@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/iam/sim-iam.js

@@ -1,16 +1,6 @@
-import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { BackgroundTasks, } from "../../util/background/background.js";
-import { SimIamRoleCommandHandlers } from "./command/role/sim-iam-role-command-handlers.js";
-import { SimIamCredentialRegistry } from "./credential/sim-iam-credential-registry.js";
-import { SimIamRandomSessionCredentialGenerator, } from "./credential/session/sim-iam-session-cred-gen.js";
-import { SimIamSessionManager } from "./credential/session/sim-iam-session-manager.js";
-import { SimIamRandomUserCredentialGenerator, } from "./credential/user/sim-iam-user-credential-generator.js";
-import { SimIamUserCommandHandlers } from "./command/user/sim-iam-user-command-handlers.js";
-import { SimIamPolicyCommandHandlers } from "./command/policy/sim-iam-policy-command-handlers.js";
-import { SimIamActionAuthorizer } from "./authorize/sim-iam-action-authorizer.js";
-import { SimIamAccountAuthZ } from "./authorize/sim-iam-account-auth-z.js";
 import { SimIamCloudFormationResourceFactory } from "./cfn/sim-cfn-iam-resource-factory.js";
 import { SimIamSdkCommandRouter } from "./sdk/sim-iam-sdk-command-router.js";
+import { SimIamAccountParts, } from "./sim-iam-account-parts.js";
 /**
  * Simulated IAM service facade. Handles SDK commands. Emulates AWS behaviour
  * and state.
@@ -20,65 +10,34 @@ import { SimIamSdkCommandRouter } from "./sdk/sim-iam-sdk-command-router.js";
  * service facade per Account.
  */
 export class SimIam {
+    /**
+     * The simulated AWS Account this IAM belongs to.
+     *
+     * A standalone SimIam generates one, so this is how a test naming its own
+     * principals finds out which Account they should belong to.
+     */
+    accountId;
     /**
      * Manage temporary sessions belonging to this simulated IAM Account.
      */
     sessionManager;
     credentials;
-    policies = new Map();
-    roles = new Map();
-    users = new Map();
-    background;
+    policies;
+    roles;
     cfnFactory;
-    roleCommands;
-    userCommands;
-    policyCommands;
+    commands;
     accountAuthZ;
     sdkRouter = new SimIamSdkCommandRouter(this);
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), sessionCredentialGenerator = new SimIamRandomSessionCredentialGenerator(), userCredentialGenerator = new SimIamRandomUserCredentialGenerator(), } = properties;
-        // The scheduler is this simulation's clock, so session expiry is judged in
-        // the same time as every other simulated timestamp.
-        const credentialRegistry = properties.credentialRegistry ??
-            new SimIamCredentialRegistry({ clock: background });
-        this.background = background;
-        this.credentials = credentialRegistry;
-        this.sessionManager = new SimIamSessionManager({
-            accountId: accountRegionScope.accountId,
-            roles: this.roles,
-            credentialRegistry,
-            credentialGenerator: sessionCredentialGenerator,
-        });
+        const parts = new SimIamAccountParts(properties);
+        this.accountId = parts.accountId;
+        this.policies = parts.policies;
+        this.roles = parts.roles;
+        this.credentials = parts.credentials;
+        this.sessionManager = parts.sessionManager;
+        this.accountAuthZ = parts.accountAuthZ;
+        this.commands = parts.commandHandlers(this);
         this.cfnFactory = new SimIamCloudFormationResourceFactory(this);
-        this.accountAuthZ = new SimIamAccountAuthZ({
-            accountId: accountRegionScope.accountId,
-            policies: this.policies,
-            roles: this.roles,
-            users: this.users,
-            credentialIdentityResolver: credentialRegistry,
-        });
-        const authorizer = new SimIamActionAuthorizer({ iam: this });
-        this.roleCommands = new SimIamRoleCommandHandlers({
-            accountId: accountRegionScope.accountId,
-            roles: this.roles,
-            background: this.background,
-            authorizer,
-        });
-        this.userCommands = new SimIamUserCommandHandlers({
-            accountId: accountRegionScope.accountId,
-            users: this.users,
-            credentialRegistry,
-            credentialGenerator: userCredentialGenerator,
-            background: this.background,
-            authorizer,
-        });
-        this.policyCommands = new SimIamPolicyCommandHandlers({
-            accountId: accountRegionScope.accountId,
-            policies: this.policies,
-            users: this.users,
-            background: this.background,
-            authorizer,
-        });
     }
     /**
      * Evaluate an IAM authorization attempt against policies relevant to the
@@ -87,71 +46,83 @@ export class SimIam {
     authorize(input) {
         return this.accountAuthZ.authorize(input);
     }
+    /**
+     * Identity-based policies this Account applies to one of its own principals.
+     *
+     * This is how another Account's IAM asks this Account what it grants a
+     * principal of its own, which is the caller's side of a cross-Account
+     * request. Real AWS requires that side to allow the action as well as the
+     * resource's own resource-based policy.
+     * @internal
+     */
+    identityPolicySourcesFor(principal) {
+        return this.accountAuthZ.identityPolicySourcesFor(principal);
+    }
     /**
      * Handle a Create Policy Command from the SDK.
      */
     async createPolicy(command, options) {
-        return await this.policyCommands.createPolicy(command, options);
+        return await this.commands.policies.createPolicy(command, options);
     }
     /**
      * Handle a Get Policy Command from the SDK.
      */
     async getPolicy(command, options) {
-        return await this.policyCommands.getPolicy(command, options);
+        return await this.commands.policies.getPolicy(command, options);
     }
     /**
      * Handle a List Policies Command from the SDK.
      */
     async listPolicies(command, options) {
-        return await this.policyCommands.listPolicies(command, options);
+        return await this.commands.policies.listPolicies(command, options);
     }
     /**
      * Handle a Put Role Policy Command from the SDK.
      */
     async putRolePolicy(command, options) {
-        return await this.roleCommands.putRolePolicy(command, options);
+        return await this.commands.roles.putRolePolicy(command, options);
     }
     /**
      * Handle an IAM PutUserPolicy command.
      */
     async putUserPolicy(command, options) {
-        return await this.policyCommands.putUserPolicy(command, options);
+        return await this.commands.policies.putUserPolicy(command, options);
     }
     /**
      * Handle a Create Role Command from the SDK.
      */
     async createRole(command, options) {
-        return await this.roleCommands.createRole(command, options);
+        return await this.commands.roles.createRole(command, options);
     }
     /**
      * Handle an Attach Role Policy Command from the SDK.
      */
     async attachRolePolicy(command, options) {
-        return await this.roleCommands.attachRolePolicy(command, options);
+        return await this.commands.roles.attachRolePolicy(command, options);
     }
     /**
      * Handle a Get Role Command from the SDK.
      */
     async getRole(command, options) {
-        return await this.roleCommands.getRole(command, options);
+        return await this.commands.roles.getRole(command, options);
     }
     /**
      * Handle a List Roles Command from the SDK.
      */
     async listRoles(command, options) {
-        return await this.roleCommands.listRoles(command, options);
+        return await this.commands.roles.listRoles(command, options);
     }
     /**
      * Handle an IAM CreateUser command.
      */
     async createUser(command, options) {
-        return await this.userCommands.createUser(command, options);
+        return await this.commands.users.createUser(command, options);
     }
     /**
      * Handle an IAM CreateAccessKey command.
      */
     async createAccessKey(command, options) {
-        return await this.userCommands.createAccessKey(command, options);
+        return await this.commands.users.createAccessKey(command, options);
     }
     /**
      * Get this service's CloudFormation Resource factory.

package/dist/service/iam/sim-iam.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam.js","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAcjG,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAc7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAW5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EACL,sCAAsC,GAEvC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EACL,mCAAmC,GAEpC,MAAM,wDAAwD,CAAC;AAUhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAM3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAG5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAW7E;;;;;;;GAOG;AACH,MAAM,OAAO,MAAM;IACjB;;OAEG;IACa,cAAc,CAAuB;IAErC,WAAW,CAA2B;IAEtC,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7C,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE9C,UAAU,CAAsB;IAChC,UAAU,CAA+B;IACzC,YAAY,CAA4B;IACxC,YAAY,CAA4B;IACxC,cAAc,CAA8B;IAC5C,YAAY,CAAqB;IACjC,SAAS,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9D,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,0BAA0B,GAAG,IAAI,sCAAsC,EAAE,EACzE,uBAAuB,GAAG,IAAI,mCAAmC,EAAE,GACpE,GAAG,UAAU,CAAC;QAEf,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB;YAC7B,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC;YAC7C,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,0BAA0B;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC;YACzC,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,0BAA0B,EAAE,kBAAkB;SAC/C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,GAAG,IAAI,yBAAyB,CAAC;YAChD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,yBAAyB,CAAC;YAChD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,kBAAkB;YAClB,mBAAmB,EAAE,uBAAuB;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,SAAS,EAAE,kBAAkB,CAAC,SAAS;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAmC,EACnC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,OAA0B,EAC1B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAkC,EAClC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-iam.js","sourceRoot":"","sources":["../../../src/service/iam/sim-iam.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAM5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAM7E,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,OAAO,MAAM;IAGjB;;;;;OAKG;IACa,SAAS,CAAkB;IAE3C;;OAEG;IACa,cAAc,CAAuB;IAErC,WAAW,CAA2B;IAEtC,QAAQ,CAAmC;IAC3C,KAAK,CAAkC;IAEtC,UAAU,CAA+B;IACzC,QAAQ,CAAwB;IAChC,YAAY,CAAqB;IACjC,SAAS,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9D,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEjD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,SAA0B;QAE1B,OAAO,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAmC,EACnC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,OAA0B,EAC1B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAA4B,EAC5B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAkC,EAClC,OAA8B;QAE9B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/service/kms/command/alias/alias.command.d.ts

@@ -0,0 +1,43 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim KMS CreateAlias command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/CreateAliasCommand/
+ */
+export interface SimCreateAliasCommand {
+    readonly input: SimCreateAliasCommandInput;
+}
+export interface SimCreateAliasCommandInput {
+    readonly AliasName?: string | undefined;
+    readonly TargetKeyId?: string | undefined;
+}
+export interface SimCreateAliasCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS ListAliases command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/ListAliasesCommand/
+ */
+export interface SimListAliasesCommand {
+    readonly input?: SimListAliasesCommandInput | undefined;
+}
+export interface SimListAliasesCommandInput {
+    /**
+     * Narrows the result to the aliases of one key. Real KMS returns every alias
+     * in the Region when this is omitted.
+     */
+    readonly KeyId?: string | undefined;
+    readonly Limit?: number | undefined;
+}
+export interface SimListAliasesCommandEntry {
+    readonly AliasName: string;
+    readonly AliasArn: string;
+    readonly TargetKeyId: string;
+}
+export interface SimListAliasesCommandOutput {
+    readonly Aliases?: readonly SimListAliasesCommandEntry[] | undefined;
+    readonly Truncated?: boolean | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=alias.command.d.ts.map

package/dist/service/kms/command/alias/alias.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/alias.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/alias/alias.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=alias.command.js.map

package/dist/service/kms/command/alias/alias.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/alias.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimCreateAliasCommand, SimCreateAliasCommandOutput, SimListAliasesCommand, SimListAliasesCommandOutput } from "./alias.command.js";
+interface SimKmsAliasCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsAliasCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The alias commands of one simulated KMS scope.
+ */
+export declare class SimKmsAliasCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly aliasName;
+    constructor(properties: SimKmsAliasCommandsProperties);
+    /**
+     * Point a new alias at a key.
+     *
+     * Real KMS checks kms:CreateAlias against both the alias and the target key.
+     * Only the key is checked here, because the key is what the alias gives
+     * access to and it is the half that carries a policy.
+     */
+    create(command: SimCreateAliasCommand, options?: SimKmsAliasCommandOptions): SimCreateAliasCommandOutput;
+    /**
+     * List aliases, optionally narrowed to one key's.
+     */
+    list(command: SimListAliasesCommand, options?: SimKmsAliasCommandOptions): SimListAliasesCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-alias-commands.d.ts.map

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,YAAY,UAAU,EAAE,6BAA6B,EAGpD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAc7B;IAED;;OAEG;IACH,IAAI,CACF,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAyB7B;CACF"}

package/dist/service/kms/command/alias/sim-kms-alias-commands.js

@@ -0,0 +1,56 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+import { SimKmsAliasName } from "../../key/sim-kms-alias.js";
+/**
+ * The alias commands of one simulated KMS scope.
+ */
+export class SimKmsAliasCommands {
+    keys;
+    authorizer;
+    aliasName = new SimKmsAliasName();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * Point a new alias at a key.
+     *
+     * Real KMS checks kms:CreateAlias against both the alias and the target key.
+     * Only the key is checked here, because the key is what the alias gives
+     * access to and it is the half that carries a policy.
+     */
+    create(command, options) {
+        const aliasName = command.input.AliasName;
+        if (aliasName === undefined) {
+            throw new SimKmsValidationException("AliasName is required");
+        }
+        this.aliasName.validateCustomerAlias(aliasName);
+        const key = this.keys.require(command.input.TargetKeyId);
+        this.authorizer.authorizeKey("kms:CreateAlias", key, options?.caller);
+        this.keys.addAlias(aliasName, key);
+        return { $metadata: {} };
+    }
+    /**
+     * List aliases, optionally narrowed to one key's.
+     */
+    list(command, options) {
+        this.authorizer.authorizeAccount("kms:ListAliases", options?.caller);
+        const keyId = command.input?.KeyId;
+        const aliases = this.keys
+            .aliasesFor(keyId === undefined ? undefined : this.keys.require(keyId).keyId)
+            .map((alias) => ({
+            AliasName: alias.aliasName,
+            AliasArn: alias.arn,
+            TargetKeyId: alias.targetKeyId,
+        }));
+        const limit = command.input?.Limit;
+        if (limit === undefined || aliases.length <= limit) {
+            return { $metadata: {}, Aliases: aliases, Truncated: false };
+        }
+        return {
+            $metadata: {},
+            Aliases: aliases.slice(0, limit),
+            Truncated: true,
+        };
+    }
+}
+//# sourceMappingURL=sim-kms-alias-commands.js.map

package/dist/service/kms/command/alias/sim-kms-alias-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAmB7D;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnD,YAAY,UAAyC;QACnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA8B,EAC9B,OAAmC;QAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,CACF,OAA8B,EAC9B,OAAmC;QAEnC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI;aACtB,UAAU,CACT,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACjE;aACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC,CAAC;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAChC,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts

@@ -0,0 +1,38 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimKmsKey } from "../../key/sim-kms-key.js";
+interface SimKmsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * Applies simulated IAM authorization to KMS requests.
+ *
+ * KMS splits into two kinds of request, and they authorize differently:
+ *
+ * - operations on an existing key, where the key policy is mandatory and must
+ *   allow the request, so an identity policy alone never reaches the key;
+ * - operations with no key to speak of, such as CreateKey and ListKeys, which
+ *   real KMS gives no resource-level permissions and so are authorized against
+ *   `*` with identity policies alone.
+ */
+export declare class SimKmsAuthorizer {
+    private readonly iam;
+    private readonly accountRegionScope;
+    constructor(properties: SimKmsAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a key.
+     *
+     * The key's policy is supplied as the resource side and is required to
+     * allow: this is the rule that makes a KMS key policy the root of trust for
+     * its key rather than one more input to the decision.
+     */
+    authorizeKey(action: string, key: SimKmsKey, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may perform an action that names no particular key.
+     */
+    authorizeAccount(action: string, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=sim-kms-authorizer.d.ts.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAgBxE;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAY5D;CACF"}

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -0,0 +1,58 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies simulated IAM authorization to KMS requests.
+ *
+ * KMS splits into two kinds of request, and they authorize differently:
+ *
+ * - operations on an existing key, where the key policy is mandatory and must
+ *   allow the request, so an identity policy alone never reaches the key;
+ * - operations with no key to speak of, such as CreateKey and ListKeys, which
+ *   real KMS gives no resource-level permissions and so are authorized against
+ *   `*` with identity policies alone.
+ */
+export class SimKmsAuthorizer {
+    iam;
+    accountRegionScope;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Ensure the caller may perform an action on a key.
+     *
+     * The key's policy is supplied as the resource side and is required to
+     * allow: this is the rule that makes a KMS key policy the root of trust for
+     * its key rather than one more input to the decision.
+     */
+    authorizeKey(action, key, caller) {
+        const decision = this.iam.authorize({
+            action,
+            resource: key.arn,
+            caller,
+            resourcePolicies: [key.policy.asResourcePolicy()],
+            requiresResourcePolicyAllow: true,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource: key.arn,
+            });
+        }
+    }
+    /**
+     * Ensure the caller may perform an action that names no particular key.
+     */
+    authorizeAccount(action, caller) {
+        const resource = `arn:aws:kms:${this.accountRegionScope.regionName}:${this.accountRegionScope.accountId}:key/*`;
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-authorizer.js.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQzE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAA0B;IAC7B,kBAAkB,CAA2B;IAE9D,YAAY,UAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAc,EAAE,GAAc,EAAE,MAAqB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,MAAM;YACN,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjD,2BAA2B,EAAE,IAAI;SAClC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc,EAAE,MAAqB;QACpD,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,CAAC;QAEhH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/crypto/crypto.command.d.ts

@@ -0,0 +1,68 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimKmsEncryptionContext } from "../../key/sim-kms-encryption-context.js";
+/**
+ * Minimal structural sim KMS Encrypt command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/EncryptCommand/
+ */
+export interface SimEncryptCommand {
+    readonly input: SimEncryptCommandInput;
+}
+export interface SimEncryptCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+}
+export interface SimEncryptCommandOutput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS Decrypt command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/DecryptCommand/
+ */
+export interface SimDecryptCommand {
+    readonly input: SimDecryptCommandInput;
+}
+export interface SimDecryptCommandInput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    /**
+     * Optional for a symmetric key, because the ciphertext names the key that
+     * produced it. Supplying it asks KMS to check that expectation, and the
+     * request fails if the ciphertext came from a different key.
+     */
+    readonly KeyId?: string | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+}
+export interface SimDecryptCommandOutput {
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS GenerateDataKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/GenerateDataKeyCommand/
+ */
+export interface SimGenerateDataKeyCommand {
+    readonly input: SimGenerateDataKeyCommandInput;
+}
+export interface SimGenerateDataKeyCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly KeySpec?: string | undefined;
+    readonly NumberOfBytes?: number | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+}
+export interface SimGenerateDataKeyCommandOutput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=crypto.command.d.ts.map

package/dist/service/kms/command/crypto/crypto.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/crypto.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEvF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAEjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CAClE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/crypto/crypto.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=crypto.command.js.map

package/dist/service/kms/command/crypto/crypto.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/crypto.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.d.ts

@@ -0,0 +1,40 @@
+import type { SimKmsKey } from "../../key/sim-kms-key.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+/**
+ * The only encryption algorithm a symmetric KMS key supports.
+ */
+export declare const simKmsSymmetricAlgorithm = "SYMMETRIC_DEFAULT";
+/**
+ * Resolves the key behind a ciphertext, and checks the caller's expectations.
+ *
+ * Decrypt is the one KMS operation whose target key comes from the ciphertext
+ * rather than the request, so working out which key that is, and what to say
+ * when it is not the one the caller expected, is its own small job.
+ */
+export declare class SimKmsCiphertextKey {
+    private readonly keys;
+    constructor(keys: SimKmsKeyStore);
+    /**
+     * Find the key a ciphertext was produced under.
+     *
+     * A blob naming a key this scope does not have is an unreadable ciphertext
+     * rather than a missing key, because the caller never named the key and so
+     * cannot be told which one is missing.
+     */
+    behind(keyArn: string): SimKmsKey;
+    /**
+     * Check a supplied KeyId against the key the ciphertext actually names.
+     *
+     * A KeyId naming no key at all is a missing key rather than the wrong one,
+     * so it is resolved the same way every other operation resolves its target.
+     */
+    requireExpected(keyId: string | undefined, key: SimKmsKey): void;
+    /**
+     * Refuse an encryption algorithm this simulation does not model.
+     *
+     * Only symmetric keys are simulated, so an asymmetric algorithm is refused
+     * rather than quietly treated as the symmetric one.
+     */
+    requireSymmetricAlgorithm(algorithm: string | undefined): void;
+}
+//# sourceMappingURL=sim-kms-ciphertext-key.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-ciphertext-key.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;GAEG;AACH,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IAEtC,YAAY,IAAI,EAAE,cAAc,EAE/B;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAQhC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CAU/D;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAM7D;CACF"}