@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/kms/command/key/key.command.d.ts

@@ -0,0 +1,159 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+import type { SimKmsKeyMetadata } from "../../key/sim-kms-key-metadata.js";
+import type { SimKmsKeyState } from "../../key/sim-kms-key.js";
+/**
+ * Minimal structural sim KMS CreateKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/CreateKeyCommand/
+ */
+export interface SimCreateKeyCommand {
+    readonly input: SimCreateKeyCommandInput;
+}
+export interface SimCreateKeyCommandInput {
+    readonly Description?: string | undefined;
+    /**
+     * The key policy, as a JSON document string, exactly as the real API takes
+     * it. Omitting it gets the default policy KMS applies, which delegates to
+     * the Account's IAM.
+     */
+    readonly Policy?: string | undefined;
+    readonly KeyUsage?: string | undefined;
+    readonly KeySpec?: string | undefined;
+    readonly Origin?: string | undefined;
+}
+export interface SimCreateKeyCommandOutput {
+    readonly KeyMetadata?: SimKmsKeyMetadata | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS DescribeKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/DescribeKeyCommand/
+ */
+export interface SimDescribeKeyCommand {
+    readonly input: SimDescribeKeyCommandInput;
+}
+export interface SimDescribeKeyCommandInput {
+    readonly KeyId?: string | undefined;
+}
+export interface SimDescribeKeyCommandOutput {
+    readonly KeyMetadata?: SimKmsKeyMetadata | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS ListKeys command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/ListKeysCommand/
+ */
+export interface SimListKeysCommand {
+    readonly input?: SimListKeysCommandInput | undefined;
+}
+export interface SimListKeysCommandInput {
+    readonly Limit?: number | undefined;
+}
+export interface SimListKeysCommandEntry {
+    readonly KeyId: string;
+    readonly KeyArn: string;
+}
+export interface SimListKeysCommandOutput {
+    readonly Keys?: readonly SimListKeysCommandEntry[] | undefined;
+    readonly Truncated?: boolean | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS GetKeyPolicy command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/GetKeyPolicyCommand/
+ */
+export interface SimGetKeyPolicyCommand {
+    readonly input: SimGetKeyPolicyCommandInput;
+}
+export interface SimGetKeyPolicyCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly PolicyName?: string | undefined;
+}
+export interface SimGetKeyPolicyCommandOutput {
+    readonly Policy?: string | undefined;
+    readonly PolicyName?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS PutKeyPolicy command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/PutKeyPolicyCommand/
+ */
+export interface SimPutKeyPolicyCommand {
+    readonly input: SimPutKeyPolicyCommandInput;
+}
+export interface SimPutKeyPolicyCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly Policy?: string | SimIamPolicyDocument | undefined;
+    readonly PolicyName?: string | undefined;
+}
+export interface SimPutKeyPolicyCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS EnableKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/EnableKeyCommand/
+ */
+export interface SimEnableKeyCommand {
+    readonly input: SimEnableKeyCommandInput;
+}
+export interface SimEnableKeyCommandInput {
+    readonly KeyId?: string | undefined;
+}
+export interface SimEnableKeyCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS DisableKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/DisableKeyCommand/
+ */
+export interface SimDisableKeyCommand {
+    readonly input: SimDisableKeyCommandInput;
+}
+export interface SimDisableKeyCommandInput {
+    readonly KeyId?: string | undefined;
+}
+export interface SimDisableKeyCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS ScheduleKeyDeletion command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/ScheduleKeyDeletionCommand/
+ */
+export interface SimScheduleKeyDeletionCommand {
+    readonly input: SimScheduleKeyDeletionCommandInput;
+}
+export interface SimScheduleKeyDeletionCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly PendingWindowInDays?: number | undefined;
+}
+export interface SimScheduleKeyDeletionCommandOutput {
+    readonly KeyId?: string | undefined;
+    readonly DeletionDate?: Date | undefined;
+    readonly KeyState?: SimKmsKeyState | undefined;
+    readonly PendingWindowInDays?: number | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS CancelKeyDeletion command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/CancelKeyDeletionCommand/
+ */
+export interface SimCancelKeyDeletionCommand {
+    readonly input: SimCancelKeyDeletionCommandInput;
+}
+export interface SimCancelKeyDeletionCommandInput {
+    readonly KeyId?: string | undefined;
+}
+export interface SimCancelKeyDeletionCommandOutput {
+    readonly KeyId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=key.command.d.ts.map

package/dist/service/kms/command/key/key.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/key.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC;CACpD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC;CAClD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/key/key.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=key.command.js.map

package/dist/service/kms/command/key/key.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/key.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/key/sim-kms-key-commands.d.ts

@@ -0,0 +1,41 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyFactory } from "../../key/sim-kms-key-factory.js";
+import type { SimKmsKeyMetadataView } from "../../key/sim-kms-key-metadata.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimCreateKeyCommand, SimCreateKeyCommandOutput, SimDescribeKeyCommand, SimDescribeKeyCommandOutput } from "./key.command.js";
+interface SimKmsKeyCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly keyFactory: SimKmsKeyFactory;
+    readonly authorizer: SimKmsAuthorizer;
+    readonly metadata: SimKmsKeyMetadataView;
+}
+interface SimKmsKeyCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The key creation and description commands of one simulated KMS scope.
+ */
+export declare class SimKmsKeyCommands {
+    private readonly keys;
+    private readonly keyFactory;
+    private readonly authorizer;
+    private readonly metadata;
+    private readonly keyType;
+    private readonly policyDocument;
+    constructor(properties: SimKmsKeyCommandsProperties);
+    /**
+     * Create a key with fresh key material.
+     *
+     * There is no key to hold a policy yet, so this authorizes against the
+     * Region's keys rather than a key policy. Real KMS gives kms:CreateKey no
+     * resource-level permissions for the same reason.
+     */
+    create(command: SimCreateKeyCommand, options?: SimKmsKeyCommandOptions): SimCreateKeyCommandOutput;
+    /**
+     * Describe a key.
+     */
+    describe(command: SimDescribeKeyCommand, options?: SimKmsKeyCommandOptions): SimDescribeKeyCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-commands.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,UAAU,2BAA2B;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,2BAA2B,EAKlD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,uBAAuB,GAChC,yBAAyB,CAgB3B;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,uBAAuB,GAChC,2BAA2B,CAK7B;CACF"}

package/dist/service/kms/command/key/sim-kms-key-commands.js

@@ -0,0 +1,45 @@
+import { SimKmsPolicyDocument } from "../../key/sim-kms-policy-document.js";
+import { SimKmsKeyType } from "./sim-kms-key-type.js";
+/**
+ * The key creation and description commands of one simulated KMS scope.
+ */
+export class SimKmsKeyCommands {
+    keys;
+    keyFactory;
+    authorizer;
+    metadata;
+    keyType = new SimKmsKeyType();
+    policyDocument = new SimKmsPolicyDocument();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.keyFactory = properties.keyFactory;
+        this.authorizer = properties.authorizer;
+        this.metadata = properties.metadata;
+    }
+    /**
+     * Create a key with fresh key material.
+     *
+     * There is no key to hold a policy yet, so this authorizes against the
+     * Region's keys rather than a key policy. Real KMS gives kms:CreateKey no
+     * resource-level permissions for the same reason.
+     */
+    create(command, options) {
+        this.keyType.require(command.input.KeyUsage, command.input.KeySpec, command.input.Origin);
+        this.authorizer.authorizeAccount("kms:CreateKey", options?.caller);
+        const key = this.keyFactory.make({
+            description: command.input.Description,
+            policy: this.policyDocument.parseOptional(command.input.Policy),
+        });
+        this.keys.add(key);
+        return { $metadata: {}, KeyMetadata: this.metadata.describe(key) };
+    }
+    /**
+     * Describe a key.
+     */
+    describe(command, options) {
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:DescribeKey", key, options?.caller);
+        return { $metadata: {}, KeyMetadata: this.metadata.describe(key) };
+    }
+}
+//# sourceMappingURL=sim-kms-key-commands.js.map

package/dist/service/kms/command/key/sim-kms-key-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAsBtD;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,UAAU,CAAmB;IAC7B,QAAQ,CAAwB;IAChC,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;IAC9B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA4B,EAC5B,OAAiC;QAEjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YACtC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEnB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,OAA8B,EAC9B,OAAiC;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEtE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.d.ts

@@ -0,0 +1,48 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimCancelKeyDeletionCommand, SimCancelKeyDeletionCommandOutput, SimDisableKeyCommand, SimDisableKeyCommandOutput, SimEnableKeyCommand, SimEnableKeyCommandOutput, SimScheduleKeyDeletionCommand, SimScheduleKeyDeletionCommandOutput } from "./key.command.js";
+interface SimKmsKeyLifecycleCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+    readonly clock: SimClock;
+}
+interface SimKmsKeyLifecycleCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The commands that move a simulated KMS key between lifecycle states.
+ *
+ * The state transitions themselves belong to SimKmsKey, which refuses the ones
+ * its current state does not allow. These commands resolve the key, authorize
+ * the caller and report the result.
+ */
+export declare class SimKmsKeyLifecycleCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly clock;
+    constructor(properties: SimKmsKeyLifecycleCommandsProperties);
+    /**
+     * Enable a key.
+     */
+    enable(command: SimEnableKeyCommand, options?: SimKmsKeyLifecycleCommandOptions): SimEnableKeyCommandOutput;
+    /**
+     * Disable a key, leaving it present but unusable.
+     */
+    disable(command: SimDisableKeyCommand, options?: SimKmsKeyLifecycleCommandOptions): SimDisableKeyCommandOutput;
+    /**
+     * Schedule a key for deletion after a recovery window.
+     *
+     * The key stays in the store while it is pending deletion, because that is
+     * what recoverable means: the key is still there, refusing to be used, until
+     * the window runs out.
+     */
+    scheduleDeletion(command: SimScheduleKeyDeletionCommand, options?: SimKmsKeyLifecycleCommandOptions): SimScheduleKeyDeletionCommandOutput;
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion(command: SimCancelKeyDeletionCommand, options?: SimKmsKeyLifecycleCommandOptions): SimCancelKeyDeletionCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-lifecycle-commands.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-lifecycle-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,kBAAkB,CAAC;AAE1B,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,gCAAgC,GACzC,yBAAyB,CAM3B;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,gCAAgC,GACzC,0BAA0B,CAM5B;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,OAAO,EAAE,6BAA6B,EACtC,OAAO,CAAC,EAAE,gCAAgC,GACzC,mCAAmC,CAmBrC;IAED;;OAEG;IACH,cAAc,CACZ,OAAO,EAAE,2BAA2B,EACpC,OAAO,CAAC,EAAE,gCAAgC,GACzC,iCAAiC,CAMnC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.js

@@ -0,0 +1,67 @@
+import { SimKmsPendingWindow } from "./sim-kms-pending-window.js";
+/**
+ * The commands that move a simulated KMS key between lifecycle states.
+ *
+ * The state transitions themselves belong to SimKmsKey, which refuses the ones
+ * its current state does not allow. These commands resolve the key, authorize
+ * the caller and report the result.
+ */
+export class SimKmsKeyLifecycleCommands {
+    keys;
+    authorizer;
+    clock;
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+        this.clock = properties.clock;
+    }
+    /**
+     * Enable a key.
+     */
+    enable(command, options) {
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:EnableKey", key, options?.caller);
+        key.enable();
+        return { $metadata: {} };
+    }
+    /**
+     * Disable a key, leaving it present but unusable.
+     */
+    disable(command, options) {
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:DisableKey", key, options?.caller);
+        key.disable();
+        return { $metadata: {} };
+    }
+    /**
+     * Schedule a key for deletion after a recovery window.
+     *
+     * The key stays in the store while it is pending deletion, because that is
+     * what recoverable means: the key is still there, refusing to be used, until
+     * the window runs out.
+     */
+    scheduleDeletion(command, options) {
+        const window = new SimKmsPendingWindow(command.input.PendingWindowInDays);
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:ScheduleKeyDeletion", key, options?.caller);
+        const deletionDate = window.deletionDateFrom(this.clock.now());
+        key.scheduleDeletion(deletionDate);
+        return {
+            $metadata: {},
+            KeyId: key.arn,
+            DeletionDate: deletionDate,
+            KeyState: key.keyState,
+            PendingWindowInDays: window.days,
+        };
+    }
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion(command, options) {
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:CancelKeyDeletion", key, options?.caller);
+        key.cancelDeletion();
+        return { $metadata: {}, KeyId: key.arn };
+    }
+}
+//# sourceMappingURL=sim-kms-key-lifecycle-commands.js.map

package/dist/service/kms/command/key/sim-kms-key-lifecycle-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-lifecycle-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAuBlE;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACpB,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,KAAK,CAAW;IAEjC,YAAY,UAAgD;QAC1D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA4B,EAC5B,OAA0C;QAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,GAAG,CAAC,MAAM,EAAE,CAAC;QAEb,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,OAAO,CACL,OAA6B,EAC7B,OAA0C;QAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,GAAG,CAAC,OAAO,EAAE,CAAC;QAEd,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,OAAsC,EACtC,OAA0C;QAE1C,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAC1B,yBAAyB,EACzB,GAAG,EACH,OAAO,EAAE,MAAM,CAChB,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAEnC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,YAAY,EAAE,YAAY;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,mBAAmB,EAAE,MAAM,CAAC,IAAI;SACjC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,OAAoC,EACpC,OAA0C;QAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,uBAAuB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5E,GAAG,CAAC,cAAc,EAAE,CAAC;QAErB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-policy-commands.d.ts

@@ -0,0 +1,39 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimGetKeyPolicyCommand, SimGetKeyPolicyCommandOutput, SimPutKeyPolicyCommand, SimPutKeyPolicyCommandOutput } from "./key.command.js";
+interface SimKmsKeyPolicyCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsKeyPolicyCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The commands that read and replace a simulated KMS key policy.
+ *
+ * Replacing a key policy can lock the key out of its own Account, exactly as
+ * on real AWS: a policy with no statement for the Account root leaves the key
+ * reachable only by the principals it names, and no IAM policy will get it
+ * back. That is deliberate, and it is the behaviour worth being able to test.
+ */
+export declare class SimKmsKeyPolicyCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly policyDocument;
+    constructor(properties: SimKmsKeyPolicyCommandsProperties);
+    /**
+     * Get a key's policy, as the JSON document string the real API returns.
+     */
+    get(command: SimGetKeyPolicyCommand, options?: SimKmsKeyPolicyCommandOptions): SimGetKeyPolicyCommandOutput;
+    /**
+     * Replace a key's policy.
+     */
+    put(command: SimPutKeyPolicyCommand, options?: SimKmsKeyPolicyCommandOptions): SimPutKeyPolicyCommandOutput;
+    /**
+     * A KMS key has exactly one policy, and it is always called "default".
+     */
+    private requireDefaultPolicyName;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-policy-commands.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-policy-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-policy-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAC;AAE1B,UAAU,iCAAiC;IACzC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,iCAAiC,EAGxD;IAED;;OAEG;IACH,GAAG,CACD,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,6BAA6B,GACtC,4BAA4B,CAW9B;IAED;;OAEG;IACH,GAAG,CACD,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,6BAA6B,GACtC,4BAA4B,CAgB9B;IAED;;OAEG;IACH,OAAO,CAAC,wBAAwB;CAOjC"}

package/dist/service/kms/command/key/sim-kms-key-policy-commands.js

@@ -0,0 +1,57 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+import { simKmsKeyPolicyName } from "../../key/sim-kms-key-policy.js";
+import { SimKmsPolicyDocument } from "../../key/sim-kms-policy-document.js";
+/**
+ * The commands that read and replace a simulated KMS key policy.
+ *
+ * Replacing a key policy can lock the key out of its own Account, exactly as
+ * on real AWS: a policy with no statement for the Account root leaves the key
+ * reachable only by the principals it names, and no IAM policy will get it
+ * back. That is deliberate, and it is the behaviour worth being able to test.
+ */
+export class SimKmsKeyPolicyCommands {
+    keys;
+    authorizer;
+    policyDocument = new SimKmsPolicyDocument();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * Get a key's policy, as the JSON document string the real API returns.
+     */
+    get(command, options) {
+        this.requireDefaultPolicyName(command.input.PolicyName);
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:GetKeyPolicy", key, options?.caller);
+        return {
+            $metadata: {},
+            PolicyName: simKmsKeyPolicyName,
+            Policy: JSON.stringify(key.policy.document()),
+        };
+    }
+    /**
+     * Replace a key's policy.
+     */
+    put(command, options) {
+        this.requireDefaultPolicyName(command.input.PolicyName);
+        const policy = command.input.Policy;
+        if (policy === undefined) {
+            throw new SimKmsValidationException("Policy is required");
+        }
+        const document = this.policyDocument.parse(policy);
+        const key = this.keys.require(command.input.KeyId);
+        this.authorizer.authorizeKey("kms:PutKeyPolicy", key, options?.caller);
+        key.policy.replaceWith(document);
+        return { $metadata: {} };
+    }
+    /**
+     * A KMS key has exactly one policy, and it is always called "default".
+     */
+    requireDefaultPolicyName(policyName) {
+        if (policyName !== undefined && policyName !== simKmsKeyPolicyName) {
+            throw new SimKmsValidationException(`PolicyName must be '${simKmsKeyPolicyName}': a KMS key has exactly one policy`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-policy-commands.js.map

package/dist/service/kms/command/key/sim-kms-key-policy-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-policy-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-policy-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAkB5E;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAA6C;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAAuC;QAEvC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvE,OAAO;YACL,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,mBAAmB;YAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CACD,OAA+B,EAC/B,OAAuC;QAEvC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAEpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,UAA8B;QAC7D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;YACnE,MAAM,IAAI,yBAAyB,CACjC,uBAAuB,mBAAmB,qCAAqC,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-type.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Checks a requested key type against what this simulation models.
+ *
+ * Asymmetric keys, HMAC keys and imported material all behave differently
+ * enough that pretending a symmetric key is one of them would make a passing
+ * test meaningless, so an unmodelled type is refused rather than substituted.
+ */
+export declare class SimKmsKeyType {
+    /**
+     * Refuse a key type this simulation does not model.
+     */
+    require(keyUsage: string | undefined, keySpec: string | undefined, origin: string | undefined): void;
+}
+//# sourceMappingURL=sim-kms-key-type.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-type.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACH,OAAO,CACL,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,IAAI,CAkBN;CACF"}

package/dist/service/kms/command/key/sim-kms-key-type.js

@@ -0,0 +1,31 @@
+import { SimKmsInvalidKeyUsageException, SimKmsValidationException, } from "../../error/sim-kms.error.js";
+/**
+ * The only key type this simulation models.
+ */
+const symmetricKeySpec = "SYMMETRIC_DEFAULT";
+const encryptDecryptUsage = "ENCRYPT_DECRYPT";
+const kmsOrigin = "AWS_KMS";
+/**
+ * Checks a requested key type against what this simulation models.
+ *
+ * Asymmetric keys, HMAC keys and imported material all behave differently
+ * enough that pretending a symmetric key is one of them would make a passing
+ * test meaningless, so an unmodelled type is refused rather than substituted.
+ */
+export class SimKmsKeyType {
+    /**
+     * Refuse a key type this simulation does not model.
+     */
+    require(keyUsage, keySpec, origin) {
+        if (keyUsage !== undefined && keyUsage !== encryptDecryptUsage) {
+            throw new SimKmsInvalidKeyUsageException(`KeyUsage '${keyUsage}' is not simulated: simulated KMS creates ${encryptDecryptUsage} keys`);
+        }
+        if (keySpec !== undefined && keySpec !== symmetricKeySpec) {
+            throw new SimKmsInvalidKeyUsageException(`KeySpec '${keySpec}' is not simulated: simulated KMS creates ${symmetricKeySpec} keys`);
+        }
+        if (origin !== undefined && origin !== kmsOrigin) {
+            throw new SimKmsValidationException(`Origin '${origin}' is not simulated: simulated KMS generates its own key material`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-type.js.map

package/dist/service/kms/command/key/sim-kms-key-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-type.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AACH,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,SAAS,GAAG,SAAS,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACxB;;OAEG;IACH,OAAO,CACL,QAA4B,EAC5B,OAA2B,EAC3B,MAA0B;QAE1B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/D,MAAM,IAAI,8BAA8B,CACtC,aAAa,QAAQ,6CAA6C,mBAAmB,OAAO,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,8BAA8B,CACtC,YAAY,OAAO,6CAA6C,gBAAgB,OAAO,CACxF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,yBAAyB,CACjC,WAAW,MAAM,kEAAkE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-list-keys.d.ts

@@ -0,0 +1,29 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimListKeysCommand, SimListKeysCommandOutput } from "./key.command.js";
+interface SimKmsListKeysProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsListKeysOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The ListKeys command of one simulated KMS scope.
+ *
+ * Real KMS gives kms:ListKeys no resource-level permissions, so the listing is
+ * authorized once rather than per key. It therefore reports keys the caller
+ * may not be allowed to use, which is what real KMS does too.
+ */
+export declare class SimKmsListKeys {
+    private readonly keys;
+    private readonly authorizer;
+    constructor(properties: SimKmsListKeysProperties);
+    /**
+     * List the keys in this scope, up to any requested limit.
+     */
+    handle(command: SimListKeysCommand, options?: SimKmsListKeysOptions): SimListKeysCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-list-keys.d.ts.map

package/dist/service/kms/command/key/sim-kms-list-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-list-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,kBAAkB,CAAC;AAE1B,UAAU,wBAAwB;IAChC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAE9C,YAAY,UAAU,EAAE,wBAAwB,EAG/C;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,wBAAwB,CAc1B;CACF"}

package/dist/service/kms/command/key/sim-kms-list-keys.js

@@ -0,0 +1,31 @@
+/**
+ * The ListKeys command of one simulated KMS scope.
+ *
+ * Real KMS gives kms:ListKeys no resource-level permissions, so the listing is
+ * authorized once rather than per key. It therefore reports keys the caller
+ * may not be allowed to use, which is what real KMS does too.
+ */
+export class SimKmsListKeys {
+    keys;
+    authorizer;
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * List the keys in this scope, up to any requested limit.
+     */
+    handle(command, options) {
+        this.authorizer.authorizeAccount("kms:ListKeys", options?.caller);
+        const limit = command.input?.Limit;
+        const entries = this.keys.keys
+            .values()
+            .map((key) => ({ KeyId: key.keyId, KeyArn: key.arn }))
+            .toArray();
+        if (limit === undefined || entries.length <= limit) {
+            return { $metadata: {}, Keys: entries, Truncated: false };
+        }
+        return { $metadata: {}, Keys: entries.slice(0, limit), Truncated: true };
+    }
+}
+//# sourceMappingURL=sim-kms-list-keys.js.map

package/dist/service/kms/command/key/sim-kms-list-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-list-keys.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-list-keys.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACR,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAE9C,YAAY,UAAoC;QAC9C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA2B,EAC3B,OAA+B;QAE/B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI;aAC3B,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;aACrD,OAAO,EAAE,CAAC;QAEb,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;CACF"}