@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/kms/key/sim-kms-key-policy.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamResourcePolicyInput } from "../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * The name real KMS reports a key's policy under. A KMS key has exactly one
+ * policy and it is always called this.
+ */
+export declare const simKmsKeyPolicyName = "default";
+/**
+ * The key policy of one simulated KMS key.
+ *
+ * Every KMS key has a policy and it cannot be removed, which is what makes it
+ * the root of trust for the key: an IAM policy granting kms:Decrypt achieves
+ * nothing unless the key policy allows the access too. That is unlike other
+ * AWS resource policies, where the resource having no policy at all simply
+ * leaves the decision to IAM.
+ */
+export declare class SimKmsKeyPolicy {
+    private readonly keyArn;
+    private policyDocument;
+    constructor(keyArn: string, document: SimIamPolicyDocument);
+    /**
+     * Build the default policy CreateKey applies when given no policy.
+     *
+     * This is the policy the AWS console and CLI create: it allows the Account
+     * root every KMS action, which is how a key ends up usable by whichever of
+     * the Account's principals IAM allows. A key created with a policy that
+     * omits this statement can only be used by the principals it names, and no
+     * IAM policy will widen that.
+     */
+    static default(keyArn: string, accountId: SimAwsAccountId): SimKmsKeyPolicy;
+    /**
+     * The stored policy document.
+     */
+    document(): SimIamPolicyDocument;
+    /**
+     * Replace the stored policy document.
+     */
+    replaceWith(document: SimIamPolicyDocument): void;
+    /**
+     * This policy as the resource-policy side of an IAM authorization.
+     */
+    asResourcePolicy(): SimIamResourcePolicyInput;
+}
+//# sourceMappingURL=sim-kms-key-policy.d.ts.map

package/dist/service/kms/key/sim-kms-key-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAC;AAC/G,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,cAAc,CAAuB;IAE7C,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAGzD;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,eAAe,CAc1E;IAED;;OAEG;IACH,QAAQ,IAAI,oBAAoB,CAE/B;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,gBAAgB,IAAI,yBAAyB,CAM5C;CACF"}

package/dist/service/kms/key/sim-kms-key-policy.js

@@ -0,0 +1,69 @@
+/**
+ * The name real KMS reports a key's policy under. A KMS key has exactly one
+ * policy and it is always called this.
+ */
+export const simKmsKeyPolicyName = "default";
+/**
+ * The key policy of one simulated KMS key.
+ *
+ * Every KMS key has a policy and it cannot be removed, which is what makes it
+ * the root of trust for the key: an IAM policy granting kms:Decrypt achieves
+ * nothing unless the key policy allows the access too. That is unlike other
+ * AWS resource policies, where the resource having no policy at all simply
+ * leaves the decision to IAM.
+ */
+export class SimKmsKeyPolicy {
+    keyArn;
+    policyDocument;
+    constructor(keyArn, document) {
+        this.keyArn = keyArn;
+        this.policyDocument = document;
+    }
+    /**
+     * Build the default policy CreateKey applies when given no policy.
+     *
+     * This is the policy the AWS console and CLI create: it allows the Account
+     * root every KMS action, which is how a key ends up usable by whichever of
+     * the Account's principals IAM allows. A key created with a policy that
+     * omits this statement can only be used by the principals it names, and no
+     * IAM policy will widen that.
+     */
+    static default(keyArn, accountId) {
+        return new SimKmsKeyPolicy(keyArn, {
+            Version: "2012-10-17",
+            Id: "key-default-1",
+            Statement: [
+                {
+                    Sid: "Enable IAM User Permissions",
+                    Effect: "Allow",
+                    Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+                    Action: "kms:*",
+                    Resource: "*",
+                },
+            ],
+        });
+    }
+    /**
+     * The stored policy document.
+     */
+    document() {
+        return this.policyDocument;
+    }
+    /**
+     * Replace the stored policy document.
+     */
+    replaceWith(document) {
+        this.policyDocument = document;
+    }
+    /**
+     * This policy as the resource-policy side of an IAM authorization.
+     */
+    asResourcePolicy() {
+        return {
+            document: this.policyDocument,
+            policyName: simKmsKeyPolicyName,
+            resourceArn: this.keyArn,
+        };
+    }
+}
+//# sourceMappingURL=sim-kms-key-policy.js.map

package/dist/service/kms/key/sim-kms-key-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-policy.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAS;IACxB,cAAc,CAAuB;IAE7C,YAAY,MAAc,EAAE,QAA8B;QACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAc,EAAE,SAA0B;QACvD,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,YAAY;YACrB,EAAE,EAAE,eAAe;YACnB,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,6BAA6B;oBAClC,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,GAAG,EAAE,gBAAgB,SAAS,OAAO,EAAE;oBACpD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA8B;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,UAAU,EAAE,mBAAmB;YAC/B,WAAW,EAAE,IAAI,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-store.d.ts

@@ -0,0 +1,58 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { SimKmsAlias } from "./sim-kms-alias.js";
+import { type SimKmsKey, type SimKmsKeyId } from "./sim-kms-key.js";
+import type { SimKmsKeyFactory } from "./sim-kms-key-factory.js";
+interface SimKmsKeyStoreProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly keyFactory: SimKmsKeyFactory;
+}
+/**
+ * The keys and aliases of one simulated KMS scope, and how a KeyId resolves.
+ *
+ * Every KMS operation takes its target as a `KeyId` that may be a key ID, a
+ * key ARN, an alias name or an alias ARN, so resolution belongs in one place
+ * rather than in each command handler.
+ */
+export declare class SimKmsKeyStore {
+    readonly keys: Map<string, SimKmsKey>;
+    readonly aliases: Map<string, SimKmsAlias>;
+    private readonly accountRegionScope;
+    private readonly keyFactory;
+    private readonly identifiers;
+    constructor(properties: SimKmsKeyStoreProperties);
+    /**
+     * Store a newly created key.
+     */
+    add(key: SimKmsKey): void;
+    /**
+     * Resolve a KeyId to the key it names, or refuse.
+     */
+    require(keyId: string | undefined): SimKmsKey;
+    /**
+     * Resolve a KeyId in any of the forms real KMS accepts.
+     *
+     * An alias of an AWS managed key resolves to a key created on demand, since
+     * that is how such a key comes into existence on real AWS: the service that
+     * needs it asks for it, and it appears without anyone creating it.
+     */
+    find(keyId: string): SimKmsKey | undefined;
+    /**
+     * Point an alias at a key, refusing a name already in use.
+     */
+    addAlias(aliasName: string, targetKey: SimKmsKey): SimKmsAlias;
+    /**
+     * The aliases pointing at one key, or all of them.
+     */
+    aliasesFor(keyId: SimKmsKeyId | undefined): readonly SimKmsAlias[];
+    /**
+     * Find the key an alias points at, creating an AWS managed key if the alias
+     * is a reserved one that has not been used yet.
+     */
+    private findByAlias;
+    /**
+     * Create an AWS managed key on first reference to its reserved alias.
+     */
+    private makeAwsManagedKey;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-store.d.ts.map

package/dist/service/kms/key/sim-kms-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-store.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAM1F,OAAO,EAAE,WAAW,EAAwB,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,SAAgB,IAAI,yBAAqC;IACzD,SAAgB,OAAO,2BAAkC;IAEzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IAExD,YAAY,UAAU,EAAE,wBAAwB,EAM/C;IAED;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAExB;IAED;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAc5C;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAYzC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,WAAW,CAgB7D;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,WAAW,EAAE,CAQjE;IAED;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAW1B"}

package/dist/service/kms/key/sim-kms-key-store.js

@@ -0,0 +1,111 @@
+import { SimKmsAlreadyExistsException, SimKmsNotFoundException, SimKmsValidationException, } from "../error/sim-kms.error.js";
+import { SimKmsAlias, simKmsAwsAliasPrefix } from "./sim-kms-alias.js";
+import { SimKmsKeyIdentifierParser } from "./sim-kms-key-identifier.js";
+import { SimKmsKeyManager, } from "./sim-kms-key.js";
+/**
+ * The keys and aliases of one simulated KMS scope, and how a KeyId resolves.
+ *
+ * Every KMS operation takes its target as a `KeyId` that may be a key ID, a
+ * key ARN, an alias name or an alias ARN, so resolution belongs in one place
+ * rather than in each command handler.
+ */
+export class SimKmsKeyStore {
+    keys = new Map();
+    aliases = new Map();
+    accountRegionScope;
+    keyFactory;
+    identifiers;
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
+        this.keyFactory = properties.keyFactory;
+        this.identifiers = new SimKmsKeyIdentifierParser(properties.accountRegionScope);
+    }
+    /**
+     * Store a newly created key.
+     */
+    add(key) {
+        this.keys.set(key.keyId, key);
+    }
+    /**
+     * Resolve a KeyId to the key it names, or refuse.
+     */
+    require(keyId) {
+        if (keyId === undefined || keyId === "") {
+            throw new SimKmsValidationException("KeyId is required");
+        }
+        const key = this.find(keyId);
+        if (key === undefined) {
+            throw new SimKmsNotFoundException(`Key '${keyId}' does not exist in Account ${this.accountRegionScope.accountId} Region ${this.accountRegionScope.regionName}`);
+        }
+        return key;
+    }
+    /**
+     * Resolve a KeyId in any of the forms real KMS accepts.
+     *
+     * An alias of an AWS managed key resolves to a key created on demand, since
+     * that is how such a key comes into existence on real AWS: the service that
+     * needs it asks for it, and it appears without anyone creating it.
+     */
+    find(keyId) {
+        const identifier = this.identifiers.parse(keyId);
+        if (identifier.aliasName !== undefined) {
+            return this.findByAlias(identifier.aliasName);
+        }
+        if (identifier.keyId === undefined) {
+            return undefined;
+        }
+        return this.keys.get(identifier.keyId);
+    }
+    /**
+     * Point an alias at a key, refusing a name already in use.
+     */
+    addAlias(aliasName, targetKey) {
+        if (this.aliases.has(aliasName)) {
+            throw new SimKmsAlreadyExistsException(`Alias '${aliasName}' already exists`);
+        }
+        const alias = new SimKmsAlias({
+            aliasName,
+            targetKeyId: targetKey.keyId,
+            accountRegionScope: this.accountRegionScope,
+        });
+        this.aliases.set(aliasName, alias);
+        return alias;
+    }
+    /**
+     * The aliases pointing at one key, or all of them.
+     */
+    aliasesFor(keyId) {
+        const all = this.aliases.values().toArray();
+        if (keyId === undefined) {
+            return all;
+        }
+        return all.filter((alias) => alias.targetKeyId === keyId);
+    }
+    /**
+     * Find the key an alias points at, creating an AWS managed key if the alias
+     * is a reserved one that has not been used yet.
+     */
+    findByAlias(aliasName) {
+        const alias = this.aliases.get(aliasName);
+        if (alias !== undefined) {
+            return this.keys.get(alias.targetKeyId);
+        }
+        if (!aliasName.startsWith(simKmsAwsAliasPrefix)) {
+            return undefined;
+        }
+        return this.makeAwsManagedKey(aliasName);
+    }
+    /**
+     * Create an AWS managed key on first reference to its reserved alias.
+     */
+    makeAwsManagedKey(aliasName) {
+        const key = this.keyFactory.make({
+            description: `Default key that protects my ${aliasName.slice(simKmsAwsAliasPrefix.length)} resources when no other key is defined`,
+            keyManager: SimKmsKeyManager.Aws,
+        });
+        this.add(key);
+        this.addAlias(aliasName, key);
+        return key;
+    }
+}
+//# sourceMappingURL=sim-kms-key-store.js.map

package/dist/service/kms/key/sim-kms-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-store.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EACL,gBAAgB,GAGjB,MAAM,kBAAkB,CAAC;AAQ1B;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACT,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExC,kBAAkB,CAA2B;IAC7C,UAAU,CAAmB;IAC7B,WAAW,CAA4B;IAExD,YAAY,UAAoC;QAC9C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,yBAAyB,CAC9C,UAAU,CAAC,kBAAkB,CAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAc;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAyB;QAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,KAAK,+BAA+B,IAAI,CAAC,kBAAkB,CAAC,SAAS,WAAW,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAC7H,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAa;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAiB,EAAE,SAAoB;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAA4B,CACpC,UAAU,SAAS,kBAAkB,CACtC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,SAAS;YACT,WAAW,EAAE,SAAS,CAAC,KAAK;YAC5B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAA8B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,SAAiB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,gCAAgC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,yCAAyC;YAClI,UAAU,EAAE,gBAAgB,CAAC,GAAG;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9B,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key.d.ts

@@ -0,0 +1,88 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimKmsCiphertextBlobParts } from "./sim-kms-ciphertext-blob.js";
+import type { SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
+import { type SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
+import type { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import type { SimKmsKeyPolicy } from "./sim-kms-key-policy.js";
+export { SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
+/**
+ * Who created and controls a key. AWS managed keys are created by a service
+ * on first use rather than by the customer, and cannot be deleted.
+ */
+export declare const SimKmsKeyManager: {
+    readonly Aws: "AWS";
+    readonly Customer: "CUSTOMER";
+};
+export type SimKmsKeyManager = (typeof SimKmsKeyManager)[keyof typeof SimKmsKeyManager];
+export type SimKmsKeyId = string;
+interface SimKmsKeyProperties {
+    readonly keyId: SimKmsKeyId;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly material: SimKmsKeyMaterial;
+    readonly policy: SimKmsKeyPolicy;
+    readonly creationDate: Date;
+    readonly description?: string | undefined;
+    readonly keyManager?: SimKmsKeyManager | undefined;
+}
+/**
+ * A stored simulated KMS key.
+ *
+ * The key owns its material, its policy and its lifecycle, because all three
+ * live exactly as long as the key does and every cryptographic operation needs
+ * to consult all three.
+ */
+export declare class SimKmsKey {
+    readonly keyId: SimKmsKeyId;
+    readonly arn: string;
+    readonly creationDate: Date;
+    readonly keyManager: SimKmsKeyManager;
+    readonly policy: SimKmsKeyPolicy;
+    readonly description: string;
+    private readonly material;
+    private readonly lifecycle;
+    constructor(properties: SimKmsKeyProperties);
+    /**
+     * The key's current lifecycle state.
+     */
+    get keyState(): SimKmsKeyState;
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled(): boolean;
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate(): Date | undefined;
+    /**
+     * Enable the key.
+     */
+    enable(): void;
+    /**
+     * Disable the key, leaving it present but unusable.
+     */
+    disable(): void;
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * An AWS managed key is refused. The service that owns it created it and
+     * only that service can remove it, so letting a test delete one would let
+     * the test pass on something real AWS would not allow. The failure is
+     * reported as an invalid state, which is one of the errors real
+     * ScheduleKeyDeletion returns, rather than claiming to know exactly which
+     * error AWS picks for this case.
+     */
+    scheduleDeletion(deletionDate: Date): void;
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion(): void;
+    /**
+     * Encrypt plaintext under this key.
+     */
+    encrypt(plaintext: Uint8Array, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    /**
+     * Decrypt a ciphertext produced under this key.
+     */
+    decrypt(parts: SimKmsCiphertextBlobParts, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+}
+//# sourceMappingURL=sim-kms-key.d.ts.map

package/dist/service/kms/key/sim-kms-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gBAAgB;aAC3B,GAAG,EAAE,KAAK;aACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAC1B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,SAAS;IACpB,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IACnC,SAAgB,UAAU,EAAE,gBAAgB,CAAC;IAC7C,SAAgB,MAAM,EAAE,eAAe,CAAC;IACxC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C,YAAY,UAAU,EAAE,mBAAmB,EAW1C;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAE7B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAEb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAQzC;IAED;;OAEG;IACH,cAAc,IAAI,IAAI,CAErB;IAED;;OAEG;IACH,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;IAED;;OAEG;IACH,OAAO,CACL,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;CACF"}

package/dist/service/kms/key/sim-kms-key.js

@@ -0,0 +1,106 @@
+import { SimKmsInvalidStateException } from "../error/sim-kms.error.js";
+import { SimKmsKeyLifecycle, } from "./sim-kms-key-lifecycle.js";
+export { SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
+/**
+ * Who created and controls a key. AWS managed keys are created by a service
+ * on first use rather than by the customer, and cannot be deleted.
+ */
+export const SimKmsKeyManager = {
+    Aws: "AWS",
+    Customer: "CUSTOMER",
+};
+/**
+ * A stored simulated KMS key.
+ *
+ * The key owns its material, its policy and its lifecycle, because all three
+ * live exactly as long as the key does and every cryptographic operation needs
+ * to consult all three.
+ */
+export class SimKmsKey {
+    keyId;
+    arn;
+    creationDate;
+    keyManager;
+    policy;
+    description;
+    material;
+    lifecycle;
+    constructor(properties) {
+        const { accountRegionScope } = properties;
+        this.keyId = properties.keyId;
+        this.arn = `arn:aws:kms:${accountRegionScope.regionName}:${accountRegionScope.accountId}:key/${properties.keyId}`;
+        this.material = properties.material;
+        this.policy = properties.policy;
+        this.creationDate = properties.creationDate;
+        this.description = properties.description ?? "";
+        this.keyManager = properties.keyManager ?? SimKmsKeyManager.Customer;
+        this.lifecycle = new SimKmsKeyLifecycle(this.arn);
+    }
+    /**
+     * The key's current lifecycle state.
+     */
+    get keyState() {
+        return this.lifecycle.state;
+    }
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled() {
+        return this.lifecycle.isEnabled;
+    }
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate() {
+        return this.lifecycle.deletionDate;
+    }
+    /**
+     * Enable the key.
+     */
+    enable() {
+        this.lifecycle.enable();
+    }
+    /**
+     * Disable the key, leaving it present but unusable.
+     */
+    disable() {
+        this.lifecycle.disable();
+    }
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * An AWS managed key is refused. The service that owns it created it and
+     * only that service can remove it, so letting a test delete one would let
+     * the test pass on something real AWS would not allow. The failure is
+     * reported as an invalid state, which is one of the errors real
+     * ScheduleKeyDeletion returns, rather than claiming to know exactly which
+     * error AWS picks for this case.
+     */
+    scheduleDeletion(deletionDate) {
+        if (this.keyManager === SimKmsKeyManager.Aws) {
+            throw new SimKmsInvalidStateException(`Key ${this.arn} is an AWS managed key and cannot be scheduled for deletion`);
+        }
+        this.lifecycle.scheduleDeletion(deletionDate);
+    }
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion() {
+        this.lifecycle.cancelDeletion();
+    }
+    /**
+     * Encrypt plaintext under this key.
+     */
+    encrypt(plaintext, encryptionContext) {
+        this.lifecycle.requireUsable();
+        return this.material.encrypt(plaintext, encryptionContext);
+    }
+    /**
+     * Decrypt a ciphertext produced under this key.
+     */
+    decrypt(parts, encryptionContext) {
+        this.lifecycle.requireUsable();
+        return this.material.decrypt(parts, encryptionContext);
+    }
+}
+//# sourceMappingURL=sim-kms-key.js.map

package/dist/service/kms/key/sim-kms-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAiBX;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IACJ,KAAK,CAAc;IACnB,GAAG,CAAS;IACZ,YAAY,CAAO;IACnB,UAAU,CAAmB;IAC7B,MAAM,CAAkB;IACxB,WAAW,CAAS;IAEnB,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAE/C,YAAY,UAA+B;QACzC,MAAM,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QAE1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,eAAe,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,SAAS,QAAQ,UAAU,CAAC,KAAK,EAAE,CAAC;QAClH,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAkB;QACjC,IAAI,IAAI,CAAC,UAAU,KAAK,gBAAgB,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,GAAG,6DAA6D,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAqB,EACrB,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,KAAgC,EAChC,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-policy-document.d.ts

@@ -0,0 +1,30 @@
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * Reads a key policy from the JSON string the real KMS API takes.
+ *
+ * CreateKey and PutKeyPolicy both take the policy this way, so parsing it, and
+ * refusing it in the same terms when it is not a policy document, belongs in
+ * one place.
+ */
+export declare class SimKmsPolicyDocument {
+    /**
+     * Parse a policy, or refuse if it is not valid JSON.
+     *
+     * A document object is accepted too, because writing one inline is the
+     * obvious thing to do from a test and stringifying it adds nothing.
+     */
+    parse(policy: string | SimIamPolicyDocument): SimIamPolicyDocument;
+    /**
+     * Parse an optional policy, leaving it undefined when none was given.
+     */
+    parseOptional(policy: string | undefined): SimIamPolicyDocument | undefined;
+    /**
+     * A policy has to be a JSON object. `null`, an array and a bare scalar are
+     * all valid JSON and none of them is a policy document, so refusing them
+     * here reports the problem where it was made rather than at the point some
+     * later authorization tries to evaluate them.
+     */
+    private requireDocument;
+    private parsed;
+}
+//# sourceMappingURL=sim-kms-policy-document.d.ts.map

package/dist/service/kms/key/sim-kms-policy-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-policy-document.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-policy-document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,oBAAoB,CAMjE;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAM1E;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,MAAM;CASf"}

package/dist/service/kms/key/sim-kms-policy-document.js

@@ -0,0 +1,54 @@
+import { SimKmsValidationException } from "../error/sim-kms.error.js";
+/**
+ * Reads a key policy from the JSON string the real KMS API takes.
+ *
+ * CreateKey and PutKeyPolicy both take the policy this way, so parsing it, and
+ * refusing it in the same terms when it is not a policy document, belongs in
+ * one place.
+ */
+export class SimKmsPolicyDocument {
+    /**
+     * Parse a policy, or refuse if it is not valid JSON.
+     *
+     * A document object is accepted too, because writing one inline is the
+     * obvious thing to do from a test and stringifying it adds nothing.
+     */
+    parse(policy) {
+        if (typeof policy !== "string") {
+            return policy;
+        }
+        return this.requireDocument(this.parsed(policy));
+    }
+    /**
+     * Parse an optional policy, leaving it undefined when none was given.
+     */
+    parseOptional(policy) {
+        if (policy === undefined) {
+            return undefined;
+        }
+        return this.parse(policy);
+    }
+    /**
+     * A policy has to be a JSON object. `null`, an array and a bare scalar are
+     * all valid JSON and none of them is a policy document, so refusing them
+     * here reports the problem where it was made rather than at the point some
+     * later authorization tries to evaluate them.
+     */
+    requireDocument(parsed) {
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)) {
+            throw new SimKmsValidationException("Policy is not a valid JSON policy document");
+        }
+        return parsed;
+    }
+    parsed(policy) {
+        try {
+            return JSON.parse(policy);
+        }
+        catch {
+            throw new SimKmsValidationException("Policy is not a valid JSON policy document");
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-policy-document.js.map

package/dist/service/kms/key/sim-kms-policy-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-policy-document.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-policy-document.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,MAAqC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAA0B;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,MAAe;QACrC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,yBAAyB,CACjC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/sdk/sim-kms-sdk-command-router.d.ts

@@ -0,0 +1,18 @@
+import { type SimSdkCommandRoute, type SimSdkCommandRouter } from "../../../sdk/index.js";
+import type { SimKms } from "../sim-kms.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated KMS instance.
+ */
+export declare class SimKmsSdkCommandRouter implements SimSdkCommandRouter {
+    private readonly routes;
+    constructor(simKms: SimKms);
+    /**
+     * The SDK Command names simulated KMS can handle.
+     */
+    supportedCommandNames(): readonly string[];
+    /**
+     * Get the route for an SDK Command name, if simulated KMS supports it.
+     */
+    route(commandName: string): SimSdkCommandRoute | undefined;
+}
+//# sourceMappingURL=sim-kms-sdk-command-router.d.ts.map

package/dist/service/kms/sdk/sim-kms-sdk-command-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-sdk-command-router.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/sdk/sim-kms-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAqB/B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;GAEG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,YAAY,MAAM,EAAE,MAAM,EAmHzB;IAED;;OAEG;IACH,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAEzC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEzD;CACF"}