@kensio/yulin 0.37.0 → 0.38.0

package/dist/service/kms/key/sim-kms-encryption-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-encryption-context.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-encryption-context.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,SAAS,CAAC,OAA4C;QACpD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,OAA4C;QAC5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;aAC3B,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAC5D;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-factory.d.ts

@@ -0,0 +1,36 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import { SimKmsKey, type SimKmsKeyManager } from "./sim-kms-key.js";
+interface SimKmsKeyFactoryProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly clock: SimClock;
+}
+interface SimKmsMakeKeyProperties {
+    readonly description?: string | undefined;
+    readonly policy?: SimIamPolicyDocument | undefined;
+    readonly keyManager?: SimKmsKeyManager | undefined;
+}
+/**
+ * Builds simulated KMS keys, including their key material.
+ *
+ * Key creation has to assemble an identifier, an ARN, real AES key material
+ * and a policy that all agree with each other, so it happens in one place
+ * rather than at each call site that needs a key.
+ */
+export declare class SimKmsKeyFactory {
+    private readonly accountRegionScope;
+    private readonly clock;
+    private readonly blob;
+    constructor(properties: SimKmsKeyFactoryProperties);
+    /**
+     * Make a new key with fresh key material.
+     *
+     * Real key IDs are UUIDs, and code in the wild parses them that way, so
+     * these are real UUIDs rather than a shorter simulator-only identifier.
+     */
+    make(properties?: SimKmsMakeKeyProperties): SimKmsKey;
+    private keyPolicy;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-factory.d.ts.map

package/dist/service/kms/key/sim-kms-key-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIpE,UAAU,0BAA0B;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAAE,uBAA4B,GAAG,SAAS,CAaxD;IAED,OAAO,CAAC,SAAS;CAUlB"}

package/dist/service/kms/key/sim-kms-key-factory.js

@@ -0,0 +1,47 @@
+import { randomUUID } from "node:crypto";
+import { SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
+import { SimKmsKey } from "./sim-kms-key.js";
+import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import { SimKmsKeyPolicy } from "./sim-kms-key-policy.js";
+/**
+ * Builds simulated KMS keys, including their key material.
+ *
+ * Key creation has to assemble an identifier, an ARN, real AES key material
+ * and a policy that all agree with each other, so it happens in one place
+ * rather than at each call site that needs a key.
+ */
+export class SimKmsKeyFactory {
+    accountRegionScope;
+    clock;
+    blob = new SimKmsCiphertextBlob();
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
+        this.clock = properties.clock;
+    }
+    /**
+     * Make a new key with fresh key material.
+     *
+     * Real key IDs are UUIDs, and code in the wild parses them that way, so
+     * these are real UUIDs rather than a shorter simulator-only identifier.
+     */
+    make(properties = {}) {
+        const keyId = randomUUID();
+        const arn = `arn:aws:kms:${this.accountRegionScope.regionName}:${this.accountRegionScope.accountId}:key/${keyId}`;
+        return new SimKmsKey({
+            keyId,
+            accountRegionScope: this.accountRegionScope,
+            material: new SimKmsKeyMaterial({ keyArn: arn, blob: this.blob }),
+            policy: this.keyPolicy(arn, properties.policy),
+            creationDate: this.clock.now(),
+            description: properties.description,
+            keyManager: properties.keyManager,
+        });
+    }
+    keyPolicy(keyArn, document) {
+        if (document === undefined) {
+            return SimKmsKeyPolicy.default(keyArn, this.accountRegionScope.accountId);
+        }
+        return new SimKmsKeyPolicy(keyArn, document);
+    }
+}
+//# sourceMappingURL=sim-kms-key-factory.js.map

package/dist/service/kms/key/sim-kms-key-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAyB,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAa1D;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAChB,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEnD,YAAY,UAAsC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAA4B,EAAE;QAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC;QAElH,OAAO,IAAI,SAAS,CAAC;YACnB,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;YAC9C,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CACf,MAAc,EACd,QAA0C;QAE1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-identifier.d.ts

@@ -0,0 +1,44 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+/**
+ * What a KeyId names: an alias, a key, or nothing this scope can resolve.
+ */
+export declare class SimKmsKeyIdentifier {
+    readonly aliasName: string | undefined;
+    readonly keyId: string | undefined;
+    private constructor();
+    /**
+     * An identifier naming nothing resolvable here.
+     */
+    static none(): SimKmsKeyIdentifier;
+    /**
+     * An identifier naming an alias.
+     */
+    static alias(aliasName: string): SimKmsKeyIdentifier;
+    /**
+     * An identifier naming a key.
+     */
+    static key(keyId: string): SimKmsKeyIdentifier;
+}
+/**
+ * Reads the four forms of KeyId real KMS accepts, within one scope.
+ *
+ * A key ARN and an alias ARN both name an Account and a Region, and KMS keys
+ * are scoped to both. An ARN belonging to somewhere else therefore resolves to
+ * nothing here rather than having its identifier pulled out and looked up
+ * locally, which would let a foreign ARN reach a key that happens to share an
+ * identifier.
+ */
+export declare class SimKmsKeyIdentifierParser {
+    private readonly accountRegionScope;
+    constructor(accountRegionScope: SimAwsAccountRegionScope);
+    /**
+     * Read what a KeyId names.
+     */
+    parse(keyId: string): SimKmsKeyIdentifier;
+    /**
+     * Read a key or alias ARN, refusing one belonging to another scope.
+     */
+    private parseArn;
+    private parseArnResource;
+}
+//# sourceMappingURL=sim-kms-key-identifier.d.ts.map

package/dist/service/kms/key/sim-kms-key-identifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-identifier.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAG1F;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,OAAO,eAMN;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAEjC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAEnD;IAED;;OAEG;IACH,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAE7C;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,kBAAkB,EAAE,wBAAwB,EAEvD;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAUxC;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,gBAAgB;CAazB"}

package/dist/service/kms/key/sim-kms-key-identifier.js

@@ -0,0 +1,81 @@
+import { simKmsAliasPrefix } from "./sim-kms-alias.js";
+/**
+ * What a KeyId names: an alias, a key, or nothing this scope can resolve.
+ */
+export class SimKmsKeyIdentifier {
+    aliasName;
+    keyId;
+    constructor(aliasName, keyId) {
+        this.aliasName = aliasName;
+        this.keyId = keyId;
+    }
+    /**
+     * An identifier naming nothing resolvable here.
+     */
+    static none() {
+        return new SimKmsKeyIdentifier(undefined, undefined);
+    }
+    /**
+     * An identifier naming an alias.
+     */
+    static alias(aliasName) {
+        return new SimKmsKeyIdentifier(aliasName, undefined);
+    }
+    /**
+     * An identifier naming a key.
+     */
+    static key(keyId) {
+        return new SimKmsKeyIdentifier(undefined, keyId);
+    }
+}
+/**
+ * Reads the four forms of KeyId real KMS accepts, within one scope.
+ *
+ * A key ARN and an alias ARN both name an Account and a Region, and KMS keys
+ * are scoped to both. An ARN belonging to somewhere else therefore resolves to
+ * nothing here rather than having its identifier pulled out and looked up
+ * locally, which would let a foreign ARN reach a key that happens to share an
+ * identifier.
+ */
+export class SimKmsKeyIdentifierParser {
+    accountRegionScope;
+    constructor(accountRegionScope) {
+        this.accountRegionScope = accountRegionScope;
+    }
+    /**
+     * Read what a KeyId names.
+     */
+    parse(keyId) {
+        if (keyId.startsWith("arn:")) {
+            return this.parseArn(keyId);
+        }
+        if (keyId.startsWith(simKmsAliasPrefix)) {
+            return SimKmsKeyIdentifier.alias(keyId);
+        }
+        return SimKmsKeyIdentifier.key(keyId);
+    }
+    /**
+     * Read a key or alias ARN, refusing one belonging to another scope.
+     */
+    parseArn(arn) {
+        const [, partition, service, regionName, accountId, ...rest] = arn.split(":");
+        if (partition !== "aws" ||
+            service !== "kms" ||
+            regionName !== this.accountRegionScope.regionName ||
+            accountId !== this.accountRegionScope.accountId) {
+            return SimKmsKeyIdentifier.none();
+        }
+        return this.parseArnResource(rest.join(":"));
+    }
+    parseArnResource(resource) {
+        if (resource.startsWith(simKmsAliasPrefix)) {
+            return SimKmsKeyIdentifier.alias(resource);
+        }
+        const keyId = /^key\/(.+)$/u.exec(resource)?.[1];
+        if (keyId === undefined) {
+            return SimKmsKeyIdentifier.none();
+        }
+        return SimKmsKeyIdentifier.key(keyId);
+    }
+}
+//# sourceMappingURL=sim-kms-key-identifier.js.map

package/dist/service/kms/key/sim-kms-key-identifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-identifier.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-identifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACd,SAAS,CAAqB;IAC9B,KAAK,CAAqB;IAE1C,YACE,SAA6B,EAC7B,KAAyB;QAEzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAiB;QAC5B,OAAO,IAAI,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAG,CAAC,KAAa;QACtB,OAAO,IAAI,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAE9D,YAAY,kBAA4C;QACtD,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAa;QACjB,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,GAAW;QAC1B,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAC1D,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjB,IACE,SAAS,KAAK,KAAK;YACnB,OAAO,KAAK,KAAK;YACjB,UAAU,KAAK,IAAI,CAAC,kBAAkB,CAAC,UAAU;YACjD,SAAS,KAAK,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAC/C,CAAC;YACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3C,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-lifecycle.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The lifecycle states a simulated KMS key can be in.
+ *
+ * Real KMS has more of them, covering imported material, external key stores
+ * and multi-Region replication. These are the three a key reaches through the
+ * operations this simulation supports.
+ */
+export declare const SimKmsKeyState: {
+    readonly Enabled: "Enabled";
+    readonly Disabled: "Disabled";
+    readonly PendingDeletion: "PendingDeletion";
+};
+export type SimKmsKeyState = (typeof SimKmsKeyState)[keyof typeof SimKmsKeyState];
+/**
+ * The lifecycle state of one simulated KMS key, and the moves it allows.
+ *
+ * Kept apart from the key itself so that the key is about what it holds and
+ * what it can do with it, while the rules about which transitions are legal
+ * and which failure each illegal one produces live in one place.
+ */
+export declare class SimKmsKeyLifecycle {
+    private readonly keyArn;
+    private currentState;
+    private scheduledDeletionDate;
+    constructor(keyArn: string);
+    /**
+     * The current lifecycle state.
+     */
+    get state(): SimKmsKeyState;
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled(): boolean;
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate(): Date | undefined;
+    /**
+     * Enable the key, if it is not pending deletion.
+     */
+    enable(): void;
+    /**
+     * Disable the key, if it is not pending deletion.
+     */
+    disable(): void;
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * Real KMS does not delete a key on request. It waits out the window, during
+     * which the key is unusable but recoverable, because deleting key material
+     * destroys every ciphertext ever produced under it.
+     */
+    scheduleDeletion(deletionDate: Date): void;
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     *
+     * Real KMS does not restore the key to enabled: cancelling returns it to
+     * Disabled, and enabling it again is a separate deliberate step.
+     */
+    cancelDeletion(): void;
+    /**
+     * Refuse a cryptographic operation the current state does not allow.
+     *
+     * The two unusable states fail differently on real KMS, and the difference
+     * is worth keeping: DisabledException says to enable the key, while
+     * KMSInvalidStateException says the key is on its way out.
+     */
+    requireUsable(): void;
+    private refuseWhilePendingDeletion;
+}
+//# sourceMappingURL=sim-kms-key-lifecycle.d.ts.map

package/dist/service/kms/key/sim-kms-key-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-lifecycle.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;aACzB,OAAO,EAAE,SAAS;aAClB,QAAQ,EAAE,UAAU;aACpB,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,MAAM,MAAM,cAAc,GACxB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,YAAY,CAA0C;IAC9D,OAAO,CAAC,qBAAqB,CAAmB;IAEhD,YAAY,MAAM,EAAE,MAAM,EAEzB;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,cAAc,CAE1B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAGb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAIzC;IAED;;;;;OAKG;IACH,cAAc,IAAI,IAAI,CASrB;IAED;;;;;;OAMG;IACH,aAAa,IAAI,IAAI,CAUpB;IAED,OAAO,CAAC,0BAA0B;CAOnC"}

package/dist/service/kms/key/sim-kms-key-lifecycle.js

@@ -0,0 +1,106 @@
+import { SimKmsDisabledException, SimKmsInvalidStateException, } from "../error/sim-kms.error.js";
+/**
+ * The lifecycle states a simulated KMS key can be in.
+ *
+ * Real KMS has more of them, covering imported material, external key stores
+ * and multi-Region replication. These are the three a key reaches through the
+ * operations this simulation supports.
+ */
+export const SimKmsKeyState = {
+    Enabled: "Enabled",
+    Disabled: "Disabled",
+    PendingDeletion: "PendingDeletion",
+};
+/**
+ * The lifecycle state of one simulated KMS key, and the moves it allows.
+ *
+ * Kept apart from the key itself so that the key is about what it holds and
+ * what it can do with it, while the rules about which transitions are legal
+ * and which failure each illegal one produces live in one place.
+ */
+export class SimKmsKeyLifecycle {
+    keyArn;
+    currentState = SimKmsKeyState.Enabled;
+    scheduledDeletionDate;
+    constructor(keyArn) {
+        this.keyArn = keyArn;
+    }
+    /**
+     * The current lifecycle state.
+     */
+    get state() {
+        return this.currentState;
+    }
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled() {
+        return this.currentState === SimKmsKeyState.Enabled;
+    }
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate() {
+        return this.scheduledDeletionDate;
+    }
+    /**
+     * Enable the key, if it is not pending deletion.
+     */
+    enable() {
+        this.refuseWhilePendingDeletion("enable");
+        this.currentState = SimKmsKeyState.Enabled;
+    }
+    /**
+     * Disable the key, if it is not pending deletion.
+     */
+    disable() {
+        this.refuseWhilePendingDeletion("disable");
+        this.currentState = SimKmsKeyState.Disabled;
+    }
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * Real KMS does not delete a key on request. It waits out the window, during
+     * which the key is unusable but recoverable, because deleting key material
+     * destroys every ciphertext ever produced under it.
+     */
+    scheduleDeletion(deletionDate) {
+        this.refuseWhilePendingDeletion("schedule");
+        this.currentState = SimKmsKeyState.PendingDeletion;
+        this.scheduledDeletionDate = deletionDate;
+    }
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     *
+     * Real KMS does not restore the key to enabled: cancelling returns it to
+     * Disabled, and enabling it again is a separate deliberate step.
+     */
+    cancelDeletion() {
+        if (this.currentState !== SimKmsKeyState.PendingDeletion) {
+            throw new SimKmsInvalidStateException(`Key ${this.keyArn} is not pending deletion`);
+        }
+        this.currentState = SimKmsKeyState.Disabled;
+        this.scheduledDeletionDate = undefined;
+    }
+    /**
+     * Refuse a cryptographic operation the current state does not allow.
+     *
+     * The two unusable states fail differently on real KMS, and the difference
+     * is worth keeping: DisabledException says to enable the key, while
+     * KMSInvalidStateException says the key is on its way out.
+     */
+    requireUsable() {
+        if (this.currentState === SimKmsKeyState.PendingDeletion) {
+            throw new SimKmsInvalidStateException(`Key ${this.keyArn} is pending deletion and cannot be used`);
+        }
+        if (this.currentState === SimKmsKeyState.Disabled) {
+            throw new SimKmsDisabledException(`Key ${this.keyArn} is disabled`);
+        }
+    }
+    refuseWhilePendingDeletion(action) {
+        if (this.currentState === SimKmsKeyState.PendingDeletion) {
+            throw new SimKmsInvalidStateException(`Key ${this.keyArn} is already pending deletion and cannot be ${action}d`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-lifecycle.js.map

package/dist/service/kms/key/sim-kms-key-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-lifecycle.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAKX;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAS;IACxB,YAAY,GAAmB,cAAc,CAAC,OAAO,CAAC;IACtD,qBAAqB,CAAmB;IAEhD,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,OAAO,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAkB;QACjC,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,eAAe,CAAC;QACnD,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YACzD,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,MAAM,0BAA0B,CAC7C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;QAC5C,IAAI,CAAC,qBAAqB,GAAG,SAAS,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YACzD,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,MAAM,yCAAyC,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,MAAc;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YACzD,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,MAAM,8CAA8C,MAAM,GAAG,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-material.d.ts

@@ -0,0 +1,36 @@
+import { SimKmsCiphertextBlobParts, type SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
+import { type SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
+interface SimKmsKeyMaterialProperties {
+    readonly keyArn: string;
+    readonly blob: SimKmsCiphertextBlob;
+    readonly bytes?: Uint8Array | undefined;
+}
+/**
+ * The key material of one simulated KMS key, and the operations that use it.
+ *
+ * The bytes are generated here and never leave: nothing exposes them, exactly
+ * as real key material never leaves KMS. That is a modelling choice rather
+ * than a security boundary, since this all runs in one process and anything
+ * sharing that process can reach the object.
+ */
+export declare class SimKmsKeyMaterial {
+    private readonly keyArn;
+    private readonly blob;
+    private readonly bytes;
+    private readonly aad;
+    constructor(properties: SimKmsKeyMaterialProperties);
+    /**
+     * Encrypt plaintext under this key, binding the encryption context.
+     */
+    encrypt(plaintext: Uint8Array, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    /**
+     * Decrypt a ciphertext produced under this key.
+     *
+     * A wrong encryption context fails the GCM authentication tag rather than an
+     * explicit comparison, so the failure comes from the cipher for the same
+     * reason it does on real KMS.
+     */
+    decrypt(parts: SimKmsCiphertextBlobParts, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-material.d.ts.map

package/dist/service/kms/key/sim-kms-key-material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-material.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AAezC,UAAU,2BAA2B;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IAExD,YAAY,UAAU,EAAE,2BAA2B,EAIlD;IAED;;OAEG;IACH,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAoBZ;IAED;;;;;;OAMG;IACH,OAAO,CACL,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAgBZ;CACF"}

package/dist/service/kms/key/sim-kms-key-material.js

@@ -0,0 +1,74 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { SimKmsInvalidCiphertextException } from "../error/sim-kms.error.js";
+import { SimKmsCiphertextBlobParts, } from "./sim-kms-ciphertext-blob.js";
+import { SimKmsEncryptionContextAad, } from "./sim-kms-encryption-context.js";
+/**
+ * The cipher backing a simulated symmetric KMS key.
+ *
+ * Real KMS symmetric keys are AES-256-GCM, so this uses the same thing rather
+ * than a stand-in. Encryption in this simulation is real encryption: a
+ * ciphertext genuinely cannot be read without the key, and the authentication
+ * tag genuinely fails on a tampered blob or a mismatched encryption context.
+ */
+const algorithm = "aes-256-gcm";
+const keyLength = 32;
+const ivLength = 12;
+/**
+ * The key material of one simulated KMS key, and the operations that use it.
+ *
+ * The bytes are generated here and never leave: nothing exposes them, exactly
+ * as real key material never leaves KMS. That is a modelling choice rather
+ * than a security boundary, since this all runs in one process and anything
+ * sharing that process can reach the object.
+ */
+export class SimKmsKeyMaterial {
+    keyArn;
+    blob;
+    bytes;
+    aad = new SimKmsEncryptionContextAad();
+    constructor(properties) {
+        this.keyArn = properties.keyArn;
+        this.blob = properties.blob;
+        this.bytes = properties.bytes ?? randomBytes(keyLength);
+    }
+    /**
+     * Encrypt plaintext under this key, binding the encryption context.
+     */
+    encrypt(plaintext, encryptionContext) {
+        const iv = randomBytes(ivLength);
+        const cipher = createCipheriv(algorithm, this.bytes, iv);
+        cipher.setAAD(this.aad.serialise(encryptionContext));
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        return this.blob.encode(new SimKmsCiphertextBlobParts({
+            keyArn: this.keyArn,
+            iv: Uint8Array.from(iv),
+            authTag: Uint8Array.from(authTag),
+            ciphertext: Uint8Array.from(ciphertext),
+        }));
+    }
+    /**
+     * Decrypt a ciphertext produced under this key.
+     *
+     * A wrong encryption context fails the GCM authentication tag rather than an
+     * explicit comparison, so the failure comes from the cipher for the same
+     * reason it does on real KMS.
+     */
+    decrypt(parts, encryptionContext) {
+        const decipher = createDecipheriv(algorithm, this.bytes, parts.iv);
+        decipher.setAAD(this.aad.serialise(encryptionContext));
+        decipher.setAuthTag(parts.authTag);
+        try {
+            return Uint8Array.from(Buffer.concat([decipher.update(parts.ciphertext), decipher.final()]));
+        }
+        catch {
+            throw new SimKmsInvalidCiphertextException("The ciphertext could not be decrypted: it was produced under a " +
+                "different key, with a different encryption context, or has been " +
+                "altered");
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-key-material.js.map

package/dist/service/kms/key/sim-kms-key-material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-material.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EACL,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAQpB;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAS;IACf,IAAI,CAAuB;IAC3B,KAAK,CAAa;IAClB,GAAG,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAExD,YAAY,UAAuC;QACjD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAqB,EACrB,iBAA2C;QAE3C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAErD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CACrB,IAAI,yBAAyB,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACjC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SACxC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,KAAgC,EAChC,iBAA2C;QAE3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gCAAgC,CACxC,iEAAiE;gBAC/D,kEAAkE;gBAClE,SAAS,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-metadata.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimKmsKey, SimKmsKeyManager, SimKmsKeyState } from "./sim-kms-key.js";
+/**
+ * The KeyMetadata structure CreateKey and DescribeKey return.
+ *
+ * Only symmetric encryption keys are simulated, so the fields describing key
+ * type are constants rather than stored state. They are reported anyway
+ * because application code reads them to decide what a key can do.
+ */
+export interface SimKmsKeyMetadata {
+    readonly AWSAccountId: SimAwsAccountId;
+    readonly KeyId: string;
+    readonly Arn: string;
+    readonly CreationDate: Date;
+    readonly Enabled: boolean;
+    readonly Description: string;
+    readonly KeyUsage: "ENCRYPT_DECRYPT";
+    readonly KeyState: SimKmsKeyState;
+    readonly DeletionDate?: Date | undefined;
+    readonly Origin: "AWS_KMS";
+    readonly KeyManager: SimKmsKeyManager;
+    readonly KeySpec: "SYMMETRIC_DEFAULT";
+    readonly CustomerMasterKeySpec: "SYMMETRIC_DEFAULT";
+    readonly EncryptionAlgorithms: readonly ["SYMMETRIC_DEFAULT"];
+    readonly MultiRegion: false;
+}
+/**
+ * Builds the AWS-shaped view of a stored key.
+ *
+ * Kept apart from SimKmsKey so the stored key stays a model of what a key is
+ * and does, rather than also owning the shape two commands happen to return.
+ */
+export declare class SimKmsKeyMetadataView {
+    private readonly accountId;
+    constructor(accountId: SimAwsAccountId);
+    /**
+     * Describe a key the way KMS reports it.
+     */
+    describe(key: SimKmsKey): SimKmsKeyMetadata;
+    /**
+     * Copy a date, so the response never hands out the key's own instance.
+     */
+    private copied;
+}
+//# sourceMappingURL=sim-kms-key-metadata.d.ts.map

package/dist/service/kms/key/sim-kms-key-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-metadata.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACf,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;IACpD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAE5C,YAAY,SAAS,EAAE,eAAe,EAErC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,iBAAiB,CAkB1C;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/kms/key/sim-kms-key-metadata.js

@@ -0,0 +1,44 @@
+/**
+ * Builds the AWS-shaped view of a stored key.
+ *
+ * Kept apart from SimKmsKey so the stored key stays a model of what a key is
+ * and does, rather than also owning the shape two commands happen to return.
+ */
+export class SimKmsKeyMetadataView {
+    accountId;
+    constructor(accountId) {
+        this.accountId = accountId;
+    }
+    /**
+     * Describe a key the way KMS reports it.
+     */
+    describe(key) {
+        return {
+            AWSAccountId: this.accountId,
+            KeyId: key.keyId,
+            Arn: key.arn,
+            CreationDate: new Date(key.creationDate),
+            Enabled: key.isEnabled,
+            Description: key.description,
+            KeyUsage: "ENCRYPT_DECRYPT",
+            KeyState: key.keyState,
+            DeletionDate: this.copied(key.deletionDate),
+            Origin: "AWS_KMS",
+            KeyManager: key.keyManager,
+            KeySpec: "SYMMETRIC_DEFAULT",
+            CustomerMasterKeySpec: "SYMMETRIC_DEFAULT",
+            EncryptionAlgorithms: ["SYMMETRIC_DEFAULT"],
+            MultiRegion: false,
+        };
+    }
+    /**
+     * Copy a date, so the response never hands out the key's own instance.
+     */
+    copied(date) {
+        if (date === undefined) {
+            return undefined;
+        }
+        return new Date(date);
+    }
+}
+//# sourceMappingURL=sim-kms-key-metadata.js.map

package/dist/service/kms/key/sim-kms-key-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-metadata.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,SAAS,CAAkB;IAE5C,YAAY,SAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAc;QACrB,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,SAAS;YAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACxC,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,mBAAmB;YAC5B,qBAAqB,EAAE,mBAAmB;YAC1C,oBAAoB,EAAE,CAAC,mBAAmB,CAAC;YAC3C,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,IAAsB;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;CACF"}