionCommandOutput, SimDisableKeyCommand, SimDisableKeyCommandOutput, SimEnableKeyCommand, SimEnableKeyCommandOutput, SimScheduleKeyDeletionCommand, SimScheduleKeyDeletionCommandOutput } from "./key.command.js";
+interface SimKmsKeyLifecycleCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+    readonly clock: SimClock;
+}
+interface SimKmsKeyLifecycleCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The commands that move a simulated KMS key between lifecycle states.
+ *
+ * The state transitions themselves belong to SimKmsKey, which refuses the ones
+ * its current state does not allow. These commands resolve the key, authorize
+ * the caller and report the result.
+ */
+export declare class SimKmsKeyLifecycleCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly clock;
+    constructor(properties: SimKmsKeyLifecycleCommandsProperties);
+    /**
+     * Enable a key.
+     */
+    enable(command: SimEnableKeyCommand, options?: SimKmsKeyLifecycleCommandOptions): SimEnableKeyCommandOutput;
+    /**
+     * Disable a key, leaving it present but unusable.
+     */
+    disable(command: SimDisableKeyCommand, options?: SimKmsKeyLifecycleCommandOptions): SimDisableKeyCommandOutput;
+    /**
+     * Schedule a key for deletion after a recovery window.
+     *
+     * The key stays in the store while it is pending deletion, because that is
+     * what recoverable means: the key is still there, refusing to be used, until
+     * the window runs out.
+     */
+    scheduleDeletion(command: SimScheduleKeyDeletionCommand, options?: SimKmsKeyLifecycleCommandOptions): SimScheduleKeyDeletionCommandOutput;
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion(command: SimCancelKeyDeletionCommand, options?: SimKmsKeyLifecycleCommandOptions): SimCancelKeyDeletionCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-lifecycle-commands.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-lifecycle-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,kBAAkB,CAAC;AAE1B,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,gCAAgC,GACzC,yBAAyB,CAM3B;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,gCAAgC,GACzC,0BAA0B,CAM5B;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,OAAO,EAAE,6BAA6B,EACtC,OAAO,CAAC,EAAE,gCAAgC,GACzC,mCAAmC,CAmBrC;IAED;;OAEG;IACH,cAAc,CACZ,OAAO,EAAE,2BAA2B,EACpC,OAAO,CAAC,EAAE,gCAAgC,GACzC,iCAAiC,CAMnC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.js

@@ -0,0 +1,67 @@
+import { SimKmsPendingWindow } from "./sim-kms-pending-window.js";
+/**
+ * The commands that move a simulated KMS key between lifecycle states.
+ *
+ * The state transitions themselves belong to SimKmsKey, which refuses the ones
+ * its current state does not allow. These commands resolve the key, authorize
+ * the caller and report the result.
+ */
+export class SimKmsKeyLifecycleCommands {
+    keys;
+    authorizer;
+    clock;
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+        this.clock = properties.clock;
+    }
+    /**
+     * Enable a key.
+     */
+    enable(command, options) {
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:EnableKey", key, options?.caller);
+        key.enable();
+        return { $metadata: {} };
+    }
+    /**
+     * Disable a key, leaving it present but unusable.
+     */
+    disable(command, options) {
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:DisableKey", key, options?.caller);
+        key.disable();
+        return { $metadata: {} };
+    }
+    /**
+     * Schedule a key for deletion after a recovery window.
+     *
+     * The key stays in the store while it is pending deletion, because that is
+     * what recoverable means: the key is still there, refusing to be used, until
+     * the window runs out.
+     */
+    scheduleDeletion(command, options) {
+        const window = new SimKmsPendingWindow(command.input.PendingWindowInDays);
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:ScheduleKeyDeletion", key, options?.caller);
+        const deletionDate = window.deletionDateFrom(this.clock.now());
+        key.scheduleDeletion(deletionDate);
+        return {
+            $metadata: {},
+            KeyId: key.arn,
+            DeletionDate: deletionDate,
+            KeyState: key.keyState,
+            PendingWindowInDays: window.days,
+        };
+    }
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion(command, options) {
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:CancelKeyDeletion", key, options?.caller);
+        key.cancelDeletion();
+        return { $metadata: {}, KeyId: key.arn };
+    }
+}
+//# sourceMappingURL=sim-kms-key-lifecycle-commands.js.map

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-lifecycle-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAuBlE;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,KAAK,CAAW;IAEjC,YAAY,UAAgD;QAC1D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA4B,EAC5B,OAA0C;QAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,GAAG,CAAC,MAAM,EAAE,CAAC;QAEb,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,OAAO,CACL,OAA6B,EAC7B,OAA0C;QAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,GAAG,CAAC,OAAO,EAAE,CAAC;QAEd,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,OAAsC,EACtC,OAA0C;QAE1C,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAC1B,yBAAyB,EACzB,GAAG,EACH,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAEnC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,YAAY,EAAE,YAAY;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,mBAAmB,EAAE,MAAM,CAAC,IAAI;SACjC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,OAAoC,EACpC,OAA0C;QAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,uBAAuB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5E,GAAG,CAAC,cAAc,EAAE,CAAC;QAErB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-policy-commands.d.ts

@@ -0,0 +1,39 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimGetKeyPolicyCommand, SimGetKeyPolicyCommandOutput, SimPutKeyPolicyCommand, SimPutKeyPolicyCommandOutput } from "./key.command.js";
+interface SimKmsKeyPolicyCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsKeyPolicyCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The commands that read and replace a simulated KMS key policy.
+ *
+ * Replacing a key policy can lock the key out of its own Account, exactly as
+ * on real AWS: a policy with no statement for the Account root leaves the key
+ * reachable only by the principals it names, and no IAM policy will get it
+ * back. That is deliberate, and it is the behaviour worth being able to test.
+ */
+export declare class SimKmsKeyPolicyCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly policyDocument;
+    constructor(properties: SimKmsKeyPolicyCommandsProperties);
+    /**
+     * Get a key's policy, as the JSON document string the real API returns.
+     */
+    get(command: SimGetKeyPolicyCommand, options?: SimKmsKeyPolicyCommandOptions): SimGetKeyPolicyCommandOutput;
+    /**
+     * Replace a key's policy.
+     */
+    put(command: SimPutKeyPolicyCommand, options?: SimKmsKeyPolicyCommandOptions): SimPutKeyPolicyCommandOutput;
+    /**
+     * A KMS key has exactly one policy, and it is always called "default".
+     */
+    private requireDefaultPolicyName;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-policy-commands.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-policy-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-policy-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAC;AAE1B,UAAU,iCAAiC;IACzC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,iCAAiC,EAGxD;IAED;;OAEG;IACH,GAAG,CACD,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,6BAA6B,GACtC,4BAA4B,CAW9B;IAED;;OAEG;IACH,GAAG,CACD,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,6BAA6B,GACtC,4BAA4B,CAgB9B;IAED;;OAEG;IACH,OAAO,CAAC,wBAAwB;CAOjC"}

package/dist/service/kms/command/key/sim-kms-key-policy-commands.js

@@ -0,0 +1,57 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+import { simKmsKeyPolicyName } from "../../key/sim-kms-key-policy.js";
+import { SimKmsPolicyDocument } from "../../key/sim-kms-policy-document.js";
+/**
+ * The commands that read and replace a simulated KMS key policy.
+ *
+ * Replacing a key policy can lock the key out of its own Account, exactly as
+ * on real AWS: a policy with no statement for the Account root leaves the key
+ * reachable only by the principals it names, and no IAM policy will get it
+ * back. That is deliberate, and it is the behaviour worth being able to test.
+ */
+export class SimKmsKeyPolicyCommands {
+    keys;
+    authorizer;
+    policyDocument = new SimKmsPolicyDocument();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * Get a key's policy, as the JSON document string the real API returns.
+     */
+    get(command, options) {
+        this.requireDefaultPolicyName(command.input.PolicyName);
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:GetKeyPolicy", key, options?.caller);
+        return {
+            $metadata: {},
+            PolicyName: simKmsKeyPolicyName,
+            Policy: JSON.stringify(key.policy.document()),
+        };
+    }
+    /**
+     * Replace a key's policy.
+     */
+    put(command, options) {
+        this.requireDefaultPolicyName(command.input.PolicyName);
+        const policy = command.input.Policy;
+        if (policy === undefined) {
+            throw new SimKmsValidationException("Policy is required");
+        }
+        const document = this.policyDocument.parse(policy);
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:PutKeyPolicy", key, options?.caller);
+        key.policy.replaceWith(document);
+        return { $metadata: {} };
+    }
+    /**
+     * A KMS key has exactly one policy, and it is always called "default".
+     */
+    requireDefaultPolicyName(policyName) {
+        if (policyName !== undefined && policyName !== simKmsKeyPolicyName) {
+            throw new SimKmsValidationException(`PolicyName must be '${simKmsKeyPolicyName}': a KMS key has exactly one policy`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-policy-commands.js.map

package/dist/service/kms/command/key/sim-kms-key-policy-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-policy-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAkB5E;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAA6C;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAAuC;QAEvC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvE,OAAO;YACL,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,mBAAmB;YAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAAuC;QAEvC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAEpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,UAA8B;QAC7D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;YACnE,MAAM,IAAI,yBAAyB,CACjC,uBAAuB,mBAAmB,qCAAqC,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-type.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Checks a requested key type against what this simulation models.
+ *
+ * Asymmetric keys, HMAC keys and imported material all behave differently
+ * enough that pretending a symmetric key is one of them would make a passing
+ * test meaningless, so an unmodelled type is refused rather than substituted.
+ */
+export declare class SimKmsKeyType {
+    /**
+     * Refuse a key type this simulation does not model.
+     */
+    require(keyUsage: string | undefined, keySpec: string | undefined, origin: string | undefined): void;
+}
+//# sourceMappingURL=sim-kms-key-type.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-type.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACH,OAAO,CACL,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,IAAI,CAkBN;CACF"}

package/dist/service/kms/command/key/sim-kms-key-type.js

@@ -0,0 +1,31 @@
+import { SimKmsInvalidKeyUsageException, SimKmsValidationException, } from "../../error/sim-kms.error.js";
+/**
+ * The only key type this simulation models.
+ */
+const symmetricKeySpec = "SYMMETRIC_DEFAULT";
+const encryptDecryptUsage = "ENCRYPT_DECRYPT";
+const kmsOrigin = "AWS_KMS";
+/**
+ * Checks a requested key type against what this simulation models.
+ *
+ * Asymmetric keys, HMAC keys and imported material all behave differently
+ * enough that pretending a symmetric key is one of them would make a passing
+ * test meaningless, so an unmodelled type is refused rather than substituted.
+ */
+export class SimKmsKeyType {
+    /**
+     * Refuse a key type this simulation does not model.
+     */
+    require(keyUsage, keySpec, origin) {
+        if (keyUsage !== undefined && keyUsage !== encryptDecryptUsage) {
+            throw new SimKmsInvalidKeyUsageException(`KeyUsage '${keyUsage}' is not simulated: simulated KMS creates ${encryptDecryptUsage} keys`);
+        }
+        if (keySpec !== undefined && keySpec !== symmetricKeySpec) {
+            throw new SimKmsInvalidKeyUsageException(`KeySpec '${keySpec}' is not simulated: simulated KMS creates ${symmetricKeySpec} keys`);
+        }
+        if (origin !== undefined && origin !== kmsOrigin) {
+            throw new SimKmsValidationException(`Origin '${origin}' is not simulated: simulated KMS generates its own key material`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-type.js.map

package/dist/service/kms/command/key/sim-kms-key-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-type.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AACH,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,SAAS,GAAG,SAAS,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACxB;;OAEG;IACH,OAAO,CACL,QAA4B,EAC5B,OAA2B,EAC3B,MAA0B;QAE1B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/D,MAAM,IAAI,8BAA8B,CACtC,aAAa,QAAQ,6CAA6C,mBAAmB,OAAO,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,8BAA8B,CACtC,YAAY,OAAO,6CAA6C,gBAAgB,OAAO,CACxF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,yBAAyB,CACjC,WAAW,MAAM,kEAAkE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-list-keys.d.ts

@@ -0,0 +1,29 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimListKeysCommand, SimListKeysCommandOutput } from "./key.command.js";
+interface SimKmsListKeysProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsListKeysOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The ListKeys command of one simulated KMS scope.
+ *
+ * Real KMS gives kms:ListKeys no resource-level permissions, so the listing is
+ * authorized once rather than per key. It therefore reports keys the caller
+ * may not be allowed to use, which is what real KMS does too.
+ */
+export declare class SimKmsListKeys {
+    private readonly keys;
+    private readonly authorizer;
+    constructor(properties: SimKmsListKeysProperties);
+    /**
+     * List the keys in this scope, up to any requested limit.
+     */
+    handle(command: SimListKeysCommand, options?: SimKmsListKeysOptions): SimListKeysCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-list-keys.d.ts.map

package/dist/service/kms/command/key/sim-kms-list-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-list-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,kBAAkB,CAAC;AAE1B,UAAU,wBAAwB;IAChC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAE9C,YAAY,UAAU,EAAE,wBAAwB,EAG/C;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,wBAAwB,CAc1B;CACF"}

package/dist/service/kms/command/key/sim-kms-list-keys.js

@@ -0,0 +1,31 @@
+/**
+ * The ListKeys command of one simulated KMS scope.
+ *
+ * Real KMS gives kms:ListKeys no resource-level permissions, so the listing is
+ * authorized once rather than per key. It therefore reports keys the caller
+ * may not be allowed to use, which is what real KMS does too.
+ */
+export class SimKmsListKeys {
+    keys;
+    authorizer;
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * List the keys in this scope, up to any requested limit.
+     */
+    handle(command, options) {
+        this.authorizer.authorizeAccount("kms:ListKeys", options?.caller);
+        const limit = command.input?.Limit;
+        const entries = this.keys.keys
+            .values()
+            .map((key) => ({ KeyId: key.keyId, KeyArn: key.arn }))
+            .toArray();
+        if (limit === undefined || entries.length <= limit) {
+            return { $metadata: {}, Keys: entries, Truncated: false };
+        }
+        return { $metadata: {}, Keys: entries.slice(0, limit), Truncated: true };
+    }
+}
+//# sourceMappingURL=sim-kms-list-keys.js.map

package/dist/service/kms/command/key/sim-kms-list-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-list-keys.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACR,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAE9C,YAAY,UAAoC;QAC9C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA2B,EAC3B,OAA+B;QAE/B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;aACrD,OAAO,EAAE,CAAC;QAEb,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-pending-window.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The recovery window between scheduling a KMS key's deletion and it happening.
+ *
+ * Real KMS will not take less than seven days or more than thirty, because the
+ * window is the only protection against destroying every ciphertext ever
+ * produced under the key.
+ */
+export declare class SimKmsPendingWindow {
+    readonly days: number;
+    constructor(days: number | undefined);
+    private static validated;
+    /**
+     * When a deletion scheduled now would fall due.
+     */
+    deletionDateFrom(now: Date): Date;
+}
+//# sourceMappingURL=sim-kms-pending-window.d.ts.map

package/dist/service/kms/command/key/sim-kms-pending-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-pending-window.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-pending-window.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B,YAAY,IAAI,EAAE,MAAM,GAAG,SAAS,EAEnC;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAcxB;;OAEG;IACH,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAEhC;CACF"}

package/dist/service/kms/command/key/sim-kms-pending-window.js

@@ -0,0 +1,37 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+/**
+ * The deletion recovery window real KMS allows, and the one it defaults to.
+ */
+const minDays = 7;
+const maxDays = 30;
+const defaultDays = 30;
+const millisecondsPerDay = 24 * 60 * 60 * 1000;
+/**
+ * The recovery window between scheduling a KMS key's deletion and it happening.
+ *
+ * Real KMS will not take less than seven days or more than thirty, because the
+ * window is the only protection against destroying every ciphertext ever
+ * produced under the key.
+ */
+export class SimKmsPendingWindow {
+    days;
+    constructor(days) {
+        this.days = SimKmsPendingWindow.validated(days);
+    }
+    static validated(days) {
+        if (days === undefined) {
+            return defaultDays;
+        }
+        if (!Number.isSafeInteger(days) || days < minDays || days > maxDays) {
+            throw new SimKmsValidationException(`PendingWindowInDays must be a whole number between ${String(minDays)} and ${String(maxDays)}`);
+        }
+        return days;
+    }
+    /**
+     * When a deletion scheduled now would fall due.
+     */
+    deletionDateFrom(now) {
+        return new Date(now.getTime() + this.days * millisecondsPerDay);
+    }
+}
+//# sourceMappingURL=sim-kms-pending-window.js.map

package/dist/service/kms/command/key/sim-kms-pending-window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-pending-window.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-pending-window.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;GAEG;AACH,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACd,IAAI,CAAS;IAE7B,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,IAAwB;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;YACpE,MAAM,IAAI,yBAAyB,CACjC,sDAAsD,MAAM,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,GAAS;QACxB,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/kms/command/sim-kms-command.types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The command types of every simulated KMS operation, in one place.
+ *
+ * The SimKms facade handles all of them, so gathering the types here keeps it
+ * a delegation rather than a page of imports.
+ */
+export type { SimCreateAliasCommand, SimCreateAliasCommandOutput, SimListAliasesCommand, SimListAliasesCommandOutput, } from "./alias/alias.command.js";
+export type { SimDecryptCommand, SimDecryptCommandOutput, SimEncryptCommand, SimEncryptCommandOutput, SimGenerateDataKeyCommand, SimGenerateDataKeyCommandOutput, } from "./crypto/crypto.command.js";
+export type { SimCancelKeyDeletionCommand, SimCancelKeyDeletionCommandOutput, SimCreateKeyCommand, SimCreateKeyCommandOutput, SimDescribeKeyCommand, SimDescribeKeyCommandOutput, SimDisableKeyCommand, SimDisableKeyCommandOutput, SimEnableKeyCommand, SimEnableKeyCommandOutput, SimGetKeyPolicyCommand, SimGetKeyPolicyCommandOutput, SimListKeysCommand, SimListKeysCommandOutput, SimPutKeyPolicyCommand, SimPutKeyPolicyCommandOutput, SimScheduleKeyDeletionCommand, SimScheduleKeyDeletionCommandOutput, } from "./key/key.command.js";
+//# sourceMappingURL=sim-kms-command.types.d.ts.map

package/dist/service/kms/command/sim-kms-command.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-command.types.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-command.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC"}

package/dist/service/kms/command/sim-kms-command.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-kms-command.types.js.map

package/dist/service/kms/command/sim-kms-command.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-command.types.js","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-command.types.ts"],"names":[],"mappings":""}

package/dist/service/kms/error/sim-kms.error.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Minimal metadata shape for simulated KMS errors.
+ */
+export interface SimKmsErrorMetadata {
+    readonly httpStatusCode?: number;
+}
+/**
+ * Base class for simulated KMS errors.
+ */
+export declare class SimKmsError extends Error {
+    readonly $metadata: SimKmsErrorMetadata;
+    constructor(message: string, $metadata?: SimKmsErrorMetadata);
+}
+/**
+ * Simulated KMS NotFoundException error.
+ *
+ * Real KMS reports a key, alias or key ARN it cannot find this way, whether
+ * the identifier is unknown or belongs to another Account or Region.
+ */
+export declare class SimKmsNotFoundException extends SimKmsError {
+    readonly name = "NotFoundException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS AlreadyExistsException error.
+ */
+export declare class SimKmsAlreadyExistsException extends SimKmsError {
+    readonly name = "AlreadyExistsException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS DisabledException error.
+ *
+ * Real KMS distinguishes a disabled key from one pending deletion: a
+ * cryptographic operation on a disabled key fails this way, while a key
+ * pending deletion fails with KMSInvalidStateException.
+ */
+export declare class SimKmsDisabledException extends SimKmsError {
+    readonly name = "DisabledException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS KMSInvalidStateException error.
+ */
+export declare class SimKmsInvalidStateException extends SimKmsError {
+    readonly name = "KMSInvalidStateException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS InvalidCiphertextException error.
+ *
+ * This covers every reason a ciphertext will not open: it was not produced by
+ * this simulation, it was produced under a different key, or the encryption
+ * context does not match the one it was encrypted with. Real KMS is equally
+ * uninformative here on purpose, because saying more would leak something
+ * about the key or the plaintext.
+ */
+export declare class SimKmsInvalidCiphertextException extends SimKmsError {
+    readonly name = "InvalidCiphertextException";
+    constructor(message?: string);
+}
+/**
+ * Simulated KMS IncorrectKeyException error.
+ *
+ * Decrypt was given a KeyId, and the ciphertext was produced under a different
+ * key. Naming the key is optional for a symmetric ciphertext precisely because
+ * the blob already says which key made it, so a mismatch means the caller's
+ * expectation was wrong rather than the ciphertext being unreadable.
+ */
+export declare class SimKmsIncorrectKeyException extends SimKmsError {
+    readonly name = "IncorrectKeyException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS ValidationException error.
+ */
+export declare class SimKmsValidationException extends SimKmsError {
+    readonly name = "ValidationException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS InvalidKeyUsageException error.
+ */
+export declare class SimKmsInvalidKeyUsageException extends SimKmsError {
+    readonly name = "InvalidKeyUsageException";
+    constructor(message: string);
+}
+//# sourceMappingURL=sim-kms.error.d.ts.map

package/dist/service/kms/error/sim-kms.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms.error.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,SAAQ,WAAW;IAC/D,SAAyB,IAAI,gCAAgC;IAE7D,YAAY,OAAO,SAAuD,EAEzE;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,2BAA2B;IAExD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/kms/error/sim-kms.error.js

@@ -0,0 +1,101 @@
+/**
+ * Base class for simulated KMS errors.
+ */
+export class SimKmsError extends Error {
+    $metadata;
+    constructor(message, $metadata = {}) {
+        super(message);
+        this.$metadata = $metadata;
+    }
+}
+/**
+ * Simulated KMS NotFoundException error.
+ *
+ * Real KMS reports a key, alias or key ARN it cannot find this way, whether
+ * the identifier is unknown or belongs to another Account or Region.
+ */
+export class SimKmsNotFoundException extends SimKmsError {
+    name = "NotFoundException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS AlreadyExistsException error.
+ */
+export class SimKmsAlreadyExistsException extends SimKmsError {
+    name = "AlreadyExistsException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS DisabledException error.
+ *
+ * Real KMS distinguishes a disabled key from one pending deletion: a
+ * cryptographic operation on a disabled key fails this way, while a key
+ * pending deletion fails with KMSInvalidStateException.
+ */
+export class SimKmsDisabledException extends SimKmsError {
+    name = "DisabledException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS KMSInvalidStateException error.
+ */
+export class SimKmsInvalidStateException extends SimKmsError {
+    name = "KMSInvalidStateException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS InvalidCiphertextException error.
+ *
+ * This covers every reason a ciphertext will not open: it was not produced by
+ * this simulation, it was produced under a different key, or the encryption
+ * context does not match the one it was encrypted with. Real KMS is equally
+ * uninformative here on purpose, because saying more would leak something
+ * about the key or the plaintext.
+ */
+export class SimKmsInvalidCiphertextException extends SimKmsError {
+    name = "InvalidCiphertextException";
+    constructor(message = "The ciphertext refers to a key that does not exist") {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS IncorrectKeyException error.
+ *
+ * Decrypt was given a KeyId, and the ciphertext was produced under a different
+ * key. Naming the key is optional for a symmetric ciphertext precisely because
+ * the blob already says which key made it, so a mismatch means the caller's
+ * expectation was wrong rather than the ciphertext being unreadable.
+ */
+export class SimKmsIncorrectKeyException extends SimKmsError {
+    name = "IncorrectKeyException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS ValidationException error.
+ */
+export class SimKmsValidationException extends SimKmsError {
+    name = "ValidationException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS InvalidKeyUsageException error.
+ */
+export class SimKmsInvalidKeyUsageException extends SimKmsError {
+    name = "InvalidKeyUsageException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+//# sourceMappingURL=sim-kms.error.js.map