@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/kms/command/key/sim-kms-pending-window.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The recovery window between scheduling a KMS key's deletion and it happening.
+ *
+ * Real KMS will not take less than seven days or more than thirty, because the
+ * window is the only protection against destroying every ciphertext ever
+ * produced under the key.
+ */
+export declare class SimKmsPendingWindow {
+    readonly days: number;
+    constructor(days: number | undefined);
+    private static validated;
+    /**
+     * When a deletion scheduled now would fall due.
+     */
+    deletionDateFrom(now: Date): Date;
+}
+//# sourceMappingURL=sim-kms-pending-window.d.ts.map

package/dist/service/kms/command/key/sim-kms-pending-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-pending-window.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-pending-window.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B,YAAY,IAAI,EAAE,MAAM,GAAG,SAAS,EAEnC;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAcxB;;OAEG;IACH,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAEhC;CACF"}

package/dist/service/kms/command/key/sim-kms-pending-window.js

@@ -0,0 +1,37 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+/**
+ * The deletion recovery window real KMS allows, and the one it defaults to.
+ */
+const minDays = 7;
+const maxDays = 30;
+const defaultDays = 30;
+const millisecondsPerDay = 24 * 60 * 60 * 1000;
+/**
+ * The recovery window between scheduling a KMS key's deletion and it happening.
+ *
+ * Real KMS will not take less than seven days or more than thirty, because the
+ * window is the only protection against destroying every ciphertext ever
+ * produced under the key.
+ */
+export class SimKmsPendingWindow {
+    days;
+    constructor(days) {
+        this.days = SimKmsPendingWindow.validated(days);
+    }
+    static validated(days) {
+        if (days === undefined) {
+            return defaultDays;
+        }
+        if (!Number.isSafeInteger(days) || days < minDays || days > maxDays) {
+            throw new SimKmsValidationException(`PendingWindowInDays must be a whole number between ${String(minDays)} and ${String(maxDays)}`);
+        }
+        return days;
+    }
+    /**
+     * When a deletion scheduled now would fall due.
+     */
+    deletionDateFrom(now) {
+        return new Date(now.getTime() + this.days * millisecondsPerDay);
+    }
+}
+//# sourceMappingURL=sim-kms-pending-window.js.map

package/dist/service/kms/command/key/sim-kms-pending-window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-pending-window.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-pending-window.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;GAEG;AACH,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACd,IAAI,CAAS;IAE7B,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,IAAwB;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;YACpE,MAAM,IAAI,yBAAyB,CACjC,sDAAsD,MAAM,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,GAAS;QACxB,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/kms/command/sim-kms-command.types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The command types of every simulated KMS operation, in one place.
+ *
+ * The SimKms facade handles all of them, so gathering the types here keeps it
+ * a delegation rather than a page of imports.
+ */
+export type { SimCreateAliasCommand, SimCreateAliasCommandOutput, SimListAliasesCommand, SimListAliasesCommandOutput, } from "./alias/alias.command.js";
+export type { SimDecryptCommand, SimDecryptCommandOutput, SimEncryptCommand, SimEncryptCommandOutput, SimGenerateDataKeyCommand, SimGenerateDataKeyCommandOutput, } from "./crypto/crypto.command.js";
+export type { SimCancelKeyDeletionCommand, SimCancelKeyDeletionCommandOutput, SimCreateKeyCommand, SimCreateKeyCommandOutput, SimDescribeKeyCommand, SimDescribeKeyCommandOutput, SimDisableKeyCommand, SimDisableKeyCommandOutput, SimEnableKeyCommand, SimEnableKeyCommandOutput, SimGetKeyPolicyCommand, SimGetKeyPolicyCommandOutput, SimListKeysCommand, SimListKeysCommandOutput, SimPutKeyPolicyCommand, SimPutKeyPolicyCommandOutput, SimScheduleKeyDeletionCommand, SimScheduleKeyDeletionCommandOutput, } from "./key/key.command.js";
+//# sourceMappingURL=sim-kms-command.types.d.ts.map

package/dist/service/kms/command/sim-kms-command.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-command.types.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-command.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC"}

package/dist/service/kms/command/sim-kms-command.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-kms-command.types.js.map

package/dist/service/kms/command/sim-kms-command.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-command.types.js","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-command.types.ts"],"names":[],"mappings":""}

package/dist/service/kms/error/sim-kms.error.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Minimal metadata shape for simulated KMS errors.
+ */
+export interface SimKmsErrorMetadata {
+    readonly httpStatusCode?: number;
+}
+/**
+ * Base class for simulated KMS errors.
+ */
+export declare class SimKmsError extends Error {
+    readonly $metadata: SimKmsErrorMetadata;
+    constructor(message: string, $metadata?: SimKmsErrorMetadata);
+}
+/**
+ * Simulated KMS NotFoundException error.
+ *
+ * Real KMS reports a key, alias or key ARN it cannot find this way, whether
+ * the identifier is unknown or belongs to another Account or Region.
+ */
+export declare class SimKmsNotFoundException extends SimKmsError {
+    readonly name = "NotFoundException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS AlreadyExistsException error.
+ */
+export declare class SimKmsAlreadyExistsException extends SimKmsError {
+    readonly name = "AlreadyExistsException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS DisabledException error.
+ *
+ * Real KMS distinguishes a disabled key from one pending deletion: a
+ * cryptographic operation on a disabled key fails this way, while a key
+ * pending deletion fails with KMSInvalidStateException.
+ */
+export declare class SimKmsDisabledException extends SimKmsError {
+    readonly name = "DisabledException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS KMSInvalidStateException error.
+ */
+export declare class SimKmsInvalidStateException extends SimKmsError {
+    readonly name = "KMSInvalidStateException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS InvalidCiphertextException error.
+ *
+ * This covers every reason a ciphertext will not open: it was not produced by
+ * this simulation, it was produced under a different key, or the encryption
+ * context does not match the one it was encrypted with. Real KMS is equally
+ * uninformative here on purpose, because saying more would leak something
+ * about the key or the plaintext.
+ */
+export declare class SimKmsInvalidCiphertextException extends SimKmsError {
+    readonly name = "InvalidCiphertextException";
+    constructor(message?: string);
+}
+/**
+ * Simulated KMS IncorrectKeyException error.
+ *
+ * Decrypt was given a KeyId, and the ciphertext was produced under a different
+ * key. Naming the key is optional for a symmetric ciphertext precisely because
+ * the blob already says which key made it, so a mismatch means the caller's
+ * expectation was wrong rather than the ciphertext being unreadable.
+ */
+export declare class SimKmsIncorrectKeyException extends SimKmsError {
+    readonly name = "IncorrectKeyException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS ValidationException error.
+ */
+export declare class SimKmsValidationException extends SimKmsError {
+    readonly name = "ValidationException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS InvalidKeyUsageException error.
+ */
+export declare class SimKmsInvalidKeyUsageException extends SimKmsError {
+    readonly name = "InvalidKeyUsageException";
+    constructor(message: string);
+}
+//# sourceMappingURL=sim-kms.error.d.ts.map

package/dist/service/kms/error/sim-kms.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms.error.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,SAAQ,WAAW;IAC/D,SAAyB,IAAI,gCAAgC;IAE7D,YAAY,OAAO,SAAuD,EAEzE;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,2BAA2B;IAExD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/kms/error/sim-kms.error.js

@@ -0,0 +1,101 @@
+/**
+ * Base class for simulated KMS errors.
+ */
+export class SimKmsError extends Error {
+    $metadata;
+    constructor(message, $metadata = {}) {
+        super(message);
+        this.$metadata = $metadata;
+    }
+}
+/**
+ * Simulated KMS NotFoundException error.
+ *
+ * Real KMS reports a key, alias or key ARN it cannot find this way, whether
+ * the identifier is unknown or belongs to another Account or Region.
+ */
+export class SimKmsNotFoundException extends SimKmsError {
+    name = "NotFoundException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS AlreadyExistsException error.
+ */
+export class SimKmsAlreadyExistsException extends SimKmsError {
+    name = "AlreadyExistsException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS DisabledException error.
+ *
+ * Real KMS distinguishes a disabled key from one pending deletion: a
+ * cryptographic operation on a disabled key fails this way, while a key
+ * pending deletion fails with KMSInvalidStateException.
+ */
+export class SimKmsDisabledException extends SimKmsError {
+    name = "DisabledException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS KMSInvalidStateException error.
+ */
+export class SimKmsInvalidStateException extends SimKmsError {
+    name = "KMSInvalidStateException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS InvalidCiphertextException error.
+ *
+ * This covers every reason a ciphertext will not open: it was not produced by
+ * this simulation, it was produced under a different key, or the encryption
+ * context does not match the one it was encrypted with. Real KMS is equally
+ * uninformative here on purpose, because saying more would leak something
+ * about the key or the plaintext.
+ */
+export class SimKmsInvalidCiphertextException extends SimKmsError {
+    name = "InvalidCiphertextException";
+    constructor(message = "The ciphertext refers to a key that does not exist") {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS IncorrectKeyException error.
+ *
+ * Decrypt was given a KeyId, and the ciphertext was produced under a different
+ * key. Naming the key is optional for a symmetric ciphertext precisely because
+ * the blob already says which key made it, so a mismatch means the caller's
+ * expectation was wrong rather than the ciphertext being unreadable.
+ */
+export class SimKmsIncorrectKeyException extends SimKmsError {
+    name = "IncorrectKeyException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS ValidationException error.
+ */
+export class SimKmsValidationException extends SimKmsError {
+    name = "ValidationException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS InvalidKeyUsageException error.
+ */
+export class SimKmsInvalidKeyUsageException extends SimKmsError {
+    name = "InvalidKeyUsageException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+//# sourceMappingURL=sim-kms.error.js.map

package/dist/service/kms/error/sim-kms.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms.error.js","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAiC,SAAQ,WAAW;IACtC,IAAI,GAAG,4BAA4B,CAAC;IAE7D,YAAY,OAAO,GAAG,oDAAoD;QACxE,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,uBAAuB,CAAC;IAExD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/kms/index.d.ts

@@ -0,0 +1,8 @@
+export { SimKms, type SimKmsRequestOptions } from "./sim-kms.js";
+export { SimKmsKey, SimKmsKeyManager, SimKmsKeyState, type SimKmsKeyId, } from "./key/sim-kms-key.js";
+export { SimKmsAlias } from "./key/sim-kms-alias.js";
+export { SimKmsKeyPolicy } from "./key/sim-kms-key-policy.js";
+export type { SimKmsEncryptionContext } from "./key/sim-kms-encryption-context.js";
+export type { SimKmsKeyMetadata } from "./key/sim-kms-key-metadata.js";
+export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsValidationException, } from "./error/sim-kms.error.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/service/kms/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/index.js

@@ -0,0 +1,6 @@
+export { SimKms } from "./sim-kms.js";
+export { SimKmsKey, SimKmsKeyManager, SimKmsKeyState, } from "./key/sim-kms-key.js";
+export { SimKmsAlias } from "./key/sim-kms-alias.js";
+export { SimKmsKeyPolicy } from "./key/sim-kms-key-policy.js";
+export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsValidationException, } from "./error/sim-kms.error.js";
+//# sourceMappingURL=index.js.map

package/dist/service/kms/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA6B,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/key/sim-kms-alias.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimKmsKeyId } from "./sim-kms-key.js";
+/**
+ * The prefix every KMS alias name carries.
+ */
+export declare const simKmsAliasPrefix = "alias/";
+/**
+ * The prefix reserved for aliases of AWS managed keys, such as
+ * `alias/aws/s3`. Real KMS refuses to let a customer create one.
+ */
+export declare const simKmsAwsAliasPrefix = "alias/aws/";
+interface SimKmsAliasProperties {
+    readonly aliasName: string;
+    readonly targetKeyId: SimKmsKeyId;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * An alias pointing at one simulated KMS key.
+ *
+ * An alias is a mutable name for a key rather than part of the key, so it is
+ * stored separately: retargeting an alias must not disturb the key, and
+ * deleting an alias must leave the key alone.
+ */
+export declare class SimKmsAlias {
+    readonly aliasName: string;
+    readonly arn: string;
+    readonly targetKeyId: SimKmsKeyId;
+    constructor(properties: SimKmsAliasProperties);
+}
+/**
+ * Checks alias names against the rules real KMS applies.
+ *
+ * Failing an invalid name here rather than storing it keeps a test from
+ * passing on an alias that CreateAlias would reject on real AWS.
+ */
+export declare class SimKmsAliasName {
+    private static readonly allowed;
+    private static readonly maxLength;
+    /**
+     * Validate an alias name a customer asked to create.
+     */
+    validateCustomerAlias(aliasName: string): void;
+}
+export {};
+//# sourceMappingURL=sim-kms-alias.d.ts.map

package/dist/service/kms/key/sim-kms-alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-alias.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,WAAW,EAAE,WAAW,CAAC;IAEzC,YAAY,UAAU,EAAE,qBAAqB,EAM5C;CACF;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAgB;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAO;IAExC;;OAEG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CA8B7C;CACF"}

package/dist/service/kms/key/sim-kms-alias.js

@@ -0,0 +1,59 @@
+import { SimKmsValidationException } from "../error/sim-kms.error.js";
+/**
+ * The prefix every KMS alias name carries.
+ */
+export const simKmsAliasPrefix = "alias/";
+/**
+ * The prefix reserved for aliases of AWS managed keys, such as
+ * `alias/aws/s3`. Real KMS refuses to let a customer create one.
+ */
+export const simKmsAwsAliasPrefix = "alias/aws/";
+/**
+ * An alias pointing at one simulated KMS key.
+ *
+ * An alias is a mutable name for a key rather than part of the key, so it is
+ * stored separately: retargeting an alias must not disturb the key, and
+ * deleting an alias must leave the key alone.
+ */
+export class SimKmsAlias {
+    aliasName;
+    arn;
+    targetKeyId;
+    constructor(properties) {
+        const { accountRegionScope } = properties;
+        this.aliasName = properties.aliasName;
+        this.arn = `arn:aws:kms:${accountRegionScope.regionName}:${accountRegionScope.accountId}:${properties.aliasName}`;
+        this.targetKeyId = properties.targetKeyId;
+    }
+}
+/**
+ * Checks alias names against the rules real KMS applies.
+ *
+ * Failing an invalid name here rather than storing it keeps a test from
+ * passing on an alias that CreateAlias would reject on real AWS.
+ */
+export class SimKmsAliasName {
+    static allowed = /^[\w/-]+$/u;
+    static maxLength = 256;
+    /**
+     * Validate an alias name a customer asked to create.
+     */
+    validateCustomerAlias(aliasName) {
+        if (aliasName.length > SimKmsAliasName.maxLength) {
+            throw new SimKmsValidationException(`Alias '${aliasName}' is longer than the ${String(SimKmsAliasName.maxLength)} character limit`);
+        }
+        if (aliasName === simKmsAliasPrefix) {
+            throw new SimKmsValidationException(`Alias must name something after '${simKmsAliasPrefix}'`);
+        }
+        if (!aliasName.startsWith(simKmsAliasPrefix)) {
+            throw new SimKmsValidationException(`Alias must start with '${simKmsAliasPrefix}': ${aliasName}`);
+        }
+        if (aliasName.startsWith(simKmsAwsAliasPrefix)) {
+            throw new SimKmsValidationException(`Alias '${aliasName}' is reserved for AWS managed keys`);
+        }
+        if (!SimKmsAliasName.allowed.test(aliasName)) {
+            throw new SimKmsValidationException(`Alias '${aliasName}' contains characters KMS does not allow`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-alias.js.map

package/dist/service/kms/key/sim-kms-alias.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-alias.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAQjD;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACN,SAAS,CAAS;IAClB,GAAG,CAAS;IACZ,WAAW,CAAc;IAEzC,YAAY,UAAiC;QAC3C,MAAM,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QAE1C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,eAAe,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAClH,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,CAAU,OAAO,GAAG,YAAY,CAAC;IACvC,MAAM,CAAU,SAAS,GAAG,GAAG,CAAC;IAExC;;OAEG;IACH,qBAAqB,CAAC,SAAiB;QACrC,IAAI,SAAS,CAAC,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,yBAAyB,CACjC,UAAU,SAAS,wBAAwB,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,kBAAkB,CAC/F,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CACjC,oCAAoC,iBAAiB,GAAG,CACzD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CACjC,0BAA0B,iBAAiB,MAAM,SAAS,EAAE,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,yBAAyB,CACjC,UAAU,SAAS,oCAAoC,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CACjC,UAAU,SAAS,0CAA0C,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-ciphertext-blob.d.ts

@@ -0,0 +1,43 @@
+interface SimKmsCiphertextBlobPartsProperties {
+    readonly keyArn: string;
+    readonly iv: Uint8Array;
+    readonly authTag: Uint8Array;
+    readonly ciphertext: Uint8Array;
+}
+/**
+ * The parts of one ciphertext blob.
+ */
+export declare class SimKmsCiphertextBlobParts {
+    readonly keyArn: string;
+    readonly iv: Uint8Array;
+    readonly authTag: Uint8Array;
+    readonly ciphertext: Uint8Array;
+    constructor(properties: SimKmsCiphertextBlobPartsProperties);
+}
+/**
+ * Encodes and decodes the opaque ciphertext blob KMS hands back.
+ *
+ * Real KMS blobs are opaque to the caller but not to KMS: a blob names the key
+ * that produced it, which is why Decrypt needs no KeyId for a symmetric key.
+ * This layout keeps that property, carrying the key ARN alongside the AES-GCM
+ * initialisation vector and authentication tag.
+ *
+ * Opaque means callers must not read it. It is not encrypted, and it is not
+ * portable to real AWS or between simulations.
+ */
+export declare class SimKmsCiphertextBlob {
+    /**
+     * Encode the parts of an encryption into one blob.
+     */
+    encode(parts: SimKmsCiphertextBlobParts): Uint8Array;
+    /**
+     * Read the parts back out of a blob.
+     *
+     * Anything that is not a blob this simulation produced is an invalid
+     * ciphertext, which is the same answer real KMS gives for bytes it cannot
+     * make sense of.
+     */
+    decode(blob: Uint8Array): SimKmsCiphertextBlobParts;
+}
+export {};
+//# sourceMappingURL=sim-kms-ciphertext-blob.d.ts.map

package/dist/service/kms/key/sim-kms-ciphertext-blob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-blob.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-ciphertext-blob.ts"],"names":[],"mappings":"AAkBA,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,EAAE,EAAE,UAAU,CAAC;IAC/B,SAAgB,OAAO,EAAE,UAAU,CAAC;IACpC,SAAgB,UAAU,EAAE,UAAU,CAAC;IAEvC,YAAY,UAAU,EAAE,mCAAmC,EAK1D;CACF;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,UAAU,CAgBnD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,yBAAyB,CA2BlD;CACF"}

package/dist/service/kms/key/sim-kms-ciphertext-blob.js

@@ -0,0 +1,89 @@
+import { SimKmsInvalidCiphertextException } from "../error/sim-kms.error.js";
+/**
+ * Marks a byte string as one of this simulation's ciphertext blobs, so that
+ * arbitrary bytes handed to Decrypt are rejected rather than misread as a
+ * short blob.
+ */
+const magic = Buffer.from("YULINKMS", "ascii");
+/**
+ * Blob layout version, so a future change to the layout can be told apart
+ * from a blob this simulation cannot read at all.
+ */
+const version = 1;
+const ivLength = 12;
+const authTagLength = 16;
+/**
+ * The parts of one ciphertext blob.
+ */
+export class SimKmsCiphertextBlobParts {
+    keyArn;
+    iv;
+    authTag;
+    ciphertext;
+    constructor(properties) {
+        this.keyArn = properties.keyArn;
+        this.iv = properties.iv;
+        this.authTag = properties.authTag;
+        this.ciphertext = properties.ciphertext;
+    }
+}
+/**
+ * Encodes and decodes the opaque ciphertext blob KMS hands back.
+ *
+ * Real KMS blobs are opaque to the caller but not to KMS: a blob names the key
+ * that produced it, which is why Decrypt needs no KeyId for a symmetric key.
+ * This layout keeps that property, carrying the key ARN alongside the AES-GCM
+ * initialisation vector and authentication tag.
+ *
+ * Opaque means callers must not read it. It is not encrypted, and it is not
+ * portable to real AWS or between simulations.
+ */
+export class SimKmsCiphertextBlob {
+    /**
+     * Encode the parts of an encryption into one blob.
+     */
+    encode(parts) {
+        const keyArn = Buffer.from(parts.keyArn, "utf8");
+        const header = Buffer.alloc(2);
+        header.writeUInt8(version, 0);
+        header.writeUInt8(keyArn.length, 1);
+        return Uint8Array.from(Buffer.concat([
+            magic,
+            header,
+            keyArn,
+            parts.iv,
+            parts.authTag,
+            parts.ciphertext,
+        ]));
+    }
+    /**
+     * Read the parts back out of a blob.
+     *
+     * Anything that is not a blob this simulation produced is an invalid
+     * ciphertext, which is the same answer real KMS gives for bytes it cannot
+     * make sense of.
+     */
+    decode(blob) {
+        const buffer = Buffer.from(blob);
+        const keyArnStart = magic.length + 2;
+        if (buffer.length < keyArnStart ||
+            !buffer.subarray(0, magic.length).equals(magic) ||
+            buffer.readUInt8(magic.length) !== version) {
+            throw new SimKmsInvalidCiphertextException();
+        }
+        const keyArnLength = buffer.readUInt8(magic.length + 1);
+        const ivStart = keyArnStart + keyArnLength;
+        const authTagStart = ivStart + ivLength;
+        const ciphertextStart = authTagStart + authTagLength;
+        if (buffer.length < ciphertextStart) {
+            throw new SimKmsInvalidCiphertextException();
+        }
+        return new SimKmsCiphertextBlobParts({
+            keyArn: buffer.subarray(keyArnStart, ivStart).toString("utf8"),
+            iv: Uint8Array.from(buffer.subarray(ivStart, authTagStart)),
+            authTag: Uint8Array.from(buffer.subarray(authTagStart, ciphertextStart)),
+            ciphertext: Uint8Array.from(buffer.subarray(ciphertextStart)),
+        });
+    }
+}
+//# sourceMappingURL=sim-kms-ciphertext-blob.js.map

package/dist/service/kms/key/sim-kms-ciphertext-blob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-blob.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-ciphertext-blob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE7E;;;;GAIG;AACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,OAAO,GAAG,CAAC,CAAC;AAElB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,aAAa,GAAG,EAAE,CAAC;AASzB;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACpB,MAAM,CAAS;IACf,EAAE,CAAa;IACf,OAAO,CAAa;IACpB,UAAU,CAAa;IAEvC,YAAY,UAA+C;QACzD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACH,MAAM,CAAC,KAAgC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAEpC,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,UAAU;SACjB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAgB;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAErC,IACE,MAAM,CAAC,MAAM,GAAG,WAAW;YAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,EAC1C,CAAC;YACD,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,GAAG,YAAY,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;QACxC,MAAM,eAAe,GAAG,YAAY,GAAG,aAAa,CAAC;QAErD,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,yBAAyB,CAAC;YACnC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9D,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC3D,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YACxE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-encryption-context.d.ts

@@ -0,0 +1,34 @@
+/**
+ * An AWS KMS encryption context: non-secret key/value pairs bound to a
+ * ciphertext.
+ */
+export type SimKmsEncryptionContext = Readonly<Record<string, string>>;
+/**
+ * Serialises an encryption context into the additional authenticated data of
+ * an AES-GCM operation.
+ *
+ * The encryption context is exactly what AAD is for: it is not secret, it is
+ * not stored in the ciphertext, and supplying a different one on decryption
+ * has to fail. Binding it as AAD gets that behaviour from the cipher itself
+ * rather than from a comparison the simulator would have to remember to make.
+ *
+ * Real KMS treats the context as an unordered map, so the serialisation sorts
+ * by key. Two contexts with the same pairs written in a different order have
+ * to produce the same AAD, or a decryption that AWS would allow would fail
+ * here.
+ */
+export declare class SimKmsEncryptionContextAad {
+    /**
+     * Serialise an encryption context to the bytes bound into the ciphertext.
+     */
+    serialise(context: SimKmsEncryptionContext | undefined): Uint8Array;
+    /**
+     * The canonical string form of an encryption context.
+     *
+     * Pairs are sorted by key and both halves are escaped, so that no pair of
+     * distinct contexts can serialise to the same string by placing a separator
+     * inside a key or a value.
+     */
+    private canonical;
+}
+//# sourceMappingURL=sim-kms-encryption-context.d.ts.map

package/dist/service/kms/key/sim-kms-encryption-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-encryption-context.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-encryption-context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,CAElE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;CAalB"}

package/dist/service/kms/key/sim-kms-encryption-context.js

@@ -0,0 +1,39 @@
+/**
+ * Serialises an encryption context into the additional authenticated data of
+ * an AES-GCM operation.
+ *
+ * The encryption context is exactly what AAD is for: it is not secret, it is
+ * not stored in the ciphertext, and supplying a different one on decryption
+ * has to fail. Binding it as AAD gets that behaviour from the cipher itself
+ * rather than from a comparison the simulator would have to remember to make.
+ *
+ * Real KMS treats the context as an unordered map, so the serialisation sorts
+ * by key. Two contexts with the same pairs written in a different order have
+ * to produce the same AAD, or a decryption that AWS would allow would fail
+ * here.
+ */
+export class SimKmsEncryptionContextAad {
+    /**
+     * Serialise an encryption context to the bytes bound into the ciphertext.
+     */
+    serialise(context) {
+        return Buffer.from(this.canonical(context), "utf8");
+    }
+    /**
+     * The canonical string form of an encryption context.
+     *
+     * Pairs are sorted by key and both halves are escaped, so that no pair of
+     * distinct contexts can serialise to the same string by placing a separator
+     * inside a key or a value.
+     */
+    canonical(context) {
+        if (context === undefined) {
+            return "";
+        }
+        return Object.entries(context)
+            .toSorted(([left], [right]) => left.localeCompare(right))
+            .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
+            .join("&");
+    }
+}
+//# sourceMappingURL=sim-kms-encryption-context.js.map