@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/kms/key/sim-kms-key-lifecycle.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The lifecycle states a simulated KMS key can be in.
+ *
+ * Real KMS has more of them, covering imported material, external key stores
+ * and multi-Region replication. These are the three a key reaches through the
+ * operations this simulation supports.
+ */
+export declare const SimKmsKeyState: {
+    readonly Enabled: "Enabled";
+    readonly Disabled: "Disabled";
+    readonly PendingDeletion: "PendingDeletion";
+};
+export type SimKmsKeyState = (typeof SimKmsKeyState)[keyof typeof SimKmsKeyState];
+/**
+ * The lifecycle state of one simulated KMS key, and the moves it allows.
+ *
+ * Kept apart from the key itself so that the key is about what it holds and
+ * what it can do with it, while the rules about which transitions are legal
+ * and which failure each illegal one produces live in one place.
+ */
+export declare class SimKmsKeyLifecycle {
+    private readonly keyArn;
+    private currentState;
+    private scheduledDeletionDate;
+    constructor(keyArn: string);
+    /**
+     * The current lifecycle state.
+     */
+    get state(): SimKmsKeyState;
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled(): boolean;
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate(): Date | undefined;
+    /**
+     * Enable the key, if it is not pending deletion.
+     */
+    enable(): void;
+    /**
+     * Disable the key, if it is not pending deletion.
+     */
+    disable(): void;
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * Real KMS does not delete a key on request. It waits out the window, during
+     * which the key is unusable but recoverable, because deleting key material
+     * destroys every ciphertext ever produced under it.
+     */
+    scheduleDeletion(deletionDate: Date): void;
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     *
+     * Real KMS does not restore the key to enabled: cancelling returns it to
+     * Disabled, and enabling it again is a separate deliberate step.
+     */
+    cancelDeletion(): void;
+    /**
+     * Refuse a cryptographic operation the current state does not allow.
+     *
+     * The two unusable states fail differently on real KMS, and the difference
+     * is worth keeping: DisabledException says to enable the key, while
+     * KMSInvalidStateException says the key is on its way out.
+     */
+    requireUsable(): void;
+    private refuseWhilePendingDeletion;
+}
+//# sourceMappingURL=sim-kms-key-lifecycle.d.ts.map

package/dist/service/kms/key/sim-kms-key-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-lifecycle.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;aACzB,OAAO,EAAE,SAAS;aAClB,QAAQ,EAAE,UAAU;aACpB,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,MAAM,MAAM,cAAc,GACxB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,qBAAqB,CAAmB;IAEhD,YAAY,MAAM,EAAE,MAAM,EAEzB;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,cAAc,CAE1B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAGb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAIzC;IAED;;;;;OAKG;IACH,cAAc,IAAI,IAAI,CASrB;IAED;;;;;;OAMG;IACH,aAAa,IAAI,IAAI,CAUpB;IAED,OAAO,CAAC,0BAA0B;CAOnC"}

package/dist/service/kms/key/sim-kms-key-lifecycle.js

@@ -0,0 +1,106 @@
+import { SimKmsDisabledException, SimKmsInvalidStateException, } from "../error/sim-kms.error.js";
+/**
+ * The lifecycle states a simulated KMS key can be in.
+ *
+ * Real KMS has more of them, covering imported material, external key stores
+ * and multi-Region replication. These are the three a key reaches through the
+ * operations this simulation supports.
+ */
+export const SimKmsKeyState = {
+    Enabled: "Enabled",
+    Disabled: "Disabled",
+    PendingDeletion: "PendingDeletion",
+};
+/**
+ * The lifecycle state of one simulated KMS key, and the moves it allows.
+ *
+ * Kept apart from the key itself so that the key is about what it holds and
+ * what it can do with it, while the rules about which transitions are legal
+ * and which failure each illegal one produces live in one place.
+ */
+export class SimKmsKeyLifecycle {
+    keyArn;
+    currentState = SimKmsKeyState.Enabled;
+    scheduledDeletionDate;
+    constructor(keyArn) {
+        this.keyArn = keyArn;
+    }
+    /**
+     * The current lifecycle state.
+     */
+    get state() {
+        return this.currentState;
+    }
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled() {
+        return this.currentState === SimKmsKeyState.Enabled;
+    }
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate() {
+        return this.scheduledDeletionDate;
+    }
+    /**
+     * Enable the key, if it is not pending deletion.
+     */
+    enable() {
+        this.refuseWhilePendingDeletion("enable");
+        this.currentState = SimKmsKeyState.Enabled;
+    }
+    /**
+     * Disable the key, if it is not pending deletion.
+     */
+    disable() {
+        this.refuseWhilePendingDeletion("disable");
+        this.currentState = SimKmsKeyState.Disabled;
+    }
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * Real KMS does not delete a key on request. It waits out the window, during
+     * which the key is unusable but recoverable, because deleting key material
+     * destroys every ciphertext ever produced under it.
+     */
+    scheduleDeletion(deletionDate) {
+        this.refuseWhilePendingDeletion("schedule");
+        this.currentState = SimKmsKeyState.PendingDeletion;
+        this.scheduledDeletionDate = deletionDate;
+    }
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     *
+     * Real KMS does not restore the key to enabled: cancelling returns it to
+     * Disabled, and enabling it again is a separate deliberate step.
+     */
+    cancelDeletion() {
+        if (this.currentState !== SimKmsKeyState.PendingDeletion) {
+            throw new SimKmsInvalidStateException(`Key ${this.keyArn} is not pending deletion`);
+        }
+        this.currentState = SimKmsKeyState.Disabled;
+        this.scheduledDeletionDate = undefined;
+    }
+    /**
+     * Refuse a cryptographic operation the current state does not allow.
+     *
+     * The two unusable states fail differently on real KMS, and the difference
+     * is worth keeping: DisabledException says to enable the key, while
+     * KMSInvalidStateException says the key is on its way out.
+     */
+    requireUsable() {
+        if (this.currentState === SimKmsKeyState.PendingDeletion) {
+            throw new SimKmsInvalidStateException(`Key ${this.keyArn} is pending deletion and cannot be used`);
+        }
+        if (this.currentState === SimKmsKeyState.Disabled) {
+            throw new SimKmsDisabledException(`Key ${this.keyArn} is disabled`);
+        }
+    }
+    refuseWhilePendingDeletion(action) {
+        if (this.currentState === SimKmsKeyState.PendingDeletion) {
+            throw new SimKmsInvalidStateException(`Key ${this.keyArn} is already pending deletion and cannot be ${action}d`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-lifecycle.js.map

package/dist/service/kms/key/sim-kms-key-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAKX;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IACxB,YAAY,GAAmB,cAAc,CAAC,OAAO,CAAC;IACtD,qBAAqB,CAAmB;IAEhD,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,OAAO,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAkB;QACjC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,eAAe,CAAC;QACnD,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YACzD,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,MAAM,0BAA0B,CAC7C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;QAC5C,IAAI,CAAC,qBAAqB,GAAG,SAAS,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YACzD,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,MAAM,yCAAyC,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,MAAc;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YACzD,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,MAAM,8CAA8C,MAAM,GAAG,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-material.d.ts

@@ -0,0 +1,36 @@
+import { SimKmsCiphertextBlobParts, type SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
+import { type SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
+interface SimKmsKeyMaterialProperties {
+    readonly keyArn: string;
+    readonly blob: SimKmsCiphertextBlob;
+    readonly bytes?: Uint8Array | undefined;
+}
+/**
+ * The key material of one simulated KMS key, and the operations that use it.
+ *
+ * The bytes are generated here and never leave: nothing exposes them, exactly
+ * as real key material never leaves KMS. That is a modelling choice rather
+ * than a security boundary, since this all runs in one process and anything
+ * sharing that process can reach the object.
+ */
+export declare class SimKmsKeyMaterial {
+    private readonly keyArn;
+    private readonly blob;
+    private readonly bytes;
+    private readonly aad;
+    constructor(properties: SimKmsKeyMaterialProperties);
+    /**
+     * Encrypt plaintext under this key, binding the encryption context.
+     */
+    encrypt(plaintext: Uint8Array, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    /**
+     * Decrypt a ciphertext produced under this key.
+     *
+     * A wrong encryption context fails the GCM authentication tag rather than an
+     * explicit comparison, so the failure comes from the cipher for the same
+     * reason it does on real KMS.
+     */
+    decrypt(parts: SimKmsCiphertextBlobParts, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-material.d.ts.map

package/dist/service/kms/key/sim-kms-key-material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-material.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AAezC,UAAU,2BAA2B;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IAExD,YAAY,UAAU,EAAE,2BAA2B,EAIlD;IAED;;OAEG;IACH,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAoBZ;IAED;;;;;;OAMG;IACH,OAAO,CACL,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAgBZ;CACF"}

package/dist/service/kms/key/sim-kms-key-material.js

@@ -0,0 +1,74 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { SimKmsInvalidCiphertextException } from "../error/sim-kms.error.js";
+import { SimKmsCiphertextBlobParts, } from "./sim-kms-ciphertext-blob.js";
+import { SimKmsEncryptionContextAad, } from "./sim-kms-encryption-context.js";
+/**
+ * The cipher backing a simulated symmetric KMS key.
+ *
+ * Real KMS symmetric keys are AES-256-GCM, so this uses the same thing rather
+ * than a stand-in. Encryption in this simulation is real encryption: a
+ * ciphertext genuinely cannot be read without the key, and the authentication
+ * tag genuinely fails on a tampered blob or a mismatched encryption context.
+ */
+const algorithm = "aes-256-gcm";
+const keyLength = 32;
+const ivLength = 12;
+/**
+ * The key material of one simulated KMS key, and the operations that use it.
+ *
+ * The bytes are generated here and never leave: nothing exposes them, exactly
+ * as real key material never leaves KMS. That is a modelling choice rather
+ * than a security boundary, since this all runs in one process and anything
+ * sharing that process can reach the object.
+ */
+export class SimKmsKeyMaterial {
+    keyArn;
+    blob;
+    bytes;
+    aad = new SimKmsEncryptionContextAad();
+    constructor(properties) {
+        this.keyArn = properties.keyArn;
+        this.blob = properties.blob;
+        this.bytes = properties.bytes ?? randomBytes(keyLength);
+    }
+    /**
+     * Encrypt plaintext under this key, binding the encryption context.
+     */
+    encrypt(plaintext, encryptionContext) {
+        const iv = randomBytes(ivLength);
+        const cipher = createCipheriv(algorithm, this.bytes, iv);
+        cipher.setAAD(this.aad.serialise(encryptionContext));
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        return this.blob.encode(new SimKmsCiphertextBlobParts({
+            keyArn: this.keyArn,
+            iv: Uint8Array.from(iv),
+            authTag: Uint8Array.from(authTag),
+            ciphertext: Uint8Array.from(ciphertext),
+        }));
+    }
+    /**
+     * Decrypt a ciphertext produced under this key.
+     *
+     * A wrong encryption context fails the GCM authentication tag rather than an
+     * explicit comparison, so the failure comes from the cipher for the same
+     * reason it does on real KMS.
+     */
+    decrypt(parts, encryptionContext) {
+        const decipher = createDecipheriv(algorithm, this.bytes, parts.iv);
+        decipher.setAAD(this.aad.serialise(encryptionContext));
+        decipher.setAuthTag(parts.authTag);
+        try {
+            return Uint8Array.from(Buffer.concat([decipher.update(parts.ciphertext), decipher.final()]));
+        }
+        catch {
+            throw new SimKmsInvalidCiphertextException("The ciphertext could not be decrypted: it was produced under a " +
+                "different key, with a different encryption context, or has been " +
+                "altered");
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-material.js.map

package/dist/service/kms/key/sim-kms-key-material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-material.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EACL,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAQpB;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAS;IACf,IAAI,CAAuB;IAC3B,KAAK,CAAa;IAClB,GAAG,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAExD,YAAY,UAAuC;QACjD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAqB,EACrB,iBAA2C;QAE3C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAErD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CACrB,IAAI,yBAAyB,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACjC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SACxC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,KAAgC,EAChC,iBAA2C;QAE3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gCAAgC,CACxC,iEAAiE;gBAC/D,kEAAkE;gBAClE,SAAS,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-metadata.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimKmsKey, SimKmsKeyManager, SimKmsKeyState } from "./sim-kms-key.js";
+/**
+ * The KeyMetadata structure CreateKey and DescribeKey return.
+ *
+ * Only symmetric encryption keys are simulated, so the fields describing key
+ * type are constants rather than stored state. They are reported anyway
+ * because application code reads them to decide what a key can do.
+ */
+export interface SimKmsKeyMetadata {
+    readonly AWSAccountId: SimAwsAccountId;
+    readonly KeyId: string;
+    readonly Arn: string;
+    readonly CreationDate: Date;
+    readonly Enabled: boolean;
+    readonly Description: string;
+    readonly KeyUsage: "ENCRYPT_DECRYPT";
+    readonly KeyState: SimKmsKeyState;
+    readonly DeletionDate?: Date | undefined;
+    readonly Origin: "AWS_KMS";
+    readonly KeyManager: SimKmsKeyManager;
+    readonly KeySpec: "SYMMETRIC_DEFAULT";
+    readonly CustomerMasterKeySpec: "SYMMETRIC_DEFAULT";
+    readonly EncryptionAlgorithms: readonly ["SYMMETRIC_DEFAULT"];
+    readonly MultiRegion: false;
+}
+/**
+ * Builds the AWS-shaped view of a stored key.
+ *
+ * Kept apart from SimKmsKey so the stored key stays a model of what a key is
+ * and does, rather than also owning the shape two commands happen to return.
+ */
+export declare class SimKmsKeyMetadataView {
+    private readonly accountId;
+    constructor(accountId: SimAwsAccountId);
+    /**
+     * Describe a key the way KMS reports it.
+     */
+    describe(key: SimKmsKey): SimKmsKeyMetadata;
+    /**
+     * Copy a date, so the response never hands out the key's own instance.
+     */
+    private copied;
+}
+//# sourceMappingURL=sim-kms-key-metadata.d.ts.map

package/dist/service/kms/key/sim-kms-key-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-metadata.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACf,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;IACpD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAE5C,YAAY,SAAS,EAAE,eAAe,EAErC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,iBAAiB,CAkB1C;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/kms/key/sim-kms-key-metadata.js

@@ -0,0 +1,44 @@
+/**
+ * Builds the AWS-shaped view of a stored key.
+ *
+ * Kept apart from SimKmsKey so the stored key stays a model of what a key is
+ * and does, rather than also owning the shape two commands happen to return.
+ */
+export class SimKmsKeyMetadataView {
+    accountId;
+    constructor(accountId) {
+        this.accountId = accountId;
+    }
+    /**
+     * Describe a key the way KMS reports it.
+     */
+    describe(key) {
+        return {
+            AWSAccountId: this.accountId,
+            KeyId: key.keyId,
+            Arn: key.arn,
+            CreationDate: new Date(key.creationDate),
+            Enabled: key.isEnabled,
+            Description: key.description,
+            KeyUsage: "ENCRYPT_DECRYPT",
+            KeyState: key.keyState,
+            DeletionDate: this.copied(key.deletionDate),
+            Origin: "AWS_KMS",
+            KeyManager: key.keyManager,
+            KeySpec: "SYMMETRIC_DEFAULT",
+            CustomerMasterKeySpec: "SYMMETRIC_DEFAULT",
+            EncryptionAlgorithms: ["SYMMETRIC_DEFAULT"],
+            MultiRegion: false,
+        };
+    }
+    /**
+     * Copy a date, so the response never hands out the key's own instance.
+     */
+    copied(date) {
+        if (date === undefined) {
+            return undefined;
+        }
+        return new Date(date);
+    }
+}
+//# sourceMappingURL=sim-kms-key-metadata.js.map

package/dist/service/kms/key/sim-kms-key-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-metadata.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,SAAS,CAAkB;IAE5C,YAAY,SAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAc;QACrB,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,SAAS;YAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACxC,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,mBAAmB;YAC5B,qBAAqB,EAAE,mBAAmB;YAC1C,oBAAoB,EAAE,CAAC,mBAAmB,CAAC;YAC3C,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,IAAsB;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-policy.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamResourcePolicyInput } from "../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * The name real KMS reports a key's policy under. A KMS key has exactly one
+ * policy and it is always called this.
+ */
+export declare const simKmsKeyPolicyName = "default";
+/**
+ * The key policy of one simulated KMS key.
+ *
+ * Every KMS key has a policy and it cannot be removed, which is what makes it
+ * the root of trust for the key: an IAM policy granting kms:Decrypt achieves
+ * nothing unless the key policy allows the access too. That is unlike other
+ * AWS resource policies, where the resource having no policy at all simply
+ * leaves the decision to IAM.
+ */
+export declare class SimKmsKeyPolicy {
+    private readonly keyArn;
+    private policyDocument;
+    constructor(keyArn: string, document: SimIamPolicyDocument);
+    /**
+     * Build the default policy CreateKey applies when given no policy.
+     *
+     * This is the policy the AWS console and CLI create: it allows the Account
+     * root every KMS action, which is how a key ends up usable by whichever of
+     * the Account's principals IAM allows. A key created with a policy that
+     * omits this statement can only be used by the principals it names, and no
+     * IAM policy will widen that.
+     */
+    static default(keyArn: string, accountId: SimAwsAccountId): SimKmsKeyPolicy;
+    /**
+     * The stored policy document.
+     */
+    document(): SimIamPolicyDocument;
+    /**
+     * Replace the stored policy document.
+     */
+    replaceWith(document: SimIamPolicyDocument): void;
+    /**
+     * This policy as the resource-policy side of an IAM authorization.
+     */
+    asResourcePolicy(): SimIamResourcePolicyInput;
+}
+//# sourceMappingURL=sim-kms-key-policy.d.ts.map

package/dist/service/kms/key/sim-kms-key-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC/G,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,cAAc,CAAuB;IAE7C,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAGzD;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,eAAe,CAc1E;IAED;;OAEG;IACH,QAAQ,IAAI,oBAAoB,CAE/B;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,gBAAgB,IAAI,yBAAyB,CAM5C;CACF"}

package/dist/service/kms/key/sim-kms-key-policy.js

@@ -0,0 +1,69 @@
+/**
+ * The name real KMS reports a key's policy under. A KMS key has exactly one
+ * policy and it is always called this.
+ */
+export const simKmsKeyPolicyName = "default";
+/**
+ * The key policy of one simulated KMS key.
+ *
+ * Every KMS key has a policy and it cannot be removed, which is what makes it
+ * the root of trust for the key: an IAM policy granting kms:Decrypt achieves
+ * nothing unless the key policy allows the access too. That is unlike other
+ * AWS resource policies, where the resource having no policy at all simply
+ * leaves the decision to IAM.
+ */
+export class SimKmsKeyPolicy {
+    keyArn;
+    policyDocument;
+    constructor(keyArn, document) {
+        this.keyArn = keyArn;
+        this.policyDocument = document;
+    }
+    /**
+     * Build the default policy CreateKey applies when given no policy.
+     *
+     * This is the policy the AWS console and CLI create: it allows the Account
+     * root every KMS action, which is how a key ends up usable by whichever of
+     * the Account's principals IAM allows. A key created with a policy that
+     * omits this statement can only be used by the principals it names, and no
+     * IAM policy will widen that.
+     */
+    static default(keyArn, accountId) {
+        return new SimKmsKeyPolicy(keyArn, {
+            Version: "2012-10-17",
+            Id: "key-default-1",
+            Statement: [
+                {
+                    Sid: "Enable IAM User Permissions",
+                    Effect: "Allow",
+                    Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+                    Action: "kms:*",
+                    Resource: "*",
+                },
+            ],
+        });
+    }
+    /**
+     * The stored policy document.
+     */
+    document() {
+        return this.policyDocument;
+    }
+    /**
+     * Replace the stored policy document.
+     */
+    replaceWith(document) {
+        this.policyDocument = document;
+    }
+    /**
+     * This policy as the resource-policy side of an IAM authorization.
+     */
+    asResourcePolicy() {
+        return {
+            document: this.policyDocument,
+            policyName: simKmsKeyPolicyName,
+            resourceArn: this.keyArn,
+        };
+    }
+}
+//# sourceMappingURL=sim-kms-key-policy.js.map

package/dist/service/kms/key/sim-kms-key-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAS;IACxB,cAAc,CAAuB;IAE7C,YAAY,MAAc,EAAE,QAA8B;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAc,EAAE,SAA0B;QACvD,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,YAAY;YACrB,EAAE,EAAE,eAAe;YACnB,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,6BAA6B;oBAClC,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,GAAG,EAAE,gBAAgB,SAAS,OAAO,EAAE;oBACpD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA8B;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,UAAU,EAAE,mBAAmB;YAC/B,WAAW,EAAE,IAAI,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-store.d.ts

@@ -0,0 +1,58 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { SimKmsAlias } from "./sim-kms-alias.js";
+import { type SimKmsKey, type SimKmsKeyId } from "./sim-kms-key.js";
+import type { SimKmsKeyFactory } from "./sim-kms-key-factory.js";
+interface SimKmsKeyStoreProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly keyFactory: SimKmsKeyFactory;
+}
+/**
+ * The keys and aliases of one simulated KMS scope, and how a KeyId resolves.
+ *
+ * Every KMS operation takes its target as a `KeyId` that may be a key ID, a
+ * key ARN, an alias name or an alias ARN, so resolution belongs in one place
+ * rather than in each command handler.
+ */
+export declare class SimKmsKeyStore {
+    readonly keys: Map<string, SimKmsKey>;
+    readonly aliases: Map<string, SimKmsAlias>;
+    private readonly accountRegionScope;
+    private readonly keyFactory;
+    private readonly identifiers;
+    constructor(properties: SimKmsKeyStoreProperties);
+    /**
+     * Store a newly created key.
+     */
+    add(key: SimKmsKey): void;
+    /**
+     * Resolve a KeyId to the key it names, or refuse.
+     */
+    require(keyId: string | undefined): SimKmsKey;
+    /**
+     * Resolve a KeyId in any of the forms real KMS accepts.
+     *
+     * An alias of an AWS managed key resolves to a key created on demand, since
+     * that is how such a key comes into existence on real AWS: the service that
+     * needs it asks for it, and it appears without anyone creating it.
+     */
+    find(keyId: string): SimKmsKey | undefined;
+    /**
+     * Point an alias at a key, refusing a name already in use.
+     */
+    addAlias(aliasName: string, targetKey: SimKmsKey): SimKmsAlias;
+    /**
+     * The aliases pointing at one key, or all of them.
+     */
+    aliasesFor(keyId: SimKmsKeyId | undefined): readonly SimKmsAlias[];
+    /**
+     * Find the key an alias points at, creating an AWS managed key if the alias
+     * is a reserved one that has not been used yet.
+     */
+    private findByAlias;
+    /**
+     * Create an AWS managed key on first reference to its reserved alias.
+     */
+    private makeAwsManagedKey;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-store.d.ts.map

package/dist/service/kms/key/sim-kms-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-store.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAM1F,OAAO,EAAE,WAAW,EAAwB,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,SAAgB,IAAI,yBAAqC;IACzD,SAAgB,OAAO,2BAAkC;IAEzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IAExD,YAAY,UAAU,EAAE,wBAAwB,EAM/C;IAED;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAExB;IAED;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAc5C;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAYzC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,WAAW,CAgB7D;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,WAAW,EAAE,CAQjE;IAED;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAW1B"}